CDM Index page
Motorola index
Back to Home
  Some Notes on the Motorola CDM Mobile radios
(and similar Waris-based handhelds)

Information Compiled, HTML'd and Maintained by Mike Morris WA6ILQ
   

If anyone has additional hints / tricks / gotcha's, manuals or documents on the CDM or Waris radios I'd be happy to post them on the CDM main page or this page… You can be credited or anonymous, your choice - please contact the page author.
For example, a step-by-step article on how to recover from the EEPRM CS ERROR situation would be useful.
Another example would be how to stretch the lower limit of the 450-512 MHz "S" range radios down to 440 MHz. without losing receiver sensitivity or transmitter power.
The "CDM" nickname comes from Motorola's original literature (see the sales introduction on the previous page), and was derived from the model number. Think of the CDMs as a "Waris" series handheld radio (HT750 / HT1250 / HT1550) repackaged as a mobile except that they have a good front end (varactor tuned), an RF power amplifier and a big display. The CDMs use the same "Professional Series" programming software (CPS) as the Waris handhelds These mobile radios followed the MaxTrac / Radius / GM300 product line, and use the same 8-pin RJ-45 programming cable plugged into the microphone jack or by a programming cable that is pluged into the rear panel accessory connector, Early CDMs used bipolar transistors in the RF power amplifiers, later ones used LDMOS transistors (see the Detailed Service Manual). Unfortunately the CDM series has been discontinued as of June 2015. All depot support has ended (flat rate repair for under $300). Parts are very limited (for example, the custom made-for-CDM surface mount wideband IF filters are no longer available, but there is an alternative).
The CDM series were replaced in the product line by the "Commercial Series" (CM200, CM300 and PM400) mobiles or the XPR mobiles. The CM and PM have their own page at this web site. Yes, you can program the 146-174 MHz CM series down to 144 MHz with nothing more than a hexedit to the codeplug (not the CPS) and that's on that web page. Note that the CM / PR radios have a MUCH smaller heat sink and hence are a MUCH lower duty cycle radio. Moto also made a digital / DMR variant of the CM series that uses different programming software Your author has seen the CM200D and CM300D but has not had an opportunity to bench them or program them..
The ancestry of the CDM goes back to the HT750 handheld, where the development code name was "the Waris project". FYI, "waris" is the Hindi (India) word for "heir" (as in the heir to the throne)… (and there was a 1969 movie by that name that is interesting to see). That first radio followed the HT600 / MT1000 product line and turned into an entire new product line… the HT750, HT1250, HT1550, HT1250LS+, HT1550, HT1550LS+, the EX500, EX560, EX600, EX600xls, EX650 and PR860 "Expert Series" and "Elite Series", CDM750, CDM1250, CDM1550, CDM1550LS, CDM1550LS+, the PRO5150, PRO7150 (latin america) EX500 / EX600), PRO9150 plus the GP318, GP320, GP338, GP340, GP360, GP380, GP640, GP680 and GP1280. Most of the Waris series of radios program and operate similarly. If the first two letters of the model number are "AA" they are USA region radios (FCC approved). If the first two letters are "LA" they are radios made for latin america and are not FCC approved (and the USA Depots won't touch them). If anyone has a list of region codes please forward it to the page maintainer above.
Anonymous tip #1: I like the CDM as a 420-435 MHz link or remote base receiver over the Maxtrac or GM300 as the CDM series radios have a varactor tuned receiver front end. In remote base service as you change frequencies, the selective front-end retunes its narrow passband for the frequency you are currently receiving. The Maxtrac and GM300 series have a wide fixed tuned front end nominally 24 MHz wide. I've found the CDM series to be a more selective receiver…
Translation: The CDM is much less susceptible to adjacent channel interference than the prior radios.
Anonymous tip #2: The low power (1 to 25 watts) CDMs are preferred as remote base or link transmtters. I set them to 5 watts and they are continuous duty. Just add a beam antenna (anything from 4 to 16 elements) and they are excellent for point-to-point link service. If you need an omni pattern use a an appropriate antenna and an RF amplifier - anything from 50 to 250 watts is available. I like the Henry 5-watt input units that are 2 rack units tall as you can get 100 watts in 3.5 inches of rack space.
The "Waris" family radios features are defind by their firmware… Some people refer to firmware and CPS by Version, Motorola calls it a Revision, it's the same thing. In the CDM mobiles you will find revisions R05.05.15 and R05.05.22 are common, I've seen mention of R05.10.04 on a mailing list. If you read the radio with the CPS the firmware version is visible under "Radio Information". If you have a radio that has a keypad and a display (like the EX600 handheld) and the "Utilities" menu is enabled (an option in the CPS) you can select "Software Version" and it will show the firmware revision.
There is a label on the bottom of the CDM that includes the firmware version that the radio was shipped with. That Revision number provides a rough indication of build date. I know a number of people that will not consider a radio that shows a Revision prior to 5.0.0.
The CDM series was also exported.   I've been told that the CDM750 became the PRO3100, the CDM1250 became the PRO5100, the CDM1550 became the PRO7100. In Europe the USA CDM750 is essentially a GM340, the CDM 1250 has no equivalent, the CDM1550 is a GM360. The GM338 is an Australian / Asian market version of the GM360. Despite the numbering, the GM350 was a generation before the GM340, it came in 4ch and 128ch versions. There is also a GM950 4 channel and 128 channel which was essentially the same hardware with a 5 tone signalling option.
Any other details on USA versus non-USA models would be welcome.
For everyday programming (i.e. everything except flashing replacement firmware) your existing RJ-45 Motorola cable (either 9-pin serial) or FTDI USB will work just fine. If you don't have one then both are available from from Mark KJ6ZWL at https://bluemax49ers.com. If you are going to buy a USB cable then buy an FTDI based cable – I have seen reports on other pailing lists that people have had issues with Prolific-based cables.
The CDM radios require HVN9025 Professional Radio CPS which runs under Windows 95, 98, XP and 7… Probably Win10, you author hasn't needed to find out… That CPS also programs the HT750, HT1250, HT1550, MTX "Professional Series" and EX-500 and EX-600 "Expert Series" handhelds and a number of other "Waris" family radios. Unfortunately you cannot clone a handheld to a mobile or a mobile to a handheld.
You really want to use Revision R06.12.05 (released in December 2011) as it fixed a number of problems including the 64 bit Windows USB problems, plus that revision is the last one that allows wide and narrow selection on each channel, and it can be found "out there". on the internet. Revisions R06.12.07 and the later ones are narrow only unless you have a wideband entitlement key from Motorola and as of mid 2024 they are no longer available. Revision R06.12.09 (dated 12/14/2016) is the last and final revision. I have been told that the only difference between revisions 6.12.05 and the later revisions is the forced narrowband plus they added a few newer / later model numbers into the internal tables.
Recommendation: Save the original codeplug that came with the radio and back up your tuning data (you will need the Tuner program to do that). You never know when you might need them. A firmware upgrade to a Waris radio will not change the tuning information.
I repeat: Before you do anything to a new-to-you CDM you need to read and save the original codeplug it came with AND use the Tuner program to read and save the tuning data. Having this data will allow you to fall back to a known starting point if you ever have a problem. It's best to have it and not need it than to need it and can't get it.
The RLN4853 adapter (PDF) (photo) allows programming the CDM series through the accessory connector. Build one yourself from the photo, it's nothing more than a RJ45 female connector, a length of 4-conductor cable, and a 20-pin accessory connector… The schematic is on page 2 of the PDF.
It's hard to brick a Waris series radio.
One caution: Do not let the power fail while programming the radio, ESPECIALLY while loading firmware. When programming a CDM, Pro or Expert series handheld or mobile radio do NOT touch anything until you get the second set of beeps after loading a codeplug. The radio will beep when the programming load is complete, then the radio will reset itself and restart. That restart concludes with another beep. WAIT for that post-restart beep! If you start unplugging cables or shut off the power in-between the beeps you stand a good chance of corrupting the radio…
Second caution: This was mentioned above, but Moto recommends that you disconnect any dual head kits or remote kits while programming. Use a local head only, or program it through the accessory connector.
The CDM radio bodies were made in three low band ranges: 29.7 to 36 MHz (the "B" range), 36 to 42 MHz (the "C" range), 42 to 50 MHz (the "D" range), one high band (VHF) range: 136 to 174 MHz (the "K" range), and two UHF ranges: 403 to 470 MHz (the "R" range) and 450 to 512 MHz (the "S" range). One piece of sales literature referred to the "K" range as 132-174 MHz, but I think that was an error or a special batch that was made for the military.
The low band bodies are a larger physical size and were made in one power range of 40 to 60 watts where the VHF and UHF bodies were made in two power levels: the low power (1 to 25 watts) and the high power (25 to 45 watts). The high power radios are a little larger than the low power radios (photo).
Note: At the time of this writing your author does not have any hands-on experience with the low band radios, but he's been told that "the low band 42-50 MHz radios can be hacked to 52 MHz but they do not work right unless you move the tuning posts and do a complete Tuner alignment afterward".
There is no difference in the VHF and UHF radio bodies of the same RF power and frequency range between the CDM750, CDM1250 and CDM1550 models – everything inside is controlled by the firmware and a configuration data block. Your author has watched a CDM750 turn into a CDM1550 just by some tweaks to that data block and swapping the head and sleeve. And even after you tweak the CDM1250 or CDM1550 radio you can further tweak the radio and bump up the conventional (non-trunking) channel count (it can go to a maximum of 255 conventional / analog channels).
Like the Maxtrac, Radius LRA, GM300 and CDM series the antenna connector is a Mini‑UHF female and very easy to break if you use an adapter and use stiff coax like LMR400, RG213 or RG214. Motorola offered a Mini‑UHF male to BNC female adapter back in the Maxtrac days for test bench usage and sitll does as the HLN8027 Mini‑UHF male to BNC female adapter (about $11). Your author considers a pigtail (mini‑UHF male to N female) with silver plated connectors and quality RG-400 cable to be a requirement for radio sites. The pigtail relieves the stress on the radio connector. The broken connector problem got so bad that Motorola came up with the the 8 inch long HKN9557A Mini‑UHF male to UHF SO‑239 female Antenna Adapter Cable for about $19, and an 8 foot version as the HKN9088A Mini‑UHF male to UHF PL‑259 male Adapter Cable for about $40. You can make your own adapter cables for a lot less money… and by doing so you will have the option of better coax (RG‑400) and the connector of your choice (you will want to use silver plated connectors). I made up a few 1 foot long mini‑UHF‑male to N‑female cables for my test bench back when I got started with Maxtracs. A friend prefers mini‑UHF‑male to BNC‑female pigtails for his bench test cables. When you assemble your own then it is your choice.

A comment on the Mini-UHF connector from a friend:
Especially in mobile service a lot of installs or sloppy loose attachment by service techs ends up putting side pressure on the center pin. This will spread the female contacts in the radio connector. Visually inspect, and see if your connection acts at all flaky. The CDM antenna connector is replaceable, but its NOT a job for the faint of heart, or those inexperienced in soldering. It is best to use a dental pick or similar and get at the tines in the female and "encourage" them inward to make a tighter connection. DO NOT get carried away and break one of the tines.
The acid test: Take a unused male pin out of a new connector kit, stick it into the radio connector, and turn the radio vertical with the antenna connector facing down. See if the pin falls out.
There are three different control heads for the USA CDM product line. The CDM750 control head is a part number GCN6112, the CDM1250 head is a GCN6113 and the CDM1550 head is a GCN6114. There is a GCN6116 "Databox" Data Control Head for the radio modem version. There is also a "head" (I don't have the part number yet) that mounts on the front of the radio body when using a remote head. It has a 10-pin (RJ-50) (RJ-45-like) connector for the remote cable. You can program the P1, P2, P3 and P4 keys with numerous options but the up / down / left / right arrow keys are not programmable. Each of the heads has it's own 68HC11 microprocessor inside, slaved to the 68HC11 processor that runs the radio. If you have a flaky head just remember that all of the silicone buttons on the front of the radio are electrically arranged in an X-Y matrix that can be very different than the physical arrangement. Think of each button as having a virtual "row" and "column", and each button when pressed generates two analog voltages based on "row" and "column". Both the row and column voltages are fed to analog inputs on the control head microprocessor. If you have control head issues first swap the head   if the issue follows the head then unplug and plug each end of the ribbon cable. On a regular front-mount radio (not a remote mount) the 12-conductor ribbon cable that connects the head to the radio is part number 8486127B01. There is a blue dot on cable to make sure it's not installed upside down. The dot goes towards the "0" marking cast into the front of the radio. Make sure that the ribbon cable is in the connector, it's easy to slide it into the slot between the connector and the circuit board. Then carefully take the control head apart… All that is needed is a plastic putty knife or a plastic prying tool or a small flat-blade screwdriver. The volume knob is snapped into the housing, the pot shaft just fits loosely into it. When you take the board out the potentiometer will stay on the board and the knob will stay in the housing. The exploded view in the Basic Service Manual is wrong! Make sure the PCB contact pads under each button are clean. When you put the head back together you have to make sure the D-shaped hole in the volume knob and the D-shaped shaft are lined up. Was the flaky head in a marine environment? It could have salt deposits or corrosion inside the head. The CDM was not intended for the marine environment – marine radios have better seals around any case openings. I've seen CDMs mounted vertically, on the dash of a trash truck, a street sweeper and a school bus. All horizontal surfaces (like control head faceplates on vertically mounted mobile radios) are magnets for soda cans and coffee cups. Someone could have accidentally have spilled a soda or coffee that leaked into the volume control hole or the speaker grille of the head before you got it.
There is a connecting piece that fits between the CDM radio body and the control head. Motorola calls it a "backhousing", some people call it a sleeve. It is a good idea to consider the CDM head and backhousing as a paired set. This is the voice of experience.
The CDM750 control head looks very much like the CDM1250 and CDM1550 heads but it is a different physical size and has a different shape. As such there are two different backhousings. The CDM750 backhousing is part number 1586092B01. The CDM1250 or CDM1550 backhousing is part number 1586093B02.
CDMs can be remote mounted with the appropriate remote mount kit. The RLN4801 kit is for the CDM750 and the RLN4802 is for the CDM1250 and CDM1550 radios. The only difference betwen the kits is different sleeves, as mentioned above. The RLN4801 / RLN4802 kit does NOT include the interconnecting cable, you need to order a Cable Kit: RKN4077 (3 meters long), RKN4078 (5 meters long) or a RKN4079 (7 meters long). Moto's literature says that there have been issues with programming CDMs with the remote mount kits connected. There is also a dual head kit for stuations like a single mobile radio shared by an ambulance driver and by the paramedic in the rear patient care area of the ambulance. Motorola says to never program the CDM with the dual head kit connected. Personally, I always program them with only a local head in place either by a progrmming cable plugged into the microphone jack or by a programming cable that is pluged into the accessory connector, Disconnect the dual head interface box, attach a local head to the radio, then program it. Or program it through the accessory connector.
UPDATE: There is a link on the CDM Index page that walks you through a software only password removal process that is much easier than either of the ones below.

If you end up with a password protected radio and don't need to save the original frequencies, the easiest way to bypass the password is to just load a non-password-protected codeplug over the passworded one. !!The model number must be exactly the same!! If you don't have or can't get a a non-password-protected exact same model number codeplug then load a blank codeplug into the radio using your CPS. If you need a blank codeplug there is a folder full of them, one for each possible model number in the SAMPLES directory of your CPS (but if you are going to be unlocking password protected radios you will want a copy of the SAMPLES directory from the last / final revision as there are a model numbers that are not in previous versions).

There is an alternate method that will bypass the password and will let you view or overwrite the existing codeplug, but it requires knowledge and experience in hex editing the CPS executeable file. If you know what you are doing in hexediting use CPS 6.12.05 and open ProRadio.exe, then change offset 24DD69 from 74 to EB then save. Then when the CPS asks for a password don't type anything, just hit Enter. Naturally, make a backup copy of your CPS first. What I do is rename the ProRadio.exe file to ProRadio.backup.exe, then open it, then save it as ProRadio.exe, then hexedit it, then save it again. If you have a different revision look for the string 5B85C0742B and change it to 5B85C0EB2B (only the second last byte of that new string is different). Then run your hexedited CPS and when it asks for a password just hit "Enter".
The CDM radio bodies come in three low band ranges: 29.7–36 MHz (the "B" range), 36‑42 MHz (the "C" range), 42‑50 MHz (the "D" range), one high band (VHF) range: 136‑174 MHz (the "K" range), and two UHF ranges: 403‑470 MHz (the "R" range) and 450‑512 MHz (the "S" range). One piece of sales literature referred to the "K" range as 132‑174 MHz, but I think that was an error. The VHF and UHF bodies were made in low power (1 to 25 watts) and high power (25 to 45 watts). The high power radios were made with slightly larger housings. The low band radios were made only in high power (40‑60 watts). The high power body is about 1/4 inch longer than the low power models.
Note: Your author does not have any hands‑on experience with the low band radios at the time of this writing.
CDMs are prone to have a transmit audio noise that sometimes resembles alternator whine, but at a constant unchanging frequency. Well, Motorola's production line had a screw loose. Or actually multiple of the T20 Torx™ cover screws loose. Multiple reports exist from fleet purchasers of brand new radios being received with all of the six screws in the cover anywhere from 1/4 turn to 2 turns loose. The screws are numbered on the cover. Simply tighten the screws, in sequence, to torque tight.
I'll repeat myself - If you have a whiny radio and find one cover screw loose, then back them all off a turn or two and then torque in the numbered order.
If you have to open the radio then open it in reverse order and do not forget to pull the black accessory plug housing out of the back of the chassis before lifting the board out of the housing. When installing the top cover, lightly run the screws in first to position and settle the plate, then torque them in numerical order as outlined in the manual. This is necessary to insure proper pressure on the thermal pad for the PA and other heat generating devices inside.
The internal speaker of the CDM is 22 ohms and rated at 5 watts. The prior GM300 and Maxtrac models had a jumper in the accessory plug that when removed disabled the internal speaker. That option does not exist on the CDM, you have to disassemble the head to disable the speaker. You can use a GM300, Micor or Motrac mobile speaker just by connecting it to pins 1 and 16.
NOTE: The speaker audio outputs – pins 1 and 16 – of the CDM float both sides above ground. DO NOT ground (even for a moment) pins 1 or 16. You WILL destroy the audio output stage and Moto no longer has that part.
Moto's official CDM accessory sheet mentions the RSN4001 as an amplified external speaker for loud environments (black). There's another one in a different color (brown?) but I don't have that part number.
The factory Ignition Sense cable is the HKN9327. It has an ATO fuse holder in line and ships with a 4 amp fuse. Don't use it! The Ignition Sense line (pin 10 on the acecssory plug) is one of the few weak spots in the CDM design. The Ignition Sense line pulls only a few milliamps of curernt and is NOT well protected from vehicle electronic noise or crud. Even a 1 amp fuse is too much.
Personally, I avoid using pin 10 at all and use the pin 9 to pin 7 jumper trick (documented elsewhere on this page) to get the CDM to power itself up when DC power is applied to the rear connector. This automatic-power-up is mandatory for control receivers, repeater receivers, repeater exciters, link radios, or remote base radios.
The firmware loading adapter for a CDM is a HLN9742.   If you don't know what it's for or don't know you are doing then you don't need it.   If you do need one you can build it or a substitute from the schematic on page 4…
The adapter simply pulls one pin to ground or pulls a different pin high to place the mobile or handheld into a special mode where the processor is running from it's internal on-chip memory (this mode is only used to load firmware). Follow the directions on the screen of the firmware flashing program to put the radio into boot mode…
The details:
  • Position "A" of the adapter switch will put the CDM's into boot mode, BUT only from the CDM rear 20 pin accessory connector (it grounds pin 18). It will put the HT series into boot through the side connector (external speaker-microphone connector).   Flashing from the front requires position "B".
  • Position "B" shorts the Mic Audio line (pin 5) to the PTT line (pin 6) of the CDM front panel microphone connector. Since Mic Audio is biased to +9 volts DC (to run the mcirophone preamp) the radio microprocessor sees this + voltage and goes into boot mode.
  • Several people have commented that using pin 1 as a source of the + voltage (i.e. jumpering pin 1 to pin 6) is better.
If the only firmware loading you will do is CDMs through the mic jack then just add a SPST switch to an RJ45 adapter to short the PTT line to mic audio line (and be sure to use either a 9-pin serial port cable or a FTDI USB to serial cable).
You need a T20 Torx screwdriver and a small flat blade screwdriver to work on these radios. Some have T6 and T8 screws inside. The newer units have the six cover screws numbered #1 to #6. Units that do NOT have the numbers are the older model with BiPolar RF power amplifer devices with their own screws. Models with numbered screws have LDMOS devices in the PA and the circuit board does not have ANY screws holding it to the case - the board is held in place by pressure from the top cover pushing on the devices so they will couple properly to the thermal pads. Disassemble them #6 to #1 and assemble them #1 to #6.
The CDM has an internal fuse. It's NOT mentioned in the Basic Service Manual, but it IS mentioned in the Detailed Service Manual. Referring to that manual Chapter 3: page 1-3, says (on the last line on the page) "Fuse F0401 prevents damage of the board in case the FLT A+ line is shorted at the control head connector." Chapter 3: page 3-8 is a schematic. Look at the top left - the control head connector. Find pin 10 and follow it to the source (on the right). It says "Note: Fuse is part of PCB. In case fuse is blowen, replace it with R0410 P/N 0662057B47". Yes, they are using a trace on the PCB itself as a fuse. Yes, the schematic says "blowen". And the parts list says that R0410 is Moto part number 6580542Z01, described as "FUSE 3A". Look at the board behind the control head. That's where it is. fuse. I'd suggest that you NOT bridge the fusible trace with a piece of wire. A shorted head will melt a trace elsewhere, and and the spot may not be accessible. Just solder a 3 amp fuse acoss the blown trace. Back in the 1970s I watched WA6KLA take apart a 3AG glass fuse (heat the metal end cap until the glue fails), salvage the fuse wire and tack it across a blown trace on a Motrac radio.
The CDM supports binary "Channel Select" in the CDM RSS / CPS and it functions like the GM300s "Channel Steering". The CDMs have only four channel select lines on the accessory connector where the earlier GM300 had five (the XPR series also has five). To use this feature just program several of the general-purpose I/O pins for active-low input and "Channel Select". Channels 1, 2, 4, and 8 may be selected by grounding Channel Select line 1, 2, 3 or 4 respectively. All other channels are selected by grounding multiple select lines in a binary (not BCD) fashion. If you select a channel that does not exist (i.e. 10 channels are programmed and you select channel 12), the radio the radio will buzz at you until you clear the selection. If you change selections while the radio is keyed, it will stop transmitting and buzz at you until the PTT is released. If you release all of these Channel Select lines, the pins float high (i.e. "channel zero") and the radio reverts to the channel selected by the front panel (if present).
It is advisable to force select the channels and NOT use the no-channel-selected-equals-front-panel selection as an operational channel. The front panel selection may not survive a power-off-and-back-on reboot. The number of pins you program for channel select determines how many remotely selectable channels you can access... two pins lets you select 3 channels, three pins gives you 7 channels, four pins gives you 15. On an XPR or a GM300 five pins give you 31.
The front panel microphone connector on a CDM is a 10 pin, not the normal 8 pin (but an 8-pin microphone and programming cable will work just fine for anything short of a firmware load). The 10 pin connector body is the same size / width as the 8 pin and at first glance you won't realize that it's a 10 pin connector. Looking at the microphone jack with the tab down, it is wired left to right as follows; 9-8-7-6-5-4-3-2-1-10, with 10 nearest the center of the control panel. The center 8 pins of the 10 pin connector are the same as the other radios that use an RJ45 microphone jack. The designers simply added a pin on each side of the original 8 and numbered the new pins as pin 9 as EXT_KP_ROW and pin 10 as EXT_KP_COL. The two pins are used only to send the DTMF keyboard row and column info (as DC voltages) to the microprocessor (which actually makes the DTMF tones). The standard CDM microphone is the AARMN4025, the 12 button DTMF microphone is part number AARMN4026B (there is no 16 button CDM DTMF microphone). Other manufacturers that I have seen using the 10 pin RJ connector are some bar code scanners and the APC brand UPS units (their proprietary 10 pin cable connects their UPS units to the USB jack on the host computer). Some literature (including tool catalogs) call the 10 pin RJ connector an RJ-50, others call it an RJ-48. I've seen the 10-pin connectors and the matching crimping tools listed as RJ-50 on eBay and elsewhere.
In table form:
CDM Microphone Connector Pinout, per the manual
RJ-50
Pin #
Moto
Pin #
Description Comments
9 1 A+ Voltage (12 volts)  
8 2 5 Volts  
7 3 Hookswitch Ground when the microphone is in the clip.
6 4 Ground  
5 5 Mic audio high  
4 6 Push to Talk / Bootstrap Mode Ground for PTT (connect to pin 4) or +12 for Bootstrap mode for firmware flashing (connect to pin 1).
3 7 BUS + Radio programming
2 8 Handset Audio Receiver Audio, squelch muted, PL filtered, de-emphasized.
1 9 Microphone keypad row Pressing a key on the DTMF microphone keypad puts DC voltages on pin 9 and pin 10. The actual voltage depends on the row and column of the depressed key (stepped voltages). The control head microprocessor has analog inputs that read these voltages and interpret the button presses from them. The buttons on the front of the control head are interpreted the same way.
10 10 Microphone keypad column
You CAN have a microphone connected to the accessory connector of a CDM. Just make up a cable using an 8 pin RJ45 jack on one end and connected to a 16-pin or 20-pin accessory plug as follows (note that the ethernet numbering is backwards from Motorola numbering):
Microphone Jack Microphone
Jack Pin
Description
Accessory
Plug Pin
Comments
Moto
Pin #
RJ-45
Pin #
RJ-45
Wire Color
(Body / Stripe)
3 6 Orange / White Hookswitch 6 Assign this pin to Hookswitch function in RSS / CPS.
Not every application that needs a rear panel connected microphone will need this pin.
4 5 White / Blue Ground 7  
5 4 Blue / White Microphone Audio High 2 Program with emphasis enabled in RSS / CPS.
6 3 White / Orange EPTT 3 Assign this pin to External PTT in RSS / CPS
7 2 Green / White BUS (+) 17 Optional: If you add this connection then you can program the radio through this connector / cable.
(none) (none) (none) Boot Control 19 Optional: If you add a switch from this pin to ground then you can load new firmware into the radio through this connector.
In the CPS:
Radio Configuration -> Accessory Pins tab -> Accessory Package: Default (which makes accessory connector pin 3 an External Mic PTT Input, Active Level = Low, and Debounce Enable checked).
Radio Configuration -> Accessory Pins tab -> Set pin 6 as Mic Off Hook (Input), Active Level = Low, and Debounce Enable checked.
Then Radio Configuration -> Accessory Configuration tab -> set External PTT Audio Source: Ext Mic Audio
Converting the "200 MHz" CDM radio (yes, that's what Moto calls it on the manual cover) to the ham band and from narrowband to wideband…
The VHF and UHF CDM Product line, like every LMR radio made in the last 20+ years, is switchable between wideband and narrowband on a per-channel basis… The "200 MHz" CDMs and the "700" MHz CDMs are very different than their VHF and UHF cousins. They were made for spectrum that had never been wideband. The design is locked to narrowband 2.5 kHz deviation from the factory. They were also made only in one model, a CDM1550LS+ that was configured for LTR and Passport trunking and a few conventional channels. The stock "200" MHz CDMs cover 217-222 MHz. These can be "stretched" to cover the 222-225 MHz amateur radio band (or 219-225 MHz, your choice as 220-222 MHz is commercial). They can also be convinced to use 20 KHz channel spacing instead of the 12.5 KHz it was shipped with. It's all done with tweaks to a configuration data block that is read by the firmware. Before you do anything Save a copy of the radio's tuning information.
The design of the CDM receiver uses two stages of filtering in the 44.85 MHz first IF followed by two more stages in the 445 KHz second IF. The second IF in the VHF and UHF CDM is switched between narrow and wide.
The wide filter is missing in the "200 MHz" and "200 MHz" CDMs – they actually left out the wideband receive parts as the circuit boards were assembled.
Since most 220 MHz ham rigs exceed 5 KHz deviation from the factory the narrowband "200" MHz CDM receiver will see a normal signal as an overdeviated signal and the squelch circuit will misbehave.
There is a fix…
Background info: A Murata "D" series is 20 KHz wide (actually +/- 10 KHz), an "E" series is 15 KHz wide (actually +/- 7.5 KHz),  an "F" is 12 Khz wide (actually +/- 6 KHz),  and a "G" is 9 KHz wide (actually +/- 4.5 KHz).

Note that if you are using stock 200 MHz CDMs (i.e. narrowband) as both ends of a point-to-point link between, for example, a "hub" repeater and a number of "spoke" repeaters then the entire network is narrowband by default and you won't need to do the fix…
The hardware fix for the 200 MHz CDM is to simply change out the low IF filters from the narrowband ("G") part to an equivalent wideband part (a "D" the same one that is used as the wideband filter of a UHF or VHF radio) and then do a full wideband receive alignment. Fortunately the transmit circuitry needs no changes, it will support wideband without any component changes but you must do the wideband transmit alignment.

You will find the Murata CFWC455G filter in the stock 200 MHz CDM, specifically Motorola part number 9180469V03, installed in the radio at location FL304 or FL3106 (depends on the board and manual revision). Like the rest of the radio it's a surface mount part. The same parts are used in the HT750 / HT1250 / HT1550 handhelds. You need to replace the narrowband filter with the equivalent wideband version - in the low band, VHF and UHF models Moto used part number 9180469V06, a Murata CFWC455D.
At the time this page was written Moto Parts says that exact part is NLA (No Longer Available)… it used to be between $12 and $15 each. So you'll have to salvage it from a low band, VHF or UHF hulk (not easy to remove the one from the hulk without the correct surface mount desoldering equipment), or find an electrically similar 4-pin filter ("D" or "E") and install it…
Once you get the wideband IF filters installed you get to do a full wideband receive alignment.
There are two more steps to do: The band edges need to be moved and the channel spacing changed.
Changing the Band Edges…

The stock "200" MHz CDMs came from the factory covering 217-222 MHz. These can be "stretched" to cover the 222-225 MHz (or 219-225 MHz, your choice) amateur radio band. They can also be convinced to use 20 KHz channel spacing instead of the 12.5 KHz it was shipped with. It's all done in software… Specifically tweaks to the codeplug.

Note that once you change the band edges or the channel spacing you won't be able to use any previous codeplug or stored tuning data from the radio.   So save a copy of the tuning information. Just in case… Personally, I store an electronic copy in two places on my hard drive and on a flash (thumb) drive, just in case…

No, you don't need to reinvent the wheel, it's already been done and a sample codeplug is "out there" on the internet. And once the radio is happy with the band edge changes and the channel spacing then you need to use the Tuner program to input the tuning data.

I'm going to repeat myself: Before you do anything use the Tuner program to save the tuning data. And have two copies, just in case.

Once the radio has the new band edges, channel steps and the restored tuning data you can use use stock unmodified "Pro series" Rev. 6.12.05 CPS software to program the radio.
The CDM series radios will operate without a control head if programmed for a single channel, and you can program a CDM through the accessory connector. This ability to operate without a head makes them useful as a repeater receiver, control receiver, or link receiver or link transmitter or as repeater transmitter exciters. But you do need to have the radio automatically power itself up after an AC power outage at the radio site… which requires the Ignition Sense line (pin 10 on the accessory connector) to be connected and programmed active. That line goes active with an input above +5 volts and inactive when dropped to below +3 volts.

Naturally you will have to connect a head while programming the radio. During that programming session you will be entering your frequencies and PL / DPL, and other features. The programming options under "Radio Configuration" include "Ignition Sense Type:", with the options of:
1) Disabled
2) Follow Ignition Only - this is risky
3) On/Off and Ignition
4) PTT Disabled     (i.e. a receive-only radio)

A blown Ignition Sense input is a known issue with the CDM mobile radios. If the voltage on the Ignition Sense pin spikes high or low it can kill the ignition sense function so it no longer works. Sometimes it can be fixed (replace diode D0660 and D0661, both are a 3-legged dual diode, part number 4813833C02), other times not. If the radio is programmed for Follow Ignition Only and the Ignition Sense input to the microprocessor is blown then you cannot power up the radio and YOU ARE SCREWED… Off to the depot. But there is no more flat rate depot repair, support has ended. You now have either a parts radio or a lightweight doorstop, and it's due strictly to how you programmed the radio.

You can wire the Ignition Sense (pin 10) in parallel with the DC power input. When the DC power is switched on then radio will automagically come on. But that leaves the fragile Ignition Sense line exposed to the outside world. If you do, you should include a 1 amp (or smaller) fuse in the line. Don't forget that fuse! Some CDM circuit board vintages have a 15 volt zener diode on the Ignition Sense line to shunt any overvoltage to ground. When that diode conducts it can pass enough current to melt the copper trace on the circuit board open. Sometimes you can fix the blown trace, sometimes not.

Update: Depending on the firmware the "External Emergency Switch (Input)" (pin 9) on the CDM accessory plug includes a "wakeup" feature, so if pin 9 is grounded momentarily (to pin 7), the radio will turn on and switch to emergency mode. The only options for pin 9 are Null and Emergency, so it is rarely connected, programmed or used. If the radio is not programmed for emergency, it will do nothing but turn on. This feature will simply provide a "back door" method to power up the radio. Once it's on you can reprogram the radio to On/Off and Ignition, then use the radio as a mobile or a base station. Or fix the zapped pin 10.
Seen on a mailing list: (paraphrased from several different postings)
Watch out when using ignition sense on CDM's! We had a customer with several radios with dead ignition sense pins, some were from vehicles that had been jump started and some were not. The radio dies when the ignition sense line gets a negative voltage spike, usually from a heavy-duty power solenoid (e.g. starter solenoid). This negative voltage spike exceeds the PIV rating of the diode, and the diode usually opens. When the diode does not open, this spike goes to the CMOS microprocessor, and if it jumps even one metal-oxide junction the result is fatal. The HLN6325 diode kit is designed to short this spike to ground before it enters the radio.

We eventually found a Motorola Service and Repair Note (SRN) for the CDM series that said vehicles using large power solenoids, that have the ignition sense connected to the solenoid, can produce negative voltage spikes that can blow out some parts in the radio. Since then, we always install CDM ignition kits with HLN6325 diode kits.
Could someone scan the paperwork shipped with the HLN6325 diode kits? Does anybody have a PDF of that SRN?

As posted at the top and bottom of this page, I offered to post any tips / tricks / gotcha's.
Here's one emailed response:
IF you have a CDM wired up through the accessory connector to an external controller, and you have Ignition Sense set to the default ON/Off OR Ignition there is a potential problem. If you push the front panel on-off button while the external controller has the radio transmitting then the radio will APPEAR to turn off - BUT IT DOES NOT TURN OFF! It goes into an uncontrolled mode and draws several amps. This is VERY messy. Usually you have to make a trip to the site and unplug power from the radio to clear the problem.

The safest way is to test Ignition Sense to see if it is working and then when you finish all your programming, set for Ignition Sense Only. That way someone who goes by and punches the front panel on/off button because you left the speaker turned up and blaring in the room will not cost you a trip to the site to recover the radio.

I do not recommend the alarm active line jumpered to ignition sense for any application where there is a PTT connected to the rear connector. You need to actively apply 12 volts to the Ignition Sense pin to insure the radio stays on and disable the front panel on off to insure the radio does not go uncontrolled when somebody punches the on/off button while the radio is keyed.

On the bench, try it yourself. but do not leave it in that state for a long time. I think the PA is still making power (on some random frequency) but the TR switch goes to receive.

If you test further you will discover that the radio is controlled by the Ignition Sense line. If Ignition Sense is active and you punch the front on off button, the radio simply shuts off the head and speaker and associated circuitry, but the receiver is still active. It is probably related to Sel-Call and related alerting. I think you can program Sel-Call to turn the radio back on and alert, but I have never tried to do that.

Here's another emailed response:
BTW I would NEVER separate the control head from the attachment spacer ring unless you must for a repair. Take the adapter frame off the radio and leave the head assembly intact. Unplug the ribbon from the radio end. Note the big black dot on the ribbon cable and the 0 on the radio casting and match them up.

There is a lot of pressure contact stuff inside the head, especially the display, and that's best handled with high grade cleaning alcohol and clean room approaches. When you take the adapter ring off the head, the pressure clips come away from the board. Let the intermittents begin. The board is SUPPOSED to clip into the plastic frame. there are tabs on the board and notches in the plastic for that purpose. When you stress the plastic enough to separate the adapter ring from the head, usually at least one of those tabs comes out of the slot and the process begins. Make sure all the tabs are back in place. It can take a fair amount of pressure to reseat a tab. Torque the plastic head some to help it fit.

Bottom line: Do not separate the head from the adapter ring without cause. You do NOT need to separate it to change the ribbon, or swap heads, but you may to change a speaker (it has its own tabs and slots).

Here's another emailed response:
I had a CDM that would not go into Boot Mode and found that the front power button MUST be programed in CPS for ON/OFF & IGNITION for the flash to work, this CDM was set for ignition only. I changed it and it flashed with no problem. When you run the firmware update program, the radio should be on and the HLN9742 adapter switch should be in the center (off) position. Run the program and follow the instructions on the screen. It will tell you to throw the switch to the B position and then hit the power button on the radio twice, pausing at least one second between presses. After doing that, click OK (or upgrade, I forget what it actually says) and you are off and running. I also do not think anyone mentioned that the radio turns off in the first press of the power button and remains with the display blank during the rest of the flash update. The display does not return untill you power the radio down and back up again at the end of the flash.

Here's yet another:
CDM Radios made before a certain date have several major flaws.

It is hard to determine the exact date of manufacture. The serial number is a 90% indicator, and the case metal color and the factory firmware revision (not the flashed-to revision) but factory firmware revision helps - see Photo.

The serial number format is nnnTxx. For these purposes the first 3 numbers can be ignored, they are an internal Moto code. The two digits after the "T" are year and 2 week interval.

Radios older than about TBL will have trouble. I look for TCx and after.

The FACTORY original firmware needs to be above 5.00.00. Flashing upgrade of the firmware does NOT fix this problem.

Moto made a major design error in the early CDMs. They forgot to mute all of the audio modulation paths during the PLL lockup time after PTT. This flaw occurs in 100% of the radios older than the fixit date, and that date is a Motorola secret. The front panel microphone is muted, but the external (accessory jack) modulation inputs are not, so anything plugged into the 20 pin connector will have trouble, especially the flat audio input.

This means the radio will lock up on the frequency that is the sum of the carrier and instantaneous deviation - and that can move the TX unmodulated frequency several KHz. What makes it painful is that it is a random amount determined by the instantaneous modulation level AND the instantaneous point on the modulation waveform at the moment PTT is keyed.

So, prefix a site, the controller could start the ID string and issues a PTT command. The radio keys with the modulation on and comes up as far as 3 KHz off channel.

The older radios are also prone to "grumpy old man" syndrome - the hardware either looses or has poor memory "junctions" - on the third Tuesday at 2 AM the radio locks up with any of several error messages. About 75% of the time the complete removal of the DC power (the on/off button does NOT cut it), waiting a few seconds and re-applying DC power makes the radio come back to life and work for anything from 5 minutes to 2 years. The other 25% either are dead forever or require bench flashing of the operating system code.

The older radios have BiPolar RF power amplifiers - the newer ones are LDMOS.

As long as they keep working, the older radios make perfectly good mobiles or regular base stations, and terrible radios in repeater / link / remote base service.

Moto changed the metal mix (color) around the time they changed to LDMOS. The radio frame had to be re‑designed to match the new LDMOS board and its pressure pad heatsink system. I am not sure there is a 100% date correlation, but it is very close. The old radios look like grey silver, the newer radios almost look like silver aluminum Both are pot metal, just a radically different mix.

You can tall the difference from 10 ft away IF the two radios are sitting there side by side with the heat sink visible. It is a bit harder with a single radio, but its still pretty obvious once you have seen the difference. It is really obvious if the top plastic cover is removed.

If the top of the radio has a number next to each screw that holds the top cover plate on, it is LDMOS. The numbers are the torque pattern. Don't mess up proper torque amount or torque order - that will cost you a PA device, and will be messy and spurs while it is cooking itself to death because a loose top plate also means loose shielding between internal sections of the radio.

Summary:

Look for the silver metal frame / housing.
Look for the number next to each cover screw.
Look for serial nnnTCx or newer.
Look for factory firmware newer than 5.00.00 - see Photo.
If anyone has additional hints / tricks / gotcha's, manuals or documents I'd be happy to post them on the CDM main page or this page. You can be credited or anonymous, your choice.

Back to the top of the page
One page up (the CDM Index page)
Motorola index
Back to Home


This page was created 22-Sept-2020.

This web page, this web site, the information presented in and on its pages and in these modifications and conversions is © Copyrighted 1995 and (date of last update) by Kevin Custer W3KKC and multiple originating authors. All Rights Reserved, including that of paper and web publication elsewhere.