One Page Up (CM Series Index)
Two Pages Up (Motorola index)
Back to Home
  Stretching the Frequency Range of the Motorola "Commercial Series" Radios
(CM200, CM300 and PM400 mobiles,
CP200, CP200 XLS, PR400 handhelds)

Researched, Compiled, HTML'd and Maintained by Mike Morris WA6ILQ
   

Back in January of 2020 I was asked if there was any way to use a VHF CM300 mobile radio made for the 146-174 MHz range below 146 MHz. A number of radios had been purchased for expanding a fleet but the installation had been delayed (internal corporate politics) and they were still in the boxes. An amateur radio special event was coming up and having a dozen extra mobile radios would be useful... The amateur radio repeater that the event was going to use was on a 145 MHz channel.   I said "Maybe..." and one of the CM300s (model M50KQF9AA1AN) was handed to me, still in the box. I made a few phone calls and followed up on a couple of leads. Below is the result of the research and some office desktop experimentation on the CPS... I was not able to run the test radio past a service monitor. And I had to give the radio back so that it could be used for the event, and then reprogrammed with the saved fleet codeplug and installed in a fleet vehicle.

YOU CAN HELP ON THIS PAGE!
My only hands-on experience (so far) with tricking a Commercial Series radio to go out of range was the above experience with the one VHF CM300.
I'd be interested in YOUR results... both VHF and UHF. If I get any contributions with some hands-on VHF and UHF results from readers I will update this page with real-world numbers.

If you have a service monitor I'd be interested in what your receiver sensitivity and RF power is at 146.100 and 146.00 MHz, and at increments out of range... at 145.90, 145.80, 145.70, 145.60, etcetera all the way down to 144.20, 144.10 and 144.00 plus one measurement out of band at 143.90 MHz. Does your transmitter RF power output change at those frequencies? Does the deviation change? If your service monitor has a spectrum analyzer were there any signal purity issues?

If your radio is UHF I'd be interested in your measurements of receive sensitivity and RF power in-range and at similar increments out of range, plus any other issues?

UPDATE January 2025: Jordan Carter K9NZF reported complete success on a 438-470 MHz UHF CM300 in an email to repeater-builder.
Please see his letter below. Jordan can be contacted by way of the email address on his QRZ page.

The CM200 / CM300 / PM400 mobile radios and the CP200 / CP200XLS / PR400 portables were spec'd on VHF for 146-174 MHz but you might loose a little sensitivity and transmit RF power going below 146 MHz. Tricking the radio to operate out of the design range depends on the tolerances of the individual RF components inside the radio... most VHF radios will work down to 144 MHz. Most 438-470 UHF radios should work from 430 to 473 MHz, a few might not. An email reported that this process was successful in stretching the receive side of a 465-495 MHz radio down to 462 MHz receive for GMRS.

The CM200 and PM400 mobiles use the same synthesizer / controller design as the CM300 that I played with. The CP200, CP200XLS and PR400 are the portables in the same product line and should work the same (disclaimer: I have never had the opportunity to actually touch a CP / PR handheld much less program one). From emailed reports this process described below has been succcessful on both CM200 and PM400 mobiles, a UHF CP200 and a VHF PR400 handleld.

This procedure assumes that you:

  1. Have RVN4191 CPS installed on your radio programming computer and know how to use it. The RSS help file says it runs under Windows 95, 98, XP and on Win7. I have an older Panasonic Toughbook CF‑30 that is dedicated to radio programming and it runs 32‑bit Win7 SP1. I've not needed to try Win 8 or Win 10
    You will want to use RVN4191 CPS Version R05.16 as it is the last one that allowed wideband or narrowband without a wideband entitlement key (which is no longer available).

  2. Have a compatible programming cable for the CM mobiles or CP handhelds. See the "Updating your mobile cable" article on this page.

  3. Have a hex editor on your computer and are familiar with using it.

Lets get to it...

  1. Read the radio with the CPS and save the codeplug as a file twice.... once as the working copy (you will be hex editing this one), and the second copy as a "just‑in‑case" backup that you hopefully won't need. If you screw it up you can copy the backup on top of your working copy and start over.

  2. Open the working copy in your hex editor. Make sure it's in "overwrite" mode (i.e. not in "insert" mode).

  3. Look at this translation of the codeplug elements:
    Sort Sequence
    Numerical
    Value
    Codeplug
    Element Value
    0 = A5 A0 = 5
    1 = A4 A1 = 4
    2 = A7 A2 = 7
    3 = A6 A3 = 6
    4 = A1 A4 = 1
    5 = A0 A5 = 0
    6 = A3 A6 = 3
    7 = A2 A7 = 2
    8 = AD A8 = D
    9 = AC A9 = C
    BB = "."

  4. Find the hexadecimal sequence "BBA5A5A5A5A5A5". That's "BB" and six of the "A5". If you reference the table above that sequence translates to ".000000". In a VHF codeplug you will find that sequence three times.

  5. The first full entry in a VHF "K" range (146-174 MHz radio) is "A4A5A6BBA5A5A5A5A5A5". Look carefully at the first six characters - they will be "A4A5A6". This is the VHF synthesizer base frequency: 103.000000 MHz. Do not touch this one!
    I do not know what the base frequency is for a VHF low range (model M50J...) radio (136-152 MHz) or for the 438-470 MHz or 465-495 MHz range UHF radios. If someone would be willing to let me know what they find then I'll update this writeup and add a table.
  6. The second entry is "A4A1A3BBA5A5A5A5A5A5". This is the lower limit of a VHF "K" range radio, "146.000000" MHz.

  7. Those that are stretching a 146-174 MHz radio down to 144 MHz will be changing only the sixth character... "A4A1A3BB" to "A4A1A1BB".
    Those with UHF radios will need to make the appropriate changes for their situation.
    If you are going to contribute some real world sensitivity and power measurements to this page (i.e. down to 143.something on VHF) please consider using 143.0 MHz for your new low end.

  8. The third entry is "A4A2A1BBA5A5A5A5A5A5". This is the upper limit, "174.000000" MHz. I can't imagine why a ham would be changing this one, the RF components in the radio will not do 220 MHz.

  9. Save the hexedited codeplug file. Just overwrite your working copy on your hard drive. This will be the starting code plug for your out-of-band radio.

  10. Exit the hex editor.

  11. Start the CPS, verify that you can read the radio, but then load your working copy.

  12. Add your new frequencies in the 144-145 range. If your radio came from commercial service then it will probably be narrowband on all existing frequencies; don't forget to set your new frequencies to whatever is appropriate for your use.

  13. Write the codeplug with your new frequencies into the radio and...  THIS IS IMPORTANT ‑ Save this final codeplug to your hard disk with a filename that you can find again.

When you need to change the programming in this radio DO NOT read the radio!!!
Somehow the modified codeplug is still telling the CPS that it's still a 146-174 MHz radio ! If you download the radio the CPS will think all of the frequencies below 146 MHz are errors and it will "fix" all of the errors without asking! The end result is that you will have to re‑hex‑edit the codeplug from scratch and re-enter all of the below‑146 MHz frequencies. This is the voice of experience !

Instead of reading the radio just treat this radio as a write-only device.
Load the saved codeplug from your hard drive into the CPS, make the necessary changes, save the modfied codeplug and then write it to the radio.


There has to be a better way where we can change the band edges in the radio so that the CPS does not "fix" the out of band frequencies when downloaded. I spent about 15 hours researching that and could not break the code before I had to give the radio back. Maybe the codeplug includes the model number? Maybe there is a model number to frequency range table in the CPS? Maybe the codeplug includes the frequency range but the values are in a different numeric format? I do not know.
But a bunch of emailed reports says the above method works for them.


As promised above, here is Jordan Carter's email:

I have been a long-time Repeater Builder lurker (about 28 years), so I thought it was about time I made a contribution! 
I was programming a UHF CM300 for a friend and one of the channels that he wanted in it was 437.800 for the ISS. 
Being a 438-470 MHz radio, it wouldn't take it. So off to Repeater Builder I went to see what the process was to 
convince it to go where I needed it to, where I found your information on moving the VHF CM300 down to 144-145 MHz. 
I followed your instructions for the VHF and was able to move it down to 436.000 so I could enter 437.800. 

438.000 = A1 A6 AD BB A5 A5 A5

There are 15 instances in the codeplug. 

I changed them to A1 A6 A3 BB A5 A5 A5, which of course equals 436.000.

After I did that, I went ahead and took it down to 420.000 (A1 A7 A5 BB A5 A5 A5) and documented the following:

438.000 MHz  .33uV     36W
437.000 MHz  .33uV     36W
436.000 MHz  .33uV     36W
435.000 MHz  .34uV     37W
434.000 MHz  .34uV     37W
433.000 MHz  .34uV     37W
432.000 MHz  .34uV     37W
431.000 MHz  .34uV     37W
430.000 MHz  .37uV     37W
429.000 MHz  .37uV     37W
428.000 MHz  .37uV     38W
427.000 MHz  .37uV     38W
426.000 MHz  .39uV     38W
425.000 MHz  .41uV     38W
424.000 MHz  .43uV     39W
423.000 MHz  .43uV     39W
422.000 MHz  .45uV     39W
421.000 MHz  .52uV     39W

The next step was 420.0 MHz, where the receiver went deaf (max output of my service monitor is 700+ µv), 
so I switched to 100 KHz steps to see where it unlocked:

420.900 MHz  .52uV     39W
420.800 MHz  .52uV     39W
420.700 MHz  .54uV     39W
420.600 MHz  .54uV     39W
420.500 MHz  .56uV     39W
420.400 MHz  .58uV     39W
420.300 MHz  .58uV     39W
420.200 MHz  .58uV     39W
420.100 MHz  .58uV     39W   
420.000 MHz   Unlock on RX, 39W TX

Note: I did not observe any anomalies on the spectrum analyzer while testing transmit power, but more in 
depth testing would probably be advised if someone were to be using an out of band radio as a transmitter. 

Service Monitor:  Motorola R2600

Radio Model Number: AAM50RPF9AA1AN

Windows XP Pro 

CPS Version R05.16

Feel free to modify and edit this information as you see fit.

Thanks & 73,

Jordan Carter K9NZF  email: (callsign) @ (callsign) .com


Contact Information:

The author, Mike Morris WA6ILQ, can be contacted here.

Back to the top of the page
One Page Up (CM Series Index)
Two Pages Up (Motorola index)
Back to Home

This page was created 13-Nov-2023 by Mike Morris WA6ILQ.

This web page, this web site, the information presented in and on its pages and in these modifications and conversions is © Copyrighted 1995 and (date of last update) by Kevin Custer W3KKC and multiple originating authors. All Rights Reserved, including that of paper and web publication elsewhere.