- 2000 (mts2000 flashport) softwarefirmware analog system package r08.70 cvn6258f, rebanding ENABLED, REQUIRES FLASH RIB. 2000 & 2100 Series Select 5 RSS v.R02.10.00.
- RSS for Motorola GM300 radio, you can program 40 channels to GM300 with this RSS! RSS for Motorola Saber system. RSS for Motorola GM300 professional series, GP300 professional series radio, version 03.01.02. RSS for Motorola CPS06.04AA for HT750/1250/1550 and CDM750/CDM1250/1550 radio, version 06.04. RSS for Motorola HT-800.
A manual supplement has been released for the MT2000/MTS2000/MTX838 with a new alignment procedure for the front end pre-selector. You can view this bulletin here.
Applications of Motorola, except for the normal non-exclusive, royalty fee license to use that arises by operation of law in the sale of a product., Motorola, MDC-1200, MCS 2000, Spectra, FLASHport, SMARTNET, Single Tone, StartSite, Private-Line, Digital Private-Line, Call Alert, Private.
General Information
Both the MTX8000 B5 & B7 models are Type II Trunking. If you are (un)lucky enough you might find an F3 modem that does Type II.
If it is an MTX8000 and has a front mounted display with either a 6 button or full keypad, you have a radio that will do Type II.
There were a few B3's that were Type II produced by Motorola. However, you can clone a Type II code plug into a B3 radio and it will work just fine.
Rss Software Motorola Mts2000 Flashport App
You can run system watch using a MTS2000 handheld. Firmware version has to be above 5.44 (which has a 512k controller in it). Most MTS2000/MTX8000's only have a 256k controller, which will not work. You can put the radio into RF modem mode from the F4-F4-F4 (Trunking Config).
NOTE: When the radio is in the RF MODEM mode, it will do a self test and then the screen will go blank. The radio DOES NOT have to be programed to the system you want to watch. You set SYSTEMWATCH to the Spectra with RIB mode (works best). Even watches Type I systems.
If you have the accessory adapter for the side connector on the radio, the typical schematic of the speaker mic looks like this.
If you are using a Public Safety speaker mic with the radio, you might want to order part number 3205514W01 to cover the antenna connector on the radio.
If you are trying to program a MTX-838, from what we've heard, you need to use the MTSX software. The RVN4097F ver R02.10.01 RSS package specifically shows it programs the following radios: MT/MTS2000 MTX838/8000/9000. Now, the update for this software is RVN4097M R06.00.00 05 Sept 97, which should mean that it should program the radio as well. The cable you need is the standard MTSX programming cable.
Do you want to build your own programming cable? If you don't want to use an old speaker mic cable, see the individual part numbers of the parts for the Service Cable, below.
You may want to look at the schematic for the RKN4035D Service Cable. This is the actual Motorola cable used for programming and servicing these radios.
The individual part numbers for the components of this cable are listed below.
| Reference | Part Number | Description |
| C1 | 21-84008H06 | Capacitor, 33nF |
| 1 | 09-84538E03 | Receptacle, 25pos |
| 2 | 15-80349B36 | Housing, Connector |
| 3 | 30-05118W01 | Cable, 13 Conductor |
| 4 | 01-80754A26 | Plug Assembly |
| 5 | 42-10217A24 | Strap, Tie |
| 6 | 38-80373B24 | Protective Cap |
| 7 | 04-10058B12 | Washer, Nylon |
| 8 | 42-05184R05 | Strain Relief |
| 9 | 22-05541V01 | Pin, Latch |
| 10 | 41-05538V01 | Spring, Latch |
| 11 | 55-05536V01 | Latch |
| 12 | 15-05691W08 | Housing, Connector |
| 13 | 32-05533V01 | Seal, Baseplate |
| 14 | 32-05472P11 | Gasket, 'o' Ring |
| 15 | 64-05241X01 | Baseplate |
| 16 | 39-05895V04 | Contact, (13) |
MTSX MVA
MTVA Vehicular Adapter Instruction Manual 6881075C95.
If you have the MTSX Convertacom (MTVA), you will notice that there are two DIP switches located on the bottom rear corner of the MTVA holder. These are used to select whether the microphone you are using has a manual PTT or serial data PTT.
For HMN1035 and HMN1056 microphones, set both dip switches toward the front of the holder. For HMN4044, HMN4047, NMN6209, and NMN6210 microphones, set both dip switches toward the back of the holder.
The pinout of the 6pin power connector on the NTN1340A is:
According to the manual the top row is 4 5 6 left to right with a square over pin 5. The bottom row is 3 2 1.
- 6 square
- 5 square with tab over it
- 4 square with rounded bottom shoulders
- 3 square with rounded bottom shoulders
- 2 square with rounded bottom shoulders
- 1 square
Pinouts as they are in the holder unit schematic diagram for the NTN1340A:
The 25 pin connector is listed as J100:
Connector J104 goes to the Battery Board it's a 10 pin connector, pins are:
NOTE: The NTN1340A is NOT a complete MVA if you only have the radio holder portion. You need the control box (with or without integrated power amplifier) that interfaces to the DB25, otherwise that's all you have is a radio holder.
Service Manuals
Here are a listing of the Service Manual part numbers for this series of radios:
- 6881200C15 -- HT1000/JT1000/MT2000 & MTX8000/9000 Radio Theory
- 6881200C40 -- HT1000/JT1000 & MT2000 Service Manual
- 6881200C25 -- MTX8000/9000 Service Manual
- 6881076C65 -- MT2000 Operator's Manual
- 6881072C10 -- MTX8000/9000 B3 Operator's Manual
- 6881072C40 -- MTX8000/9000 B5/B7 Operator's Manual
Error Codes
Below is a list of the Power-up Display Codes and Operational Display Codes that may show up on your MTSX series radio.
Power-up Display Codes:
| 14 CHAR FAILURE DISPLAY | 6 CHAR FAILURE DISPLAY | TYPE OF FAILURE | DESCRIPTION | POSSIBLE SOURCE |
| FAIL 01/81 | F01/81 | FATAL | External ROM/Flash checksum error | Bad ROM data, Defective ROM |
| FAIL 01/82 | F01/82 | FATAL | External EEPROM checksum error | Bad external codeplug data, Defective external EEPROM |
| ERROR 01/02 | E01/02 | NON-FATAL | External EEPROM checksum error | Bad external codeplug data |
| FAIL 01/84 | F01/84 | FATAL | External EEPROM checksum blank | Unprogrammed external codeplug data |
| FAIL 01/88 | F01/88 | FATAL | External RAM error | Defective RAM |
| FAIL 01/90 | F01/90 | FATAL | Hardware failure | Defective IC |
| FAIL 01/92 | F01/92 | FATAL | Internal EEPROM checksum error | Bad internal codeplug data, Defective microcontroller |
| ERROR 01/12 | E01/12 | NON-FATAL | Internal EEPROM checksum error | Bad internal codeplug data |
| FAIL 01/94 | F01/94 | FATAL | Internal EEPROM checksum blank | Unprogrammed internal codeplug data |
| FAIL 01/98 | F01/98 | FATAL | Internal RAM error | Defective microcontroller |
Operational Display Codes:
| 14 CHAR FAILURE DISPLAY | 6 CHAR FAILURE DISPLAY | DESCRIPTION | POSSIBLE SOURCE |
| FAIL 001 | F001 | Synthesizer out of lock | Bad frequency data in codeplug, defective synthesizer |
| FAIL 002 | F002 | Selected Mode (Zone/Channel) codeplug checksum error | Bad codeplug data |
| FAIL 100 | F100 | Incompatible trunking s/w and h/wTrunking h/w decoder disabled in codeplug, Old SLIC IC version | |
| FAIL 101 | F101 | Incompatible MDC1200 s/w and h/w | MDC1200 h/w decoder disabled in codeplug, Old SLIC IC version |
Upgrading your MT2000 from 160 to 255 modes
This may be a little too scary for some of you to want to attempt but...
It appears that all A7 model MT2000's are capaple of doing 255 modes rather than the 160 they are shipped with. The problem is getting the radio to do it. I have found one way to do this.
Rss Software Motorola Mts2000 Flashport Download
NOTE:There are a couple of things you should be aware of before you undertake this project:
- once you create your own model profile and program your radio, it becomes an individual radio
- you will not be able to program any old saved files you have from this radio into it
- you will not be able to clone this radio to any other 'normal' MT2000
- there is no way of going back to a 'normal' MT2000 unless you can create a model profile identical to a 'normal' MT2000 and program the radio with it
- for each zone you add after 10, you loose one channel (11 zones gives you 254 channels)
- write down the tuning data from the radio before you reprogram it, the reprogramming effort changes tuning data all to default so your radio won't work as well until it is retuned.
An additional note, the Version 4.00 software will let you add modes beyond 160 in the Add Personality screen. I don't know if the software will let you program more than 160 modes into the zone lists though, under the Radio Wide Information the software still reports 160.
What you have to do is get your hands on a copy of the MT2000 LAB RSS. Get the newest version you can. This software will let you create your own model profile and then a blank codeplug. All you need to do is create a model profile (with any model number you want ie. MY_MT2000) and in the Maximum Channels field, enter 255. Set everything else the way you want or think it should be.
Create yourself a blank (default) codeplug and program it into the radio. Load your normal RSS and read the radio. Program it up the way you want and program the radio.
Rss Software Motorola Mts2000 Flashport Manual
The following information was passed along to me and is a potential hazard if you use LAB RSS and write to the radio (reading is fine):
'ToolProof' Error Information
This is (Service Repair Note) SRN 1173
Date March, 1995
Deadline Date n/a
Memo To SRN Mailing List
From Radio Network Solution Group/Product Services, Plantation
Subject MTS2000 Programming Sources - Unauthorized Tool Usage
Symptoms Radio Inoperative Error 01/93
Potential Problem Radios MTS2000 Models Only with firmware 5.42 or greater
Cause Implementation of Toolproofing in release 5.42 and greater
Motorola has been shipping FLASHport software upgrades on the MTS2000 radio since September of 1994. To date, 9,000 units have been upgraded in the field. To protect against illegal software copying and/or radio upgrades, Motorola is implementing 'TOOLPROOFING' into the MTS2000 radio at the Florida factory beginning 2/27/95.
The result is many existing upgrade tools (PCON Plus, Depot RSS, Lab RSS, etc.) will no longer work with the MTS2000 radio. If these tools are used with MTS2000 radios that ship after the 2/27/95 date, the radio will fail upon power up. Any questions that arise as a radio fails to power up should be directed to Florida Product Services for diagnosis and further instructions. The number is 1-800-523-4007. Once an issue is diagnosed with the TOOLPROOFING as the violation, the individual will be instructed to send the radio(s) into the nearest depot location, where the 'FLASHport depot tool' will be used.
Corrective Action
All Motorola owned Depots and International Regional Support Centers (RSC s) will be equipped with a FLASHport depot tool . This proprietary tool will ONLY be distributed to the National Subscriber Depot in Schaumburg, the Florida Regional Support Center, and 18 previously established International Regional Support Centers Worldwide who have signed license agreements not to copy or distribute the tool. This new tool will have the capability to reprogram as required to perform repairs.
This bulletin is for information only, no warranty is implied.
Toolproof Explanation
Now, above is the official explanation of the toolproof situation and its rectification. What follows below is what we have been told is the way this silly protection scheme is implemented.
First, a little info on the structure of the MTSX series codeplug.
In its native format (the format that is actually dumped to the radio), the codeplug file is actually a standard Motorola S-record. It is unpacked from the archive file format and converted to an s-record which is stored in memory when the codeplug is read from disk. When the codeplug is written to disk, the s-record is packed and converted to the archive file that is stored.
Motorola Mts2000
The native codeplug is a list of blocks or records. The first block/record begins at address 0000h of EEPROM space. The format of each block/record follows the general s-record format:
S-RECORD CONTENT
S-Records are character strings made of several fields which specify the record type, record length, memory address, data, and checksum. Each byte of binary data is encoded as a 2-character hexadecimal number: the first ASCII character representing the high-order 4 bits, and the second the low-order 4 bits of the byte.
The 5 fields which comprise an S-record are defined as follows:| Field | Characters | Description | |
|---|---|---|---|
| 1 | Type | 2 | S-record type - S1 or S9. |
| 2 | Record length | 2 | The count of the character pairs in the record, excluding the type and record length (in bytes). |
| 3 | Address | 4 | The 2-byte address at which the data field is to be loaded into memory. |
| 4 | >Data | 0-2n | From 0 to n bytes of executable code, or memory loadable data. n is normally 20 hex (32 decimal) or less. |
| 5 | Checksum | 2 | The least significant byte of the one's complement of the sum of the values represented by the pairs of characters making up the record length, address, and data fields (One's complement of the length, address and data fields modulo 256 minus 1). |
Each record is terminated with a CR/LF/NULL. Accuracy of transmission is ensured by the record length (byte count) and checksum fields.
Some specific info relating to the radio's codeplug:
- The block type (S1) refers to 'InternalCodeplugRootBlock'
- The data is radio parameters defined by various tools like Lab, Factory test and tuning equipment, RSS and others. Also contains pointers to linked Blocks (ie. ExternalCodepluRootBlock).
Now, on to toolproofing...
- It is available only on open architecture controllers (with flash memory).
- It checks if the codeplug and the FLASH platform were created together (that they are syncronized).
Internal codeplug block 01 contains a 9 byte fingerprint record, which is calculated as the result of Encryption(FlashSignature, ModelNumber, SerialNumber, HardwareDefinitionVector, FlashCodeVector). The Encryption() function is similar to ordinary DES.
On power up, the radio always calculates the current fingerprint of the radio, and this value is compared to the 9 bytes stored in the codeplug.
So, if anything changed in internal codeplug (model, serial, Hvector, FlashCode, fingerprint itself) the radio will display the dreaded error message 'F01/93' and execute ROS_Idle (ROS means Radio Operating System).
The important thing at this state, the ROS is able to communicate with the external world using serial bus, so, if you have codeplug image from THIS radio, you will be able to put it back (by labtool for example) any time and resume normal operation.
NOTE: THERE IS NO TOOL CAPABLE OF CREATING A GOOD CODEPLUG, EXCEPT THE FACTORY ROBOT! There is some field software like LABTOOLS, but they can create WORKING codeplug, not GOOD one. The radio will be operational with such a codeplug, but someone will need to spend hours with test equipment tuning this radio to meet the specifications and adjust hundreds of settings to have all the specs in their type-approval window for the specified temperature and battery level range. Field Labtools do not support toolproof radios. Of course this fine tuning can be omitted if the radio used for HAM radio purposes.
'Fixing' or Recovering From a Toolproof
To properly backup a MTSX radio before attempting to hack it with lab perform the following:
USE LAB SOFTWARE FOR BACKING UP THE RADIO! Conventional RSS will NOT back up a radio like was previously thought!
- From the Main menu select F3>F4>F2 to read the radio with no unpack
- From the Main menu select F3>F6 to Write S-Record
- Type in a unique name ending in &guot;.bin' so as to not mistake it for anything else
- Then press F6 to write the archive.
**GUARD THIS IMAGE FILE WITH YOUR LIFE!** It saves you $300 and a very tough explanation to Motorola if something goes wrong!
This doesn't unpack the codeplug, rather what you have stored on disk is a raw binary image of the radios codeplug, internal and external. That way, if something goes drastically wrong when you are hacking later, and you get the dreaded FAIL 01/93, you can use the procedure below to dump the raw image back to the radio to restore it.
You cannot edit this codeplug from memory. As far as the RSS is concerned you did not load a codeplug BUT the information is there. In order to edit a codeplug using RSS, the codeplug has to be unpacked and we bypassed that step so that the RSS won't hose things up.
Now, if you do screw up your radio and end up with FAIL 01/93, simply do the following to restore it:
- From the Main menu select F3>F6
- Type in the filename given to your image from step 2 above
- Then press F2 to read the archive without unpack. If you read with unpack you will still end up with FAIL 01/93
- From the Main menu select F3>F4>F8>F8 to write the radios internal and external codeplug
- When this is done, the radio will reset and come up just as it was when you made the image
This procedure has been performed several times successfully.
It is safe to say that trying to do anything with a toolproofed radio in Lab is useless. These methods should be able to protect one from screwing up their radio if they want to try to circumvent the toolproofing. I'm sure there are persons out there that may be able to.
Changing band limits in all MTSX RSS versions
Grab yourself a good hex editor like Hex Workshop.
Open the MTSX.ODB file.
Search for the ASCII text string of one of your band limits (ie 136). This should get you to a list like this:
000177F0 9C 78 01 00 08 00 08 00 0D 00 22 22 31 33 36 20 2D 20 31 37 .x........'136 - 17
00017804 38 20 4D 48 7A 39 01 00 0D 00 22 22 34 30 33 20 2D 20 34 37 8 MHz9....'403 - 47
00017818 30 20 4D 48 7A 3A 01 00 0D 00 22 22 34 35 30 20 2D 20 35 32 0 MHz:....'450 - 52
0001782C 30 20 4D 48 7A 3B 01 00 0D 00 22 22 38 30 36 20 2D 20 38 37 0 MHz;....'806 - 87
00017840 30 20 4D 48 7A 3C 01 00 0D 00 22 22 38 32 35 20 2D 20 39 31 0 MHz<....'825 - 91
00017854 35 20 4D 48 7A 3D 01 00 0D 00 22 22 38 39 36 20 2D 20 39 34 5 MHz=....'896 - 94
00017868 31 20 4D 48 7A 3E 01 00 0D 00 22 22 31 2E 30 20 2D 20 31 2E 1 MHz>....'1.0 - 1.
0001787C 36 20 47 48 7A 3F 01 00 0D 00 22 22 31 2E 35 20 2D 20 32 2E 6 GHz?....'1.5 - 2.
00017890 30 20 47 48 7A 40 01 00 20 00 22 22 FC 77 01 00 10 78 01 00 0 GHz@.. .'.w...x..
Notice these are all the different bandsplits. Find yours and edit it to what you want.
Next you will have to find the actual frequency limits for the radio and change these as well. If you look further down in the file you should see a few lists like:
If you try and enter an invalid frequency in the RSS you will get a warning in the upper right box on the screen informing you of the legal band limits for your radio. This is where those limits are stored. Change them as required for your radio and you should be able to enter any frequency you want (no guarantees that it will actually transmit or receive there though).
Converting a B5 to B7 (C7)
Well, it looks like so far, the only way to convert a MTX B5 or B7 into a MTS C7 is to use Lab RSS. You need to read an archive for a MTS C7 and program it into the MTX.
Just remember to beware of the Toolproofing error...
Rss Software Motorola Mts2000 Flashport Usb
If you are creating a codeplug from scratch with Lab/Depot RSS, you need to ensure the following options are set:
In the 'Config, Features, Buttons, Lab' menu (page 1), set the following:
| LAB BUTTON CONFIGURATION | |||
| Button | Feature | Button | Feature |
| PTT | PTT | Soft Power Off | Soft Power Off |
| External PTT | External PTT | Left Arrow Key | Left Arrow |
| External Audio | External Audio | Home Key | Home |
| Normal Mode | Normal Opt Select | Right Arrow Key | Right Arrow |
| 3 Pos Switch | Switch 2 | JVA | Vehicle Adapter |
| 2 Pos Switch | Switch 0 | Man Down | Man Down |
| Hub Monitor | Switch 1 | Digit 0 | Keypad Digit |
In the 'Config, Features, Buttons, Lab' menu (page 2), set the following:
| LABTOOL BUTTON CONFIGURATION | |||
| Button | Feature | Button | Feature |
| Digit 1 | Keypad Digit | Digit 8 | Keypad Digit |
| Digit 2 | Keypad Digit | Digit 9 | Keypad Digit |
| Digit 3 | Keypad Digit | Digit * | Keypad Digit |
| Digit 4 | Keypad Digit | Digit # | Keypad Digit |
| Digit 5 | Keypad Digit | ||
| Digit 6 | Keypad Digit | ||
| Digit 7 | Keypad Digit |
Motorola Mts2000 Flashport Manual
In the 'Labtool, Labtool Config 2, Radio Wide', menu, set the following:
Rss Software Motorola Mts2000 Flashport Driver
| RADIOWIDE LABTOOL OPTIONS | |||
| Keypad Type | Menu & Num Keys | Button Debounce (ms) | 50 |
| Display Type | 1 Line 14 Chars | Synth Out of Lock | Disabled |
| HHCH Capable | Disable | Zone/Chan Select | Last Zone |
Remember, if you are creating a codeplug from scratch, you will need to do a fill service alignment after programming the radio.
If you have any questions, email us and we'll try to help.