Manuals - Catalogs - Application Notes in PDF
Factory Part Number and Description

Shared by all
Saber Accessory Catalog
HighTier_TwoWay_Catalog
Motorola Accessory catalog large
Accessory Catalog Branded
Battery Maintenance BMS Plus
Encryption Products and Protocols
Motorola Secure Modules
TinyTrak TNC to Saber series interface

Systems Saber
68P81060C20-A Systems Saber & Saber-ATS service manual
68P81066C95-0 Systems Saber UHF service manual
68P81067C10-O Systems Saber VHF service manual
68PB1060C10-C Systems Saber operators manual

Saber
68P81062C95-F Saber RSS 07.01.00 manual
68P81048C40-O Saber III operating instructions
68P81044C05-O Saber service manual
68P81044C05-A Saber theory maintenance manual

Astro Saber
68P81072C80-B Astro Saber operators manual
68P810740-O Saber SI operators manual
6881094C35-B Flashport users guide
Astro Digital Saber parts & accessories
Astro Radio disassembly
Astro Saber parts & accessories
Astro security policy
Flashport users guide
Guide to Astro Digital Radio version 03.00.01
Guide to Astro Digital Radios version 03.00.00
R3-161C Astro Saber specsheet
RC-26-2001 Astro Trunked brochure

MTX
68P81072C10-A MTX B3 operators manual
68P81072C40-0 MTX B3 B5 operators manual
68P81074C50-J MTSX RSS manual
68P81200C40-O MTSX service manual
RC4-30 MTX9000 Ad

XTS



Pagers
688030P66-O Advisor Alpha Gold Programming Guide
Advisor Alpha Gold Manual
6881020B80 Advisor Alpha Gold Service Manual





Keys 

The MOT-1 key has the exact same cuts as found on a 2135 key, but it's made on a different blank (Ilco 1041-N).   Have the locksmith copy your 2135 onto the Ilco 1041-N blank but use the photo to get it rightside up.  

 






Model Details



Saber
Systems Saber
Saber "R"

Astro Saber MTX XTS

Security

Key Loaders
Battery Date Code Manufacture Date By Serial Number First three numbers in serial number




Saber / Systems Saber / Saber "R"




Introduction:

The original Saber family was developed for the US military around 1989, and is noted for its long, thin shape. The Saber receiver probably has the best selectivity that has ever been seen on a portable. These handhelds are tough, popular radios still used by users in the military / industrial / public service / commercial and private user environment. The basic Saber and the more advanced Systems Saber were officially labeled obsolete and Motorola depot repair for them ended Dec 31st 2005. The Astro Saber product line was discontinued as of the end of 2002. Accessories for the Astro Saber will be supported through 2008, and the Systems Saber and original Saber use many of those. Because of abandonment of the Saber line, and the upcoming narrow banding rules they are being replaced by the MTS and XTS series. As a result we are seeing a LOT of surplused Sabers and they are relatively inexpensive on the used market plus they are available from several sources. With that in mind, it's time to discuss the advantages and disadvantages of the various Saber models, some of which sold for US$3,000 new (or US$4,000 for a trunked, encrypted Astro Saber). Note that "Astro" is Motos name for a digital radio, and that "Astro" is a proprietary format and NOT the same as P25. There are later versions of "Astro" that will do P25 (introduced around 1996), but basic "Astro" does not (and the VSELP versions are not P25... VSLEP has not been produce and supported by Motorola since late 1995. Since 1996 the only digital mode from motorola on the Astro line be it portable or mobile has been P25). Astro25 is the common name for the P25 version of Astro.

There are several series of handheld radios in Motorola's Saber line. These include the original Saber I, the Saber IE, the Saber II and the Saber III, the Astro Saber family, the Saber SI family, Systems Saber family (which offers trunked models) and the SSE5000. It's not unusual to see the I / IE / II / III written as 1, 1E, 2 and 3, especially on eBay auctions.

The MX1000, MX2000 and MX3000 are the export version of the Saber I / II / III, with the only major difference being the model tags on the case, and the firmware (this means that the Saber accessories will work). Two changes in the firmware are that (1) they do not support the non-exportable encryption modules and (2) they can only be programmed with the MX1000/2000/3000 RSS.

The basic differences:

  • The Saber I is the most basic of Sabers. This radio has 12 channels and it is available as either a Secure Capable or Non-Secure radio.

  • The Saber IE (also known as a 1E) is capable of 24 channels by having two zones of 12 channels each. What is normally the Secure / Clear switch on top now selects between the two zones. The top escutcheon on one radio that I own has a single dot for zone 1 and two dots for zone 2. I have seen others that have an A or B on the top escutcheon. You could also use the zone selector switch as a way to select Talk-Around or Direct for each repeater, simplex on the output frequency, by programming zone one with twelve repeaters and zone two with the matching talk-around frequency. This way if you're on any channel, a flip of the switch gives you talk-around. In a Saber IE secure radio you then have the option of slaving the secure transmit to specific modes so that you can still use the top switch to select zones, or assign the switch to secure/clear use and losing the second zone.
    The IE also has the different front shield assembly. It includes a small memory board and connecting cable, like a display board for a Saber II or III. The part number for the front assembly should be NTN5686A. The radio's on-board memory is insufficient to accommodate 24 channels and needs the extra board.

  • The Saber II is capable of either four zones of twelve channels, or ten zones of twelve channels. The difference is in the front shield assembly. The 2k 48-channel radio, when disassembled, will have four surface-mount ICs on the back of the front display board. The 8k 120-channel radio front display board has five surface-mount ICs. However, there is an exception to this rule. If an 8k radio is programmed as a 2k radio by selecting option H670 Omit memory - 2k memory option under Radio Feature Options in the RSS, it will be the same as a 2k radio. It can be restored to an 8k radio with some trickery, but that's another article!

  • The Saber III is basically a Saber II with the full keypad. It offers multiple channels and zones, analog only, no trunking. The full keypad allows you to use some other options such as user programmable scan and DTMF. Otherwise it's the same radio as a II.

  • The Systems Saber is capable of analog trunking operation and it has increased channel capacity, up to 255 channels. Yes, there are other feature changes, such as the buttons are reprogrammable (the ones on the regular Saber are not), but I will not get into the nitty gritty of the exact differences in this article. Please note, you must use the Systems Saber RSS to program this radio. If you use any other software, it will not work, and you may damage the radio.

  • The Astro Saber is a totally different radio. In my opinion the only thing they share is that they are similar in size and shape and uses the same battery and battery charger. It will do both wideband and narrowband analog on a per-channel basis plus added digital capability. Not all the Astro Sabers are digital, however. Another article will have to be dedicated to describing it.
The Saber series is very ham-friendly. The Saber II and III have handy features such as MPL (Multiple PL select), nuisance delete - the temporary deletion of a busy channel from the scan list (a feature I think all radios should have since it is so handy), and many more!

Sabers that do features like scan do so via cumbersome menus, while Systems Sabers do it via direct button presses. Astro Sabers, unlike Systems Sabers, will remember scan state through a channel change. Systems Sabers only allow one MDC ID per radio, while Astro Sabers allow you to enable multiple MDC "systems" and select which system goes with which channel. This feature is nice if you have call signs on both the Police and the Fire channels, but different MDC IDs.

The SSE5000 is a model of Saber manufactured by Motorola's Special Products Division specifically for the NYPD; I have no clue of its options.

There is also a version of the Saber which carries an R suffix (i.e. Saber 1R, Saber 2R). These are ruggedized versions of the Saber originally built for the Military: the Marine Corps, Navy Seals, Green Berets, and other units requiring an ultra-rugged radio for field communications. The cases are completely different and incompatible with standard Saber case parts and batteries.

The Mobile Vehicular Adapter (MVA) or Convertacom for the Saber I, II, III or Astro Saber radios is the NTN5487B or C. In some catalogs it's called the Saber Vehicular Adapter or SVA. It includes a battery charger, external antenna hookups and on some models an RF amplifier. The unit requires the microphone (model NMN6150A) that was made for the unit as it includes an LCD display and a keypad.

There are several speaker-mics for the Saber, one is the NMN6128. The UHF Public Safety models have a straight cord and an antenna on top of the speaker-mic head.

In this writeup we will be discussing the more common Saber I / IE / II / III series of radios.

First a general explanation of Secure vs. Non-Secure:

"Secure" is a generic name for voice encryption. There are several methods some of which are exportable, and some of which are not. You will find terms like Digitally Encryption System (DES), DES/XL, Digital Voice Privacy (DVP) and DVP/XL.

Encryption also requires the loading of a hexadecimal encryption key (16 to 24 characters depending on the encryption method - DES, DVI, DVP, etc.) into the radio with a Key Variable Loader (KVL). Each radio needs to have the same key if they are going to communicate with each other. A KVL resembles a handheld radio but with a numeric display and membrane keypad. There are also Secure modules that offer Over-The-Air Rekeying (OTAR). This option allows the encryption key to be updated over the air.

Note that a Secure Saber radio is longer in length; these are known as Secure-Capable radios and is easily distinguished by a flat area of the case, about 5/8" in length, between the speaker grill and the battery. A Non-Secure Saber has the shorter case that ends at the bottom of the speaker grill. The interior components are interchangeable except for the metal frame, which of course matches the case length, and the main board that the modules plug into, which is also the same length and has the location at the bottom end for the Secure module to be installed. The use of encryption on a Secure-equipped Saber is not mandatory and is selectable by a switch on the top of the radio. The switch is labeled O for Clear Operation and Ø for Secure Operation. Encryption can also be user enabled, fully disabled, or required on a per channel basis in the software. You can also have a Secure capable radio without a Secure module installed - in this case there is a "Bypass" or dummy module installed containing nothing but a wire jumper.

Saber Model Number Decoding

The basic differences between a Saber I, IE, II and III are:

Radio Display Keypad Channels / Zones
Saber I No No 12 Channels (one zone)
Saber IE No No 24 Channels in two Zones
Saber II Yes 3 Keys 48 Channels in 4 zones or
120 Channels in 10 Zones [1]
Saber III Yes Full [2] 120 Channels

Notes:
1: Two different models of radio - one with 2k of memory, the other with 8k.
2: The 3 keys of the Saber II plus a 12-button pad that is also used for DTMF. There is no 16 button DTMF option.

This question has a very roundabout answer; the "Model" number scheme varies across the Saber line of radios and is not a reliable source of information about a given radio. To determine the frequency band / options of a given radio you need to decode the "Factory ID" number on the label on the back of the Saber. Some Sabers have model numbers and Factory IDs that are the same. If you have a recased Saber then there may be no label, or it may be absolutely irrelevant, as it could be for whatever was in that case originally (i.e. a completely different radio).

The Factory ID of a VHF Saber is formatted as the letter H (For Handheld), then two numbers (usually 33 or 43 in high band, or 34 or 44 on UHF), then three letters, then some additional letters or numbers, then finally a two letter combination of either AN, BN or CN. The Factory ID can be decoded using the following table.

Radio Type Transmit
Power [1]
Frequency
Range
Environmental /
Security [2]
Feature Set
H
Hand-
held

or

Z
Special
Product
3
66-88 MHz:
None made

146-174 MHz:
1 or 2.5 W

438-470 MHz:
1 or 2 W
2
68-88 MHz
SA
Non-Submersible /
Non-Secure (Clear)
G
Two Zone
No Keypad
(Saber IE)
4
66-88 MHz:
1 or 6 W

136-174 MHz:
2.5 or 6 W

403-512 MHz:
2 or 5 W
3
136-174 MHz
YB
Submersible /
Non-Secure (Clear)
J
3 Keys in 1 Row Keypad
Menu, Select, Enter
(Saber II)
4
403-512 MHz
QX
Non-Submersible /
Secure Capable
K
3 Keys as above plus
5 Rows Numeric and DTMF Keypad
(Saber III)
  YX
Submersible /
Secure Capable
N
One Zone
(Saber I)

Core Channel Spacing Channel Selector Model Variation Model Revision[3] Model Package
7
Binary CORE (US)
1
Wide Band (25/30 kHz)
0
10 Channel Capable (Int'l)
9
Model Variation
A
Original Revision
N
Model Package
9
Tone CORE (Int'l)
5
Narrow Band
(12.5 kHz)
(Int'l)
3
12 Channel Capable (US)
  C
Scan Capable
 


Systems Saber Model Number Decoding

Factory ID Number
Power
Frequency
Submersible
Keypad
Display
VHF





H33TUN5170CN 2.5
146-175
No
No
No
H43TUN5170CN 6
136-174
No
No
No
H33YUN5170CN 2.5
146-174
Yes
No
No
H43YUN5170CN 6
136.174
Yes
No
 No
H33TUK5170CN 2.5
146-174
No
3x5
Yes
H43TUK5170CN 6
136-174
No
3x5
Yes
UHF





H34TUN5170CN 1-2
403-512
No
No
No
H44TUN5170CN 2-5
403-512
No
No
No
H34YUN5170CN 1-2
403-512 Yes
No
No
H44YUN5170CN 2-5
403-512 Yes
No
No
H34TUK5170CN 1-2
403-512 No
3x5
Yes
H44TUK5170CN 2-5
403-512 No
3x5
Yes

Notes:
[1]: Transmit Power: a 3 is the low power version of that band and split, while a 4 is the high power version of that band and split. There were no H32 series Sabers made. Two power levels are shown because each band has its own low and high power values (two different power amplifier modules). Also the high power radios have adjustable low and high power levels via the RSS and can be assigned to each channel. So a high power radio can still have a low power setting.
[2]: Environmental / Security: SA and YB are the short-case radios. QX and YX are the long-case radios.
[3]: Model Revision: A Saber I is not capable of scan even if it is a C revision.

The above sample model number H43SAJ7139CN decodes to a 6 Watt VHF Saber with no encryption capability, a 3 key keypad and display (i.e. a Saber II), with a US binary core, wide band channeling, 12 channels and is Scan Capable.

You can not tell a Saber's bandsplit by the Factory ID, only the band (Midband, VHF or UHF). To determine the actual frequency range (bandsplit) within the band you must do one of these:
1) Read the radio with the Motorola RSS (Radio Service Software), or
2) Disassemble the radio and read the part numbers off the actual modules.

Band Changing:
Modules from a VHF radio are a different design than the modules from a UHF, so you can not change the band of a radio with a module swap, but you can change the band split (i.e. the range within the band) by swapping modules from a radio in another split. More on this later!

Common Frequency Bandsplits Include:

MIDBAND: Two ranges in midband:

  • 66-84 MHz
  • 74-88 MHz
These radios are fairly rare and fairly useless to USA amateurs - but some countries have a 4 meter amateur band. In the USA the 66-72 MHz range is television channel 4, the 72‑76 MHz frequencies are used as "Operational Fixed / Repeater" frequencies (essentially commercial point-to-point links), 76‑82 MHz is television channel 5, 82-88 MHz is television channel 6, and 88‑108 MHz is commercial FM broadcast (which is 76‑90 MHz in Japan).

VHF ranges:

  • 136-150.8 MHz - Government/military surplus and usually referred to as the government split. Programs up on amateur, MARS or CAP channels with no problems.
  • 146-162 MHz - This will cover the entire USA 144-148 MHz amateur band with modifications to the RSS.
  • 146-174 MHz - Wideband split.
  • 148-174 MHz - This is a wideband split only found in low power H33 series Sabers.
  • 157-174 MHz - This is the most useless VHF split to an amateur, but they make good trading radios or parts radios. Also, these can be changed to a more desirable band split by swapping the modules. For example if you had a Saber III on this split and a Saber I on 136‑150 Mhz you could swap the modules around and end up with a 136‑150 Mhz Saber III and a 157‑174 MHz Saber I you could sell to someone on a commercial channel (perhaps on eBay).

UHF ranges:

  • 403-433 MHz - Government / military surplus and usually referred to as the government split. These are useless for USA ham use as they will not cover the 440-450 MHz (repeater) segment of the amateur band. The highest I got one to program and operate was 436 MHz. Beyond that the VCO would unlock and there is no easy way to fix it. (Note from WA6ILQ: Sabers have been seen as low as 395 MHz but I have no technical info on them.)
  • 440-470 MHz - The absolute perfect USA amateur split radio!
  • 458-490 MHz - This split will not extend down to the ham band, making it a trading radio or a parts radio.
  • 482-512 MHz - Again, not useful to an amateur... Another trading radio or a parts radio.
Using a frequency counter could give you a possible idea of what frequency range it is, but it's still only a starting point. For example, if the radio was programmed anywhere between 144-150 MHz it could be a 136-150, a 146-162 or a 146-174 split radio, since all three splits cover that range. However, if you find only frequencies in the 150-160 range then chances are it would have to be a mid or high split.

Ebay descriptions can be deceiving... I have seen low split radios with something in the 154 range programmed in... Yes it worked, but the radio was a low split and receive sensitivity was very poor. Also, some ebay sellers have realized that the low split is less valuable than anything else, and desirable only to hams and CAP and have started slamming them with mid or high split codeplugs. The radio will take it because it doesn't know any better until the VCO unlocks, so they will put a mid or high split codeplug in the radio and then program it with a few channels that relate to its original bandsplit so the VCO stays locked. That gives you the appearance of a mid or high split radio, and it works, until you reprogram it and the VCO unlocks.


Saber Modules:

Think of the Saber radio as a computer: it's a main board with everything plugged into that. The Saber has five basic modules and a 16.8 MHz Reference Oscillator plugged into the main board. A Secure-Capable radio will either have a Bypass module or some sort of a Secure module installed as well. The Bypass module routes transmit audio in place of the Secure module. If you end up with a secure-capable radio that transmits but has no transmit audio, check to see if there is a bypass or secure module installed (they are frequently removed before being surplused). If it is missing a simple wire jumper can be installed to simulate a bypass module.

I have accumulated some of the part numbers and descriptions of the various modules. If you have any changes or additions please let me know; some of the manuals are out of print and no longer available. I will provide the module numbers and splits as printed in the manuals that I own. The "x" on the end of each part number stands for the revision letter of the part: A, B, C, D, etc.

  • Reference Oscillator = This is the same component for the entire series. VHF and UHF all use the same crystal. Also, the HT600 used the same crystal in case you get a Saber that has had this removed to disable the radio before sale; not too uncommon a practice.
    • NXN6268x, 16.8 MHz. Standard for the series, however a "XN6269A" was found in the 74-88MHz radio. We suspect that the rubber stamp at the factory didn't make full contact and left off the leading "N".

  • Synthesizer: The radio's VCO comes in various splits. The VHF radios use two different splits to cover the entire range, whereas the UHF has four! I have not been able to locate the part number of the mid-band synthesizer.
    • Unknown = 66-84 MHz
    • NLC6241A = 74-88 MHz
    • NLD8201x = 136-150.8 MHz
    • NLD8210x = 146-178 MHz Used in 146-162, 148-174, and 157-174 splits.
    • NLE9461x = 403-433 MHz "Government" split
    • NLE9462x = 440-470 MHz
    • NLE9463x = 460-490 MHz
    • NLE9464x = 482-512 MHz

  • Receiver and 5-Pole Front End Filter: These two components make up one module: the 5-pole filter is the bottom half of this module and the receiver is the top half. On the VHF radio, the same receiver is used for the entire range; the 5-Pole filter determines the sub-split in use.
    • Receiver
      • Unknown = 66-84 MHz
      • NLC6231A = 74-88 MHz
      • NLD8180x = 136-174 MHz. Used for all of the VHF sub-splits.
      • NLE9431x = 403-433 MHz. Govt. split
      • NLE9432x = 440-470 MHz.
      • NLE9433x = 460-490 MHz.
      • NLE9434x = 482-512 MHz.
      • NLE9501x = 403-433 MHz.   12.5khz spacing only!
      • NLE9502x = 440-470 MHz.   12.5khz spacing only!

    • 5-Pole Filter
      • ???????? = (I don't think the 5-pole filter module was used in the 66-88MHz radio)
      • NFD6091x = 136-150.8 MHz.
      • NFD6092x = 146-162 MHz.
      • NFE????x = 403-433 MHz.
      • NFE????x = 440-470 MHz.
      • NFE????x = 460-490 MHz.
      • NFE????x = 482-512 MHz.

    • 2-Pole Filter = A separate module present in VHF radios between the receiver and FDS. The UHF radios do not have this separate filter module.
      • Unknown = 66-84 MHz
      • NLC6382A = 74-88 MHz
      • NLD6111x = 136-150.8 MHz.
      • NLD6112x = 146-162 MHz.
      • NLD????x = 146-174 MHz.

  • Filter, Detector, Switch (FDS) = Responsible for steering RF between the receiver and transmitter and also selecting the internal and external antenna connections. (A fancy name for a solid-state T/R relay!)
    • Unknown = 66-84 MHz
    • NLC6251A = 74-88 MHz
    • NFD6131x = 136-150.8 MHz
    • NFD6132x = 146-178 MHz. Used in 146-162, 146-174, and 148-174 split radios.
    • NFE6061x = 403-470 MHz.
    • NFE6062x = 470-512 MHz.

  • Power Amplifier = The PA modules are where you can move around a bit. You can put a wide split PA in a narrow split radio since it still covers the range needed. Also, you can put a low split PA in a mid split radio to give better performance at the bottom end of the ham band, provided you will not need full transmit power above 150 MHz, this allows you to have a greater receive bandwidth while maximizing transmit performance on the ham band.
    • Unknown = 66-84 MHz
    • NLC6261A = 74-88 MHz
    • NLD8121x = 136-150.8 MHz High Power 6W
    • NLD8773x = 146-174 MHz High Power 6W
    • NLD8122x = 146-162 MHz High Power 6W
    • NLD8133x = 146-178 MHz Low Power 2.5W
    • NLD8123x = 157-174 MHz High Power 6W
    • NLE9471x = 403-433 MHz High Power 5W
    • NLE9472x = 440-470 MHz High Power 5W
    • NLE9473x = 460-490 MHz High Power 5W
    • NLE9474x = 482-512 MHz High Power 5W

  • Secure Module
    • NTN4711 Non-Smartnet DVP
    • NTN4712 Non-Smartnet DES (replaced with NTN1072)
    • NTN4713 Non-Smartnet DVP-XL (replaced with NTN1074)
    • NTN4714 Non-Smartnet DES-XL (replaced with NTN1071)
    • NTN4720 Secure BYPASS module - can be either silver dummy or plastic
    • NTN5832 Smartnet DVP
    • NTN5833 Smartnet DES (replaced with NTN1072)
    • NTN5834 Smartnet DVP-XL (replaced with NTN1073 *cancelled)
    • NTN5835 Smartnet DES-XL (replaced with NTN1071)
    • NTN5755 Multikey DVP (DVP = Digital Voice Privacy or Digital Voice Protection)
    • NTN5756 Multikey DVP-XL
    • NTN5757 Multikey DES (DES = Data Encryption Standard)
    • NTN5758 Multikey DES-XL
    • NTN5759 Multikey DVI-XL (DVI = Digital Voice International)
    • NTN5760 OTAR DVP (OTAR = Over The Air Rekeying)
    • NTN5761 OTAR DVP-XL
    • NTN5762 OTAR DES
    • NTN5763 OTAR DES-XL
    • NTN7288 Multikey DVP (replaced with NTN5755)
    • NTN7289 Multikey DVP-XL (replaced with NTN5756)
    • NTN7290 Multikey DES (replaced with NTN5757)
    • NTN7991 Multikey DES-XL (replaced with NTN5758)
    • NTN7992 Multikey DVP-XL (replaced with NTN5759)
    • NTN7298 FASCINATOR (Controlled Cryptographic Item - CCI)

Under the Hood:
Into the radio...





Here is is with the modules identified


The secure capable radio is longer and uses a different motherboard and frame


The flip side of the above picture



About Motorola's Programming Software / Hardware:
The RSS and RIB

Motorola's Radio Service Software, which is needed for programming and alignment of the Saber line of handhelds can be licensed and obtained on disk by calling Motorola Parts at 800-422-4210. To purchase the software license you must agree to and sign a license form attesting that you will not resell the software, distribute the software or otherwise allow it to be used by unlicensed users. And the software is not cheap. Repeater-builder has a separate web page with several in-depth articles on RSS and on the RIB,it can be found from the Motorola page. A copy of the Motorola RSS license is linked off that page.

The Part Number for Saber RSS is RVN4002K. Version 07.01.00 is the newest as of the writing of this document, with a release date of 12/13/1995. The Part Number for the Saber RSS manual is 6881062C95. The Systems Saber RSS is RVN4051F version R04.00.00, and the Systems Saber RSS Manual is part number 6881060C25. The Part Number for the license form you will be required to sign is RPX4719G. Anyone programming Sabers needs to have a copy of the appropriate programming manual.

Note that the Saber, Astro Saber and System Saber III RSS packages are *NOT* compatible. You need to use the software specified for your radio. System Sabers have 8K of available memory that you assign as needed. Once you use all 8K, you are out of room for anything else. ALL of the programmed information goes there: Channel frequencies, scan lists, PL codes, DPL codes, MDC codes, single tone and other signaling all go in that 8K. Yes, that's what was available in a single EEPROM chip at the time the radio was designed, but 8K is really NOT enough for what this radio can or should do, and nobody has come up with a mod to replace the memory chip with a larger one, or to piggyback a second one onto the board. And if you could pack 16K into a radio you'd still have to convince the RSS to use it.

The hardware required to program a Motorola Saber includes:

  • A low end computer running MS-DOS (486 DX50 - i.e. maximum clock speed of 50MHz, with all cache memory disabled), and using a faster computer WILL turn good radios into bricks). Don't even think of running ANY version of Windows - this has to be a straight DOS computer. We are NOT kidding here. This is one case where slower is better, and going to a 486-33 or even a 386 wouldn't hurt. The required characteristics of the programming computer are described in depth on the RSS pages mentioned above. The newest revision of the Saber software is still too old to have the speed fix that is mentioned there applied.
    I repeat, find an old DOS computer no faster than 50mhz and with a real COM (serial) port. Desktop or laptop, it doesn't matter, except that many laptops do not give you the option to switch off the cache memory.

  • A Programming Radio Interface Box (the "RIB", Part Number RLN4008x (where "x" is a letter), or equivalent replacement).

  • The Saber-specific programming cable to go from the RIB to the radio (Part Number RTK4203C or equivalent replacement). If you have an extra speaker-mic connector (the one that goes on the side of the radio) you can make this yourself from that connector, a length of three-conductor cable, and a DB25F connector (and a shell for it).

There are many people manufacturing RIBs and programming cables that work just as well as Motorola's branded equipment. Be sure that the RIB you purchase is guaranteed to be 100% compatible with Motorola's RLN4008.

The sections of the radio programmed by the RSS are the Internal and External COPE and the CORE Options.

  • COPE = "Control of Peripheral Electronics" - This is the subsystem which is the front shield assembly on Saber IIs and IIIs. It consists of extended memory, display electronics, keypad functionality, and the DTMF generator. A Saber I does not have a COPE processor because it does not have the front display board.

  • CORE = "Control of Radio Electronics" - controls the actual radio transceiver itself. The CORE number is the main board processor / firmware version.

Changing the Band Limits in the RSS:

The RSS can easily be hex-edited to allow out-of-band programming, rather than editing each channel individually. For example, on the 146-162 MHz and 148-174 MHz splits I moved the bottom end to 144 MHz. However, if you read a radio that is programmed as a 146-162 MHz radio it will default to such in the RSS. You have to create a new codeplug from scratch by selecting the newly available 144-162 MHz or 144-174 MHz splits, then filling it with the frequency, tone, etc, information. Once the radio has been loaded with the new codeplug (i.e. programmed with the new split) it will continue to be read as such, so you only have to do this once.

Upgrading Sabers to Support Additional Features:

The CORE firmware is run by the radios 68HC11 series microprocessor. Options that are determined by the CORE version (such as QuickCall-II decode, MDC600 or MDC1200 Signaling, StatAlert and a plethora of other options that most Amateurs have no interest in, as well as the radio’s scan capability) can not typically be upgraded without replacement of the CPU board. This is not usually cost effective as the CPU boards are around $100 US. The common core versions for Sabers are 5D, 6D and 8D. A 5D is a more basic CORE, a 6D is capable of QC-II Decoding and Repeater Access Tone Encoding and an 8D CORE is capable of the previous options and StatAlert. There may be additional options but these are the differences I'm aware of.

A Saber II can be upgraded to a Saber III by replacing the front panel with one that has a keypad, the DTMF Encoder and 8k of memory. The process is rather intensive and is not for the faint of heart as it requires deliberate corruption of the internal codeplug (flash memory contents) in order to convince the radio to accept programming with a Factory ID that differs from what it believes it should be. A separate tutorial will be written on this topic detailing this process in the near future.


Adding Channels to a Saber:

Method 1 (Expansion from 12 channels to 15 channels):

This is accomplished by removing the knob cover from the channel selector switch, removing the tabbed cover from the switch post, removing the metal stop tab ring from the switch by turning the radio over and tapping it on the desk and replacing the tabbed cover to the switch post and snapping the knob cover back into place. You must then add the additional channels to the codeplug file in your RSS Archive directory.

This method will allow 15 channels in a single zone but be warned, do not fill all of the zones with 15 channels. The codeplug memory does not allocate a chunk of RAM for each channel and N times a chunk for a zone - each channel takes up a chunk and if you run out of memory you will end up with weird things happening in the radio such as duplicate channels across zones that look just fine on the RSS screens.

Method 2 (Conversion from a Saber I to a Saber IE):

A Saber IE is the same as a Secure Saber I except the clear / coded switch is used to switch between two zones of 12 channels. It also has an additional memory board in the front shield assembly. The part number for the board and connecting cable kit is NTN5686A. You would then create a Saber IE codeplug and flash it to the radio.


Manuals: 

Useful manual part numbers: 

  • 68-81044C05   Saber Theory / Maintenance Manual
  • 68-81065C60   Saber I Instruction Manual
  • 68-81065C65   Saber II and III Instruction Manual
  • 68-81048C40   Saber III Operators Manual
  • 68-81060C10   System Saber, Saber ATS Instruction Manual
  • 68-81067C10   System Saber, VHF Service Manual
  • 68-81066C95   System Saber, UHF Service Manual
  • 68-81076C05   Astro Digital Saber Basic Service Manual
  • 68-81076C10   Astro Digital Saber Detailed Service Manual
  • 68-81072C75   Astro Digital Saber I VHF, UHF, 800 Operators/User Manual
  • 68-81072C80   Astro Digital Saber II, III VHF, UHF, 800 Operators/User Manual
  • 68-81098E85   Astro Digital Saber I VHF, UHF, 800 Service Software Manual
  • 68-81060C10C  Systems Saber operating instructions

Accessories / Antennas:

Saber Parts List and Accessories  

Heliflex antennas:

  • 85-05816K22   136-150MHz 
  • 85-05816K21   146-162MHz (will work OK down to 144MHz)
  • 85-05816K23   157-174MHz

  • 85-05816K24   403-433MHz
  • 85-05816K25   440-470MHz
  • 85-05816K26   460-512MHz

Older antennas:

  • VHF   136-151MHz   Yellow paint dot
  • VHF   151-162MHz   Black paint dot
  • VHF   162-174MHz   Blue paint dot
  • UHF   403-435MHz   Red paint dot
  • UHF   435-470MHz   Green paint dot
  • UHF   470-512MHz   Black paint dot

Saber Motor Vehicle Adapter (MVA), aka Saber Vehicular Adapter (SVA)

SVA Connector Pinouts

Interface Connector

Pin          Description

1            Self-test (gnd on power-up)
2,3          V-
5            High on squelch open
11,24        V+
20           Audio+
21           Audio-

Power

Red          + Power
Black        - Power
Yellow       Ignition Sense (disables battery charger)
Green        Headlight Sense (turns on panel lights in MVA)

LED Function

Red LED      Charging
Green LED    Charging Complete

Microphone Connector Pinout

Here is the pin out for the SVA Mic input. Pin 1 is to the right as you look into the connector of the SVA. Color codes relate to microphone wire color.

Pin       Color        Description

1          Red         +5V
2          Purple      Clock
3          Wht         Data
4          Blk         Gnd
5          Org         Mic
6          Grn         PTT
7          Yel         LED (Front panel lighting)
8          Blu         Keypad

Other SVA Information

Manuals

SVA Operating Instructions 68P81061C60
SVA Instruction Manual 68P81068C70
Microphones

Mobile (Palm) HMN1035A
Compact (Mini-Mobile) HMN1056A
SVA Display/Keypad (Saber) HMN6150A
SVA Display/Keypad (Systems Saber) HMN6169A
The question has come up many times, "What's the difference between an Astro Saber SVA and a normal SVA?".

Answer, not much. There's that Astro label on the front panel, and the cutout on the top rim of the housing that allows you to get a better grip on the radio top controls. The only other difference is that the connector body assembly is different and the connector is fully populated with 12 contacts, while on a standard SVA there are only 7 installed contacts. The main circuit board is apparently the exact same item in both models.

The part number for the Astro SVA is NTN7227BSP01. Other revisions exist, in which case the B in that part number is replaced with a C or a D which is the most current version.

The part number for a standard SVA is NTN5487A.

There is a decal on top of the Astro SVA that gives the following useful data:

"CAUTION: Inserting the wrong radio may Damage the Adapter. This Adapter works with ASTRO Digital SABER, SABER and Systems SABER radios manufactured on or after September 1, 1994. These radios can be identified by their serial numbers: The 5th character (year) must be "U" or later (V, W, X, Y, or Z). If 5th character is U, the 6th character (month) must be "S" or later (T, U, V, W, X, Y, or Z). Use Adapter ONLY with approved radio models. For radios manufactured prior to this date please contact: Motorola at 1-800-523-4007 (ext. 112) for upgrade details."

So, later Saber (non-Astro) radios apparently can be used with an Astro SVA...hmm. I would not be surprised to find out that the modification is merely a new housing for Sabers and Systems Sabers that reshuffle the connector assignment. It's the way I'd do it. That suggests that Astro speaker-mics might work on newer Sabers.

So there it is...an Astro SVA is a regular SVA with a new connector body, an Astro decal, and a notch filed in the top of the housing...!






Notes on programming Sabers out of band.

Motorola RSS writes a dictionary file RPFDATA.DCT that contains the model and option numbers, and an eight character filename for the actual programming file. I haven't figured out the whole format of this file, but programming out of band frequencies is easy. This has been tried with UHF and VHF Sabers, don't know how far it will go but the format seems the same for both bands.

1. Program all the channel data, alphanumerics, scan, etc. using a place-holder frequency near the band edge you want to go beyond.

2. Store this as a personality file, note in RPFDATA.DCT which file it is.

3. Open the file in an editor (doesn't need to be hex, it's all ASCII upper-case letters and numbers, but you do need to be able to display a full 80 character line) and look for the lines that begin with S2. A typical line would be

S20101081B3200081B32000000...

if you separate it out into the components I've identified so far

S2 01 01 081B3200 081B3200

(a) (b) (c) (d) (e)

(a) means it's a channel entry

(b) means channel {01..0C} up to 12 channels

(c) means zone {01..0A} up to 10 zones

(d) is receive frequency, in Hz, converted to ASCII representation of hex (081B3200 = 136000000 Hz)

(e) is transmit frequency

4. So you can enter the new transmit and receive frequencies yourself, by converting the frequency in Hz to ASCII hex (146.94 MHz = 08C22060). Plug them in instead of the place-holder frequency you entered in the RSS.

5. Save the file and read it into the RSS. Program the radio *without looking at the file in the RSS* (although you can print it without the RSS complaining, don't try to look at it in the channel data window or it will be reset to discard the out-of- band frequencies).

6. If you don't want to calculate the frequencies in hex, just set up a different RPF using the band split your frequencies are in, read off the numbers from that file, and plug them into the file for your radio.

Note that these radios don't really like to go all that far out of their rated bandsplit. +/- 5MHz is typical.


--------------------------------------------------------------------------------

What are the COPE and CORE?

If you've messed with Saber's, you have seen references to COPE and CORE. These are as follows:

COPE: Control Of Peripheral Electronics
CORE: Control Of Radio Electronics

The CORE is the main radio system itself. The COPE is the subsystem which is the front shield assembly on Saber II's and III's. It consists of extended memory, display electronics, keypad functionality, and the DTMF generator, essentially.

A Saber I does not have a COPE processor.


--------------------------------------------------------------------------------

Saber Upgrading

CORE version is mask programmed in the CPU so while Saber upgrades are possible (they can be done in order to have QC II in older Saber2s), they are neither cheap nor easy as the new processor is around 100 bucks dealer cost and requires a degree of skill in SMT board repair to swap out.

On the other hand there are a number of other features which can be enabled via RSS without any hacking at all and some Saber bandsplits are quite wide indeed! (when I get info on what, I'll let you know)

This should probably be tried only on those Saber II's with an 8k logic board. These are often only crippled Saber III's and by converting them, you may be able to get all kinds of features likes scan, extra channels, etc.

To determine if you have the 8k logic board, you need to observe the following:

Take apart the radio and look at the display circuit board. If there are five chips, it's an 8K board. If there are only four chips, it's a 2K board. And no, the fifth chip (a DTMF generator) can not be placed on the 2K board, and an 8K chip can't replace the 2K chip on that board because there aren't solder pads for the DTMF chip, and the 2K board lacks the address line necessary to make an 8K chip work.

Also, an 8K board/shield will have a different speaker/microphone flex circuit which includes a 3 pin connector that connects to the display board (to provide a way to get the DTMF tones from the chip to the radio's circuits.

If you are sure you have an 8k board and want to proceed, read on... this next one isn't for the faint of heart...

WARNING!!! This modification could do permanent damage to the code plug, so use it at your own risk!

Start the Saber software
Read the radio
Program the data right back into the radio,BUT, when the first 2 or 3 dots appear on the first line, turn the radio off.
Hit F2 when the error comes up
Turn the radio on , the display should read "ERR 0 81"
Read the radio again, press F2 after each line comes up with a checksum error
Create a radio personality file (Main Menu - F4 - F3) for the radio you want it to be (same power level and RF sub-band)
Program the new data into the radio
Reading and programming the radio is back to normal
Thats it!

WARNING!!! This modification could do permanent damage to the code plug, so use it at your own risk!


Saber Series Error Codes

--------------------------------------------------------------------------------

In the Saber display radio models, the radios will display error messages under two conditions:

When the radio is turned on, and there exists an error condition in the radio, the radio will display an error message of the form ERR x yz for approximately 2 seconds before attempting to show the default display which is either the channel name or number (in a channel only radio) or the zone and channel names or numbers (in a zone radio).
The error message will also be shown on the display and remain on the display until the radio is turned off (or the radio is reset by the Saber RSS) under the following conditions:
With the radio turned off, press and hold the MENU, SELECT and ENTER keys simultaneously
Turn the radio on while still holding the 3 keys pressed down
For a COPE 4 (A&B radio): The display should show a message of the form ERR x yz. This message should remain on the display even when you release the 3 keys. If the message does not remain on the display or does not appear at all, then you have not pressed the keys simultaneously. You will have to turn off the radio and repeat the procedure until the message remain on the display.
For a COPE 5 (C radio): A full eight-character display should appear for this radio unless there really is an error.
The following paragraphs will describe the meaning of the error messages. The error message has the form ERR x yz, where x is the address of the device with the error and yz is the error condition.

x can take on one of 3 values:

0 - CORE microprocessor
1 - COPE microprocessor
2 - external EEPROM on display board
yz can take on the following values (note that these values are hexadecimal numbers):

00 - no error
01 - internal EEPROM checksum error. This means that the data in the internal EEPROM could be corrupted or the checksum value itself could be wrong. If several reprogramming attempts do not eliminate this error, then the related microprocessor must be replaced. Applicable to COPE and CORE.
02 - RAM read/write error. This means that an error was detected while the processor was attempting to read from, or write into, the microcomputer RAM (random access memory, or scratchpad memory). This indicates that the related microprocessor is faulty and should be replaced. Applicable to COPE only.
04 - external EEPROM checksum error. This means that the data in the external EEPROM could be corrupted or the checksum value itself could be wrong. If several reprogramming attempts do not eliminate this error, then the external EEPROM must be replaced. Applicable to COPE only.
08 - blank internal EEPROM. This means that the internal EEPROM is blank (all locations contain hexadecimal value FF). Reprogram the radio. If unsuccessful, replace the related microprocessor. Applicable to COPE only.
10 - ROM checksum error. This means that the read-only-memory (ROM) of the related microprocessor has an error. Replace the faulty microprocessor. Applicable to COPE only.
20 - Hardware error. This means that the external EEPROM is faulty. Replace the external EEPROM and reprogram the radio. Applicable to COPE only.
The above listing contains the basic errors that can be displayed to the user. However, if more than one error occurs simultaneously, the error message is simply an addition of the values of the errors involved. A few examples will clairify this. Note that since the error values are hexadecimal, the addition will also result in hexadecimal values. Some examples of common error messages are given below.

Error message examples:

ERR 0 X1 - The CORE micro. has an internal EEPROM checksum error (x may be any value).
ERR 1 01 - The COPE micro. has an internal EEPROM checksum error.
ERR 1 03 - The COPE micro. has an internal EEPROM checksum error as well as a RAM read/write error.
ERR 1 0B - The COPE micro. has a RAM read/write error as well as a blank internal EPROM and internal checksum error (01 + 02 + 08 = 0B in hexadecimal).
ERR 1 24 - There is an external EEPROM and hardware error as well as an external EEPROM checksum error.
ERR 1 30 - The COPE micro. has a ROM checksum error and the external EEPROM has a hardware error (10 + 20 = 30 in hexadecimal).
ERR 1 00 - The radio has no errors.
ERR 1 0D - The display that comes up for a COPE 5 radio when the programmer starts writing to the radio.

--------------------------------------------------------------------------------

ERR 081 is easy to recover from.

first you need the following

1. original saber programming cable, this is the cable with the 12 pin cylindrical connector.
2. Motorola RIB box, using anything else and you could find yourself in an endless loop of crashing and recovering the radio.
NOTE: If you don't have the original programming cable then you can do this with a toggle switch connected to whatever UDC connector you have.
3. fresh battery for RIB.


Procedure:

First make up a simple codeplug for the exact model radio that you have.
Don't try this with a fully channelized codeplug, use a minimal 1 or 2 channel freshly made codeplug using the RSS. Just a simple codeplug with everything else disabled otherwise you could crash the radio once it's revived.

Basically with this procedure You will place a short across the radios OPT SELECT pin while holding the radios PTT and turning on the radio while holding in PTT. Then continue holding the PTT in and remove the short from the OPT SELECT pin then release PTT. Finally program in a simple codeplug.

STEPS REQUIRED
1.A if you have the original saber prog cable with the cylindrical connector place a toggle switch across pins 3 and 5 of the cylindrical connector.

1.B If you don't have the original saber prog cable then follow this step: place a short , using a toggle switch, from the radios UDC (Universal device connectors) PIN 7 to ground.

You can get ground from the ring on the external antenna connector on the radios UDC

2.0 Once you have PIN 7 of the UDC shorted using either step 1.A or 1.B hold in the radios PTT and turn the radio on while still holding in the radios PTT.

3.0 Continue to hold in the radios PTT and open the toggle switch to remove the short on the OPT SELECT pin.

4.0 Release the PTT.

5.0 Program in the freshly made minimal codeplug mentioned at the beginning of this recovery procedure.

Once the radio is alive then you can go back and add some more channels and turn on some options such as scan etc.

But I recommend going slowly, add some zones and channels. but don't fill the radio up with all possible channels that it is capable of at once.

Just Program in a few zones and 1 or 2 scan lists, if you use scan, and program the radio.

If all goes fine then add some more zones and channels in small steps. This has worked for me every time I crashed a radio.






Astro Saber





The available bandsplits (per the RSS) are:

VHF 136-174 (1W/5W), 174-178 (1W/4W)

VHF1 136-162
VHF2 146-174
VHF3 136-174
VHF4 136-174
UHF-LO403-470 (1W/4W), UHF-HI450-512 (1W/4W) 512-520 (1W/3W)

UHF1 403-433
UHF2 438-470
UHF3 450-482
UHF3.5 450-488
UHF4 482-512
800/900 (3W)

851.010-868.985 RX/806.010-868.985 TX
935.010-940.985 RX/896.010-940.985 TX

--------------------------------------------------------------------------------

Astro Saber Error Codes

Here's a list of the error codes that may be displayed on your Astro Saber, and their meaning:

Error Code Description Action
01/02 External EEPROM Checksum Non-Fatal Error Reprogram the Codeplug
01/81 Host ROM Checksum Failure Reprogram the FLASH Memory
01/82 External EEPROM Checksum Failure Reprogram the Codeplug
01/84 SLIC Initialization Failure Turn the radio off then on
01/88 MCU (Host uC) External SRAM Failure Turn the radio off then on
01/90 General Hardware Failure Turn the radio off then on
01/92 Internal EEPROM Checksum Failure Reprogram the Codeplug
02/81 DSP ROM Checksum Failure Reprogram the FLASH Memory
02/82 DSP External SRAM1 Failure U402 Turn the radio off then on
02/84 DSP External SRAM2 Failure U403 Turn the radio off then on
02/88 DSP External SRAM3 Failure U414 Turn the radio off then on
02/90 General DSP Hardware Failure
(DSP startup message no received correctly) Turn the radio off then on
02/A0 ADSIC Checksum Failure Turn the radio off then on
09/10 Secure Hardware Failure  
09/90 Secure Hardware Failure  
001 Synthesizer Out of Lock Reprogram the Codeplug/Replace RF Board
002 Selected Mode/Zone Codeplug Checksum Error Reprogram the Codeplug

Note: If the corrective action does not fix the failure, replace the controller board.


--------------------------------------------------------------------------------

Astro Saber Test Mode

Getting into test mode is the same as most of the newer handheld radios. To get into test mode, do the following:

Turn the radio on
Within 10 seconds after "Self Test" is complete, press the Side Button 3 five times in succession
The radio will show a series of displays that will give information regarding various version numbers and subscriber specific information.

Name of Display Description Appears
SERVICE The literal string indicates the radio has entered test mode Always
Radio Host Software Version The version of radio firmware is displayed Always
DSP Software Version The version of firmware being used by the DSP Always
EMC Secure Version Version of the encryption hardware When the radio is secure equipped
Encryption Type 1 Type of encryption being used When the radio is secure equipped
Encryption Type 2 Type of encryption being used When the radio is secure equipped
Model Number The radio’s model number as programmed in the codeplug Always
Serial Number The radio’s serial number as programmed in the codeplug Always
ROM Size The memory capacity of the flash part Always
FLASHcode The FLASHcodes as programmed as part of the radio’s codeplug Always

NOTE: All displays are temporary and will expire without any user intervention. If information is longer than the physical length of the control-head display, the information will wrap around to the next display. After the last display, "RF TEST" will be displayed.


Press Side Button 1 to stop the displays and put the radio into Control Top and Keypad test mode. The test mode menu "CH TEST" will be displayed.

Note: Each press of the Side Button 1 will toggle between CH TEST and RF TEST.

FLASHcode Decoder Ring

•    A FLASHcode looks like this:
000000-000000-0

Digit 12            Digit 1    Checksum


•    Each digit is a Hex representation of 4 bits               B4  B3  B2  B1
•    B4 has a weight of 8, B3 is 4, B2 is 2, B1 is 1, so if B4 and B2 in a digit are both enabled, that digit value is 10 or “A” (in Hex).
•    The last digit is a checksum that is dependent on the value of the previous 12 digits.
•    The definitions of the features that each bit represents are common for all subscribers* that support FLASHport (MTS, MCS, ASTRO Saber, ASTRO Spectra, ASTRO XTS3000, ASTRO XTS3500). ALL subscriber products do not support ALL features, however.  Consult price pages for options available for a particular subscriber
•    The feature sets for Jedi series portables (MTS-2000, etc) are slightly different, and annotated as such.
•    If two option numbers are separated by a slash, they represent first portable, then mobile options unless
•    otherwise specified.

 
•    Digit 12
B4    H15/H44               H15 is Astro Data/ H44 is VRM500 for MCS2000 only
B3 – H14/G114            Digital ID Display
B2 – H260                    250 Modes on W3 and W4 (150 or 160 channels for MTS2000)
B1 – Q806/G806         ASTRO Digital CAI (IMBE) Operation


Digit 11
B4 – H868/W298            Conventional Multikey and Analog Conventional MDC OTAR
B3 – H869/W969            Multikey Operation
B2 – H451                       GE STAR
B1 – H101, G101, H169    Conventional Repeater Access (Analog Operation Only)(MDC1200 or Singletone)

Digit 10
B4 – H46                One Touch
B3 – H45                SmartNet Type I
B2 – H44/H29(MTS)        trunk Data Operation /H29 150 modes (mts2000)
B1 – G170/H43            Remote Monitor and Radio Trace

Digit 9
B4 – H42                Trunked variable talkgroup  ID
B3 – H41                Trunked badge ID
B2 – H40                RAC Software Option (Repeater Access, Single Tone)
B1 – H39                Selective Radio Inhibit

Digit 8
B4 –                     Future System Package
B3 –                     Future System Package
B2 –                     Future System Package
B1 –                     Future System Package

Digit 7
B4 – H38/G51            SmartZone Operation
B3 – H37/G50            SmartNet Operation
B2 – H36                    StarSite Operation
B1 – H35/G48            Conventional Operation

Digit 6
B4 –     H29                Single key Software Encryption Option
B3 –     H07                Multikey software encryption
B2 – H915                  International Radio (Internal Option)
B1 – Q181                 StatAlert (MDC1200) Features

Digit 5
B4 –    Q351                MODAT
B3 –    Q352                Soft ID
B2 –    Q353                OTACR   (Over The Air Channel Reassignment)
B1 –    Q354                OTACS   (Over The Air Channel Steering)

Digit 4
B4 –    Q190                Channel change ID
B3 – H270/H738          MDC Status Message
B2 – Q241                   ASTRO Ready (Analog Operation Only)
B1 – W947/Q947        APCO Packet Data

Digit 3
B4 – G182                Enhanced Radio Call Protocol
B3 – Q173/G173     SmartZone OmniLink Operation
B2 –    Q387             Conventional voting scan
B1 –    Q471             (MCS only) messaging (MDC on trunking)

Digit 2
B4 – Q361/G361      ASTRO 25 Digital Trunking Option
B3 –    W357             Scan with VRS
B2 –    W995             zone/mode NJSP
B1 –                           Future System Enhancement

Digit 1
B4 –                    Future System Enhancement
B3 –                    Future System Enhancement
B2 –                    Future System Enhancement
B1 –                    Future System Enhancement

Other notes:  Option Q241, Astro Ready, should actually be named 'Delete all Astro Modes' which
is an accurate description of what it does. A radio with this option does not have Astro digital mode options!


IMBE radios can NOT have software encryption.
With IMBE radios, MODAT can work on portables, not on mobiles.


You may also want to check out theinteractive flash code decoder version .





Model Number Chart

Type of Mount Model Series Frequency Band Power Level Physical Package Channel Spacing Primary Operation
D Dash Mount 04 Astro Series A Less than 29 MHz A 0-0.7 W A RF Modem 1 5 kHz A Conventional/Simplex
M Motorcycle Mount   B 29.7-35.99 MHz B 0.7-0.9 W B RX Only 2 6.25 kHz B Conventional/Duplex
T Trunk Mount   C 36-41.99 MHz C 1.0-3.9 W C Standard Control, no Display 3 10 kHz C Trunked Twin Type
H Hand-Held/Portable   D 42-50 MHz D 4.0-5.0 W D Standard Control, with Display 4 12.5 kHz D Dual Mode Trunked
    F 66-80 MHz E 5.1-6.0 W E Limited Keypad, no Display 5 15 kHz E Dual Mode Trunked/Duplex
    G 74-90 MHz F 6.1-10 W F Limited Keypad, with Display 6 20/25 kHz F Trunked Type I
    H Product Specific G 10.2-15 W* G Full Keypad, no Display 7 30 kHz G Trunked Type II
    J 136-162 MHz H 16-25 W* H Full Keypad, with Display 9 Variable/Programmable H FDMA Digital Dual Mode
    K146-178 MHz J26-35 W* J Limited Controls, no Display   J TDMA Digital Dual Mode
    L 174-210 MHz K 61-110 W* K Limited Controls, Basic Display   K Single Sideband
    M 190-235 MHz   L Limited Controls, Limited Display   L GPS Capable
    P 336-410 MHz   M Rotary Controls, Standard Display   M ACSB
    Q 403-437 MHz   N Enhanced Controls, Enhanced Display   P Programmable
    R 438-482 MHz   P Low Profile, no Display    
    S 470-520 MHz   Q Low Profile, Basic Display    
    T Product Specific   R Low Profile, Basic Display, Full Keypad    
    U 806-870 MHz        
    V 825-870 MHz        
    W 896-941 MHz        
    Y 1.0-1.6 GHz        
    Z 1.5-2.0 GHz        

*Mobile Applications Only

Primary System Type Feature Level Version Letter Unique Model Variation "SP"Model Suffix
A Conventional 1 Basic A Major Change C Cenelec  
B Privacy Plus 2 Limited Package   N Standard Package  
C Clear SmartNet 3 Limited Plus      
D Advanced Conventional Stat-Alert 4 Intermediate Package      
E Enhances Privacy Plus 5 Standard Package      
F Nauganet 888 Series 6 Standard Plus      
G Japan SMR 7 Standard Package      
H Multi-Channel 8 Expanded Plus      
J Coverage Plus 9 Full Featured/Programmable      
K MPT1237 Public        
L MPT1237 Private        
M Radiocom        
N Tone Signalling        
P Binary Signalling        
Q PhoneNet        
W Programmable        
X Secure Capable        
Y Secure SmartNet        
         
         
         

*Mobile Applications Only



MTX



Lots of good information about mod'ing commercial radios to 900 MHZ
http://www.qsl.net/kb9mwr/projects/900mhz/plan.html







MTVA Vehicular Adapter

Instruction Manual 6881075C95.

If you have the MTSX Convertacom (MTVA), you will notice that there are two DIP switches located on the bottom rear corner of the MTVA holder. These are used to select whether the microphone you are using has a manual PTT or serial data PTT.

For HMN1035 and HMN1056 microphones, set both dip switches toward the front of the holder. For HMN4044, HMN4047, NMN6209, and NMN6210 microphones, set both dip switches toward the back of the holder.

The pinout of the 6pin power connector on the NTN1340A is:

1   Audio+
2/3 Ground
4   I/P Stage Ground
5   A+
6   Audio Shield

According to the manual the top row is 4 5 6 left to right with a square over pin 5. The bottom row is 3 2 1.

6 square
5 square with tab over it
4 square with rounded bottom shoulders
3 square with rounded bottom shoulders
2 square with rounded bottom shoulders
1 square
Pinouts as they are in the holder unit schematic diagram for the NTN1340A:

The 25 pin connector is listed as J100:

Pin1 --- Green Led
Pin2 --- LH Data
Pin3 --- Tx/Rx Data
Pin4 --- LH Busy
Pin5--- Option B+
Pin6--- Hook
Pin7--- Pac-RT-CTRL
Pin8 --- Bat-RC  
Pin9 --- Bat-RT
Pin10 --- NC
Pin11 --- B+
Pin12 --- NC
Pin13 --- A+
Pin14 --- Red Led
Pin15 --- Data Mode CTRL
Pin16 --- CTS
Pin17 --- Aux Tx RTS
Pin18 --- NC
Pin19 --- Pac-RT
Pin20 --- NC
Pin21 --- NC
Pin22 --- NC
Pin23 --- Gnd
Pin24 --- Gnd
Pin25 --- PA Sense

Connector J104 goes to the Battery Board it's a 10 pin connector, pins are:

Pin1 --- Gnd
Pin2 --- Gnd
Pin3 --- Gnd
Pin4 --- Gnd
Pin5 --- Bat-RC
Pin6 --- Bat-RT
Pin7 --- B+
Pin8 --- B+
Pin9 --- B+
Pin10 --- B+

NOTE: The NTN1340A is NOT a complete MVA if you only have the radio holder portion. You need the control box (with or without integrated power amplifier) that interfaces to the DB25, otherwise that's all you have is a radio holder.




XTS 3000








Determining Manufacture Date By Serial Number 


Most Motorola products follow the same serial number conventions. As such, this often enables you to determine the approximate manufacture date for a device.

The serial number convention follows the following general format:

123ABC4567

Where 123 is an unique three digit code for each model series, where BC determines manufacture year and month respectively, and where 4567 is a unique four digit serial number for the device in question.

To determine the manufacture year and month, refer to the table below:

Second Letter Year Third Letter Month
A 1976/2000 A-B January
B 1977/2001 C-D February
C 1978/2002 E-F March
D 1979/2003 G-H April
E 1980/2004 J-K May
F 1981/2005 L-M June
G 1982/2006 N-P July
H 1983/2007 Q-R August
J 1984/2008 S-T September
K 1985/2009 U-V October
L 1986/2010 W-X November
M 1987/2011 Y-Z December
N 1988/2012    
P 1989/2013    
Q 1990/2014    
R 1991/2015    
S 1992/2016    
T 1993/2017    
U 1994/2018    
V 1995/2019    
W 1996/2020    
X 1997/2021    
Y 1998/2022    
Z 1999/2023    




Battery Date Code

Year/Week as in 411 is 11th week of 2004.










Saber to TinyTrak3 or any other TNC

By Kelvin Helmick: N7XVB and Ron Parks: WB5DYG 

Introduction:

This project started out by trying to create a small lightweight APRS tracker for use on a bicycle.  The secondary use was to have a portable APRS unit that could be moved from vehicle to vehicle without having to install a great deal of equipment.

In seeking a radio to be used for the project a commercial quality radio was desired due to durability and stability.  Currently Motorola Saber radios have become cheaper and cheaper and in recent years has made them available at low cost to the average ham radio operator.

During the planning stages of this project, we located a vendor selling Saber 1E radios for a mere $25 per radio without antennas or batteries.  This revelation made the Saber the obvious choice for this project.

This article does not encompass the entire project, merely the interface between the radio and the TinyTrak3.  There are currently three units being built and those are being well documented for a future article of the entire completed project(s).

The tracker chosen for this project was the TinyTrak3 because of it’s flexibility and small size as well as it’s power consumption.  More information on the TinyTrak3 can be found at:

http://www.byonics.com/tinytrak/

Schematic:

The following schematic shows the wiring required to make the TinyTrak3 work with the Saber Radio.

The Saber needs to have two diodes in series between option select (pin 7) and ground to provide a voltage drop between the two connections.  This will cause the programming in the Saber to recognize an external device.   

Push to talk is accomplished by grounding pin 7 on the Saber.  This however will only work when the two diodes are in place, so that the Saber is looking for a signal from an external device.

Mic High normally enters the Saber through pin 4, while audio high is on pin 1 and audio low is on pin 2.  Both of the audio outputs on the Saber float and do not go to ground.  Therefore a 1:1 audio isolation transformer is required to isolate audio low to ground.

For this project, zener diodes were used to provide the voltage drop between pin 7 and ground.  Diodes 1N4733A from Radio Shack part #275-565 were used.

The audio isolation transformer used was a 1:1 transformer also from Radio Shack, part number 273-1374.

Building the Interface Board:

Because of the desire to keep the package as small as possible, a very small perf-board was used to build this project.  The following is merely an illustration of the board.  The circuit built was actually smaller, but for the purposes of this article have been made slightly larger.


A ground strap, a couple of jumpers, the diodes and the transformer were first mounted to the perf-board.  Traces were then soldered to the bottom of the board. 

In the diagram below, the traces have been darkened to better illustrate their path.

Shielded computer mouse cable was used to make the connections from each component to the board.  The wires indicated are the colors from that particular cable.  This cable was chosen because of it’s small lightweight and flexible.  

To provide the connection to the Saber radio, a factory Motorola accessory plug was used.

The factory accessory plug can be disassembled by removing the two screws from the unit and the rubber and plastic plate can be pulled from the housing.  This will reveal a small circuit board inside the connector.  This board can be cut away and discarded.  The din connector on the top of the plug is threaded and can be unscrewed and discarded as well.

Trim the factory wires back from each of the individual connectors as close to the surface of the plug as possible.  Then tin the surface of each pin, remembering that the pin is inserted in plastic.  Keep the soldering time down to as little as possible.

Insert the mouse wire through the hole that previously held the din connector.  Tin each of the wires to be used and solder on the correct pin.  The tolerances inside this connector, particularly the lower pins is very tight, so make the soldered connections as flat as possible. Re-assemble the connector as it was disassembled.

A standard DB9 can be used for the interface to the TinyTrak3.  Because of size constraints, on our project, we soldered directly to the TinyTrak3 board.

The diagram below illustrates the finished product:

Many thanks to Kelvin and Ron for doing the footwork and the write-up on this interface!  They deserve all the credit on this one.








Security



Key Loaders


DVP What is it????

In this context DVP stands for Digital Voice Protection DVP (tm). DVP(tm) is a Motorola Inc encryption system widely used in the USA and many other countries around the world. Using DVP(tm) Two-Way radio users are protected from eavsdropping through encryption of their signals. DVP(tm) is just one of several scrambling systems sold by Motorola Inc.

The digital scrambling systems sold by Motorola include:
DVP (Numbers on keypad of Code Inserter 0-7 inclusive)
DVP-XL (Has numbers 0-9 and A-F inclusive on keypad of KVL)
DES Reported to use the US Data Encryption Standard in CBC mode (DES)
DES-XL Reported to use DES (Has numbers 0-9 and A-F inclusive on keypad of KVL)
DVI Believed to be a version designed for export from the USA
DVI-XL SPFL As above but with improvements
Fascinator A more secret system apparently used by various US Government users for national security applications.
Indictor A digital scrambling system often used by military and federal law enforcement users in the USA.

Note: In US patent No: 5,363,447 it is stated that DVI-XL is more secure than DVP-XL.

To the recreational radio scanner listener DVP transmissions can often be identified by the unusual "white noise" or "static" sound. This noise is similar to that of having an open squelch. The noise is in fact that of "data" being sent at 12kbps.  In Australia DVP and DVP-XL is mainly used by Government bodies. I understand however that prawn trawlers in the North of Western Australia were also using the system, perhaps there are other civilian users in Australia as well?

How Does it Work?
Speach is digitised using the CVSD method and then combined with a "random" stream of data
generated by the secret key and the DVP encryption algorithm.  The reverse process is applied
to the receiving radio.

Is this gear available to the public?
In the USA DVP & DES systems are readily obtainable. Just a quick browse through the USENET newsgroup rec.radio.swap will reveal a plethorah of scrambling gear for sale. Most of the gear sold on rec.radio.swap is DES or DES-XL. I have seen on this newsgroup a wide variety of gear that includes:

*DES compatible repeaters
*DES,DES-XL(tm),DVP(tm),DVP-XL(tm)   radios,keyloaders & cables
*DES and DVP(tm)service monitors/test gear

Another place to look for second hand DVP/DES gear is the following site:
http://www.dejavue.com/panik/panik.txt (2ND hand Motorola gear)

A few years back there was a realisation that DES might be getting a little dated. A group in the USA called EFF (Electronic Frontiers Foundation) built a machine which can find a DES key in several days. The details of the machine were published in a book called "Cracking DES".  The hardware was custom built and used purpose made ASIC. The VHDL used to describe these ASIC s, schematics, programs in C were all included in this book, the idea being that anyone could (in theory) make there own machine.   Perhaps this will result in DES based radio encryption gear being replaced with stronger encryption schemes?

Here is a link to the EFF web site where you can see photographs of Deep Crack, there are also links to online versions of the
book "Cracking DES".
http://www.eff.org/descracker.html

DVP CODE INSERTERS (Also known as KVL's or Key Variable Loaders for DES systems)
The DVP Code inserters shown in the above photographs are used to load a secret key into a DVP compatible radio. The key is entered into the Code Inserter by way of the keypad. The key is transferred from the Code inserter to the radio using an interface cable.   (The interface cable is described in the "batwing" link in the links section).

One Code Inserter may be used to program a huge number of radios. Thus Code Inserters are much less common than DVP radios. To spell out how a Code Inserter is used:
(a)A key is typed into the DVP Code Inserter
(b)The key is loaded into compatible radio Number "1"
(c)The key is loaded into compatible radio Number "2"
(d)Radio Number "1" and radio Number "2" can now communicate using DVP

DVP Code Inserter general info
The Code Inserter shown above has a red LED type display. The display can show only 8 alphanumeric characters, for example:
0 ErASEd This indicates that key memory number 0 is empty.
LOAd  _   This occurs after the LOAD key is pressed.  The Code Inserter is prompting for a memory location.
4.1 121394 This is a typical screen when loading a key.  It indicates memory number 4, line 1, and the first six digits of the key are 121394.


The case resembles that of the MX series handhelds. The keypad is a membrane type, similar to that found on the old Sinclair ZX-81 computer or the keypad on some microwave ovens.
*There are only 8 numeric keys 0-7 inclusive (more on the -XL versions)
*There is the standard MX type connector on the side of the unit (only some pins are used)
*There is a PTT style switch to load the key, even when the Code Inserter is turned off it "wakes"
when this switch is depressed.
*Audible "beeps" are made during certain operations

SECURITY SYSTEMS
The keys stored in the Code Inserter will be lost if the battery (power supply) is removed. To prevent unauthorised use of a Code Inserter to load an unauthorised radio with a secret key a PIN type system can be implemented on the Code Inserter using the "LOCK" key. The DVP code inserters are also called "keyloaders" by some people. The name on the back of the T3010 units says "DVP Code Inserter". I have learnt that there are different versions of the DVP Code Inserters. They are:
T3010AX Oldest
T3010BX
T3010CX
T3010DX More recent

There are a variety of other Motorola KVL's, eg the T3011

The DES keyloaders of the same generation as the T3010 are model number T3020
The DES keyloaders state on the ID plate that they are:

DES Key
Variable Loader

COMPATIBLE RADIOS
Radios generally require a special "DVP Module" in order to be able to transmit and receive the encrypted signal. Motorola Inc refer to their range of radios capable of encryption as "SECURENET (tm)" products. Not just any radio can take a DVP module. For example a specific model of Motorola Saber (tm) is required before a "DVP Module" can be fitted. The case on the SECURENET compatible radios is slightly longer than the standard model.  If a DVP/DES module is not fitted to a Saber then a "dummy" module must be fitted (sometimes radio technicians solder a few wires to avoid using the dummy module).  From browsing the rec.radio.swap newsgroup I have noted that the following radios are available with DVP as an option
Motorola Saber 1,2 &3 (See the picture near the top of this article)
Astro Saber
Astro Spectra
MTS 2000
MX300-R (This is a ruggedised version of the MX300S)
MX350
MX360
Syntor X 9000 .........please let me know if you have a complete list..

XTS3500 Handheld radio capable of being equipped with Fascinator(tm)  or Idictor(tm).

BASIC TECHNICAL DETAILS OF DVP (tm)
Analogue to Digital Conversion
A/D & D/A conversion using CVSD chip. Sampling Interval/Rate 12,000 bits per second
Cryptographic Algorithm
Reported to be a Motorola proprietry algorithm
Self synchronising cypher (cipher if you are in the US) algorithm
Key Length
A 24 digit number is entered using the keypad for each key.
Number of possible keys 2.36 * 1021 (Note: This is not 2192 as might be expected from 24*8)
In fact 271 is equal to 2.3612*1021.
The process where a 24 digit number is converted to 71 bits of key is unknown to me. 71 is an unusual length for a key.

There are a number of keys that are prohibited by the DVP Code Inserter.
Any key ending in the numbers 4,5,6 or 7 is prohibited.  This markedly reduces the number of
keys available.

This means keys:
000000 000000 000000 000004 through to key
777777 777777 777777 777774
are prohibited.
It also means keys:
000000 000000 000000 000005 through to key
777777 777777 777777 777775
are prohibited.
It also means keys:
000000 000000 000000 000006 through to key
777777 777777 777777 777776
are prohibited.
It also means keys:
000000 000000 000000 000007 through to key
777777 777777 777777 777777
are prohibited.



First three numbers in serial number


001 CDM1550LS+ 700/200 UHF & VHF
004 EX500 / 600XLS UHF & VHF
005 PR860 UHF / VHF / Low Band
008 HT1250LS+ UHF & VHF 200 or 700
018 CP150 / 200 UHF & VHF
019 CM200 / 300 UHF & VHF
019 PM400 UHF & VHF
027 BPR40
035 Portable
037 XPR 6500
038 Mobile
077 Paging
084 Paging
085 Paging
088 Triton MP+ H5111A
088 Triton MP100 H5126A
103 CDM750 Low Band / UHF / VHF
108 Astro Saber Europe
109 CDM1250 UHF / VHF / Low Band
112 Infrastructure
114 Infrastructure
117 Infrastructure
118 Infrastructure
119 Paging
124 Infrastructure
129 Infrastructure
131 Infrastructure
135 Infrastructure
139 Data
140 Infrastructure
142 TRNK MCS2000 DUPLEX
144 Infrastructure
147 Infrastructure
148 Infrastructure
152 Infrastructure
153 HIGH PERF DATA SUBSCRIBER
154 Mobile
164 M1225-LS
169 Paging
170 Data
171 Mobile Video Enforcer
174 GP300
176 XTL1500 REBANDING
177 Infrastructure
183 Portable
191 MTX820s / MTX810 PRIVACY PLUS
192 Infrastructure
201 KVL 3000 Plus Keyloader
204 RENAISSANCE OPEN
205 XTS2500 / XTS2250 (7/800 MHz) / 700/800 STINGRAY
207 Digital Vehicular Repeater VHF/UHF/700/800
214 Infrastructure
218 Quantro
221 CLEAR SPECTRA (LO/MID) C
225 Infrastructure
228 Infrastructure
229 Infrastructure
235 Infrastructure
241 Data
243 Infrastructure
244 Infrastructure
246 Commercial Tier Portable
253 Paging
256 SABER/ASTRO ACCY
257 Infrastructure
261 General Test Equipment
262 General Test Equipment
265 Infrastructure
270 XTS2500 REBANDING
270 Spectra 800 E7
273 Infrastructure
274 Infrastructure
275 Infrastructure
276 XTL5000 CONSOLETTE
277 Infrastructure
280 Infrastructure
281 Infrastructure
282 Micom SSB 1000W Linear
287 PAC-RT,VRS
296 Data
301 Infrastructure
305 SPECIAL ENCRYPT PORTABLE
307 Infrastructure
310 Astro Saber
311 Data
312 Data
314 Data
320 XTS5000 136 - 174
322 Infrastructure
326 XTS3000
329 Infrastructure
332 CONV. FLASHPORT SUBSCR.
335 Infrastructure
336 Astro Saber
343 ML900
351 Infrastructure
355 MT2000 UHF / VHF / 800
356 Mobile
360 Infrastructure
372 Infrastructure
374 Astro Spectra Digital Consolette UHF / VHF / 800
376 Visor
377 Smartnet II controler
381 Infrastructure
388 MSF5000(Conventional)
398 MSF5000(trunked)


401 Infrastructure
402 HT1000 800 / UHF / VHF
402 JT1000 UHF & VHF
403 Infrastructure
404 Infrastructure
405 Infrastructure
407 XTS2250 Starpoint Microwave
407 XTS2500 UHF & VHF
409 Infrastructure
411 CLEAR SPECTOR (BOX) CONV
412 Astro Conv Spectra
415 R2000
416 Infrastructure
417 Infrastructure
422 CT150 / 250 / 450 / 450LS UHF & VHF
423 Data
424 Securenet Keyloader
425 Infrastructure
426 Astro Saber
428 Mobile
430 FLASHPORT SFTWR UPGRADE
431 Micom SSB
432 PC MTS2000 CONVENTIONAL
432 MTS2000 VHF / UHF / 800 / 900
436 Mobile
437 OEM SUBSCRIBER
438 Maxtrac 800 Type I/II
442 PR400 UHF & VHF
443 Infrastructure
446 Mobile
448 Quantar, Digital Data
457 Infrastructure
463 Spirit
465 LTS2000 TRNK
466 MTS2000 / MTS2000 TRUNKED UHF 450-512
469 Infrastructure
470 PORTABLE FASCINATOR
471 Analog Saber / SABER II VHF
474 Infrastructure
475 P1225
476 Mobile
481 MAXTRAC SMARTNET
482 Infrastructure
483 Syntor X
484 Infrastructure
493 Mobile
494 ASTRO Spectra TRUNKED ASTRO MOBILE
495 Infrastructure
496 R2670 / R2600 system analyzer
500 XTL5000 / XTS4250 (7/800 MHz)
501 MICOM
503 Data
504 Infrastructure
508 Data
509 Quantar, A25 Rptr
511 MTX8000 / 9000 / 838 / MTS2000
512 MTR2000
513 Infrastructure
514 XTL2500 700/800
516 Infrastructure
518 XTL2500 UHF & VHF
523 Data
524 Infrastructure
525 Infrastructure
526 Astro Digital Spectra Plus Mobile UHF / VHF / 800
527 KRAMER
529 SPECTRA (800 MHz)
533 Syntor Conv x / 9000
536 MAXTRAC 900 MHZ/SN
537 Quantar, A25 Rptr
538 Mobile
546 Portable
548 Infrastructure
562 PC-CCI ASTRO PORTABLE
563 MaxTrac 800
564 Portable
566 Mobile
570 Infrastructure
570 PORT REPEATER,SABERX,SVA
571 SABER II UHF
574 Infrastructure
577 Portable
579 MTX Classic
581 SPECTRA (analog) SECURE TRUNK SPECTRA
582 MSR2000
584 Paging
585 XTL5000 UHF/VFH
586 Infrastructure
589 Data
590 Infrastructure
593 Infrastructure
595 STR3000 Base Radio
602 PFD3000
604 Analog SPECTRA (800 MHz)
609 Infrastructure
611 Infrastructure
617 CLEAR SPECTRA (HIGH) CON
620 PC-XTS3000
620 XTS3000 800
621 SUBSCRIBER CARROT APC
623 MCS2000
624 XTL2500 REBANDING
624 Astro Spectra Secure UHF
626 STX Portables
626 PR1500 UHF & VHF
629 Data
632 Infrastructure
642 MTX850LS 800
643 Infrastructure
646 Paging
647 Infrastructure
649 HT600
652 MTX8090 PRIVACY PLUS
654 Mackinaw Covert Portable
655 Mackinaw Portable
656 Mackinaw Mobile
657 XTS1500 REBANDING
671 Mobile
672 HT750 UHF / VHF / Low Band
672 Pro 5150 / 5350
673 MTX900 Pirvacy Plus
676 Infrastructure
677 Infrastructure
677 Syntor
678 STX Portables / LTS2000
679 Portable
680 Quantar, Digital Capable
681 SMARTZONE MAXTRAC
682 SM50
684 Infrastructure
687 MT1000
687 MT1500 800 UHF & VHF
687 XTS1500 700/800 UHF & VHF
689 Data
702 Mobile
703 Mobile
704 Infrastructure
707 Data
708 Infrastructure
710 P1225-LS
711 Nucleus Infrastructure
720 Portable
721 XTS5000 700/800
722 MCS2000 UHF 450-512
726 MTX800 / MTX820
726 XTL1500 UHF / VHF / Mid Power
729 Infrastructure
732 Infrastructure
736 Data
737 Mobile
740 MIP5000
742 Mobile
743 Infrastructure
747 Infrastructure
749 Pro 7150
749 HT1250 / LS UHF / VHF / Low Band
749 MTX8250LS 800
752 Portable
755 SABER I UHF SP
756 SABER III VHF SP
757 SABER III UHF SP
760 LCS2000
761 ASTRO Spectra Consolette
775 XTL1500 700/800
776 MaraTrac Low Band / UHF / VHF
777 SP50
779 GP350
780 R1225
790 MAXTRAC SMARTNET UV
792 CDM1550 Low Band
808 Mobile
818 SPECTRA RR-CLEANCAB
833 SPECTRA RR-MCP
837 800 MHZ JSMR PORTABLE
839 Paging
841 HT1550XLS UHF & VHF
855 Data
863 MCX1000
866 Portable
867 GTX 800 / 900 800
869 M1225
870 Infrastructure
877 Infrastructure
879 Infrastructure
891 HTX
921 MTX8250 / Pro 7550 / Pro 7750
921 MTX850 / 8250
921 MTX950 / 9250 900
922 Commercial Tier Mobile
977 XPR 6300