Batboard

I did a bit of investigating on a couple of CDM-750 / CDM-1250 - CDM-1550LS+ trying to figure out the protocol between the main unit and the control head.

Here is a compilation of my findings:

I hope it might be useful for others.

I think you will find that this is the SB9600 databus that many of the newer Motorola radios use. It is a Motorola format that they don't like to talk about. They feel it belongs to Motorola only and as such won't provide any info on it.

Jim

arnu wrote:I did a bit of investigating on a couple of CDM-750 / CDM-1250 - CDM-1550LS+ trying to figure out the protocol between the main unit and the control head.

Here is a compilation of my findings:

I hope it might be useful for others.

Code: Select all

===============================================================================================

  Motorola SBEP bus commands		

===============================================================================================
                The protocol is based on US patent 5,551,068  dated: Aug. 27th 1996
-----------------------------------------------------------------------------------------------
Basic characteristics:

Speed: 9600 N 8 1		Level: 0/5V TTL  1=idle 0=active   RX and TX ANDed on one line. (BUS+ pin 17 on the accessory connector & pin 7 on the microphone connector)


Message buildup:
[ OpCd-Len ] [Ext Len] {data} [CRC]

Byte 1 = bits 0:3 = datalength incl. CRC  if 0xF = then use byte 3 as extended length
    	     bits 4:7 = Opcode                    if 0xF = then use byte 2 as extended opcode

Byte 2 = databyte or if MSB of Byte 1 = f then  this is the extended opcode. (I have observed ONLY extended opcodes)
Byte 3 = databyte or if LSB of Byte 1 = f then this is the extended length byte (ie. used to write text on the LCD)
Byte N = databytes see below.
Last byte = CRC : simply add all bytes modulo 0xFF and XOR with FF to get the CRC byte.

================================================================================================
Acknowledge to certain messages is a single byte 0x50
If ACK is not received then the message will be repeated.

ACK byte = 0x50

================================================================================================


Opcode		Example	                                                          ACK ?
================================================================================================
unknown use / sent on power up
0xF10		F1 10 - FE 								=> 50

----------------------------------------------------------------------------------------------
button indication:

0xF24	F4 24 - NN 01 00 - E6		pushed 
		F4 24 - NN 00 00 - E7		released

NN   button
---------------------------------------------------------
00 = PTT
01 = ?
02 = Right >
03 = Left  <
04 = Up    ^
05 = Dovn  v
06 = Menu
07 = Exit
08 = P1 / Call
09 = P2 
0A = P3 / Scan
0B = P4
0C = ?
0D = ?
0E = ?
0F = ?
10 = volume control  par2 = [00...FF] = volume level
11 = [1] channel 1  CDM 750
12 = [2] channel 2  CDM 750
13 = [3] channel 3  CDM 750
14 = [4] channel 4  CDM 750
20 = unknown (on power on/off)
21 = unknown (on power on     push only)
24 = Hook contact
FF = power control   00 00 = power off  / 01 00 power on

----------------------------------------------------------------------------------------------
0xF30		F8 30 - 02 00 00 00 00 00 00 - D5					=> 50
0xF30		F8 30 - 04 FF 00 00 00 00 00 - D4					=> 50

LED control:
                                         rd yl gn  
0xF30		F5 30 - 06 00 00 00 - D4						=> 50

                Databyte 1 seems to be a sub address - 0x06 indicating LED control
                Databyte 2 = Red LED 
                Databyte 3 = Yellow LED 
                Databyte 4 = Green LED 

		The individual LED bytes seem to be bit patterns 
		ie: 00=off ff=on f0=flash 50% c0=flash 25%

----------------------------------------------------------------------------------------------
backlight level
0xF31		F2 31 - 11    - AC							=> 50


	Databyte 1 = brightness level    (pushbutton:  0x11 -> 0x17 -> 0x30 -> 0x64)
	at power off: 0x00

----------------------------------------------------------------------------------------------
wake up control head
0xF33		F1 33 - DB 								=> 50

----------------------------------------------------------------------------------------------
write display:

0xF34		FF 34 - 00 [03] 00 0E - BB						=> 50

0xF34		FF 34 - 00 [11] 00 00 34 35 36 2E 38 37 35 20 4D 48 7A 20 20 20 - BB  	=> 50
                                                  displays:  456.875_MHz___

----------------------------------------------------------------------------------------------
0xF35		F5 35 - 00 80 05 02 - 4E						=> 50
0xF35		F5 35 - 03 7F FA 1D - 3C						=> 50

		F5 35 - 03 FF FF 1F = B5	on power off

		Databyte 1:00 seems to be on / 03 off
		Databytes 2 and 3 on and off are always compliments of each other
----------------------------------------------------------------------------------------------
button pushed Irq:
0xF36 		F2 36 - 00 - D7								=> 50

Sent from the control head when a button has been pushed.

----------------------------------------------------------------------------------------------
control head id:
0xF90	F7 90 - 22 00 52 01 02 00 - 01    CDM-1550				=> 50
		F7 90 - 11 00 52 01 03 01 - 10	CDM-1250
		F7 90 - 07 00 52 01 03 01 - 1A    CDM-750

		Databyte 1 = input from CH_KPD_ID[0:7] port   

----------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------