The General forum is where users can discuss any topic regarding Motorola communications equipment - hardware, software, etc. There are also several focused forums on this board, so please take the time to ensure that your questions doesn't fall into one of those categories before posting here!
I did a bit of investigating on a couple of CDM-750 / CDM-1250 - CDM-1550LS+ trying to figure out the protocol between the main unit and the control head.
===============================================================================================
Motorola SBEP bus commands
===============================================================================================
The protocol is based on US patent 5,551,068 dated: Aug. 27th 1996
-----------------------------------------------------------------------------------------------
Basic characteristics:
Speed: 9600 N 8 1 Level: 0/5V TTL 1=idle 0=active RX and TX ANDed on one line. (BUS+ pin 17 on the accessory connector & pin 7 on the microphone connector)
Message buildup:
[ OpCd-Len ] [Ext Len] {data} [CRC]
Byte 1 = bits 0:3 = datalength incl. CRC if 0xF = then use byte 3 as extended length
bits 4:7 = Opcode if 0xF = then use byte 2 as extended opcode
Byte 2 = databyte or if MSB of Byte 1 = f then this is the extended opcode. (I have observed ONLY extended opcodes)
Byte 3 = databyte or if LSB of Byte 1 = f then this is the extended length byte (ie. used to write text on the LCD)
Byte N = databytes see below.
Last byte = CRC : simply add all bytes modulo 0xFF and XOR with FF to get the CRC byte.
================================================================================================
Acknowledge to certain messages is a single byte 0x50
If ACK is not received then the message will be repeated.
ACK byte = 0x50
================================================================================================
Opcode Example ACK ?
================================================================================================
unknown use / sent on power up
0xF10 F1 10 - FE => 50
----------------------------------------------------------------------------------------------
button indication:
0xF24 F4 24 - NN 01 00 - E6 pushed
F4 24 - NN 00 00 - E7 released
NN button
---------------------------------------------------------
00 = PTT
01 = ?
02 = Right >
03 = Left <
04 = Up ^
05 = Dovn v
06 = Menu
07 = Exit
08 = P1 / Call
09 = P2
0A = P3 / Scan
0B = P4
0C = ?
0D = ?
0E = ?
0F = ?
10 = volume control par2 = [00...FF] = volume level
11 = [1] channel 1 CDM 750
12 = [2] channel 2 CDM 750
13 = [3] channel 3 CDM 750
14 = [4] channel 4 CDM 750
20 = unknown (on power on/off)
21 = unknown (on power on push only)
24 = Hook contact
FF = power control 00 00 = power off / 01 00 power on
----------------------------------------------------------------------------------------------
0xF30 F8 30 - 02 00 00 00 00 00 00 - D5 => 50
0xF30 F8 30 - 04 FF 00 00 00 00 00 - D4 => 50
LED control:
rd yl gn
0xF30 F5 30 - 06 00 00 00 - D4 => 50
Databyte 1 seems to be a sub address - 0x06 indicating LED control
Databyte 2 = Red LED
Databyte 3 = Yellow LED
Databyte 4 = Green LED
The individual LED bytes seem to be bit patterns
ie: 00=off ff=on f0=flash 50% c0=flash 25%
----------------------------------------------------------------------------------------------
backlight level
0xF31 F2 31 - 11 - AC => 50
Databyte 1 = brightness level (pushbutton: 0x11 -> 0x17 -> 0x30 -> 0x64)
at power off: 0x00
----------------------------------------------------------------------------------------------
wake up control head
0xF33 F1 33 - DB => 50
----------------------------------------------------------------------------------------------
write display:
0xF34 FF 34 - 00 [03] 00 0E - BB => 50
0xF34 FF 34 - 00 [11] 00 00 34 35 36 2E 38 37 35 20 4D 48 7A 20 20 20 - BB => 50
displays: 456.875_MHz___
----------------------------------------------------------------------------------------------
0xF35 F5 35 - 00 80 05 02 - 4E => 50
0xF35 F5 35 - 03 7F FA 1D - 3C => 50
F5 35 - 03 FF FF 1F = B5 on power off
Databyte 1:00 seems to be on / 03 off
Databytes 2 and 3 on and off are always compliments of each other
----------------------------------------------------------------------------------------------
button pushed Irq:
0xF36 F2 36 - 00 - D7 => 50
Sent from the control head when a button has been pushed.
----------------------------------------------------------------------------------------------
control head id:
0xF90 F7 90 - 22 00 52 01 02 00 - 01 CDM-1550 => 50
F7 90 - 11 00 52 01 03 01 - 10 CDM-1250
F7 90 - 07 00 52 01 03 01 - 1A CDM-750
Databyte 1 = input from CH_KPD_ID[0:7] port
----------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------
I think you will find that this is the SB9600 databus that many of the newer Motorola radios use. It is a Motorola format that they don't like to talk about. They feel it belongs to Motorola only and as such won't provide any info on it.
Jim
arnu wrote:I did a bit of investigating on a couple of CDM-750 / CDM-1250 - CDM-1550LS+ trying to figure out the protocol between the main unit and the control head.
===============================================================================================
Motorola SBEP bus commands
===============================================================================================
The protocol is based on US patent 5,551,068 dated: Aug. 27th 1996
-----------------------------------------------------------------------------------------------
Basic characteristics:
Speed: 9600 N 8 1 Level: 0/5V TTL 1=idle 0=active RX and TX ANDed on one line. (BUS+ pin 17 on the accessory connector & pin 7 on the microphone connector)
Message buildup:
[ OpCd-Len ] [Ext Len] {data} [CRC]
Byte 1 = bits 0:3 = datalength incl. CRC if 0xF = then use byte 3 as extended length
bits 4:7 = Opcode if 0xF = then use byte 2 as extended opcode
Byte 2 = databyte or if MSB of Byte 1 = f then this is the extended opcode. (I have observed ONLY extended opcodes)
Byte 3 = databyte or if LSB of Byte 1 = f then this is the extended length byte (ie. used to write text on the LCD)
Byte N = databytes see below.
Last byte = CRC : simply add all bytes modulo 0xFF and XOR with FF to get the CRC byte.
================================================================================================
Acknowledge to certain messages is a single byte 0x50
If ACK is not received then the message will be repeated.
ACK byte = 0x50
================================================================================================
Opcode Example ACK ?
================================================================================================
unknown use / sent on power up
0xF10 F1 10 - FE => 50
----------------------------------------------------------------------------------------------
button indication:
0xF24 F4 24 - NN 01 00 - E6 pushed
F4 24 - NN 00 00 - E7 released
NN button
---------------------------------------------------------
00 = PTT
01 = ?
02 = Right >
03 = Left <
04 = Up ^
05 = Dovn v
06 = Menu
07 = Exit
08 = P1 / Call
09 = P2
0A = P3 / Scan
0B = P4
0C = ?
0D = ?
0E = ?
0F = ?
10 = volume control par2 = [00...FF] = volume level
11 = [1] channel 1 CDM 750
12 = [2] channel 2 CDM 750
13 = [3] channel 3 CDM 750
14 = [4] channel 4 CDM 750
20 = unknown (on power on/off)
21 = unknown (on power on push only)
24 = Hook contact
FF = power control 00 00 = power off / 01 00 power on
----------------------------------------------------------------------------------------------
0xF30 F8 30 - 02 00 00 00 00 00 00 - D5 => 50
0xF30 F8 30 - 04 FF 00 00 00 00 00 - D4 => 50
LED control:
rd yl gn
0xF30 F5 30 - 06 00 00 00 - D4 => 50
Databyte 1 seems to be a sub address - 0x06 indicating LED control
Databyte 2 = Red LED
Databyte 3 = Yellow LED
Databyte 4 = Green LED
The individual LED bytes seem to be bit patterns
ie: 00=off ff=on f0=flash 50% c0=flash 25%
----------------------------------------------------------------------------------------------
backlight level
0xF31 F2 31 - 11 - AC => 50
Databyte 1 = brightness level (pushbutton: 0x11 -> 0x17 -> 0x30 -> 0x64)
at power off: 0x00
----------------------------------------------------------------------------------------------
wake up control head
0xF33 F1 33 - DB => 50
----------------------------------------------------------------------------------------------
write display:
0xF34 FF 34 - 00 [03] 00 0E - BB => 50
0xF34 FF 34 - 00 [11] 00 00 34 35 36 2E 38 37 35 20 4D 48 7A 20 20 20 - BB => 50
displays: 456.875_MHz___
----------------------------------------------------------------------------------------------
0xF35 F5 35 - 00 80 05 02 - 4E => 50
0xF35 F5 35 - 03 7F FA 1D - 3C => 50
F5 35 - 03 FF FF 1F = B5 on power off
Databyte 1:00 seems to be on / 03 off
Databytes 2 and 3 on and off are always compliments of each other
----------------------------------------------------------------------------------------------
button pushed Irq:
0xF36 F2 36 - 00 - D7 => 50
Sent from the control head when a button has been pushed.
----------------------------------------------------------------------------------------------
control head id:
0xF90 F7 90 - 22 00 52 01 02 00 - 01 CDM-1550 => 50
F7 90 - 11 00 52 01 03 01 - 10 CDM-1250
F7 90 - 07 00 52 01 03 01 - 1A CDM-750
Databyte 1 = input from CH_KPD_ID[0:7] port
----------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------
