GE index Back to Home

Secrets of the GE MLS and MLS2 Mobile Radios Written by Robert W. Meister From data by Pierre Drolet VE2DID With help from Miles Jackson N9MJ

Background:

The GE MLS and MLS2 radios store their transmit and receive frequencies and coded squelch information, as well as other radio-wide settings, in an EEPROM. They call this data a "personality", which is similar to what Motorola people call a "code plug". This defines the radio's operating parameters.

The MLS radios use a TQ2310 suitcase unit for programming. These units are rare and hard to use. The MLS radio stores its data in a socketed 2816 (or 28C16) 2,048 byte parallel EEPROM. The MLS2 radios use a DOS computer program and serial interface cable for programming. The MLS2 radio stores its data in a more modern socketed generic 2404 (or 24C04) 512 byte serial EEPROM.

I actually own a two-channel VHF MLS radio (it was supposed to be an MLS2 radio) and borrowed a TQ2310 to program it. Not an easy task but I waded through and got the two channels working. That was the extent of my MLS experience. I own several MLS2 radios and have the programming software and cable to play with them. I much prefer the MLS2 radios over the MLS radios, but they both operate and perform the same once you've programmed them.

Sometime in 2012 Pierre decoded some of the channel information in the MLS radio. Someone sent me the information he compiled (I think it had been posted on a Yahoo group) consisting of a DOC file and an XLS file. It was incomplete and limited but it did provide some details of the personality memory layout and how channel information was encoded.

Earlier in 2015 Miles contacted me with a request for some additional MLS information and we started investigating the MLS2 memory with a goal to completely detail the MLS memory. I read the EEPROMs from the MLS and MLS2 radios and started analyzing the data. An eventual goal is to be able to correctly write new programming information into the MLS radio's EEPROM without requiring a TQ2310. This article presents the results of our findings.

Most of the MLS2 data was gathered by programming the radio with a DOS computer, pulling the EEPROM, inserting it into an EPROM reader, and analyzing the data with a hex editor in a Windows computer. We then compared this to the MLS data for verification. Just about every feature was exercised this way. I'm hoping to try a similar tactic with the MLS radio if I can borrow a TQ2310 and manage to plod my way through the user interface.

General Notes:

Most of the data is the same format for both the MLS and MLS2 radios. The locations changed slightly because of the size of the EEPROM. The MLS2 also has the ability to do both analog and digital Channel Guard while the MLS can only do analog Channel Guard. That seems to be about the only major difference between the radios. Both handle the same band splits and have the same specifications. From the outside they look identical.

So we'll all be talking the same language, I'll be using hexadecimal notation and identifying individual bits starting with bit00 as the least significant bit, the one on the right side of the 8-bit byte. I'll also split binary values with a comma every four bits. These groupings of four bits (half of a byte) are commonly called a nibble; they are referred to as the high nibble (the left four bits 07 through 04) and the low nibble (the right four bits 03 through 00).

EEPROM Layout:

The EEPROM data is laid out in two distinct areas. The low area (000-3FF in the MLS, 000-0FF in the MLS2) is used for some volatile storage, things that, if erased or reset, aren't terribly important. The high area is used for radio-wide parameters and channel data that are programmed for the user. Since the memory capacity is different, data must be kept at different addresses and there are two tables describing the layout, one for the MLS, one for the MLS2. The channel data is the same for both radios and will be described separately. All addresses and data values are in hex. First here's the MLS layout.

Address	Value	MLS Function and Use
000	00-FF	Channel 1-8 scan list; bit00=ch1, bit01=ch2, etc. [1]
001	00-FF	Channel 9-16 scan list; bit00=ch9, bit01=ch10, etc. [1]
002	00-10	Priority 1 channel number. 00 means no P1 channel.
003	00-10	Priority 2 channel number. 00 means no P2 channel.
004	FF	Apparently unused.
005	FF	Apparently unused.
006	FF	Apparently unused.
007	69	Always 69 (unless no channels programmed, then 00).
008	00-10	Last channel number selected.
009	00-0F	Last volume level selected.
00A	00	Unknown.
00B-3FF	FF	Apparently unused.
400-404	Var.	Radio-wide Parameters. See below.
405-40E	Var.	Channel 1 RX and TX data. See below.
40F-418	Var.	Channel 2 RX and TX data. See below.
419-422	Var.	Channel 3 RX and TX data. See below.
423-42C	Var.	Channel 4 RX and TX data. See below.
42D-436	Var.	Channel 5 RX and TX data. See below.
437-440	Var.	Channel 6 RX and TX data. See below.
441-44A	Var.	Channel 7 RX and TX data. See below.
44B-454	Var.	Channel 8 RX and TX data. See below.
455-45E	Var.	Channel 9 RX and TX data. See below.
45F-468	Var.	Channel 10 RX and TX data. See below.
469-472	Var.	Channel 11 RX and TX data. See below.
473-47C	Var.	Channel 12 RX and TX data. See below.
47D-486	Var.	Channel 13 RX and TX data. See below.
487-490	Var.	Channel 14 RX and TX data. See below.
491-49A	Var.	Channel 15 RX and TX data. See below.
49B-4A4	Var.	Channel 16 RX and TX data. See below.
4A5-4FD	00	Unused.
4FE-4FF	Var.	Checksum, high byte at 4FE, low byte at 4FF. [2]
500-7FF	FF	Unused.

Notes:
[1]: If a channel is selected as the Priority 1 or Priority 2 channel, it will be scanned but it will not show up as a bit in the Channel Scan List bytes.
[2]: The checksum is a simple 16-bit addition of all the bytes from address 400 through 4A4.

In the MLS2, the data is similar to the MLS but they moved the radio-wide data down to the lowest addresses.

Address	Value	MLS2 Function and Use
000-004	Var.	Radio-wide Parameters. See below.
005	00	Unknown.
006	00-10	Last channel number selected.
007	00-0F	Last volume level selected.
008	00	Apparently unused.
009	00	Apparently unused.
00A	00	Apparently unused.
00B	00	Apparently unused.
00C	00	Apparently unused.
00D	00	Apparently unused.
00E	00	Apparently unused.
00F	69	Always 69 unless no channels programmed, then 00.
010	00-FF	Channel 1-8 scan list; bit00=ch1, bit01=ch2, etc. [1]
011	00-FF	Channel 9-16 scan list; bit00=ch9, bit01=ch10, etc. [1]
012	00-10	Priority 1 channel number. 00 means no P1 channel.
013	00-10	Priority 2 channel number. 00 means no P2 channel.
014-0FF	00	Apparently unused.
100-109	Var.	Channel 1 RX and TX data. See below.
10A-113	Var.	Channel 2 RX and TX data. See below.
114-11D	Var.	Channel 3 RX and TX data. See below.
11E-127	Var.	Channel 4 RX and TX data. See below.
128-131	Var.	Channel 5 RX and TX data. See below.
132-13B	Var.	Channel 6 RX and TX data. See below.
13C-145	Var.	Channel 7 RX and TX data. See below.
146-14F	Var.	Channel 8 RX and TX data. See below.
150-159	Var.	Channel 9 RX and TX data. See below.
15A-163	Var.	Channel 10 RX and TX data. See below.
164-16D	Var.	Channel 11 RX and TX data. See below.
16E-177	Var.	Channel 12 RX and TX data. See below.
178-181	Var.	Channel 13 RX and TX data. See below.
182-18B	Var.	Channel 14 RX and TX data. See below.
18C-195	Var.	Channel 15 RX and TX data. See below.
196-19F	Var.	Channel 16 RX and TX data. See below.
1A0-1A1	Var.	Checksum, high byte at 1A0, low byte at 1A1. [2]
1A2-1FF	00	Apparently unused.

Notes:
[1]: If a channel is selected as the Priority 1 or Priority 2 channel, it will be scanned but it will not show up as a bit in the Channel Scan List bytes.
[2]: We haven't figured out the checksum yet. It is NOT a simple 16-bit addition. It covers the bytes from addresses 100 through 19F and probably some of the bytes in low memory, but the result eludes us. Since the MLS2 programming software is readily available and easy to use, this really is not a big issue. I'm just presenting it for completeness.

Radio-wide Parameters:

The radio-wide parameters occupy five bytes at different locations. While they are in the same order and have the same usage, the values are slightly different between the two radios. In the MLS2 software, these parameters are specified on the "Setup" screen and the "Options" screen. The table and text below explain the various bytes and nibbles.

Byte #	Nibble	MLS	MLS2	Function or Use (see text for details)
00	High	0	3	Unknown.
00	Low	2	4	Unknown.
01	High	0-7	0-7	Operating Band.
01	Low	0-1-F	F-0-E	CCT in 0.5 minute increments.
02	High	???	???	Unknown.
02	Low	0-3	0-3	Flashing Priority (bit00) and Channel (bit01) LEDs.
03	Byte	0	0	Unknown.
04	Byte	2/8/10	2/8/10	Maximum number of channels allowed.

The high nibble of byte 1 is the operating band. The table below shows the possible values. Note that there is no band 3 or band 6; these may have been reserved for expansion of the VHF and UHF bands.

Band	Frequency Range	Value
VHF-L1	29.7 - 42.0 MHz	0
VHF-L2	42.0 - 50.0 MHz	1
VHF-H	150 - 170 MHz	2
UHF-1	403 - 430 MHz	4
UHF-2	450 - 470 MHz	5
800 MHz	806 - 870 MHz	7

The low nibble of byte 1 is the Carrier Control Timer (CCT) value in 0.5 minute increments from 0 to 7.5 minutes. The MLS starts at 0 for 0.0 minutes and goes all the way up to F for 7.5 minutes. Unfortunately the MLS2 did it differently (and in my opinion incorrectly) by starting at 0 for 0.5 minutes and going all the way up to E for 7.5 minutes, leaving F for 0.0 minutes. Dumb. See the table below.

Mins	0.0	0.5	1.0	1.5	2.0	2.5	3.0	3.5	4.0	4.5	5.0	5.5	6.0	6.5	7.0	7.5
MLS	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E	F
MLS2	F	0	1	2	3	4	5	6	7	8	9	A	B	C	D	E

The low nibble of byte 2 has the Flashing LEDs option bits. Bit00 handles the Priority LEDs. Bit01 handles the Channel LEDs. These select whether the LEDs will flash or not when the radio is scanning. A 2-channel radio doesn't offer scanning.

The TQ2310 programmer asks one additional question regarding the front panel LEDs but I haven't figured out if this sets its own bit or sets the other two Flashing LED bits. The only MLS radio I could access has a 2-channel control panel with no scanning ability but I have since acquired other panels that have more channels and scanning; I just have to play with the bits.

The maximum number of channels is what the radio is capable of, which really depends on the front panel (2, 8, or 16 channel units are different). You can have up to this many channels programmed into the radio. Channels with a blank receive frequency can't be selected. Channels can be left completely blank and will be skipped by the radio. It would seem that you can program more channels than the control panel is capable of.

Channel RX and TX Data:

The radio maintains its channel information in two groups of five bytes, one group for the receiver followed by one group for the transmitter. Both groups are coded the same. Three bytes deal with the synthesizer frequency and the remaining two bytes deal with Channel Guard and some channel-specific features. There's room for up to 16 channels but the radio will only utilize as many as it was set up to handle: 2, 8, or 16. The 800 MHz radio doubles the synthesized frequencies, so the radio would actually contain frequency data as if it's a 400 MHz radio.

When you program the radio, you must specify a receive frequency for each channel you want to use. The software lets you enter just a transmit frequency but the radio won't let you select that channel; what good is a channel that you can't listen to? You can also skip channels, i.e. fill out channels 1, 2, 4, and 5, although I don't know the benefit of doing that. The radio just skips channels with no receive frequency.

Synthesizer Math:

The synthesizer needs two values to set up its dividers properly. The datasheets and texts refer to these as "N" and "A". "N" is the integral quotient and "A" is the integral remainder. As a simple example, if we take the decimal value 42 and divide it by 8, we get 5.25. The whole number quotient is obvious: "5" for "N". The remainder is 0.25 8ths, so you need to multiply the remainder by the divisor to get "2" for "A". The MLS needs these two values and devotes 10 bits for "N" and 7 bits for "A". This occupies one bit more than two bytes can hold, so the radios allocate three bytes for the frequency information. Additional bits are used to specify the step size (5.0 kHz or 6.25 kHz) and whether the divisor is 64 or 128.

The various bands (VHF, UHF, 800 MHz) have different requirements for their frequencies, summarized below. Even though the calculations use 6.25 kHz for step size, the actual frequencies are usually 12.5 kHz apart, or twice the 6.25 kHz step. Frequencies can be any multiple of 5.0 or 6.25 kHz depending on the band. For VHF, if the frequency is divisible by both 5.0 and 6.25 kHz, a step size of 5.0 kHz is used. This table also provides the I.F. frequency for the receiver offset and whether the radio uses high-side or low-side injection. High-side injection means the oscillator frequency is higher than (above) the carrier frequency. For example, if you want to receive 162.400 MHz, the synthesizer must be programmed to receive (162.400 + 82.2) or 244.600 MHz. Doubled means that the bytes are programmed with half of the desired frequency and it is doubled in the oscillator circuit. So when transmitting on 820 MHz, the three bytes of programming data would specify 410 MHz.

Band	Step Size	Divisor	I.F. MHz	Inj.	Doubled?
VHF-L	5.0 or 6.25	64	20.8	High	No
VHF-H	5.0 or 6.25	64	82.2	High	No
UHF	6.25	128	82.2	Low	No
800 MHz	6.25	128	82.2	Low	Yes

Bytes 1 through 3:

The first byte holds the most significant bit (bit09) of the "N" value as well as bits that determine the divider and step size. "Div" is set to 1 for a Divider of 128 or set to 0 for a Divider of 64. "Step" is set to 1 for a Step Size of 5.0 kHz or set to 0 for a Step Size of 6.25 kHz. The other bits are set as shown below.

Bit #	7	6	5	4	3	2	1	0
Data	N09	0	0	0	0	1	Div	Step

The second byte holds the middle 8 bits (bit08 through bit01) of the "N" value.

Bit #	7	6	5	4	3	2	1	0
Data	N08	N07	N06	N05	N04	N03	N02	N01

The third byte holds the least significant bit (bit00) of the "N" value as well as the entire "A" value.

Bit #	7	6	5	4	3	2	1	0
Data	N00	A06	A05	A04	A03	A02	A01	A00

Transmit Examples:

So how does this all fit together? Let's take that 410.000 MHz frequency as an example. First I'm going to multiply it by 1000 to convert MHz to kHz. The resulting 410,000 kHz is divided by the step size of 6.25 kHz to yield 65,600. This is then further divided by the divisor value of 128 to come up with a quotient "N" and a remainder "A". The decimal division is 512.5, so "N" is 512 and "A" ends up being 128 times 0.5 or 64. Converting these to hex, we get 200 for "N" (10,0000,0000 in binary) and 40 for "A" (100,0000 in binary). To encode the first byte, we take the most significant bit (the only bit set to 1) from "N" and put that into bit07. Since the divisor is 128, we put "1" into bit01. Since the step size is 6.25, we put "0" into bit00. This gives us a binary value of 1000,0110 or a hex value of 86.

The second byte, from the middle 8 bits of "N", is all zeroes.

The third byte starts out with the least significant bit "0" from "N" followed by the bits from "A", giving us a binary value of 0100,0000 or a hex value of 40. So the three bytes in hex are 86,00,40. This resulted in an awful lot of zero bits but you'd get exactly the same result if you entered 820 MHz for an 800 MHz radio. This was a pretty poor value to use as an example. Let's try another one. How about 456.8875 MHz? That should be a bit more fun.

First, convert MHz to kHz: 456,887.5 kHz. Then divide by the step size (6.25) to get 73,102. We then divide by 128 to get the quotient 571.109375. The integral portion becomes "N", which is 571. The remainder portion is 0.109375 times 128 or 14 for "A". 571 decimal becomes 23B in hex, or 10,0011,1011 in binary. 14 decimal becomes 0E in hex, or 000,1110 in binary. So to encode the first byte, we take the most significant bit from "N" and put that into bit07, then since the divider is 128, we put "1" into bit01 and since the step size is 6.25, we put "0" into bit00. This gives us a binary value of 1000,0110 or a hex value of 86. This just happens to be the same as in the previous example.

The second byte is a bit better. We take the middle 8 bits from "N" (0001,1101) and place them into the second byte, giving us a hex value of 1D.

The third byte starts out with the least significant bit "1" from "N" followed by the bits from "A", giving us a binary value of 1000,1110 or a hex value of 8E. The final three bytes in hex are 86,1D,8E.

For 800 MHz, divide the frequency by 2 then follow the procedure above to encode the (approximately) 400 MHz value into three bytes.

Receive Examples:

We can work the same way on the receive frequency. 456.8875 MHz. First we need to deal with the I.F. frequency and offset, so we subtract 82.2 MHz yielding a synthesized frequency of 374.6875 MHz or 374687.5 kHz. Divide this by 6.25 to produce 59,950. We divide this by the divisor 128 to get 468.359375, so "N" is 468 and "A" is 0.359375 times 128 or 46. Converting these to binary we get 01,1101,0100 for "N" and 010,1110 for "A". Encoding these into the three bytes gives us 06 for the first byte, 1110,1010 or EA for the second byte, and 0010,1110 or 2E for the third byte.

For 800 MHz, first subtract 82.2 MHz, divide the result by 2 then follow the procedure above to encode the (approximately) 400 MHz value into three bytes.

All of these examples exactly match what the MLS2 software writes to the radio. Similar calculations for the VHF frequencies show that the MLS uses exactly the same encoding algorithm. Isn't modern technology wonderful?

Bytes 4 through 5:

These bytes are used for the Channel Guard value as well as some channel-specific options. For analog Channel Guard, they take the tone frequency (typically 50-250 Hz) and multiply that by 10, then utilize 12 bits to hold that value. The low 8 bits of the tone value are stored in the 4th byte, shown below.

Function	Bit07	Bit06	Bit05	Bit04	Bit03	Bit02	Bit01	Bit00
CG Code	CG07	CG06	CG05	CG04	CG03	CG02	CG01	CG00

The high 4 bits of the tone value are stored in the low half of the 5th byte. The upper half of the 5th byte is used for other purposes, shown below. Only the MLS2 radio can do DCG; this will be explained shortly. STE is Squelch Tail Elimination and refers to the reverse-burst sent by the transmitter at the end of a transmission or how the receiver acts when it receives a reverse burst. CCT is Carrier Control Timeout and is only meaningful in the transmitter's data bytes. Both of these are Yes/No settings in the programming software and the bit is turned on (1) for Yes and turned Off (0) for No.

Function	Bit07	Bit06	Bit05	Bit04	Bit03	Bit02	Bit01	Bit00
Inv. DCG	1	1	0	0	---	---	---	---
DCG	0	1	0	0	---	---	---	---
STE	0	0	1	0	---	---	---	---
CCT	0	0	0	1	---	---	---	---
CG Code	---	---	---	---	CG11	CG10	CG09	CG08

Channel Guard Examples:

So let's try a common tone frequency of 141.3 Hz. This becomes 1413, which is 585 in hex or 0101,1000,0101 in binary. The low 8 bits (1000,0101) go into byte 4 as hex value 85, and the upper 4 bits (0101) go into the low 4 bits of byte 5 as the hex value 5. If both STE and CCT are on, this results in a hex value of 35 in byte 5.

Let's try 67.0 Hz, the lowest legitimate CG code. This becomes 670, which is 0010,1001,1110 in binary. The low 8 bits (1001,1110) go into byte 4 as hex value 9E, and the upper 4 bits (0010) go into the low 4 bits of byte 5 as the hex value 2. If neither STE nor CCT are on, this results in a hex value of 2 in byte 5.

The MLS2 programming manual states that any tone from 50 to 250 Hz can be handled by the radio, but the software checks for the 38 legitimate Channel Guard frequencies and you can over-ride this restriction.

Digital Channel Guard:

Only the MLS2 radio can do Digital Channel Guard. DCG values are three digit octal codes with each digit ranging from 0 to 7. There are also so-called "inverted" digital codes. GE's software may alter the inverted DCG code you've entered to an equivalent code, which can be bothersome, but let it do its thing and see what it changes to. Alternatively, there are tables on the web that show all the digital codes and their inverted values; refer to one of those if necessary.

The same two CG bytes are used for DCG; they just set additional bits in byte 5 to indicate DCG rather than analog Channel Guard. Note that if you specify an inverted code, this implies the DCG bit would be on as well. The three-digit (9 bit) code occupies the entire byte 4 (the low 8 bits) as well as one bit in byte 5 (the most significant bit). So here's how the 4th byte is encoded.

Function	Bit07	Bit06	Bit05	Bit04	Bit03	Bit02	Bit01	Bit00
DCG Code	DCG07	DCG06	DCG05	DCG04	DCG03	DCG02	DCG01	DCG00

And here's how the 5th byte is encoded.

Function	Bit07	Bit06	Bit05	Bit04	Bit03	Bit02	Bit01	Bit00
Inv. DCG	1	1	0	0	---	---	---	---
DCG	0	1	0	0	---	---	---	---
STE	0	0	1	0	---	---	---	---
CCT	0	0	0	1	---	---	---	---
DCG Code	---	---	---	---	0	0	0	DCG08

Digital Channel Guard Examples:

Only the MLS2 radio can do Digital Channel Guard. Let's try DCG code 762 as an example). The encoding is simple: each octal digit uses three bits, so 7 in binary is 111, 6 in binary is 110, 2 in binary is 010, making the full 9 bit value 1,1111,0010 in binary. The 4th byte will hold the low 8 bits: 1111,0010 in binary or F2 in hex. The 5th byte gets the leading 1 plus the DCG, STE, and CCT bits, so the results are 0111,0001 in binary or 71 in hex. The two byte coding in hex is F2,71.

If we used Inverted 762 instead, the only difference is the extra bit in the high half of the 5th byte, which changes it from 0111,0001 to 1111,0001 in binary or F1 in hex. The two byte coding in hex is F2,F1.

Acknowledgements and Credits:

Some MLS programming information was verified against the TQ2310 suitcase programmer manual, LBI-31717.

Contact Information:

The author can be contacted at: his-callsign [ at ] comcast [ dot ] net.

Back to the top of the page
Up one level (GE index)
Back to Home

This page originally conceived on Monday 15-Jun-2015.

Article text and hand-coded HTML © Copyright 2010 by Robert W. Meister WA1MIK.

This web page, this web site, the information presented in and on its pages and in these modifications and conversions is © Copyrighted 1995 and (date of last update) by Kevin Custer W3KKC and multiple originating authors. All Rights Reserved, including that of paper and web publication elsewhere.