woensdag 25 januari 2017

Program the Racal Cougar - Part 1



Inspired by an article by Jacob, PE2CJ, posted in the januari 2017 edition of the VERON (Dutch radio society) magazine about the Racal Cougar surplus 4 meter tranceiver and how to modify the channel frequencies stored in the EEprom i wondered if it was possible to change this information without having to desolder the EEprom and program it outside the set.

I ordered a set from Baco Army Goods and after a couple of days a box containing a Racal Cougar PRM 4515L, a 10 Watt S.M.T. TA4523L/010 PA and E.C.U MA 4730A Remote control unit arrived.



After making sure the set powered on and worked correctly the first thing i did was applying the NATO Squelch Mod described by Jacob on his website. This allowed me to do some tests with my Ascom 4 meter set which doesn't have support for a 150 hz CTCSS tone.

The plan


Programming the PRM-4515 is done using a special programmer (MA-4073) or fill gun (MA-4083). These devices are hard to find and even if you manage to find one, they will go for absurd prices.

Wouldn’t it be possible to program this set using an Arduino ?

(Technical) documentation for this set is scarce except for a technical manual for the UHF version, the PRM-4515U, hosted on the Crypto Museum website. Since the different versions of the PRM-4515 share (almost) the same processor board most of the information in this document also applies to the 4515L version.

Although there is  plenty information in this manual describing how the PRM-4515(U) and its microprocessor communicate using PWM data on the “F” pin of the audio / E.C.U connector there is little information on the protocol used and what bits to send to program this thing.

Reverse engineering was needed, i love it !

Reverse engineering the protocol


After making a tap on the ground (E) and PTT (F) pins and connecting it to my oscilloscoop the PWM signal was made visible. Using the Control Unit the data send for every command was copied in a notebook. This gave me an overview of the data send by this unit.

Using an Arduino i was able to send these commands back to the Racal which allowed me to change channels, crypto mode (Clear , A or B) and Squelch On / Off.

Next i wrote a Arduino sketch that dumped the data in Hexadecimal format on the serial console and hooked it to a fill gun, wow that's a lot of data :-) !

There were multiple commands related to storage, sub-tone and frequencies send of which the frequency ones had my interest. Simply repeating the command is one thing but actually changing the frequency to any channel on the 12.5 kHz raster between 66 and 88 Mhz was my goal.

After looking at the data related to the frequency settings for some hours it helped a lot writing it out in binary code and after a while i noticed a pattern.

The result

 



Having written some Arduino test code i was able to program the channels for transmit and receive frequencies. 

The movie clip shows me changing the RX frequency for channel 0. Its in dutch language and shaky and i probably need to reshoot it to be at least in English. 

Next steps

 

Next is writing some decent code allowing you to use the Arduino Serial Console to enter frequencies for the channels and use this to program the Racal.

Details on the protocol, Arduino and sketch will follow !