GE PCS Radio programming notes

GE/Ericsson PCS radio programming notes:
----------------------------------------
interfacing with the radio, entering programming mode:

Reset: send null byte (0x00) at 300 baud. Then switch to 1200 baud for remaining session.

Enter programming mode (at 1200 baud):
send: U
receive: >
Note: ">" seems to be the "ready" char. The unit will not respond to any other programming commands until you have performed these two steps above: reset and enter programming mode.

Query radio ID:
send: G2
expect: id string? Model?
Note: 2C11 = 8 channel UHF (440-470), 2C01 = 2 channel UHF (440-470), others?

Download entire program memory from radio:
send: G7
expect: ascii-encoded hex string representing memory segment, terminated w/ ready char ">"
Note: Radio memory seems to be about 512 (0x200) bytes. See below for decoding this

Download specific segment of memory from radio:
send: G4XXYYYY (where XX is length of segment in hex, and YYYY is starting offset of memory segment in hex)
expect: ascii-encoded hex string representing memory segment. See below for more info on format.

Upload programming to radio:
send: G1XXYYYYZ...
Notes: Where XX is number of bytes in hex to program, YYYY is hex offset of start of segment, and Z... is the payload (in ascii-encoded hex).
PCS programming software breaks up the programming into 64 (0x20) bytes (2 "lines") at a time.
See below for more encoding/decoding of the channel structure format.

Exit programming mode:
send: G9
note: will require the above mentioned reset/programming sequence to re-enter programming mode again. (reset w/ 0x00 at 300 baud, then send U ascii char at 1200 baud)


------------------------
example programming load configuration:
╔══════════════════════════════════════════════════════════════════════════════╗
║                             Channel Data Screen                              ║
║                         3 - 16 chan  UHF  440 - 470                          ║
║                                                                              ║
║          Frequency       Chan Guard       Chan Options     Type-99 Decodes   ║
║ Ch Tx        Rx         Tx     Rx     Pw STE DTMF ANI Bsy Tb Ind Grp Spr Qck ║
║ 1  440.00000 440.00000                Lo No  No   No  No  1  No  No  No  No  ║
║ 2  442.00000 442.05000 88.5           Hi No  No   No  No  1  No  No  No  No  ║
║ 3  443.00000 443.05000        88.5    Lo No  No   No  No  1  No  No  No  No  ║
║ 4  444.00000 444.05000 110.9          Hi No  No   No  No  1  No  No  No  No  ║
║ 5  450.00000 450.00000        110.9   Lo No  No   No  No  1  No  No  No  No  ║
║ 6  460.00000 460.00000                Hi No  No   No  No  1  No  No  No  No  ║
║ 7  466.00000 466.00000 100.0  100.0   Lo Yes No   No  No  1  No  No  No  No  ║
║ 8  466.00000 466.00000 100.0  100.0   Lo No  No   No  No  1  Yes Yes Yes No  ║
║                                                                              ║
║  Enter transmit frequency in Mhz                                             ║
╚══════════════════════════════════════════════════════════════════════════════╝

Data format details of the load received with G7 or G4 cmd:
Note each "line" is just a structure of 32 ascii chars, here interpreted as 16 bytes of hex in the radios programming.

first line (32 bytes, offset 0x000):
00040843B1030130372F32362F313300
first half could be capabilites, global settings, serial number,etc.
Second half seems to be programming date, in null-terminated ascii, e.g., 07/25/13

remaining channel structures aka "lines" (16 bytes each):
---------------------------------
example data from channel 1 (offset 0x010):
1000F6E10000001001130100000000F4

0  1 2 3  4 5  6  7  8 9 A  B C  D E  F  < hex byte addr
10 00F6E1 0000 00 10 011301 0000 0000 F4 < example data chunk

mapping of each channel line:
byte location, hex:
00:    0x10 = ? rx enabled?
01-03: RX freq, big-endian, formula: ((this - 1) * 0.00625 + 45 MHz = RX_freq_MHz)
04-05: RX CTCSS tone freq and channel options, little-endian. First nibble is chan opts bit mask; last 3 nibbles are rx ctcss tone. See notes.
06:    type 99 decode options?
07:    0x10 = ?, tx enabled?
08-0A: TX freq, big-endian, formula: ((this - 1) * 0.00625 = RX_freq_MHz)
0B-0C: TX CTCSS tone freq and channel options, little-endian. First nibble is chan opts bit mask; last 3 nibbles are rx ctcss tone. See notes.
0D:    power level? 0x01 = high, 0x00 = low
0E:    ?? (some other options?)
0F:    Checksum byte (2's compliment of adding bytes 00-0E. This value added to sum of bytes 00-0E should be zero.)

Notes:
1. frequencies seem to be based on multiples of 6.25 kHz step.
2. ctcss freq: divide last 3 nibbles by 10 to get ctcss tone freq e.g: 0x375 = 885 = 88.5 Hz