AR8000 Knowlege Base Posted 3/26/95
Soft Reset Problem
There is a bug in the internal software that causes a reset when the 8K is
turned off while it is set to a passed (locked out) channel. This used to
happen to me frequently because I (like many other people) put the NOAA
weather freq. on a locked out channel and call up that channel directly
when I want to hear the forecast. I know now that I shouldn't turn the unit
off until I switch to a non locked out channel otherwise I get the reset
you described when I turn the unit back on again.
I'm interested if your US model exhibits the firmware bug we've found. If
you wouldn't mind trying something:
Lock out a frequency in one of your scan channels.
Copy the locked out frequency to the 2VFO register.
Turn off the scanner.
Now turn it back on and see if you have the classic symptoms of a soft reset:
1) Both VFOs tune to 80
2) Beep is set to on (from off)
3) Function is set (from 2nd Func)
4) Mode is set to Novice (from Expert)
Loose BNC connector fix
I had to tighten the BNC connector as soon as my AR8000 arrived. It's no
big deal to do. Take out the two screws in the battery compartment. There
are two sets of two screws on each side of the scanner at the top of the
rubberized grips. You only need to remove the screw on each side that's
closest to the back of the scanner. After removing these 4 screws, the case
will come apart. Take it apart gently as there are some connectors inside
that will come apart.
Remove the two screws at the bottom of the PC board that's set in the back
half of the case. Pull off the rubberized caps of the Squelch, Power, and
tuning knobs. You'll need to remove the washers that are on these knobs.
They have slots in them 180 degrees from each other. If you have one of
these special tools, use it. I just used the tips of a pair of needle-nose
pliers with no trouble.
Now, remove the PC board that has the knobs attached to it. There's a large
connector in the center of the board, so be gentle when lifting it out.
When you do this, you may have the two power battery clips pop out. These
clips have long straight leads that go through holes in the battery
compartment into connectors on the board you just removed. Fortunately,
they're not hard to reset.
Once you've got the PC board out, you'll be able to get to the BNC
connector. It also uses one of those slotted washers. It's a little awkward
to get to with needle-nose pliers but not too hard.
Reassembling:
Put the PC board back in place: Knobs go through the holes in the top of
the case and the connector in the center of the board must be aligned
properly. Gently push the connector in. Put in the two screws at the bottom
of the board. If the battery comaprtment springs have popped out, now is
the time to replace them. Flatter spring goes on the left, "deep" spring
goes on the right (as you're looking into the battery compartment). Put the
washers back on the knobs and then the rubber covers.
Finally, put the front of the case and the back together, aligning the
connectors inside carefully. Screw in the black screws
Traveling Birdie Fix
The solution I came up with that works *most* of the time with the floating
birdies, is to set the Level threshold to 1 (in the Scan config setup). The
birdie usually doesn't produce a signal greater than 1 on the S-meter and
setting the threshold to 1 requires a signal *greater* than 1 to break
squelch. Thus, the birdie is skipped. Of course, setting the level
threshold to other than 0 has other implications one has to balance out
with the birdie problem.
2nd fix-- It seems that by turning the Audio search on and playing with the
Audio level (Func 4) you can have the scanner automatically skip the
birdies. Adjusting Audio Wait (Func 3) will determine how long it will
stay on the birdie. Audio search will not work if Audio level is set to
00. The default is supposed to be A but some shipped set to 00, causing
their owners to think that the Audio search didn't work. I have had to set
Audio level to 1A to skip the birdies
Desktop power stand
Check your EEB (1995) catalog, pg. 28. Listed as the PSU-101 Desk
Charger/Power Supply. The 12-volt model works fine for both the Yupi and
the AR8000 (same plug works fine, actually). Here's your two paragraphs...
"This quality custom-designed combination desk charger and regulated power
supply unit is perfect for convenient 'Base Station' use of your handheld
scanner at home or office!"
"Securely holds scanner in handy position. Chages radio's internal Ni-Cds.
Powers radio from standard 117 VAC house current. WT: 2 lbs." EEB can be
reached at 800-368-3270.
Interface cable fix
Just a warning, several Scan*Star customers have had problems with the EDCO
US interface either not working or going bad after a few days.
The problem is that the right angle bends where the flat cable connects to
the small PC board develop hair line cracks and break. There is a fix, if
you don't want to return the device: Open the unit up and place one side of
the shell on a flat surface. Lay a large "pillow" of silicone (RTV) near
the opening, where the flat cable will exit the housing. Place the board
and cable into the half shell and lay the cable on the pillow. You need to
put something under the board to hold it straight while the silicone dries.
Once in place, place another glob of silicone on top of the other one,
sandwiching the flat cable. AFTER the silicone dries, fix any cracks or
breaks in the right angle connections with a soldering iron CAREFULLY, then
snap the other shell on. If you did the silicone right, there wont be too
much to snap the shells together and the flat cable will be held in the
middle. The point is to mechanically isolate the right angle connections
from the outside world. By reaheating t
he right angle solder joints after the silicone dries you remove any stress
from misalignment.
Audio Scan Fix
This info might help fellow AR8000 owners who suspect that their
AUDIO SCAN/SEARCH function may not be working properly, when it in
fact might be working just fine.
I recently posted my experiences with this, and was pretty
convinced that there was a problem with the AUDIO SCAN/SEARCH not
working on my radio too. I believe there really ARE units that are
truly defective, but here is what I discovered about mine to solve
the problem.
Hold down [FUNC] [4] at the same time, while turning the unit on,
holding down these two keys until the radio displays "SET LEVEL"
and "AUDIO LEVEL". There will be a 2-digit value displayed also
(how to do this is also in the manual near the end).
It took me a while of fiddling with the radio and examining the
manual to figure out that mine was set by default to 00 (rather
than 0A like it says in the manual)! This parameter sets the
minimum amount of modulation present in a carrier before it is
considered a truly valid signal (and thus not bypassed via AUDIO
SCAN/SEARCH). Thus when set to 00, AUDIO SCAN/SEARCH considers a
perfectly quiet carrier to be a valid signal, thus opening the
squelch and staying locked on that frequency, and all you hear is
a dead carrier. It was precisely this that lead me to believe that
my AR8000 was defective (until I found the solution).
Well, the manual says this default is "0A". With my default being
00, it effectively negated the effect of the AUDIO SCAN/SEARCH.
So, I set the value to 0A (like the manual said) and it seemed to
work fine. Actually, after some playing with it, I settled on a
much lower value of 02, since 0A seemed to blow past signals with
moderately strong carrier modulation; signals that you really DO
want to hear. Setting it to 02 seemed to be enough for it to truly
ignore reasonably quiet carriers.
The numbering scheme chosen for this parameter seems strange, and
is in hexadecimal form, and ranges from 00 to 4F. Converted to
decimal, this results in 80 discrete settings for the AUDIO LEVEL
(4 * 16 + 16 = 80), F = 16 hex. You really don't need to know hex
to set this, but it would have made more sense if it was
sequentially indexed using conventional decimal notation (00 to
80). Of all the settings in this scanner, it's the only one that
counts in hexadecimal. I guess this truly makes it a computer!
If setting AUDIO LEVEL to something greater than 00 does not fix
it on your radio, then you probably have a bona fide problem with
it. My serial number by the way is 11412.
I hope this helps. It was a big relief.
Programming
To enter a new freq into a channel use the VFO mode, enter the freq, step, mode and attenuator setting then press and hold the enter key until it pops you into the frequency enter mode, then you can select any channel you want and enter the alpha text.
If you are using the tuning knob, let's say with a .0005 step rate, click on the function key once, and the tuning rate will increase by a factor of 10. Click on the function key again, and the tuning rate will return to .0005 steps.
Mail Lists
I have set up a mailing list for ar8000 owners/users/developers. To subscribe to the list,
simply send a message to ar8000-request@doma.hsr.umn.edu with a subject of
subscribe. Likewise, a subject of unsubscribe will get you off the list; and
of course, all posts should go to ar8000@doma.hsr.umn.edu.
AR8000 Antenna
Try a Radio Shack PRO-43 ducky. Works swell. The Pro43 ducky is called the GRE All-Band rubber ducky antenna. It is 8" long and costs about $15. Call GRE America at 800-233-5973 (outside Cal) or 415-591-1400. PS Also, make sure you purchase the RS $9.99 telescoping whip! Nothing touches it on VHF-Lo. Catalog number is 20-006.
AR8000 Search Bank limits
>Your trick for getting the AR8000 to accept search limits in between the steps has a problem. If you do exactly as you said (enter the true upper and lower limits, and step with +) something funny happens when you search. I haven't pinned this down exactly, but it's something like this: when searching upwards, it skips the high limit channel, and when searching downwards, it loses the lower limit one. Open the squelch and step manually through a search range, and you'll find that either the top or low limit, or both, isn't seen depending on direction and how you start the search. "You can't fool Mother Narture".
I've found the only way to be SURE it includes both limits in the search is to do this: take the lower limit and subtract half the step. Take the upper and add half the step. So in effect you have added one whole step to the search range.
For instance - to search cordless (46.61 - 46.97 @ 20 KHz) you enter limits of 46.60 (46.61 minus 20/2) and 46.98 (46.97 + 20/2). With a step size of + 20 of course. That works ... all the time.<
Interface Software
Scan*Star
Signal Intelligence
408-926-5630
Sam Dunham 71603,366 call the Scan*Star BBS @ 408-258-6462.
You can get cellular images loud-and-clear in the 1419.9-1442.9MHz range when using AR8000s.
FCC Frequency Allocations
---------------------------
A summary of the FCC Table of Frequency Allocations, based on
the Oct '93 Code of Federal Regulations - 47 CFR 2.106
30 - 50 MHz: FM @ 20 kHz steps
30.000 - 30.560 US Government
30.560 - 31.980 Business / Industry / Forestry
31.990 - 32.000 Public Safety
32.000 - 33.000 US Government
33.000 - 33.100 Public Safety
33.120 - 33.400 Business / Petroleum
33.420 - 34.000 Fire
34.000 - 35.000 US Government
35.020 - 36.000 Business / Paging
36.000 - 37.000 US Government
37.020 - 37.420 Police / Local Govt
37.460 - 37.860 Power, Water, Pipeline
37.900 - 38.000 Highway Maint / Special Emergency
38.000 - 39.000 US Government
39.020 - 40.000 Police / Local Govt
40.000 - 42.000 US Government
42.020 - 42.940 State Police
42.960 - 43.680 Business / Paging
43.700 - 44.600 Transportation - bus, truck
44.620 - 45.060 State Police / Forestry Conservation
45.080 - 45.860 Police / Local Govt / Highway Maint
45.900 - 46.040 Police / Emergency
46.060 - 46.500 Fire
46.520 - 46.580 Local Govt
46.610 - 46.970 Cordless Phones - base (20/40 kHz steps)
47.020 - 47.400 Highway Maint
47.440 - 47.680 Industry / Emergency
47.700 - 49.580 Industry
49.670 - 49.990 Cordless Phones - handset (irregular steps)
50 - 150 MHz
50.000 - 54.000 Amateur (6-meter)
54.000 - 72.000 Broadcast TV chs 2-4 (6 MHz steps - FMw)
72.000 - 76.000 (various)
76.000 - 88.000 Broadcast TV chs 5-6 (6 MHz steps - FMw)
88.000 - 108.000 FM Broadcast (200 kHz steps - FMw)
108.000 - 118.000 Aero - navigation
118.000 - 136.000 Aero - communications (25 kHz steps - AM)
136.000 - 138.000 Satellite
138.000 - 144.000 US Government
144.000 - 148.000 Amateur (2-meter)
148.000 - 150.800 US Government
150 - 162 MHz: FM @ 15 kHz steps
150.815 - 150.965 Auto Emergency
150.995 - 151.595 Highway / Forestry / Industry
151.625 - 151.955 Business (30 kHz steps)
152.030 - 152.240 Mobile phone (Base) / Page (30 kHz steps)
152.270 - 152.450 Taxi (Base)
152.510 - 152.840 Mobile phone (Base) / Page (30 kHz steps)
152.870 - 153.725 Industry
153.740 - 154.445 Fire / Govt (mobile)
154.452 - 154.482 Industry (telemetry) (7.5 kHz steps)
154.490 - 154.625 Industry
154.650 - 156.240 Police / Govt / Emrgncy / Hwy
156.025 - 157.425 Maritime (ship) (25 kHz steps)
157.470 - 157.515 Auto Emergency
157.530 - 157.710 Taxi (mobile) / Business
157.770 - 158.100 Mobile phone (mobile) / Page (30 kHz steps)
158.130 - 158.460 Industry
158.490 - 158.700 Mobile phone (mobile) / Page (30 kHz steps)
158.730 - 159.210 Police / Govt / Highway
159.225 - 159.465 Forestry Conservation
159.495 - 160.200 Transportation - bus, truck
160.215 - 161.610 Railroad
160.625 - 160.950 Maritime - Coast (25 kHz steps)
161.640 - 161.760 {Broadcast Pickups
161.500 - 162.025 {Maritime - Coast (25 kHz steps)
162 - 450 MHz
162.025 - 174.000 (various, mainly US Government)
174.000 - 216.000 Broadcast TV chs 7-13 (6 MHz steps - FMw)
216.000 - 218.000 Maritime - AMTS, coast (25 kHz steps)
218.000 - 219.000 IVDS - Interactive Video & Data
219.000 - 220.000 Maritime - AMTS, ship (25 kHz steps)
220.000 - 221.000 (Private land Mobile) - base ( 5 kHz steps)
221.000 - 222.000 (Private land Mobile) - mobile( " " " )
222.000 - 225.000 Amateur (1.25-meter)
225.000 - 400.000 US Government - Aero (AM)
400.000 - 406.000 US Govt - Meteorological / Space
406.000 - 420.000 US Government
420.000 - 450.000 Amateur (70cm) / military radar / radiolocation
450 - 460 MHz: FM @ 25 kHz steps (450-455 base, 455-460 mobile)
450.050 - 450.925 Auxiliary Broadcasting
451.025 - 452.025 Industry
452.050 - 452.500 Taxi / Industry / Transport
452.525 - 452.600 Automobile Emergency
452.625 - 452.950 Transportation - Trucks / Railroad
452.975 - 453.000 Relay Press
453.025 - 453.975 Local Govt / Public Safety
454.025 - 454.650 Mobile Telephone
454.675 - 454.975 Mobile Telephone Air (ground)
455.050 - 455.925 Auxiliary Broadcasting
456.025 - 457.025 Industry
457.050 - 457.500 Taxi / Industry / Transport
457.525 - 457.600 {Maritime - shipboard repeater (mobiles @ 467.xxx)
{Business - low power
457.625 - 457.950 Transportation - Trucks / Railroad
457.975 - 458.000 Relay Press
458.025 - 458.975 Public Safety / Local Govt
459.025 - 459.650 Mobile Telephone
459.675 - 459.975 Mobile Telephone Air (airborne)
460 - 470 MHz: FM @ 25 kHz steps (460-465 base, 465-470 mobile)
460.025 - 460.550 Police / Public Safety
460.575 - 460.625 Fire
460.650 - 460.875 Business - Airport use
460.900 - 461.000 Business - Central Alarms
461.025 - 462.175 Business
462.200 - 462.525 Manufacturers / Industry
462.550 - 462.725 GMRS (12.5 kHz steps)
462.750 - 462.925 Business (paging)
462.950 - 463.175 MED (Ambulance/Hospital)
463.200 - 465.000 Business
465.025 - 465.550 Police / Public Safety
465.575 - 465.625 Fire
465.650 - 465.875 Business - Airport use
465.900 - 466.000 Business - Central Alarms
466.025 - 467.175 Business
467.200 - 467.525 Manufacturers / Industry
467.550 - 467.725 GMRS (25 kHz steps)
467.750 - 467.925 {Business (2w, telemetry)
467.750 - 467.825 {Maritime - shipboard (rptr at 457.xxx)
467.950 - 468.175 MED (Ambulance/Hospital)
468.200 - 469.975 Business
470 - 806 MHz: 6 MHz per channel, wide FM audio
470.000 - 512.000 {Broadcast TV, chs 14-20
{Large Metro Public Safety (25 MHz steps - FM)
512.000 - 806.000 Broadcast TV, Chs 21-69
806 - 896 MHz: FM @ 25 kHz steps (mobile 806-851, base 851-896)
806.000 - 809.750 General - conventional
809.750 - 811.000 General - single channels
811.000 - 816.000 General - trunked
816.000 - 821.000 SMR - trunked
821.000 - 824.000 Public Safety - trunked (12.5 kHz steps)
824.040 - 834.360 Cellular Telephone (30 kHz steps)
834.390 - 835.620 Cellular Telephone (data) (30 kHz steps)
835.650 - 848.970 Cellular Telephone (30 kHz steps)
849.000 - 851.000 Aircraft Telephone (6 kHz steps - AM)
851.000 - 854.750 General - conventional
854.750 - 856.000 General - single channels
856.000 - 861.000 General - trunked
861.000 - 866.000 SMR - trunked
866.000 - 869.000 Public Safety - trunked (12.5 kHz steps)
869.040 - 879.360 Cellular Telephone (30 kHz steps)
879.390 - 880.620 Cellular Telephone (data) (30 kHz steps)
880.650 - 893.970 Cellular Telephone (30 kHz steps)
894.000 - 896.000 Aircraft Telephone (6 kHz steps - AM)
896 - 1300 MHz:
896.000 - 901.000 SMR/Business/Industry - mobile (12.5 kHz steps)
901.000 - 902.000 Personal Communications Services
902.000 - 928.000 Amateur (33cm) / various secondary
928.000 - 929.000 ()
929.000 - 930.000 paging
930.000 - 931.000 Personal Communications Services - base
931.000 - 935.000 ()
935.000 - 940.000 SMR/Business/Industry - base (12.5 kHz steps)
940.000 - 941.000 Personal Communications Services - base
941.000 - 960.000 ()
960.000 -1215.000 Aeronautical navigation
1215.000 -1240.000 US Govt - Radiolocation / Space
1240.000 -1300.000 Amateur (23cm)
Hacking The AR8000
There has been much discussion for the last few months about hacking
the AR8000. Why do many want to hack it? They want to have access
to cellular Band area that is restricted by US Law. Others want
to change the default settings in the band plan to ones that are
more suitable for the world IRC region were they live. Myself,
I wanted to add secret information to make it possible to prove
that the radio was mine in the event it is stolen.
How does one figure out how to go about hacking the AR8000? First
ask oneself, why did the FCC take so long to certify the radio
for USA use and then refuse to certify the CU 8-232 interface?
They knew that critical pointers are changeable that would change
the operation of the radio to receive frequencies which the FCC
did not want the citizens of the USA to be able to monitor. The
FCC later certified a specialy modified computer control interface
for USA use.
How does the USA interface differ from the CU 8 232? There is
no clone position that allows two AR8000's to talk to each other
in the USA version. This indicates that the EEPROM that is reprogramed
by the CLONE operation is where the 'personality' of the radio
is stored. The European radio contains a different basic bandplan
and is able to continously monitor from 500 KHZ to 1950 MHZ. This
then tells one that the CLONE operation is where the FCC has a
problem with allowing this radio to be sold in the USA.
What happens when the AR8000 is set to CLONE to another AR8000?
Read your AR8000 manual . Page 102 describes what takes place
if you have the CU 8 232 and two AR8000's. I reasoned out in a
message posted to USENET back in October 1994 that one could put
their AR8000 in COPY SEND-MODE SYS-DATA and make a PC act like
the other AR8000 that was being cloned to. I used Procom Plus
for Windows version 2.0 for my project. I opened a chat window
so I could see what I was sending verses what I was receiving
from my AR8000. The AR8000 sent %0000# and stopped. I tried various
things and then reasoned that maybe it wanted me to echo what
I had received. BINGO! The AR8000 then sent a continuos stream
of data (134 characters to be exact) ending with something I immediately
recognized. The ending sequence was %0040#.. That meant there
was actually 128 bytes of data followed by a address offset from
the beginning to indicate where the NEXT 128 bytes would be read
from in my AR8000's system memory. But wait the increment in addressing
was not 128 bytes. It was 40 hex. which is only 64 bytes of system
data. This meant that the data was a hex dump of system memory
and the receiving AR8000 would convert the hex data back to system
memory. Same thing when you convert a UNIX bin file to 7 bit ASCII
(two hex bytes for each 8 bit piece of data) and then email the
data to someone who has to reverse the process to get his bin
data back. This is how ham radio transfers binary data in packets
to another ham.
Echoing the last six bytes %xxxx# would cause the AR8000 to send
the next packet of data until one had received a total of 112
packets of good data. The last packet (actually 113) is a concluding
handshake that I believe indicates all is well - we are done with
this transfer. This is a little less then 8 K worth of data for
the sys memory map. (8K would have been 128 packets of 64 bytes).
A dump of the entire EPROM (i.e. SEND-MODE ALL-DATA) works out
to 32K of memory that you can alter with the CU 8 232.
To reprogram or alter the AR8000's EPROM, one must reverse the
process with the altered data being feed back in the same manner
in which it came from the AR8000 in the first place. This is a
tedious process by hand and is best done by writing a script file
to do it for you. The script can also do the checking to see if
the AR8000 got the data correctly in the first place, just as
if they were talking to each other. Failure to echo the next address
properly should be followed by re-sending the missed data , sending
first a pointer %xxxx# to where the missed data is coming from
waiting for a proper response, and then sending the data followed
by the next pointer. The AR8000 will not jump around or go backward
during a clone. Screw it all up and you may have messed up your
AR8000's memory requiring you to reset every thing. Lower the
baud rate and re-send the proper system data. The things that
allow you to recover are contained in another ROM that contains
the micro code or actual system program for the AR8000's internal
computer. You can not write to this ROM fortunately. You replace
it with another that has been programmed externally in a ROM burner
if you really are daring and sharp. Then you would have a truly
unique AR8000! The ROM is where that message "WELCOME TO..."
resides. Bummer - I wanted to change that to "THIS RADIO
STOLEN FROM KI4JE." to cut the radio's resale value if stolen
from me.
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
