MaraTrac index MaxTrac index Back to Home

Ham-friendly Firmware Mods for the MaxTrac and MaraTrac: Why and How They're Done By Robert W. Meister WA1MIK

Background:

The MaxTrac, Radius, GM300, and MaraTrac radios all have identical tables in their firmware EPROMs that control the bands and band-splits the radio knows about. These values govern the alignment frequencies but also have an effect on the programmed channel frequencies. The Radio Service Software (RSS) is aware of these same values.

The radio's synthesizers operate on steps of 5.000 kHz or 6.250 kHz. This is known as the step size. On some bands, channels can be spaced 5 kHz apart, while on others just 12.5 kHz apart. When a particular frequency is entered into RSS, it translates that to a value that represents a number of step-sized increments above a certain start frequency. Each band-split has a start frequency value for both 5.0 and 6.25 kHz step sizes. For example, on a 42-50 MHz VHF radio, if you enter a frequency of 45,000,000 MHz, RSS takes that value, subtracts the start frequency of 42,000,000 and comes up with 3,000,000. It divides this by 5,000, the step size, resulting in 600 5 kHz steps above 42.0 MHz. This is the value that is actually stored in the code plug. The radio's firmware takes this value, multiplies it by the step size, adds the start frequency, and sends that to the synthesizer, along with the step size, which results in the radio operating on 45.0 MHz. If the frequency can't be evenly divided by 5 kHz, both RSS and the radio's firmware will use a step size of 6.25 kHz. The most significant bit in the code plug frequency data is turned on if the step size is 6.25 kHz.

Start Frequencies and Span Sizes:

During alignment, there are 16 tuning frequencies that fully cover each band-split. Each one of these ranges is called a "span". For example, if the span size is 1.5 MHz and the radio covers 440-470 MHz, the first span deals with frequencies between 440.0-441.5 MHz, the second span deals with frequencies between 441.5-443.0 MHz, and so on.

There's a table of start frequencies and span sizes in the EPROMs for every band-split the radio can operate on, one pair for 5.0 kHz step size and one pair for 6.25 kHz step size. One of the bytes in the code plug has two bits that specify the band (VHF-low, VHF-high, UHF, and 800/900 MHz) and another two bits that specify the band-split (22.5-29.6, 29.6-36, 36-42, 42-50 for VHF-low, 136-162, 146-174 for VHF-high, 403-433, 440-470, 470-494, 494-520 for UHF, 806-825, 851-870 for 800 MHz, and 896-902, 935-941 for 900 MHz). Not all bands have four possible band-splits.

The values in the tables below are a number of 5.0 kHz steps or a number of 6.25 kHz steps. For example, the value 4500 means 4500 times 5 kHz, which equals 22,500 kHz or 22.500 MHz. Similarly the value 3600 means 3600 times 6.25 kHz, which equals 22,500 kHz or 22.500 MHz.

Base Frequency:

Unfortunately, on some bands, 16 bits is just not enough to specify an operating frequency properly, so they add an additional base frequency to the start frequency. I'm sure there's a table of these values in the EPROM somewhere, indexed by the two bits that specify the band. For VHF-low, the base frequency is 0 MHz. For VHF-high, the base frequency is 136 MHz. For UHF, it's 403 MHz. These values are stored as kHz values, one for 5.0 kHz step size, one for 6.25 kHz step size.

Why am I boring you with all this background information? So you will understand what is being changed and why. The table of 16-bit integer values can be stored at either an even or odd address. In the MaraTrac EPROM, it's at an odd address, so a 16-bit value spans two words: the right half of the first word, and the left half of the second word. The MaxTrac EPROM stores its table at an even address, so each 16-bit value is fully contained in one word. The order of these word values is as follows:

start frequency for 5.0 KHz step size for VHF-low band, 22.5-29.7 MHz sub-band
span size for 5.0 kHz step size for VHF-low band, 22.5-29.7 MHz sub-band
start frequency for 6.25 KHz step size for VHF-low band, 22.5-29.7 MHz sub-band
span size for 6.25 kHz step size for VHF-low band, 22.5-29.7 MHz sub-band

start frequency for 5.0 KHz step size for VHF-low band, 29.7-36.0 MHz sub-band
span size for 5.0 kHz step size for VHF-low band, 29.7-36.0 MHz sub-band
start frequency for 6.25 KHz step size for VHF-low band, 29.7-36.0 MHz sub-band
span size for 6.25 kHz step size for VHF-low band, 29.7-36.0 MHz sub-band

4 words for VHF-low band 36-42 MHz
4 words for VHF-low band 42-50 MHz
4 words for VHF-high band 136-162 MHz
4 words for VHF-high band 146-174 MHz
We don't care about the rest of the data. Here it is in tabular format. All values are decimal; values following a slash are the hexadecimal value you'd see in an EPROM image file. The values that are discussed later in this article that need to be changed are underlined.

		Step Size:	5.00 kHz	5.00 kHz	6.25 kHz	6.25 kHz
Band	Base	Band-Split	Start Freq	Span Size	Start Freq	Span Size
VHF-L	0	22.5-29.7	4500/1194	0095/005F	3600/0E10	0076/004C
VHF-L	0	29.7-36.0	5920/1720	0090/005A	4736/1280	0069/0045
VHF-L	0	36.0-42.0	7200/1C20	0080/0050	5760/1680	0064/0040
VHF-L	0	42.0-50.0	8400/20D0	0107/006B	6720/1A40	0086/0056
VHF-H	136	136-162	0000/0000	0347/015B	0000/0000	0278/0116
VHF-H	136	146-174	2000/07D0	0375/0177	1600/0640	0299/012B
UHF	403	403-433	0000/0000	0366/016E	0000/0000	0295/0127
UHF	403	440-470	7482/1D3A	0401/0191	6011/177B	0321/0141
UHF	403	470-494	13482/34AA	0401/0191	10811/2A3B	0321/0141
UHF	403	494-520	18282/476A	0347/015B	14651/393B	0278/0116

Individual Band Changes:

For 10m, the start frequency is lowered from 29.6 to 28.1 MHz. Similarly the span size is increased from 450,000 Hz to 500,000 Hz (for both 5.0 and 6.25 kHz step size) so the end of the sub-band (36.0 MHz) is fully reached during alignment.

For 6m, the start frequency is not changed for 42-50 MHz, however the span size is increased from 535,000 Hz (5.0 kHz step size) or 537,500 Hz (6.25 kHz step size) to 800,000 Hz so the end of the sub-band (54 MHz) is fully reached during alignment.

For 2m, the start frequency is lowered from 146 to 144 MHz. Similarly the span size is increased from 1,875,000 Hz (5.0 kHz steps) or 1,868,750 Hz (6.25 kHz steps) to 2,000,000 Hz so the end of the sub-band (174 MHz) is fully reached during alignment.

Checksum:

After any value in the EPROM is changed, the checksum must be fixed up. The firmware calculates two simple 8-bit checksums for two portions of the EPROM data, one for hex addresses of 8000-B5FF, a second for hex addresses of B800-FFFF, which is usually where the table is found. (The range from B600-B7FF is occupied by an EEPROM that's inside the microprocessor. This holds some of the code plug data, which includes the tuning and alignment data.) These two checksums, when added together, must equal zero, or the individual checksums must be the same value after you modify the EPROM. Hex location FF90, which normally has hex value FF, can be changed safely to make the checksum come out correct. Some EPROM image files may fill unused locations with hex 00 bytes, others with hex FF bytes. Most hex editors can generate an 8-bit checksum. You should generate one for each portion of the EPROM and verify that the results are still zero when added together after you make all of the changes. Just remember that there are two separate checksums and you have to only fix the one that covers the hex addresses where the frequency table (you modified) is found. However, you can alter either portion's checksum as long as the two individual checksums, when added together, equal zero.

The checksum is one of the trickier things to deal with. The hex editor I use has the ability to calculate the 8-bit checksum of a range of bytes by highlighting the ones you want it to process and clicking the appropriate menu item. You need to get the original checksum values before you modify anything else, and you must make your modified EPROM image have the same checksum values, whose sum equals zero, when you're done.

There are usually locations near the end of the image that are big areas of either 00 or FF bytes. You pick one of these and alter it (earlier I chose hex location FF90). There's probably a scientific method to getting the right value the first time but I find that experimenting with it is easier.

For example, let's say your original checksum is 9C and when you finish hex editing the image the checksum is now 6C. That means you need to alter one byte somewhere by a value of 30. If you take one of those 00 or FF bytes and change it to 30 and run the checksum again, you'll now see something a lot closer to 9C. Keep changing that byte's value until your checksum equals 9C. If you change it by 1 each time, it'll take several tries but you'll eventually get it.

If the byte you chose was FF originally, your first correction will most likely be off by exactly 01 because of the math, so you might have to change the FF to 31 to get an overall change of 30.

The original EPROM image has one byte (in each section) they used as a checksum but I have no idea where they are, so that's why I just pick an otherwise unused byte and change that. The byte you choose to alter is unimportant as long as it's not being used by the program as an instruction or data byte. Usually long strings of 00 or FF are just empty EPROM space fillers.

Why This Affects The Radio:

There are 16 alignment points for transmit power and deviation. During radio alignment, RSS sends a span index number (0-15) to the radio. The firmware then calculates the appropriate frequency based on the base frequency, start frequency, and span size:

Operating_freq = base_freq + start_freq + (span_size * span_index_number)

The radio will then transmit on the frequency that represents the beginning of that particular span.

During normal operation, when the radio needs to transmit, it performs a similar calculation to determine which span index number (0-15) represents the transmit frequency:

span_index_number = (operating_freq - base_freq - start_freq) / span_size

It then accesses the tuning data for that span and sets the transmit power and deviation accordingly. All of this works great as long as the transmit frequency is within the legitimate range for the band and band-split. You run into problems when this calculation generates a span index number that's less than zero or greater than 15. The radio does not protect against invalid span numbers; RSS and the stock firmware can't normally generate a frequency that's out of the expected range unless you play tricks with either one to force out-of-band operation.

Lets say you want to transmit on 50.1 MHz. The calculation would be:

span_index_number = (50,100,000 - 42,000,000) / 535,000

This comes out to 15.14, which is an integer value of 15. This would access the alignment point values at offset 15 of the 16 possible power and deviation settings and the radio works fine.

Now lets say you wanted to transmit on 53 MHz, which is outside the band-split for the radio. The calculation would be:

span_index_number = (53,000,000 - 42,000,000) / 535,000

This comes out to 20.56, which is an integer value of 20, way past the 16 possible alignment point values. This would access the alignment point values at offset 20 of the power and deviation settings, into an area in the code plug that definitely does not contain power or deviation settings, resulting in undesirable and unpredictable operation.

In actuality, all these calculations are done in increments of 5.0 or 6.25 kHz, the step size used by the synthesizer, but the results are the same.

EPROM Data Changes:

First you need to find the table. The simplest things to look for are the start frequency that represents 22.5 MHz (hex 1194), followed by the span size that represents 475 kHz (hex 005F) for the 5.0 kHz step size. You should also find values for the 6.25 kHz step size immediately following these (hex 0E10 and hex 004C). These are found exactly once in the EPROMs.

These should be followed by four similar values for the 29.7-36.0 MHz band-split (hex 1720 and hex 005A), which is the data you want to alter. To lower the start frequency, change hex 1720 to hex 15F4 (29.7 to 28.1 MHz). To raise the span size, change hex 005A to hex 0064 (450 to 500 kHz). Do the same for the 6.25 kHz span size values that immediately follow it: hex 1280 to hex 1190, and hex 0045 to hex 0050.

The next four words cover the 36-42 MHz band-split. Nothing needs to be changed here.

To alter the 42-50 MHz range so it covers up through 54 MHz, you only need to alter the step sizes. The next four words cover this band-split. You don't need to change the start frequency but you do need to change the span size from hex 006B to hex 00A0 (535 to 800 kHz) for 5 kHz step size. Similarly you don't need to change the start frequency but you do need to change the span size from hex 0056 to hex 0080 (537.5 kHz to 800 kHz) for 6.25 kHz step size.

The next four words cover the 136-162 MHz band-split. Nothing needs to be changed here.

To alter the 146-174 MHz range so it covers 144-174 MHz, you need to change both the start frequency and the span size for both 5 and 6.25 kHz step sizes. Remember there's an implied 136.0 MHz base frequency that's added to the start frequency values and the data in the table only has the start frequency. Change hex 07D0 to hex 0640 (10 MHz to 8 MHz because of the 136 MHz base frequency) and hex 0177 to hex 0190 (1.875 MHz to 2 MHz) for 5 kHz step size, and change hex 0640 to hex 0500 (10 MHz to 8 MHz because of the 136 MHz base frequency) and hex 012B to hex 0140 (1,868,750 Hz to 2,000,000 Hz) for 6.25 kHz step size.

If all these changes are implemented correctly the checksum at hex location FF90 (EPROM image file hex location 7F90) should be changed from hex FFFF to hex 4EFF. Some EPROM image files may fill unused locations with hex 00 bytes. The same technique is still used but the correction value will be different.

Remember that the words you're changing are each composed of two bytes, in ascending order, and these bytes may not both be in the same word. I have not given you exact addresses to change, since the table is located at different places in each firmware version. So you need to find the table and work down from there. If you read the firmware out of an existing EPROM, it occupies the address space from hex 0000 to hex 7FFF, but when residing in the radio, it occupies the space from hex 8000 to hex FFFF. I use Hex Workshop to hex edit all my binary files. I've set it up for Motorola byte order and to display 16 individual bytes per line on the screen.

Replacing the EPROM:

Before you replace the EPROM, you should go through all of the Logic Board Replacement screens (press F10 to exit each screen without entering or saving data) and write down all the settings. Wise old saying: It's better to have them and not need them, than to need them and not have them. Unplug the radio and replace the EPROM. Power the radio back up, connect a wattmeter, dummy load, frequency counter, and deviation meter (a service monitor will have all of these) to the antenna jack. Start RSS and go through the Logic Board Replacement screens, particularly the ones that have 16 alignment points for Deviation and Output Power. Remember that the alignment frequencies will change with the new firmware as the radio now covers the ham bands. Go through each of the 16 alignment points, pressing F8 to save these when you're finished. Remember, the frequency displayed by RSS will NOT be the actual alignment frequency the radio is transmitting on. Remember to affix some notation on the radio that states it now has ham-friendly firmware.

Contact Information:

The author can be contacted at: his-callsign [ at ] comcast [ dot ] net.

Back to the top of the page
Up one level (MaraTrac index)
Up one level (MaxTrac index)
Back to Home

This article was first posted 04-Jun-19.

Article text, artistic layout, and hand-coded HTML © Copyright 2019 by Robert W. Meister WA1MIK.

This web page, this web site, the information presented in and on its pages and in these modifications and conversions is © Copyrighted 1995 and (date of last update) by Kevin Custer W3KKC and multiple originating authors. All Rights Reserved, including that of paper and web publication elsewhere.