RECESSIM - User contributions [en]

DFM-17 Radiosonde

2025-01-24T22:48:06Z

Trevor229: Add info from gx1400's data_dfm_RE repo, clean up formatting, add new graphics and new repo for T/H measurement

The DFM-17 is a balloon-launched radiosonde manufactured by GRAW Radiosondes GmbH & Co. KG, and used for meteorological sounding.
[[File:DFM-17 Radiosonde in hand.jpg|thumb|The label side view of a DFM-17 Radiosonde]]
<br />

==Overview==
The DFM-17 radiosonde succeeds the DFM-09 radiosonde. Graw began a contract with NOAA in the US to provide radiosondes. As of Late 2021, several sites have made the transition as part of NOAA’s Operational Test and Evaluation (OT&E) program. 45 CONUS sites are expected to use these radiosondes in early 2022. <ref>[https://www.graw.de/news/press/graw-delivers-to-usa-noaanational-weather-service/ GRAW delivers to USA NOAA/National Weather Service]. GRAW Radiosondes GmbH & Co. KG. Retrieved 17 November 2021.</ref>
<br />

==Specs <ref>https://www.graw.de/products/radiosondes/dfm-17/</ref>==

*Weight: 63g
*Size: 90 x 67 x 44 mm
*Power supply: 2 CR123A batteries
*Estimated runtime: ~240 minutes
*Transmission rate: 1 packet/sec
*Bandwidth: ~10 kHz (Website lists <12)
*Frequency range: 400 - 405.99 MHz
*Modulation: GFSK @ 1250 bits/s
*TX Power: ~100mW
*Error Correction: Code-spreading, interleaving
*SoC: STM32F100R8T6B, 24MHz, 8KB RAM, 64KB Flash
*GPS: U-Blox MAX-M8C-0-10
*Transmitter: Si4063
*Optional:
**XDATA interface (24 bytes/s)
**NFC ground check
**Barometric pressure sensor.

==Peripheral attachment points==

====LED's and Buttons====

*Button = PC8
*LED_Y = PC7
*LED_G = PC6
*LED_R = PB12

====uBlox GPS (USART_2) - U11====

*PA3(RX) = GPS TXD (Pin 2)
*PA2(TX) = GPS RXD (Pin 3)
*PB8 = GPS 1pps (Pin 4) (LED next to flex cable connector)
*PC14 = RESET

====UART via USB Port (USART_1)====

*PA9(TX) = USB D+
*PA10(RX) = USB D-
*PC2 = GND/VBus Pin?

====Si4063 (SPI_1) - U10====

*PB2 = CS/nSEL (Pin 15)
*PC3 - SDN (Pin 1)
*PA7 = SDI (Pin 14)
*PA6 = SDO (Pin 13)
*PA5 = SCLK (Pin 12)
*PD0 = GPIO2 (Pin 19)
*PA4 = GPIO3 (Pin 20)

====XDATA Header (2x2 pin unpopulated)====

*PB11 = Pin 3
*PB10 = Pin 2
**Pads need solder bridge or 0 ohm links. Pin 1 or 4 can be bridged to act as GND. I suspect the SOT23-6 footprint is populated when xdata is in use. Unknown where the xdata perhipheral would get VCC.

<gallery>
File:Xdata_pinout_dfm17.jpg|alt=xdata interface pinout|XDATA interface pinout, numbered for clarity. Not official.
</gallery>

==IC Attachment Points==

===STG719 (DPST) - U2===

*PC11 = IN (Pin 1)

===STG719 (DPST) - U3===

*PD2 = IN (Pin 1)

===STG719 (DPST) - U4===

*PB5 = IN (Pin 1)

===STG719 (DPST) - U5===

*PB4= IN (Pin 1)

===DG636 (Dual DPST) - U6===

*VDD = ENABLE (always HIGH) (Pin 2)
*PA11, PB0, PA1 = A0 (Pin 1)
*PC10 = A1 (Pin 14)

===STG719 (DPST) - U7===

*PC10 (routes under STM) = IN (Pin 1)

===SN74LV4053 (Triple 2Ch Mux/Demux) - U8===

*PB13 & PB14 = A (Pin 11)
**STM pins connected by trace? ''Why? Read back?''
*PC10 = B (Pin 10) & C (Pin 9)
**IC pins connected by trace

===LMV761 (Comparator) - U9===
*PA12 & PB15 = OUT (Pin 4 via cap)

===Analog Inputs to STM32===

*PA0 - Vbatt/Power supply voltage (needs confirmation, V measured at pin is VCC)
*PB1 - Vbatt/Power supply current monitor (needs confirmation, V measured at pin seems to match 1V = 1A)

===Battery Management IC===

*PC0 - Hold high to prevent BMS from removing battery power after boot up

===NFC/RFID 4k EEPROM - U12===

*PC13 = RF WIP/Busy (Pin 7)
*PB6 = SCL (Pin 6)
*PB7 = SDA (Pin 5)
*PC0 connected to Pin 1 (Vout)
** NFC antenna pads are below left side 3 pins of uBlox module

<br />
==Identified Supplementary IC's==
<gallery>
File:DFM-17 Uref overlay.jpg|alt=U reference designators overlaid|Top view of PCB with U reference designators overlaid
</gallery>
{| class="wikitable"
|+
IC Part Numbers and Markings
!
!Manufacturer
!Part Number
!Description
!Package
!Part Marking
!Datasheet
!Note
|-
|U1
|STMicroelectronics
|STM32F100R8T6B
|ARM MCU, 24MHz, 8KB RAM, 64KB Flash
|LQFP48
|ARM 32F100R8T6B
|[https://www.mouser.com/datasheet/2/389/stm32f100cb-1851080.pdf Mouser]
|''Some recent batches of the DFM-17 have been using knockoff STM32s! The chip shortage strikes again!''
|-
|U2, U3, U4, U5, U7
|ST
|STG719
|STG719STR Low Voltage 4 Ohm SPDT Switch
|SOT-23-6
|V719
|[https://www.mouser.com/datasheet/2/389/stg719-1850635.pdf Mouser]
|''Analog ADG719 pin compatible equivalent?''
|-
|U6
|Vishay
|DG636E
|0.3 pC Charge Injection, 100 pA Leakage
CMOS ± 5 V / 5 V / 3 V Dual SPDT Analog Switch
|TSSOP14
|636EE
|[https://www.mouser.com/datasheet/2/427/dg636e-1766306.pdf Mouser]
|
|-
|U8
|Texas Instruments
|SN74LV4053A
|Triple 2-Channel Analog Multiplexer/Demultiplexer
|SOT-23-6
|LW053A
|[https://www.ti.com/lit/ds/symlink/sn74lv4053a.pdf Texas Instruments]
|
|-
|U9
|Texas Instruments
|LMV761
|Low Voltage Precision Comparator with Push/Pull Output
|SOT-23-6
|C22A
|[https://www.ti.com/lit/ds/symlink/lmv762.pdf Texas Instruments]
|
|-
|U10
|Silicon Labs
|Si4063-C2A
|High Performance, Low Current Transmitter
|QFN20
|40632A
C01Q81

2217
|[https://www.silabs.com/documents/public/data-sheets/Si4063-60-C.pdf Silcon Labs]
|
|-
|U11
|u-Blox
|MAX-M8C-0-10
|u-blox M8 GNSS module, ROM, crystal
|
|MAX-M8C-0-10
|[https://www.u-blox.com/sites/default/files/MAX-M8-FW3_DataSheet_%28UBX-15031506%29.pdf u-Blox]
|
|-
|U12
|STMicroelectronics
|M24LR04E-R
|Dynamic NFC/RFID tag IC with 4-Kbit EEPROM,

energy harvesting, I²C bus and ISO 15693 RF interface
|UDFN8
|4BEB 8150
|[https://www.st.com/resource/en/datasheet/m24lr04e-r.pdf STMicroelectronics]
|''Stores configuration of serial ports, sonde serial(?), calibration, and measurement sequences''
|-
|U13
|STMicroelectronics
|LD series, ''unsure on specific part''
|3.3V Low Drop Out Voltage Regulator
|DFN6
|33R
|[https://www.mouser.com/datasheet/2/389/ld39050-1849494.pdf Possible part from Mouser]
|''Needs verification, appears to provide 3.3V regulated power''
|-
|U14
|
|
|
|
|
|
|''Looks like a high side current monitor amplifier, need more information''
|-
|U15
|ABLIC
|S-8200A Series, ''unsure on specific Part Number''
|BATTERY PROTECTION IC FOR 1-CELL PACK
|
|VDL
|[https://www.mouser.com/datasheet/2/360/S8200A_E-1365901.pdf Mouser]
|''Needs verification, Potentially a Winsok WSTDW01 Battery Protection IC?''
|-
|U16
|???
|???
|???
|???
|AL

___
|
|''In-line with battery power, need more information; chip marking''
|-
|U17
|???
|???
|???
|???
|???
|???
|''Connected to USB data lines, likely a UART, isolation, and/or level shifter''
|}
* Do note these reference designators are not official and are here for us to keep track. The PCB has no markings.
<br />
==Photos==
<gallery>
File:DFM-17 Internal.jpg|Internal view of the DFM-17
File:DFM-17 Battery Holder.jpg|The bottom side of the PCB in the DFM-17
File:DFM-17 NOAA Label.jpg|The label sticker NOAA(US) puts on the back of their DFM-17 radiosondes
File:Dfm17-2layers.png|A view of the DFM-17 Radiosonde showing both layers to better assist tracing connections while reverse engineering the hardware.
File:Label id speculaton.jpg|Possible meanings of the internal labels and values. The date code in particular which may be useful to date production times. NWS sondes have the same cryptic string printed on the outside of the sonde where the mfg. date normally is on other countries'. "TU" may just indicate the board comes with sensors according to a third party source<ref>https://sondehunt.de/language/en/archive/1189</ref>.
File:Sensor stalk pinout.jpg|Pinout of the DFM-17 sensor stalk. Not all pins are used, and some seemingly are connected to a trace but end abruptly.
File:V719 and others removed.jpg|V719 SOT-23-6 packages removed as well as 636EE (SPDT Switch) and LW053A (Mux/Demuxer)
File:Stalk pinout mapping.png|Mapping of the pins on the sensor stalk to the connector and their corresponding IC/IO lines. '''''<u>Top of sensor stalk corresponds to bottom of pictured connector!</u>'''''
File:Dfm17_barepcb_back_traces.jpg|Bare PCB without major ICs on it and rear traces colored in purple. Any other via goes directly to main groundplane.
</gallery>

==Disassembly==
<br />

#Examine rope, parachute and parachute rigging lines for viability. Neatly organize the flight rigging if usable. Discard if not viable for reuse.
#Cut the zip tie surrounding the Styrofoam from the top portion by the rope loop.
#Pull the rope loop out, there should be little to no resistance.
#Make a slice in the sticker<ref>[[:File:DFM-17 NOAA Label.jpg|File:DFM-17 NOAA Label.jpg]]</ref> where the two pieces of Styrofoam meet.
#Pull apart the two Styrofoam pieces to reveal the circuit board.
#Pull the circuit board out. There will be some resistance.
#The board is now separated from the Styrofoam shell, reuse if desired.
#Pull the two CR123A batteries out, keep or discard them. The board can run off USB power. Batteries are not necessary for development on this board.

==Reassembly==
<br />

#Insert two fresh CR123A batteries into the board.
#Line up the board to the IO cutouts in the Styrofoam, begin to push into the slots. Make sure the antenna wire comes through.
#Press the top piece of Styrofoam into place.
#Tape or apply another sticker onto the back label. (Optional)
#Insert the plastic rope loop piece.
#zip tie the shell together, the zip tie end should end up on the edge nearest to the power button.
#Rope on a balloon/drone/kite/etc.. to the rope loop.
#Power on the device by pressing and holding the button, you will see a yellow light blink, hold until the light turns solid.

==Mini USB Port==
The mini USB port on the board does not use the USB protocol for communication, it is a UART bus. However using USB to power the board should not harm the board in theory.

In order to use it, splice a USB cable and wire up a USB<->TTL adapter with the following pins:

*VBUS: 5 Volts DC
*D- (typically white): TX
*D+ (typically green): RX
*GND: GND

The board will communicate with the official GRAWMET software using this approach. Reverse engineering of the port's protocol is underway, however it is believed to use a similar, if not the same protocol the [https://www.graw.de/products/radiosondes/ps-15/ PS-15] uses.

==Hardware modifications==

====SMA Port====
The DFM17 antenna section has pads sized for an SMA connector (likely leftover from development). Any board edge mount conector should work.

====SWD Header====
To program the DFM, you will need to connect to the SWD header. If you want to do it properly, an [https://adafru.it/4048 Adafruit Skinny SWD SMT] connector will fit. You can also 3D print [https://www.printables.com/model/594752-dfm17-swd-programming-jig-clip-thing this model] by trickv to clamp the connector to the pads for a solderless approach.

I suggest also ordering [https://www.adafruit.com/product/1675 this ribbon cable] and [https://www.adafruit.com/product/2743 this breakout] to be able to attach to your STLink much easier.

Do note that if you wish to put the PCB back in the styrofoam housing, you will need to slice away some of the inside to allow the connector to fit. Approximately 40mm or so. You will need to do this if you attach pin headers for xdata as well.

====Minimizing transmit range====
As amateurs we are not licensed to transmit in the 400-406MHz band, so for testing purposes one should perform this mod. If you have an appropriate SMA connector, solder it in place of the antenna wire and connect a 50 ohm dummy load to it (reminder that the power is approx 100mW).
If no connector is available, unsolder the antenna wire and take two 100 ohm resistors and twist them in parallel, then solder them to the center pad and one of the side pads on the SMA footprint. This creates a 50 ohm dummy load for the Si4036 to transmit into. The range is reduced to a couple tens of feet.

<u>'''Also if you are running a radiosonde_auto_rx instance, don't forget to turn it off during testing to avoid feeding erroneous data to Sondehub!'''</u>
<gallery>
File:Modified DFM-17 Radiosonde.jpg|MrARM's modified DFM-17 with a SWD connector and an SMA antenna port
File:Dfm 17 swd and resistors.jpg|Trevor229's DFM with ST-Link SWD pins connected to debug interface and 50 ohm dummy load mod.
</gallery>

==Developing for and Programming the board==
[[File:Dfm17_swd_pinout_pretty.jpg|thumb|Pinout of the SWD Port]]

When lab testing, you can power the board from the USB header. It also appears to run fine supplying 3.3V to the SWD port (STLink and clones do this).

The board uses a STM32, and requires a ST-Link to program. The process used to upload code to the MCU is the same as the Vaisala RS41 radiosonde, you will need to connect the VTRef(3.3V), Ground, SWDIO, SWDCLK and RST pins to your ST-Link.

The board can run without external power being supplied when programming. This board has read-out protection enabled similar to the RS41 and this must be disabled before you can flash firmware to the board.

==Software==

A few attempts have been made to build replacement firmware for these devices, the key goal being to be able to re-fly a sonde as an amateur payload.

There was an early attempt called dfm17_hamradio [https://github.com/gx1400/dfm17_hamradio here] and [https://github.com/trickv/dfm17_hamradio/tree/aprs-fifo-gps-superhacky here].

The most mature looking effort is [https://github.com/mikaelnousiainen/RS41ng RS41ng] which has experimental support.

There is now a repository that uses code from RS41ng to run the sampling circuitry and read from the original temperature and humidity sensors [https://github.com/robots/radiosonde_dfm17 here.]

<references />

File:Dfm17 swd pinout pretty.jpg

2025-01-24T22:28:04Z

Trevor229:

File:Dfm17 barepcb back traces.jpg

2025-01-24T22:04:51Z

Trevor229:

File:Xdata pinout dfm17.jpg

2025-01-24T22:00:40Z

Trevor229:

CD&F (Siren Controller)

2024-08-17T02:10:47Z

Trevor229: Add info about discovered DTMF modules and fix some numbering issues

Civil Defense & Fire (CD&F) siren controllers function on two-tone Motorola QuikCall, Plectron, or General Electric style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these devices or the company nowadays, but here is what I have discovered.

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* <s>Recreate schematics of each daughterboard to help with figuring out their functionality.</s> Shown in the manual
* <s>Document the theory of operation and create a rough block diagram for functionality.</s> Shown in the manual
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Design a new tone decoder daughterboard using more common components (LM567)
* Recreate timer PCB to allow for additional signals to be added to models without extra timers
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally (LCRx only)

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were more commonplace back in the 1980's and 1990's. Despite that, there are many units that were shipped into the mid 2000's, and the company was merged/acquired by Sentry Siren sometime in the mid 2010's. The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:

*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-3'''<ref>https://fccid.io/F498POCDF-2</ref> Not registered on FCC database, but exists. UHF variant of SC series (SC3)
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz.

===Speculation===
My current research shows the existence of at least two or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

* This model that I own, which is always civil defense yellow and measures 325x232x92mm a few times on the internet in videos and photos
** Appears to always have it's radio receiver on the motherboard with descrete components.

* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board, some kind of descrete but shielded radio board, or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards
** I've also noticed a possibly earlier variant that has a screw latch instead of a folding wing type latch.

My large silver unit does not appear to have an FCC ID. This kinda makes sense since the only RF part is a pre-certified radio receiver

I have also noticed at least one unit that has the "PO" of F49POCDF markered out, which would make it F49CDF, which is a vaild ID. I believe that F49CDF and F49POCDF may be the same units with just a different variation or newer/older models.

CD&F makes other products as well, though the only other example I have seen is some sort of electronic siren controller on Twitter (LINK HERE)
<br />

==Shared Components and Info==
This section contains part descriptions and information that is relevant across the entire line of controllers.

===Manual===
I was given a scanned copy of a manual for the SC line of controllers, though there is plenty of info relevant to all models within. I have uploaded it to [https://archive.org/details/cdf-radio-manual archive.org here.]

===Naming/Serial Convention===
According to the manual, this is how the controller units are named. At least, the larger SC variants. Some older units seem to follow slightly different conventions (ex. SC3M0-1322)

<pre>
SC(V)-(W)-(XY)-(ZZZZ)
</pre>

'''SC''' - Siren Controller

'''V''' - Frequency band
** '''1''' - Low Band VHF (30-50MHz)
** '''2''' - High Band VHF (148-173MHz)
** '''3''' - UHF (440-480MHz)

'''W''' - ???

'''X''' - Tone format & timing
** '''P''' - Plectron
** '''M''' - Motorola
** '''G''' - General Electric
** '''F''' - ??? (Mentioned in manual, Maybe Motorola 4 tone?)

'''Y''' - Revision number

'''Z''' - Serial Number

This is how I interpreted it, though I could be wrong about the revision number placement.

===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

{|
|+ <U>'''Tone Filter Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Pin
!Function
|-
|'''P1-1'''
|Audio in
|-
|'''P1-2'''
|Vin (+12v)
|-
|'''P1-3'''
|GND
|-
|'''P1-4'''
|Logic NOT signal out (default high, drops low when signal is in passband)
|-
|'''P1-5'''
|Logic Out (Not used on this board, but is the opposite of P4)
|}
</div>
</div>
|}

====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.

=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.

With that being said, you may want to test your own filters. Here is how I tested mine:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

Through some component changes, you will probably be able to change the adjustable range of the filters. That is something I am going to investigate soon.

====Tone filter troubleshooting====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)
*Modern replacement - TI CD4069UBE<ref>https://www.ti.com/lit/ds/symlink/cd4069ub.pdf</ref>

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)
*Modern replacement - TI CD4050BE<ref>https://www.ti.com/lit/ds/symlink/cd4050b.pdf</ref>

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)
*Modern replacement - TI CD4073BE<ref>https://www.ti.com/lit/ds/symlink/cd4073b.pdf</ref>

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)
*Modern replacement - NE555P/LM555CN

{|
|+ <U>'''Decoder Module Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Output, goes to programming section
|-
|'''P2-3'''
|Input, goes to programming section
|-
|'''P2-4'''
|Output to Timer, thru diode customization section between decoders (CR5 & CR8)
|-
|'''P2-5'''
|From CR5 diode, test output? (N/C on main board)
|}
</div>
</div>
|}

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Modules===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

====DIP Switch Config====

----
=====SW1 (Total Time)=====
The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

According to the manual, SW1 controls the total time that the function is activated with a +/- 10% margin. The switches add together in a binary sequence when closed (up)

{|
|+ <U>'''SW1 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|128 sec.
|-
|'''2'''
|64 sec.
|-
|'''3'''
|32 sec.
|-
|'''4'''
|16 sec.
|-
|'''5'''
|8 sec.
|-
|'''6'''
|4 sec.
|-
|'''7'''
|2 sec.
|-
|'''8'''
|1 sec.
|}
</div>
</div>
|}

An example shown in the manual is switches 1, 3, 4, and 6 closed, providing a run time of 3 minutes (180s).

----
=====SW2 & SW3 (On/Off time during cycle)=====

On CD cycle/fire timers, the addition of ommitted components and SW2/SW3 allows for controlling the time spent on and off during the total cycle time defined by SW1. These switches add up in a binary sequence when open (down) with a +/- 10% margin.

*SW2 controls the time spent ON during a cycle
*SW3 controls the time spent OFF during a cycle

{|
|+ <U>'''SW2/3 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|1 sec.
|-
|'''2'''
|2 sec.
|-
|'''3'''
|4 sec.
|-
|'''4'''
|8 sec.
|}
</div>
</div>
|}

----

====Converting a Steady Timer to a CD Cycle Timer====

With a bit of patience and the missing components detailed in the manual, one could theoretically turn a CD steady timer into a CD Cycle/Fire timer.

Do note however that if you do so, you must cut or desolder the jumper in the W1 position.

=====Caveats=====

Unfortunately, you cannot just replace W1 with a switch. If you attempt to do so, the timer will start and latch for the duration of the first attack cycle, then turn off, then the output of U2 will go into oscillation. After some experimentation however, if you bend pin 3 of U3 up and install a second switch that switches pin 3 to its pad, then you can control what mode the timer operates in.

*W1 "off" and U3 pin 3 "on" - CD Cycle functionality
*W2 "on" and U3 pin 3 "off" - CD Steady functionality

----

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s. This is consistent with the stated +/- 10% margin.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)
*Modern replacement - TI CD4081BE<ref>https://www.ti.com/lit/ds/symlink/cd4073b.pdf</ref>

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)
*Modern replacement - TI CD4011BE<ref>https://www.ti.com/lit/ds/symlink/cd4011b.pdf</ref>

'''U3''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer) [ONLY PRESENT ON CD CYCLE/FIRE MODELS]
*Modern replacement - NE555P/LM555CN

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)
*Modern replacement - ICM7250IPE+ ($10/chip!)

{|
|+ <U>'''Cycle Timer Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|Signal Out to Relay Driver
|-
|'''P1-2'''
|STOP (Also local control via terminal strip)
|-
|'''P1-3'''
|START (Also local control via terminal strip)
|-
|'''P1-4'''
|Cancel "A" (from manual)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Decoder Cancel (from manual)
|-
|'''P2-3'''
|Cancel "B" (Coupled to GND via C44)
|-
|'''P2-4'''
|Cancel "C" (N/C on Main Board)
|-
|'''P2-5'''
|N/C on Main Board
|}
</div>
</div>
|}

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />

----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

{|
|+ <U>'''Relay Driver Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C on Main Board, but traces route to it on driver board
|-
|'''P1-2'''
|Signal Input from timer
|-
|'''P1-3'''
|N/C on driver board
|-
|'''P1-4'''
|N/C on driver board
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Relay #1 Coil (E9 on I/O header)
|-
|'''P2-3'''
|Relay #1 Coil (E10 on I/O header)
|-
|'''P2-4'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|-
|'''P2-5'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|}
</div>
</div>
|}

<br />
----

===I/O connector pinout===
This connector is the one just left of the relay. Houses the relay wires and the start/stop button inputs.

* E10: Relay Coil
* E9: Relay Coil
* E8: Start terminal
* E7: Stop terminal
* E6: Common terminal

<br />
----

===Board Connectors===
The molex connectors that are used on all the modular boards are Molex KK series with a .156" pitch.
* [http://www.mouser.com/catalog/645/usd/1630.pdf Molex KK Series connectors datasheet]
* [https://www.mouser.com/catalog/645/usd/1631.pdf Molex KK series headers datasheet]

The modern verison of these seems to be the molex [https://www.molex.com/en-us/products/connectors/wire-to-board-connectors/kk-connectors KK 396 series.] Same shapes, different material (nylon vs polyester(!))

==Programming==

There are two small sections below the tone decoders and inbetween the two decoder boards that allow for changing the path of signals in and out of the decoder boards. This allows for changing the behavior of the unit depending on the number of tone filters installed.

For example, my unit has two filters installed and the "on" sequence is A1, A2 (1153/1285 Hz), and "off" is the opposite. Since there are 4 card positions, you can also configure a 3 and 4 card setup

===2 Card Setup===
Probably the most common, and what my unit is configured for. Sending A1, A2 turns the unit on, and A2, A1 turns it off. The jumpers are configured as follows:

*CR1 diode from 1 to A1
*CR2 diode from 2 to A2
*B1 to A2 jumper (in row 3)
*A1 to B2 jumper (in row 4)

*CR5 in place facing the board marking
*CR6 empty
*CR7 empty
*CR8 in place facing the board marking

<gallery>

</gallery>

===3 Card Setup===
One tone filter is a "common" tone, and the other two are completely different frequencies. If for example, 800 Hz is the common tone and the others are 740 and 930, then one could configure the unit to turn on with 800/740, and off with 800/930.

===4 Card Setup===
In this case, there is a different tone pair for each action. On has two completely different frequencies compared to off.

I plan on figuring out what the hell is required to change these configs and document it here soon.

<br />

==LCRx (Simpler Small Yellow Unit)==
This unit is the first type I acquired. It is significantly smaller and simpler than the other types, only allowing for a single function timer, but up to four tone filters. This allows for either a 2, 3 or 4 card setup.

===Specifications===

====Physical====
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''LCRx Series:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#(LCRx) Transformer wiring|(LCRx) transformer wiring]] section below.

----

====Photos====

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
====(LCRx) Transformer wiring====
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

===Architecture & Operation===
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

As for the LCR-1 variant, based on the FCC-ID data it seems that the receiver will be nearly identical, though the resulting IF mixer will most likely be an addition rather than subtraction circuit due to the lower operation frequency.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />

==SCx (Multi-Option Large Silver/Yellow/Red Unit)==
The second type of unit I have acquired (an SC2), is much larger and more complex. It can support up to 3 (technically 4) function timers, 4 decoders, and six tone filters. This allows for a much more complex operation.

The manual specifies a number of optional add-ons:

* ''D1'' - Thermostat controlled heater (mounts below the receiver board)
* ''D2'' - CTCSS decoder board (mostly obsolete, rare)
* ''D3'' - Top deck mount VHF low antenna
* ''D4'' - Top deck mount VHF high antenna
* ''D5'' - Additional heavy duty 10A relay (relay #2)
* ''D6'' - Cabinet painted red
* ''D7'' - Additional intermodulation filter (not sure what this is?)
* ''D8'' - Audio kit (for servicing decoders)
* ''D9'' - Test transmitter encoder (possibly one of the FCC-IDs? Maybe CDF1 and CDF2.)
* ''D10'' - Additional tone filter

===Specifications===

====Physical====

'''SC Series:'''

* '''Height:''' 325mm (12.75") & 387mm (15.25") from bracket top and bottom
* '''Width:''' 320mm (12.59") top section & 288mm (11.33") bottom section
* '''Depth:''' 95mm (3.74") top section & 90mm (3.54") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. ?? lbs

'''Transformer:'''<ref>https://www.hammfg.com/electronics/transformers/power/266.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 24v DC OR 12v DC depending on config (Unloaded is higher)
*'''Max Current:''' 1A/2A (24/12v)
*'''Max VA:''' 24

<gallery>
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

More info on configuring in the [[#(SC) Transformer wiring| SC transformer wiring]] section below.

----
====Photos====

<gallery>
File:Cdf_SC_front_case.jpg|Front case before restoration
File:Cdf_SC_front_restored.jpg|Front case of my unit after restoration
File:Cdf_SC_inside.jpg|Inside my restored unit with missing activation buttons added
File:Cdf_SC_nameplate.jpg|Nameplate with details
File:Cdf_SC_latch_side.jpg|Latch side of my restored unit
File:Cdf_SC_hinge_side.jpg|Hinge side of my restored unit
File:Cdf_SC_back.jpg|Back of my restored unit
File:Cdf_SC_top.jpg|Top of my restored unit showing the antenna bulkhead
File:Cdf_SC_bottom.jpg|Bottom of the restored unit showing optional SO-239 connector
</gallery>

<br />
----

====(SC) Transformer wiring====
The main transformer in the unit is a [https://www.hammfg.com/electronics/transformers/power/266.pdf 266J24 from Hammond Manufacturing].

*'''115v Operation:''' Tie '''black/brown''' together and '''white/orange''' together.

*'''230v Operation:''' Tie '''white/brown''' together and insulate. Input power on '''black''' and '''orange'''.

The main board operates on 12v, so just make sure that the red/grey and yellow/blue wires are tied together in those pairs for 12v operation.

<gallery>
File:Toroid1.gif|Transformer pinout from Hammond
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

----

===Tone Filter Test Board===
The tone filter test board is pretty self explanatory. It contains six LEDs, one for each tone filter, which are connected to a MC14069BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> hex inverter IC.

When the a tone filter detects a signal within its configured bandwidth and pulls it's P1-4 pin low, the hex inverter IC inverts that signal, pulling the corresponding LED high which illuminates it, indicating the filter is active.

{|
|+ <U>'''Tone Filter Test Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|4th tone filter (J3)
|-
|'''P1-2'''
|3rd tone filter (J4)
|-
|'''P1-3'''
|2nd tone filter (J5)
|-
|'''P1-4'''
|1st tone filter (J6)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|5th tone filter (J2)
|-
|'''P2-3'''
|6th tone filter (J1)
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|N/C
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_decodertester_front.jpg|Front of the SC series tone filter test board
File:Cdf_SC_decodertester_rear.jpg|Rear of the SC series tone filter test board
</gallery>

----

===Programming board===
The programming board is the center of the unit's operation. It's a bare board that allows for jumpers to be placed to route signals from the tone filters to the decoders. The manual details the configuration in more detail, but here's the basics.

There are letter and number combinations printed on the programming board, which correspond to each function and it's inputs.

*V - CD Steady (Alert)
*W - CD Cycle (Attack)
*X - Fire
*Y - Cancel

The numbers corresponding to the letters (eg. Y1) is which order the filter signal should be sent in to trigger the function. 1 is the first signal, 2 is the second signal. Theoretically, this allows for any combination of common or separate tones to be configured to activate any function as desired, though there may be limitations that I am not aware of.

{|
|+ <U>'''Programming Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|2Y (Cancel)
|-
|'''P1-3'''
|1Y (Cancel)
|-
|'''P1-4'''
|Tone filter 1 (J6)
|-
|'''P1-5'''
|Tone filter 2 (J5)
|}
</div>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Center
!Pin
!Function
|-
|'''P2-1'''
|2X (Fire)
|-
|'''P2-2'''
|1X (Fire)
|-
|'''P2-3'''
|Tone filter 3 (J4)
|-
|'''P2-4'''
|Tone filter 4 (J3)
|-
|'''P2-5'''
|2W (CD Cycle/Attack)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P3-1'''
|1W (CD Cycle/Attack)
|-
|'''P3-2'''
|Tone filter 5 (J2)
|-
|'''P3-3'''
|Tone filter 6 (J1)
|-
|'''P3-4'''
|2V (CD Steady/Alert)
|-
|'''P3-5'''
|1V (CD Steady/Alert)
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_prog_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_prog_module_back.jpg|Rear of the SC series programming board
</gallery>

----

===Power Supply Module===
On the LCx series, the power supply section is built into the main board. It is similar in architecture to the SC series, though the latter has it on a removable module. The power supply module takes in the unregulated AC output of the transformer, rectifies it, tames it down to 12v via a 7812 voltage regulator, and finally filters the DC with inductors and capacitors.

{|
|+ <U>'''Power Supply Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vout (+18v unregulated)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|N/C
|-
|'''P2-3'''
|Transformer AC in
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|Transformer AC in
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_psu_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_psu_back.jpg|Rear of the SC series programming board
</gallery>

<br />

===DTMF Tone Decoders===
I recently became aware that at some point, CD&F made DTMF decoders that use the two tone decoder PCB and have a Norcomm NC401 module attached to them. The manual for the module can be [[:File:Norcommnc401.pdf|viewed here.]] Its based on an 8051 mcu and the classic MT8870 DTMF decoder IC. You can program various functionality and digit sequences into it.

<gallery>
File:Cdf_decoder_dtmf.jpg|An example of a DTMF decoder card
</gallery>

==Other Units==
There are more unit types out there which include more variants of the LCR and SCx line:

Smaller Units:
* LCR1 - (most likely) VHF Low band small yellow unit
* LCR2 - VHF High band small yellow unit

Larger Units:
* SC1 - VHF Low band large silver/yellow unit
* SC2 - VHF High band large silver/yellow unit
* SC3 - UHF band large silver/yellow unit

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*Similarly, many of the ICs are obsolete nowadays, though some have replacements. The main Maxin timer IC is absurdly expensive per chip, so I may redesign the entire thing.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
*While the tone filters are labled J1 thru J6 on the PCB, the actual numbering is reversed, tone filter 1 is at the top and 6 is at the bottom. Despite that, my unit (and I suspect others that were reconfigured by a third party) may not start at slot 1. My unit has slots 6, 5, and 4 occupied with the corresponding wiring on the programming board. The nameplate implies slots 1, 2, and 3 however. Overall it doesn't ''really'' matter if things aren't in numerical order, but it sure as hell makes things confusing...
*On the maxon data radio DB-15 connector, you can solder a normal speaker to pin 9 and GND (4) to monitor the recieve audio. You can adjust volume with RV401 onboard inside the radio, or just use an inline resistor if you are lazy.
<br />

File:Norcommnc401.pdf

2024-08-17T02:08:34Z

Trevor229: PDF user manual for the Norcomm NC401 DTMF decoder module

== Summary ==
PDF user manual for the Norcomm NC401 DTMF decoder module

File:Cdf decoder dtmf.jpg

2024-08-17T02:06:21Z

Trevor229: A DTMF version of a CD&F tone decoder module

== Summary ==
A DTMF version of a CD&F tone decoder module

CD&F (Siren Controller)

2024-06-20T03:51:03Z

Trevor229: add discovery about adding switching functionality

Civil Defense & Fire (CD&F) siren controllers function on two-tone Motorola QuikCall, Plectron, or General Electric style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these devices or the company nowadays, but here is what I have discovered.

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* <s>Recreate schematics of each daughterboard to help with figuring out their functionality.</s> Shown in the manual
* <s>Document the theory of operation and create a rough block diagram for functionality.</s> Shown in the manual
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Design a new tone decoder daughterboard using more common components (LM567)
* Recreate timer PCB to allow for additional signals to be added to models without extra timers
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally (LCRx only)

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were more commonplace back in the 1980's and 1990's. Despite that, there are many units that were shipped into the mid 2000's, and the company was merged/acquired by Sentry Siren sometime in the mid 2010's. The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:

*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-3'''<ref>https://fccid.io/F498POCDF-2</ref> Not registered on FCC database, but exists. UHF variant of SC series (SC3)
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz.

===Speculation===
My current research shows the existence of at least two or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

* This model that I own, which is always civil defense yellow and measures 325x232x92mm a few times on the internet in videos and photos
** Appears to always have it's radio receiver on the motherboard with descrete components.

* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board, some kind of descrete but shielded radio board, or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards
** I've also noticed a possibly earlier variant that has a screw latch instead of a folding wing type latch.

My large silver unit does not appear to have an FCC ID. This kinda makes sense since the only RF part is a pre-certified radio receiver

I have also noticed at least one unit that has the "PO" of F49POCDF markered out, which would make it F49CDF, which is a vaild ID. I believe that F49CDF and F49POCDF may be the same units with just a different variation or newer/older models.

CD&F makes other products as well, though the only other example I have seen is some sort of electronic siren controller on Twitter (LINK HERE)
<br />

==Shared Components and Info==
This section contains part descriptions and information that is relevant across the entire line of controllers.

===Manual===
I was given a scanned copy of a manual for the SC line of controllers, though there is plenty of info relevant to all models within. I have uploaded it to [https://archive.org/details/cdf-radio-manual archive.org here.]

===Naming/Serial Convention===
According to the manual, this is how the controller units are named. At least, the larger SC variants. Some older units seem to follow slightly different conventions (ex. SC3M0-1322)

<pre>
SC(V)-(W)-(XY)-(ZZZZ)
</pre>

'''SC''' - Siren Controller

'''V''' - Frequency band
** '''1''' - Low Band VHF (30-50MHz)
** '''2''' - High Band VHF (148-173MHz)
** '''3''' - UHF (440-480MHz)

'''W''' - ???

'''X''' - Tone format & timing
** '''P''' - Plectron
** '''M''' - Motorola
** '''G''' - General Electric
** '''F''' - ??? (Mentioned in manual, Maybe Motorola 4 tone?)

'''Y''' - Revision number

'''Z''' - Serial Number

This is how I interpreted it, though I could be wrong about the revision number placement.

===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

{|
|+ <U>'''Tone Filter Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Pin
!Function
|-
|'''P1-1'''
|Audio in
|-
|'''P1-2'''
|Vin (+12v)
|-
|'''P1-3'''
|GND
|-
|'''P1-4'''
|Logic NOT signal out (default high, drops low when signal is in passband)
|-
|'''P1-5'''
|Logic Out (Not used on this board, but is the opposite of P4)
|}
</div>
</div>
|}

====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.

=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.

With that being said, you may want to test your own filters. Here is how I tested mine:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

Through some component changes, you will probably be able to change the adjustable range of the filters. That is something I am going to investigate soon.

====Tone filter troubleshooting====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)
*Modern replacement - TI CD4069UBE<ref>https://www.ti.com/lit/ds/symlink/cd4069ub.pdf</ref>

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)
*Modern replacement - TI CD4050BE<ref>https://www.ti.com/lit/ds/symlink/cd4050b.pdf</ref>

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)
*Modern replacement - TI CD4073BE<ref>https://www.ti.com/lit/ds/symlink/cd4073b.pdf</ref>

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)
*Modern replacement - NE555P/LM555CN

{|
|+ <U>'''Decoder Module Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|Output, goes to programming section
|-
|'''P1-3'''
|Input, goes to programming section
|-
|'''P1-4'''
|Output to Timer, thru diode customization section between decoders (CR5 & CR8)
|-
|'''P1-5'''
|From CR5 diode, test output? (N/C on main board)
|}
</div>
</div>
|}

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Modules===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

====DIP Switch Config====

----
=====SW1 (Total Time)=====
The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

According to the manual, SW1 controls the total time that the function is activated with a +/- 10% margin. The switches add together in a binary sequence when closed (up)

{|
|+ <U>'''SW1 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|128 sec.
|-
|'''2'''
|64 sec.
|-
|'''3'''
|32 sec.
|-
|'''4'''
|16 sec.
|-
|'''5'''
|8 sec.
|-
|'''6'''
|4 sec.
|-
|'''7'''
|2 sec.
|-
|'''8'''
|1 sec.
|}
</div>
</div>
|}

An example shown in the manual is switches 1, 3, 4, and 6 closed, providing a run time of 3 minutes (180s).

----
=====SW2 & SW3 (On/Off time during cycle)=====

On CD cycle/fire timers, the addition of ommitted components and SW2/SW3 allows for controlling the time spent on and off during the total cycle time defined by SW1. These switches add up in a binary sequence when open (down) with a +/- 10% margin.

*SW2 controls the time spent ON during a cycle
*SW3 controls the time spent OFF during a cycle

{|
|+ <U>'''SW2/3 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|1 sec.
|-
|'''2'''
|2 sec.
|-
|'''3'''
|4 sec.
|-
|'''4'''
|8 sec.
|}
</div>
</div>
|}

----

====Converting a Steady Timer to a CD Cycle Timer====

With a bit of patience and the missing components detailed in the manual, one could theoretically turn a CD steady timer into a CD Cycle/Fire timer.

Do note however that if you do so, you must cut or desolder the jumper in the W1 position.

=====Caveats=====

Unfortunately, you cannot just replace W1 with a switch. If you attempt to do so, the timer will start and latch for the duration of the first attack cycle, then turn off, then the output of U2 will go into oscillation. After some experimentation however, if you bend pin 3 of U3 up and install a second switch that switches pin 3 to its pad, then you can control what mode the timer operates in.

*W1 "off" and U3 pin 3 "on" - CD Cycle functionality
*W2 "on" and U3 pin 3 "off" - CD Steady functionality

----

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s. This is consistent with the stated +/- 10% margin.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)
*Modern replacement - TI CD4081BE<ref>https://www.ti.com/lit/ds/symlink/cd4073b.pdf</ref>

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)
*Modern replacement - TI CD4011BE<ref>https://www.ti.com/lit/ds/symlink/cd4011b.pdf</ref>

'''U3''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer) [ONLY PRESENT ON CD CYCLE/FIRE MODELS]
*Modern replacement - NE555P/LM555CN

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)
*Modern replacement - ICM7250IPE+ ($10/chip!)

{|
|+ <U>'''Cycle Timer Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|Signal Out to Relay Driver
|-
|'''P1-2'''
|STOP (Also local control via terminal strip)
|-
|'''P1-3'''
|START (Also local control via terminal strip)
|-
|'''P1-4'''
|Cancel "A" (from manual)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Decoder Cancel (from manual)
|-
|'''P2-3'''
|Cancel "B" (Coupled to GND via C44)
|-
|'''P2-4'''
|Cancel "C" (N/C on Main Board)
|-
|'''P2-5'''
|N/C on Main Board
|}
</div>
</div>
|}

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />

----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

{|
|+ <U>'''Relay Driver Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C on Main Board, but traces route to it on driver board
|-
|'''P1-2'''
|Signal Input from timer
|-
|'''P1-3'''
|N/C on driver board
|-
|'''P1-4'''
|N/C on driver board
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Relay #1 Coil (E9 on I/O header)
|-
|'''P2-3'''
|Relay #1 Coil (E10 on I/O header)
|-
|'''P2-4'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|-
|'''P2-5'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|}
</div>
</div>
|}

<br />
----

===I/O connector pinout===
This connector is the one just left of the relay. Houses the relay wires and the start/stop button inputs.

* E10: Relay Coil
* E9: Relay Coil
* E8: Start terminal
* E7: Stop terminal
* E6: Common terminal

<br />
----

===Board Connectors===
The molex connectors that are used on all the modular boards are Molex KK series with a .156" pitch.
* [http://www.mouser.com/catalog/645/usd/1630.pdf Molex KK Series connectors datasheet]
* [https://www.mouser.com/catalog/645/usd/1631.pdf Molex KK series headers datasheet]

The modern verison of these seems to be the molex [https://www.molex.com/en-us/products/connectors/wire-to-board-connectors/kk-connectors KK 396 series.] Same shapes, different material (nylon vs polyester(!))

==Programming==

There are two small sections below the tone decoders and inbetween the two decoder boards that allow for changing the path of signals in and out of the decoder boards. This allows for changing the behavior of the unit depending on the number of tone filters installed.

For example, my unit has two filters installed and the "on" sequence is A1, A2 (1153/1285 Hz), and "off" is the opposite. Since there are 4 card positions, you can also configure a 3 and 4 card setup

===2 Card Setup===
Probably the most common, and what my unit is configured for. Sending A1, A2 turns the unit on, and A2, A1 turns it off. The jumpers are configured as follows:

*CR1 diode from 1 to A1
*CR2 diode from 2 to A2
*B1 to A2 jumper (in row 3)
*A1 to B2 jumper (in row 4)

*CR5 in place facing the board marking
*CR6 empty
*CR7 empty
*CR8 in place facing the board marking

<gallery>

</gallery>

===3 Card Setup===
One tone filter is a "common" tone, and the other two are completely different frequencies. If for example, 800 Hz is the common tone and the others are 740 and 930, then one could configure the unit to turn on with 800/740, and off with 800/930.

===4 Card Setup===
In this case, there is a different tone pair for each action. On has two completely different frequencies compared to off.

I plan on figuring out what the hell is required to change these configs and document it here soon.

<br />

==LCRx (Simpler Small Yellow Unit)==
This unit is the first type I acquired. It is significantly smaller and simpler than the other types, only allowing for a single function timer, but up to four tone filters. This allows for either a 2, 3 or 4 card setup.

===Specifications===

====Physical====
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''LCRx Series:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#(LCRx) Transformer wiring|(LCRx) transformer wiring]] section below.

----

====Photos====

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
====(LCRx) Transformer wiring====
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

===Architecture & Operation===
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

As for the LCR-1 variant, based on the FCC-ID data it seems that the receiver will be nearly identical, though the resulting IF mixer will most likely be an addition rather than subtraction circuit due to the lower operation frequency.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />

==SCx (Multi-Option Large Silver/Yellow/Red Unit)==
The second type of unit I have acquired (an SC2), is much larger and more complex. It can support up to 3 (technically 4) function timers, 4 decoders, and six tone filters. This allows for a much more complex operation.

The manual specifies a number of optional add-ons:

* ''D1'' - Thermostat controlled heater (mounts below the receiver board)
* ''D2'' - CTCSS decoder board (mostly obsolete, rare)
* ''D3'' - Top deck mount VHF low antenna
* ''D4'' - Top deck mount VHF high antenna
* ''D5'' - Additional heavy duty 10A relay (relay #2)
* ''D6'' - Cabinet painted red
* ''D7'' - Additional intermodulation filter (not sure what this is?)
* ''D8'' - Audio kit (for servicing decoders)
* ''D9'' - Test transmitter encoder (possibly one of the FCC-IDs? Maybe CDF1 and CDF2.)
* ''D10'' - Additional tone filter

===Specifications===

====Physical====

'''SC Series:'''

* '''Height:''' 325mm (12.75") & 387mm (15.25") from bracket top and bottom
* '''Width:''' 320mm (12.59") top section & 288mm (11.33") bottom section
* '''Depth:''' 95mm (3.74") top section & 90mm (3.54") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. ?? lbs

'''Transformer:'''<ref>https://www.hammfg.com/electronics/transformers/power/266.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 24v DC OR 12v DC depending on config (Unloaded is higher)
*'''Max Current:''' 1A/2A (24/12v)
*'''Max VA:''' 24

<gallery>
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

More info on configuring in the [[#(SC) Transformer wiring| SC transformer wiring]] section below.

----
====Photos====

<gallery>
File:Cdf_SC_front_case.jpg|Front case before restoration
File:Cdf_SC_front_restored.jpg|Front case of my unit after restoration
File:Cdf_SC_inside.jpg|Inside my restored unit with missing activation buttons added
File:Cdf_SC_nameplate.jpg|Nameplate with details
File:Cdf_SC_latch_side.jpg|Latch side of my restored unit
File:Cdf_SC_hinge_side.jpg|Hinge side of my restored unit
File:Cdf_SC_back.jpg|Back of my restored unit
File:Cdf_SC_top.jpg|Top of my restored unit showing the antenna bulkhead
File:Cdf_SC_bottom.jpg|Bottom of the restored unit showing optional SO-239 connector
</gallery>

<br />
----

====(SC) Transformer wiring====
The main transformer in the unit is a [https://www.hammfg.com/electronics/transformers/power/266.pdf 266J24 from Hammond Manufacturing].

*'''115v Operation:''' Tie '''black/brown''' together and '''white/orange''' together.

*'''230v Operation:''' Tie '''white/brown''' together and insulate. Input power on '''black''' and '''orange'''.

The main board operates on 12v, so just make sure that the red/grey and yellow/blue wires are tied together in those pairs for 12v operation.

<gallery>
File:Toroid1.gif|Transformer pinout from Hammond
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

----

===Tone Filter Test Board===
The tone filter test board is pretty self explanatory. It contains six LEDs, one for each tone filter, which are connected to a MC14069BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> hex inverter IC.

When the a tone filter detects a signal within its configured bandwidth and pulls it's P1-4 pin low, the hex inverter IC inverts that signal, pulling the corresponding LED high which illuminates it, indicating the filter is active.

{|
|+ <U>'''Tone Filter Test Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|4th tone filter (J3)
|-
|'''P1-2'''
|3rd tone filter (J4)
|-
|'''P1-3'''
|2nd tone filter (J5)
|-
|'''P1-4'''
|1st tone filter (J6)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|5th tone filter (J2)
|-
|'''P2-3'''
|6th tone filter (J1)
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|N/C
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_decodertester_front.jpg|Front of the SC series tone filter test board
File:Cdf_SC_decodertester_rear.jpg|Rear of the SC series tone filter test board
</gallery>

----

===Programming board===
The programming board is the center of the unit's operation. It's a bare board that allows for jumpers to be placed to route signals from the tone filters to the decoders. The manual details the configuration in more detail, but here's the basics.

There are letter and number combinations printed on the programming board, which correspond to each function and it's inputs.

*V - CD Steady (Alert)
*W - CD Cycle (Attack)
*X - Fire
*Y - Cancel

The numbers corresponding to the letters (eg. Y1) is which order the filter signal should be sent in to trigger the function. 1 is the first signal, 2 is the second signal. Theoretically, this allows for any combination of common or separate tones to be configured to activate any function as desired, though there may be limitations that I am not aware of.

{|
|+ <U>'''Programming Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|2Y (Cancel)
|-
|'''P1-3'''
|1Y (Cancel)
|-
|'''P1-4'''
|Tone filter 1 (J6)
|-
|'''P1-5'''
|Tone filter 2 (J5)
|}
</div>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Center
!Pin
!Function
|-
|'''P2-1'''
|2X (Fire)
|-
|'''P2-2'''
|1X (Fire)
|-
|'''P2-3'''
|Tone filter 3 (J4)
|-
|'''P2-4'''
|Tone filter 4 (J3)
|-
|'''P2-5'''
|2W (CD Cycle/Attack)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P3-1'''
|1W (CD Cycle/Attack)
|-
|'''P3-2'''
|Tone filter 5 (J2)
|-
|'''P3-3'''
|Tone filter 6 (J1)
|-
|'''P3-4'''
|2V (CD Steady/Alert)
|-
|'''P3-5'''
|1V (CD Steady/Alert)
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_prog_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_prog_module_back.jpg|Rear of the SC series programming board
</gallery>

----

===Power Supply Module===
On the LCx series, the power supply section is built into the main board. It is similar in architecture to the SC series, though the latter has it on a removable module. The power supply module takes in the unregulated AC output of the transformer, rectifies it, tames it down to 12v via a 7812 voltage regulator, and finally filters the DC with inductors and capacitors.

{|
|+ <U>'''Power Supply Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vout (+18v unregulated)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|N/C
|-
|'''P2-3'''
|Transformer AC in
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|Transformer AC in
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_psu_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_psu_back.jpg|Rear of the SC series programming board
</gallery>

<br />

==Other Units==
There are more unit types out there which include more variants of the LCR and SCx line:

Smaller Units:
* LCR1 - (most likely) VHF Low band small yellow unit
* LCR2 - VHF High band small yellow unit

Larger Units:
* SC1 - VHF Low band large silver/yellow unit
* SC2 - VHF High band large silver/yellow unit
* SC3 - UHF band large silver/yellow unit

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*Similarly, many of the ICs are obsolete nowadays, though some have replacements. The main Maxin timer IC is absurdly expensive per chip, so I may redesign the entire thing.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
*While the tone filters are labled J1 thru J6 on the PCB, the actual numbering is reversed, tone filter 1 is at the top and 6 is at the bottom. Despite that, my unit (and I suspect others that were reconfigured by a third party) may not start at slot 1. My unit has slots 6, 5, and 4 occupied with the corresponding wiring on the programming board. The nameplate implies slots 1, 2, and 3 however. Overall it doesn't ''really'' matter if things aren't in numerical order, but it sure as hell makes things confusing...
*On the maxon data radio DB-15 connector, you can solder a normal speaker to pin 9 and GND (4) to monitor the recieve audio. You can adjust volume with RV401 onboard inside the radio, or just use an inline resistor if you are lazy.
<br />

CD&F (Siren Controller)

2024-05-26T21:22:26Z

Trevor229: add a linebreak

Civil Defense & Fire (CD&F) siren controllers function on two-tone Motorola QuikCall, Plectron, or General Electric style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these devices or the company nowadays, but here is what I have discovered.

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* <s>Recreate schematics of each daughterboard to help with figuring out their functionality.</s> Shown in the manual
* <s>Document the theory of operation and create a rough block diagram for functionality.</s> Shown in the manual
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Design a new tone decoder daughterboard using more common components (LM567)
* Recreate timer PCB to allow for additional signals to be added to models without extra timers
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally (LCRx only)

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were more commonplace back in the 1980's and 1990's. Despite that, there are many units that were shipped into the mid 2000's, and the company was merged/acquired by Sentry Siren sometime in the mid 2010's. The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:

*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-3'''<ref>https://fccid.io/F498POCDF-2</ref> Not registered on FCC database, but exists. UHF variant of SC series (SC3)
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz.

===Speculation===
My current research shows the existence of at least two or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

* This model that I own, which is always civil defense yellow and measures 325x232x92mm a few times on the internet in videos and photos
** Appears to always have it's radio receiver on the motherboard with descrete components.

* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board, some kind of descrete but shielded radio board, or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards
** I've also noticed a possibly earlier variant that has a screw latch instead of a folding wing type latch.

My large silver unit does not appear to have an FCC ID. This kinda makes sense since the only RF part is a pre-certified radio receiver

I have also noticed at least one unit that has the "PO" of F49POCDF markered out, which would make it F49CDF, which is a vaild ID. I believe that F49CDF and F49POCDF may be the same units with just a different variation or newer/older models.

CD&F makes other products as well, though the only other example I have seen is some sort of electronic siren controller on Twitter (LINK HERE)
<br />

==Shared Components and Info==
This section contains part descriptions and information that is relevant across the entire line of controllers.

===Manual===
I was given a scanned copy of a manual for the SC line of controllers, though there is plenty of info relevant to all models within. I have uploaded it to [https://archive.org/details/cdf-radio-manual archive.org here.]

===Naming/Serial Convention===
According to the manual, this is how the controller units are named. At least, the larger SC variants. Some older units seem to follow slightly different conventions (ex. SC3M0-1322)

<pre>
SC(V)-(W)-(XY)-(ZZZZ)
</pre>

'''SC''' - Siren Controller

'''V''' - Frequency band
** '''1''' - Low Band VHF (30-50MHz)
** '''2''' - High Band VHF (148-173MHz)
** '''3''' - UHF (440-480MHz)

'''W''' - ???

'''X''' - Tone format & timing
** '''P''' - Plectron
** '''M''' - Motorola
** '''G''' - General Electric
** '''F''' - ??? (Mentioned in manual, Maybe Motorola 4 tone?)

'''Y''' - Revision number

'''Z''' - Serial Number

This is how I interpreted it, though I could be wrong about the revision number placement.

===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

{|
|+ <U>'''Tone Filter Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Pin
!Function
|-
|'''P1-1'''
|Audio in
|-
|'''P1-2'''
|Vin (+12v)
|-
|'''P1-3'''
|GND
|-
|'''P1-4'''
|Logic NOT signal out (default high, drops low when signal is in passband)
|-
|'''P1-5'''
|Logic Out (Not used on this board, but is the opposite of P4)
|}
</div>
</div>
|}

====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.

=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.

With that being said, you may want to test your own filters. Here is how I tested mine:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

Through some component changes, you will probably be able to change the adjustable range of the filters. That is something I am going to investigate soon.

====Tone filter troubleshooting====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

{|
|+ <U>'''Decoder Module Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|Output, goes to programming section
|-
|'''P1-3'''
|Input, goes to programming section
|-
|'''P1-4'''
|Output to Timer, thru diode customization section between decoders (CR5 & CR8)
|-
|'''P1-5'''
|From CR5 diode, test output? (N/C on main board)
|}
</div>
</div>
|}

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Modules===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

====DIP Switch Config====

----
=====SW1 (Total Time)=====
The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

According to the manual, SW1 controls the total time that the function is activated with a +/- 10% margin. The switches add together in a binary sequence when closed (up)

{|
|+ <U>'''SW1 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|128 sec.
|-
|'''2'''
|64 sec.
|-
|'''3'''
|32 sec.
|-
|'''4'''
|16 sec.
|-
|'''5'''
|8 sec.
|-
|'''6'''
|4 sec.
|-
|'''7'''
|2 sec.
|-
|'''8'''
|1 sec.
|}
</div>
</div>
|}

An example shown in the manual is switches 1, 3, 4, and 6 closed, providing a run time of 3 minutes (180s).

----
=====SW2 & SW3 (On/Off time during cycle)=====

On CD cycle/fire timers, the addition of ommitted components and SW2/SW3 allows for controlling the time spent on and off during the total cycle time defined by SW1. These switches add up in a binary sequence when open (down) with a +/- 10% margin.

*SW2 controls the time spent ON during a cycle
*SW3 controls the time spent OFF during a cycle

{|
|+ <U>'''SW2/3 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|1 sec.
|-
|'''2'''
|2 sec.
|-
|'''3'''
|4 sec.
|-
|'''4'''
|8 sec.
|}
</div>
</div>
|}

----

====Converting a Steady Timer to a CD Cycle Timer====

With a bit of patience and the missing components detailed in the manual, one could theoretically turn a CD steady timer into a CD Cycle/Fire timer.

Do note however that if you do so, you must cut or desolder the jumper in the W1 position. I am curious if one may replace that jumper with a small switch to allow for choosing between steady and attack/fire signals by bypassing the extra components.

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s. This is consistent with the stated +/- 10% margin.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer) [ONLY PRESENT ON CD CYCLE/FIRE MODELS]

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

{|
|+ <U>'''Cycle Timer Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|Signal Out to Relay Driver
|-
|'''P1-2'''
|STOP (Also local control via terminal strip)
|-
|'''P1-3'''
|START (Also local control via terminal strip)
|-
|'''P1-4'''
|Cancel "A" (from manual)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Decoder Cancel (from manual)
|-
|'''P2-3'''
|Cancel "B" (Coupled to GND via C44)
|-
|'''P2-4'''
|Cancel "C" (N/C on Main Board)
|-
|'''P2-5'''
|N/C on Main Board
|}
</div>
</div>
|}

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />

----

===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

{|
|+ <U>'''Relay Driver Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C on Main Board, but traces route to it on driver board
|-
|'''P1-2'''
|Signal Input from timer
|-
|'''P1-3'''
|N/C on driver board
|-
|'''P1-4'''
|N/C on driver board
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Relay #1 Coil (E9 on I/O header)
|-
|'''P2-3'''
|Relay #1 Coil (E10 on I/O header)
|-
|'''P2-4'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|-
|'''P2-5'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|}
</div>
</div>
|}

<br />
----

===I/O connector pinout===
This connector is the one just left of the relay. Houses the relay wires and the start/stop button inputs.

* E10: Relay Coil
* E9: Relay Coil
* E8: Start terminal
* E7: Stop terminal
* E6: Common terminal

<br />
----

===Board Connectors===
The molex connectors that are used on all the modular boards are Molex KK series with a .156" pitch.
* [http://www.mouser.com/catalog/645/usd/1630.pdf Molex KK Series connectors datasheet]
* [https://www.mouser.com/catalog/645/usd/1631.pdf Molex KK series headers datasheet]

==Programming==

There are two small sections below the tone decoders and inbetween the two decoder boards that allow for changing the path of signals in and out of the decoder boards. This allows for changing the behavior of the unit depending on the number of tone filters installed.

For example, my unit has two filters installed and the "on" sequence is A1, A2 (1153/1285 Hz), and "off" is the opposite. Since there are 4 card positions, you can also configure a 3 and 4 card setup

===2 Card Setup===
Probably the most common, and what my unit is configured for. Sending A1, A2 turns the unit on, and A2, A1 turns it off. The jumpers are configured as follows:

*CR1 diode from 1 to A1
*CR2 diode from 2 to A2
*B1 to A2 jumper (in row 3)
*A1 to B2 jumper (in row 4)

*CR5 in place facing the board marking
*CR6 empty
*CR7 empty
*CR8 in place facing the board marking

<gallery>

</gallery>

===3 Card Setup===
One tone filter is a "common" tone, and the other two are completely different frequencies. If for example, 800 Hz is the common tone and the others are 740 and 930, then one could configure the unit to turn on with 800/740, and off with 800/930.

===4 Card Setup===
In this case, there is a different tone pair for each action. On has two completely different frequencies compared to off.

I plan on figuring out what the hell is required to change these configs and document it here soon.

<br />

==LCRx (Simpler Small Yellow Unit)==
This unit is the first type I acquired. It is significantly smaller and simpler than the other types, only allowing for a single function timer, but up to four tone filters. This allows for either a 2, 3 or 4 card setup.

===Specifications===

====Physical====
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''LCRx Series:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#(LCRx) Transformer wiring|(LCRx) transformer wiring]] section below.

----

====Photos====

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
====(LCRx) Transformer wiring====
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

===Architecture & Operation===
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

As for the LCR-1 variant, based on the FCC-ID data it seems that the receiver will be nearly identical, though the resulting IF mixer will most likely be an addition rather than subtraction circuit due to the lower operation frequency.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />

==SCx (Multi-Option Large Silver/Yellow/Red Unit)==
The second type of unit I have acquired (an SC2), is much larger and more complex. It can support up to 3 (technically 4) function timers, 4 decoders, and six tone filters. This allows for a much more complex operation.

The manual specifies a number of optional add-ons:

* ''D1'' - Thermostat controlled heater (mounts below the receiver board)
* ''D2'' - CTCSS decoder board (mostly obsolete, rare)
* ''D3'' - Top deck mount VHF low antenna
* ''D4'' - Top deck mount VHF high antenna
* ''D5'' - Additional heavy duty 10A relay (relay #2)
* ''D6'' - Cabinet painted red
* ''D7'' - Additional intermodulation filter (not sure what this is?)
* ''D8'' - Audio kit (for servicing decoders)
* ''D9'' - Test transmitter encoder (possibly one of the FCC-IDs? Maybe CDF1 and CDF2.)
* ''D10'' - Additional tone filter

===Specifications===

====Physical====

'''SC Series:'''

* '''Height:''' 325mm (12.75") & 387mm (15.25") from bracket top and bottom
* '''Width:''' 320mm (12.59") top section & 288mm (11.33") bottom section
* '''Depth:''' 95mm (3.74") top section & 90mm (3.54") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. ?? lbs

'''Transformer:'''<ref>https://www.hammfg.com/electronics/transformers/power/266.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 24v DC OR 12v DC depending on config (Unloaded is higher)
*'''Max Current:''' 1A/2A (24/12v)
*'''Max VA:''' 24

<gallery>
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

More info on configuring in the [[#(SC) Transformer wiring| SC transformer wiring]] section below.

----
====Photos====

<gallery>
File:Cdf_SC_front_case.jpg|Front case before restoration
File:Cdf_SC_front_restored.jpg|Front case of my unit after restoration
File:Cdf_SC_inside.jpg|Inside my restored unit with missing activation buttons added
File:Cdf_SC_nameplate.jpg|Nameplate with details
File:Cdf_SC_latch_side.jpg|Latch side of my restored unit
File:Cdf_SC_hinge_side.jpg|Hinge side of my restored unit
File:Cdf_SC_back.jpg|Back of my restored unit
File:Cdf_SC_top.jpg|Top of my restored unit showing the antenna bulkhead
File:Cdf_SC_bottom.jpg|Bottom of the restored unit showing optional SO-239 connector
</gallery>

<br />
----

====(SC) Transformer wiring====
The main transformer in the unit is a [https://www.hammfg.com/electronics/transformers/power/266.pdf 266J24 from Hammond Manufacturing].

*'''115v Operation:''' Tie '''black/brown''' together and '''white/orange''' together.

*'''230v Operation:''' Tie '''white/brown''' together and insulate. Input power on '''black''' and '''orange'''.

The main board operates on 12v, so just make sure that the red/grey and yellow/blue wires are tied together in those pairs for 12v operation.

<gallery>
File:Toroid1.gif|Transformer pinout from Hammond
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

----

===Tone Filter Test Board===
The tone filter test board is pretty self explanatory. It contains six LEDs, one for each tone filter, which are connected to a MC14069BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> hex inverter IC.

When the a tone filter detects a signal within its configured bandwidth and pulls it's P1-4 pin low, the hex inverter IC inverts that signal, pulling the corresponding LED high which illuminates it, indicating the filter is active.

{|
|+ <U>'''Tone Filter Test Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|4th tone filter (J3)
|-
|'''P1-2'''
|3rd tone filter (J4)
|-
|'''P1-3'''
|2nd tone filter (J5)
|-
|'''P1-4'''
|1st tone filter (J6)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|5th tone filter (J2)
|-
|'''P2-3'''
|6th tone filter (J1)
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|N/C
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_decodertester_front.jpg|Front of the SC series tone filter test board
File:Cdf_SC_decodertester_rear.jpg|Rear of the SC series tone filter test board
</gallery>

----

===Programming board===
The programming board is the center of the unit's operation. It's a bare board that allows for jumpers to be placed to route signals from the tone filters to the decoders. The manual details the configuration in more detail, but here's the basics.

There are letter and number combinations printed on the programming board, which correspond to each function and it's inputs.

*V - CD Steady (Alert)
*W - CD Cycle (Attack)
*X - Fire
*Y - Cancel

The numbers corresponding to the letters (eg. Y1) is which order the filter signal should be sent in to trigger the function. 1 is the first signal, 2 is the second signal. Theoretically, this allows for any combination of common or separate tones to be configured to activate any function as desired, though there may be limitations that I am not aware of.

{|
|+ <U>'''Programming Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|2Y (Cancel)
|-
|'''P1-3'''
|1Y (Cancel)
|-
|'''P1-4'''
|Tone filter 1 (J6)
|-
|'''P1-5'''
|Tone filter 2 (J5)
|}
</div>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Center
!Pin
!Function
|-
|'''P2-1'''
|2X (Fire)
|-
|'''P2-2'''
|1X (Fire)
|-
|'''P2-3'''
|Tone filter 3 (J4)
|-
|'''P2-4'''
|Tone filter 4 (J3)
|-
|'''P2-5'''
|2W (CD Cycle/Attack)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P3-1'''
|1W (CD Cycle/Attack)
|-
|'''P3-2'''
|Tone filter 5 (J2)
|-
|'''P3-3'''
|Tone filter 6 (J1)
|-
|'''P3-4'''
|2V (CD Steady/Alert)
|-
|'''P3-5'''
|1V (CD Steady/Alert)
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_prog_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_prog_module_back.jpg|Rear of the SC series programming board
</gallery>

----

===Power Supply Module===
On the LCx series, the power supply section is built into the main board. It is similar in architecture to the SC series, though the latter has it on a removable module. The power supply module takes in the unregulated AC output of the transformer, rectifies it, tames it down to 12v via a 7812 voltage regulator, and finally filters the DC with inductors and capacitors.

{|
|+ <U>'''Power Supply Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vout (+18v unregulated)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|N/C
|-
|'''P2-3'''
|Transformer AC in
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|Transformer AC in
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_psu_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_psu_back.jpg|Rear of the SC series programming board
</gallery>

<br />

==Other Units==
There are more unit types out there which include more variants of the LCR and SCx line:

Smaller Units:
* LCR1 - (most likely) VHF Low band small yellow unit
* LCR2 - VHF High band small yellow unit

Larger Units:
* SC1 - VHF Low band large silver/yellow unit
* SC2 - VHF High band large silver/yellow unit
* SC3 - UHF band large silver/yellow unit

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
*While the tone filters are labled J1 thru J6 on the PCB, the actual numbering is reversed, tone filter 1 is at the top and 6 is at the bottom. Despite that, my unit (and I suspect others that were reconfigured by a third party) may not start at slot 1. My unit has slots 6, 5, and 4 occupied with the corresponding wiring on the programming board. The nameplate implies slots 1, 2, and 3 however. Overall it doesn't ''really'' matter if things aren't in numerical order, but it sure as hell makes things confusing...
*On the maxon data radio DB-15 connector, you can solder a normal speaker to pin
<br />

CD&F (Siren Controller)

2024-05-26T21:21:18Z

Trevor229: Add timer switch info and fix oopsies on pinouts that dont match

Civil Defense & Fire (CD&F) siren controllers function on two-tone Motorola QuikCall, Plectron, or General Electric style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these devices or the company nowadays, but here is what I have discovered.

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* <s>Recreate schematics of each daughterboard to help with figuring out their functionality.</s> Shown in the manual
* <s>Document the theory of operation and create a rough block diagram for functionality.</s> Shown in the manual
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Design a new tone decoder daughterboard using more common components (LM567)
* Recreate timer PCB to allow for additional signals to be added to models without extra timers
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally (LCRx only)

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were more commonplace back in the 1980's and 1990's. Despite that, there are many units that were shipped into the mid 2000's, and the company was merged/acquired by Sentry Siren sometime in the mid 2010's. The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:

*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-3'''<ref>https://fccid.io/F498POCDF-2</ref> Not registered on FCC database, but exists. UHF variant of SC series (SC3)
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz.

===Speculation===
My current research shows the existence of at least two or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

* This model that I own, which is always civil defense yellow and measures 325x232x92mm a few times on the internet in videos and photos
** Appears to always have it's radio receiver on the motherboard with descrete components.

* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board, some kind of descrete but shielded radio board, or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards
** I've also noticed a possibly earlier variant that has a screw latch instead of a folding wing type latch.

My large silver unit does not appear to have an FCC ID. This kinda makes sense since the only RF part is a pre-certified radio receiver

I have also noticed at least one unit that has the "PO" of F49POCDF markered out, which would make it F49CDF, which is a vaild ID. I believe that F49CDF and F49POCDF may be the same units with just a different variation or newer/older models.

CD&F makes other products as well, though the only other example I have seen is some sort of electronic siren controller on Twitter (LINK HERE)
<br />

==Shared Components and Info==
This section contains part descriptions and information that is relevant across the entire line of controllers.

===Manual===
I was given a scanned copy of a manual for the SC line of controllers, though there is plenty of info relevant to all models within. I have uploaded it to [https://archive.org/details/cdf-radio-manual archive.org here.]

===Naming/Serial Convention===
According to the manual, this is how the controller units are named. At least, the larger SC variants. Some older units seem to follow slightly different conventions (ex. SC3M0-1322)

<pre>
SC(V)-(W)-(XY)-(ZZZZ)
</pre>

'''SC''' - Siren Controller

'''V''' - Frequency band
** '''1''' - Low Band VHF (30-50MHz)
** '''2''' - High Band VHF (148-173MHz)
** '''3''' - UHF (440-480MHz)

'''W''' - ???

'''X''' - Tone format & timing
** '''P''' - Plectron
** '''M''' - Motorola
** '''G''' - General Electric
** '''F''' - ??? (Mentioned in manual, Maybe Motorola 4 tone?)

'''Y''' - Revision number

'''Z''' - Serial Number

This is how I interpreted it, though I could be wrong about the revision number placement.

===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

{|
|+ <U>'''Tone Filter Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Pin
!Function
|-
|'''P1-1'''
|Audio in
|-
|'''P1-2'''
|Vin (+12v)
|-
|'''P1-3'''
|GND
|-
|'''P1-4'''
|Logic NOT signal out (default high, drops low when signal is in passband)
|-
|'''P1-5'''
|Logic Out (Not used on this board, but is the opposite of P4)
|}
</div>
</div>
|}

====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.

=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.

With that being said, you may want to test your own filters. Here is how I tested mine:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

Through some component changes, you will probably be able to change the adjustable range of the filters. That is something I am going to investigate soon.

====Tone filter troubleshooting====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

{|
|+ <U>'''Decoder Module Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|Output, goes to programming section
|-
|'''P1-3'''
|Input, goes to programming section
|-
|'''P1-4'''
|Output to Timer, thru diode customization section between decoders (CR5 & CR8)
|-
|'''P1-5'''
|From CR5 diode, test output? (N/C on main board)
|}
</div>
</div>
|}

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Modules===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

====DIP Switch Config====

----
=====SW1 (Total Time)=====
The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

According to the manual, SW1 controls the total time that the function is activated with a +/- 10% margin. The switches add together in a binary sequence when closed (up)

{|
|+ <U>'''SW1 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|128 sec.
|-
|'''2'''
|64 sec.
|-
|'''3'''
|32 sec.
|-
|'''4'''
|16 sec.
|-
|'''5'''
|8 sec.
|-
|'''6'''
|4 sec.
|-
|'''7'''
|2 sec.
|-
|'''8'''
|1 sec.
|}
</div>
</div>
|}

An example shown in the manual is switches 1, 3, 4, and 6 closed, providing a run time of 3 minutes (180s).

----
=====SW2 & SW3 (On/Off time during cycle)=====

On CD cycle/fire timers, the addition of ommitted components and SW2/SW3 allows for controlling the time spent on and off during the total cycle time defined by SW1. These switches add up in a binary sequence when open (down) with a +/- 10% margin.

*SW2 controls the time spent ON during a cycle
*SW3 controls the time spent OFF during a cycle

{|
|+ <U>'''SW2/3 Values (position from left to right)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Position
!Time value
|-
|'''1'''
|1 sec.
|-
|'''2'''
|2 sec.
|-
|'''3'''
|4 sec.
|-
|'''4'''
|8 sec.
|}
</div>
</div>
|}

----

====Converting a Steady Timer to a CD Cycle Timer====

With a bit of patience and the missing components detailed in the manual, one could theoretically turn a CD steady timer into a CD Cycle/Fire timer.

Do note however that if you do so, you must cut or desolder the jumper in the W1 position. I am curious if one may replace that jumper with a small switch to allow for choosing between steady and attack/fire signals by bypassing the extra components.

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s. This is consistent with the stated +/- 10% margin.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer) [ONLY PRESENT ON CD CYCLE/FIRE MODELS]

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

{|
|+ <U>'''Cycle Timer Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|Signal Out to Relay Driver
|-
|'''P1-2'''
|STOP (Also local control via terminal strip)
|-
|'''P1-3'''
|START (Also local control via terminal strip)
|-
|'''P1-4'''
|Cancel "A" (from manual)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Decoder Cancel (from manual)
|-
|'''P2-3'''
|Cancel "B" (Coupled to GND via C44)
|-
|'''P2-4'''
|Cancel "C" (N/C on Main Board)
|-
|'''P2-5'''
|N/C on Main Board
|}
</div>
</div>
|}

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />

----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

{|
|+ <U>'''Relay Driver Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C on Main Board, but traces route to it on driver board
|-
|'''P1-2'''
|Signal Input from timer
|-
|'''P1-3'''
|N/C on driver board
|-
|'''P1-4'''
|N/C on driver board
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|Relay #1 Coil (E9 on I/O header)
|-
|'''P2-3'''
|Relay #1 Coil (E10 on I/O header)
|-
|'''P2-4'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|-
|'''P2-5'''
|Relay #2 Coil (Optional in SC series, not used at all in LCRx.)
|}
</div>
</div>
|}

<br />
----

===I/O connector pinout===
This connector is the one just left of the relay. Houses the relay wires and the start/stop button inputs.

* E10: Relay Coil
* E9: Relay Coil
* E8: Start terminal
* E7: Stop terminal
* E6: Common terminal

<br />
----

===Board Connectors===
The molex connectors that are used on all the modular boards are Molex KK series with a .156" pitch.
* [http://www.mouser.com/catalog/645/usd/1630.pdf Molex KK Series connectors datasheet]
* [https://www.mouser.com/catalog/645/usd/1631.pdf Molex KK series headers datasheet]

==Programming==

There are two small sections below the tone decoders and inbetween the two decoder boards that allow for changing the path of signals in and out of the decoder boards. This allows for changing the behavior of the unit depending on the number of tone filters installed.

For example, my unit has two filters installed and the "on" sequence is A1, A2 (1153/1285 Hz), and "off" is the opposite. Since there are 4 card positions, you can also configure a 3 and 4 card setup

===2 Card Setup===
Probably the most common, and what my unit is configured for. Sending A1, A2 turns the unit on, and A2, A1 turns it off. The jumpers are configured as follows:

*CR1 diode from 1 to A1
*CR2 diode from 2 to A2
*B1 to A2 jumper (in row 3)
*A1 to B2 jumper (in row 4)

*CR5 in place facing the board marking
*CR6 empty
*CR7 empty
*CR8 in place facing the board marking

<gallery>

</gallery>

===3 Card Setup===
One tone filter is a "common" tone, and the other two are completely different frequencies. If for example, 800 Hz is the common tone and the others are 740 and 930, then one could configure the unit to turn on with 800/740, and off with 800/930.

===4 Card Setup===
In this case, there is a different tone pair for each action. On has two completely different frequencies compared to off.

I plan on figuring out what the hell is required to change these configs and document it here soon.

<br />

==LCRx (Simpler Small Yellow Unit)==
This unit is the first type I acquired. It is significantly smaller and simpler than the other types, only allowing for a single function timer, but up to four tone filters. This allows for either a 2, 3 or 4 card setup.

===Specifications===

====Physical====
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''LCRx Series:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#(LCRx) Transformer wiring|(LCRx) transformer wiring]] section below.

----

====Photos====

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
====(LCRx) Transformer wiring====
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

===Architecture & Operation===
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

As for the LCR-1 variant, based on the FCC-ID data it seems that the receiver will be nearly identical, though the resulting IF mixer will most likely be an addition rather than subtraction circuit due to the lower operation frequency.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />

==SCx (Multi-Option Large Silver/Yellow/Red Unit)==
The second type of unit I have acquired (an SC2), is much larger and more complex. It can support up to 3 (technically 4) function timers, 4 decoders, and six tone filters. This allows for a much more complex operation.

The manual specifies a number of optional add-ons:

* ''D1'' - Thermostat controlled heater (mounts below the receiver board)
* ''D2'' - CTCSS decoder board (mostly obsolete, rare)
* ''D3'' - Top deck mount VHF low antenna
* ''D4'' - Top deck mount VHF high antenna
* ''D5'' - Additional heavy duty 10A relay (relay #2)
* ''D6'' - Cabinet painted red
* ''D7'' - Additional intermodulation filter (not sure what this is?)
* ''D8'' - Audio kit (for servicing decoders)
* ''D9'' - Test transmitter encoder (possibly one of the FCC-IDs? Maybe CDF1 and CDF2.)
* ''D10'' - Additional tone filter

===Specifications===

====Physical====

'''SC Series:'''

* '''Height:''' 325mm (12.75") & 387mm (15.25") from bracket top and bottom
* '''Width:''' 320mm (12.59") top section & 288mm (11.33") bottom section
* '''Depth:''' 95mm (3.74") top section & 90mm (3.54") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. ?? lbs

'''Transformer:'''<ref>https://www.hammfg.com/electronics/transformers/power/266.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 24v DC OR 12v DC depending on config (Unloaded is higher)
*'''Max Current:''' 1A/2A (24/12v)
*'''Max VA:''' 24

<gallery>
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

More info on configuring in the [[#(SC) Transformer wiring| SC transformer wiring]] section below.

----
====Photos====

<gallery>
File:Cdf_SC_front_case.jpg|Front case before restoration
File:Cdf_SC_front_restored.jpg|Front case of my unit after restoration
File:Cdf_SC_inside.jpg|Inside my restored unit with missing activation buttons added
File:Cdf_SC_nameplate.jpg|Nameplate with details
File:Cdf_SC_latch_side.jpg|Latch side of my restored unit
File:Cdf_SC_hinge_side.jpg|Hinge side of my restored unit
File:Cdf_SC_back.jpg|Back of my restored unit
File:Cdf_SC_top.jpg|Top of my restored unit showing the antenna bulkhead
File:Cdf_SC_bottom.jpg|Bottom of the restored unit showing optional SO-239 connector
</gallery>

<br />
----

====(SC) Transformer wiring====
The main transformer in the unit is a [https://www.hammfg.com/electronics/transformers/power/266.pdf 266J24 from Hammond Manufacturing].

*'''115v Operation:''' Tie '''black/brown''' together and '''white/orange''' together.

*'''230v Operation:''' Tie '''white/brown''' together and insulate. Input power on '''black''' and '''orange'''.

The main board operates on 12v, so just make sure that the red/grey and yellow/blue wires are tied together in those pairs for 12v operation.

<gallery>
File:Toroid1.gif|Transformer pinout from Hammond
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

----

===Tone Filter Test Board===
The tone filter test board is pretty self explanatory. It contains six LEDs, one for each tone filter, which are connected to a MC14069BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> hex inverter IC.

When the a tone filter detects a signal within its configured bandwidth and pulls it's P1-4 pin low, the hex inverter IC inverts that signal, pulling the corresponding LED high which illuminates it, indicating the filter is active.

{|
|+ <U>'''Tone Filter Test Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|4th tone filter (J3)
|-
|'''P1-2'''
|3rd tone filter (J4)
|-
|'''P1-3'''
|2nd tone filter (J5)
|-
|'''P1-4'''
|1st tone filter (J6)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|5th tone filter (J2)
|-
|'''P2-3'''
|6th tone filter (J1)
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|N/C
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_decodertester_front.jpg|Front of the SC series tone filter test board
File:Cdf_SC_decodertester_rear.jpg|Rear of the SC series tone filter test board
</gallery>

----

===Programming board===
The programming board is the center of the unit's operation. It's a bare board that allows for jumpers to be placed to route signals from the tone filters to the decoders. The manual details the configuration in more detail, but here's the basics.

There are letter and number combinations printed on the programming board, which correspond to each function and it's inputs.

*V - CD Steady (Alert)
*W - CD Cycle (Attack)
*X - Fire
*Y - Cancel

The numbers corresponding to the letters (eg. Y1) is which order the filter signal should be sent in to trigger the function. 1 is the first signal, 2 is the second signal. Theoretically, this allows for any combination of common or separate tones to be configured to activate any function as desired, though there may be limitations that I am not aware of.

{|
|+ <U>'''Programming Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|2Y (Cancel)
|-
|'''P1-3'''
|1Y (Cancel)
|-
|'''P1-4'''
|Tone filter 1 (J6)
|-
|'''P1-5'''
|Tone filter 2 (J5)
|}
</div>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Center
!Pin
!Function
|-
|'''P2-1'''
|2X (Fire)
|-
|'''P2-2'''
|1X (Fire)
|-
|'''P2-3'''
|Tone filter 3 (J4)
|-
|'''P2-4'''
|Tone filter 4 (J3)
|-
|'''P2-5'''
|2W (CD Cycle/Attack)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P3-1'''
|1W (CD Cycle/Attack)
|-
|'''P3-2'''
|Tone filter 5 (J2)
|-
|'''P3-3'''
|Tone filter 6 (J1)
|-
|'''P3-4'''
|2V (CD Steady/Alert)
|-
|'''P3-5'''
|1V (CD Steady/Alert)
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_prog_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_prog_module_back.jpg|Rear of the SC series programming board
</gallery>

----

===Power Supply Module===
On the LCx series, the power supply section is built into the main board. It is similar in architecture to the SC series, though the latter has it on a removable module. The power supply module takes in the unregulated AC output of the transformer, rectifies it, tames it down to 12v via a 7812 voltage regulator, and finally filters the DC with inductors and capacitors.

{|
|+ <U>'''Power Supply Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vout (+18v unregulated)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P2-1'''
|GND
|-
|'''P2-2'''
|N/C
|-
|'''P2-3'''
|Transformer AC in
|-
|'''P2-4'''
|N/C
|-
|'''P2-5'''
|Transformer AC in
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_psu_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_psu_back.jpg|Rear of the SC series programming board
</gallery>

<br />

==Other Units==
There are more unit types out there which include more variants of the LCR and SCx line:

Smaller Units:
* LCR1 - (most likely) VHF Low band small yellow unit
* LCR2 - VHF High band small yellow unit

Larger Units:
* SC1 - VHF Low band large silver/yellow unit
* SC2 - VHF High band large silver/yellow unit
* SC3 - UHF band large silver/yellow unit

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
*While the tone filters are labled J1 thru J6 on the PCB, the actual numbering is reversed, tone filter 1 is at the top and 6 is at the bottom. Despite that, my unit (and I suspect others that were reconfigured by a third party) may not start at slot 1. My unit has slots 6, 5, and 4 occupied with the corresponding wiring on the programming board. The nameplate implies slots 1, 2, and 3 however. Overall it doesn't ''really'' matter if things aren't in numerical order, but it sure as hell makes things confusing...
*On the maxon data radio DB-15 connector, you can solder a normal speaker to pin
<br />

Maxon Data Radio

2024-05-25T00:36:24Z

Trevor229: add info about hex editor

Maxon America Inc. is a radio communications manufacturer headquartered in Lenexa, Kansas which makes a variety of Land Mobile Radios (LMR), Digital Mobile Radios (DMR), and original data telemetry modules.

[[File:Maxon_sd_161.jpg|thumb|250px|Maxon Data Radio Model SD-161 (VHF)]]
<br />

==Overview==
Maxon data radios are a line of small radio transcievers developed for industrial telemetry and data reporting use. There are both analog and digital options, but here we will focus on the analog models.

==Analog Models==
*'''SD-125EL'''
**'''V2''' - 5/1W VHF (148-174 MHz)
**'''U1''' - 5/1W UHF (400-430 MHz)
**'''U2''' - 5/1W UHF (440-470 MHz)
*'''SD-170EL'''
**'''SD-171EL''' - 5/1W VHF (146-174 MHz)
**'''SD-174EL''' - 5/1W UHF (450-490 MHz)

Older discontinued models:
*'''SD-161''' - 2W VHF (148-174 MHz)
*'''SD-164''' - 2W UHF (450-490 MHz)
*'''SD-171''' - 5/1W VHF (148-174 MHz)
*'''SD-174''' - 5/1W UHF (450-490 MHz)

==EEPROM Layout==
Work in progress, but I have identified the most important stuff (Freq, CTCSS/DCS, etc)

Here are [[:File:Maxon_sd_blank_configs.zip|blank .dat configuration files for each model.]] I haven't touched the EL series yet. Use these as a base for editing and flashing to your unit.

You'll need a hex editor program to modify the files, I suggest [https://mh-nexus.de/en/hxd/ HxD] as it's my favorite for Windows.

===Option Bytes===
====Model ID====
The very first byte (0x00) is the model ID 01 through 04 as below. Also 0xB4, that changes based on frequency band. 04 for VHF models, 01 for UHF models.

{|
|+ <U>'''Model ID'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Model
!Value
|-
|style="padding: 5px" |'''SD-161'''
|style="padding: 5px" |01
|-
|style="padding: 5px" |'''SD-164'''
|style="padding: 5px" |02
|-
|style="padding: 5px" |'''SD-171'''
|style="padding: 5px" |03
|-
|style="padding: 5px" |'''SD-174'''
|style="padding: 5px" |04
|}
</div>
</div>
|}

====Squelch====
Most of the time you probably want this on. 0xC8 is the squelch byte. 00 is no squelch, 01 is squelch enabled

====Wide/Narrow====
W/N operation for a given channel is configured using the fifth byte after the end of the TX frequency. 00 is narrowband (default) and 01 is wide.

====Scan Enable====
Scan enable is the first byte after the frequency channel block. 00 is disabled, 01 is enabled.

===CTCSS/DCS===
----
====Enable Byte====
The RX CTCSS/DCS enable byte is located 13 bytes after the end of the channel frequency block. 00 for disabled, 01 for CTCSS, 02 for DCS. The TX CTCSS/DCS enable is 4 bytes after the RX byte.

====Channel/Freq.====
CTCSS is also stored as a float64 of the raw value. The values are stored starting 21 bytes after the channel frequency, with the first 8 for RX CTCSS, the last 8 for TX CTCSS.

Example: '''9A 99 99 99 99 F9 51 40''' = 71.9 (aka 71.9Hz)

DCS is stored starting 37 bytes from the end of the channel frequency block. It may use the 38th byte if the value is too high. These are uint8/uint16 respectively.

Example: '''17''' = 23 (aka DCS setting 023) | '''F2 02''' = 754 (aka DCS setting 754)

----

===Channel Frequencies===
Frequencies are stored as float64 16 byte blocks with the first 8 for the receive frequency, and the last 8 for the transmit frequency. These both end in 0x40.

{|
|+ <U>'''Channel Offsets (Hex)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Channel
!Start
!End
|-
|style="padding: 5px" |'''1'''
|style="padding: 5px" |DC
|style="padding: 5px" |EB
|-
|style="padding: 5px" |'''2'''
|style="padding: 5px" |140
|style="padding: 5px" |14F
|-
|style="padding: 5px" |'''3'''
|style="padding: 5px" |1A4
|style="padding: 5px" |1B3
|-
|style="padding: 5px" |'''4'''
|style="padding: 5px" |208
|style="padding: 5px" |217
|-
|style="padding: 5px" |'''5'''
|style="padding: 5px" |26C
|style="padding: 5px" |27B
|-
|style="padding: 5px" |'''6'''
|style="padding: 5px" |208
|style="padding: 5px" |217
|-
|style="padding: 5px" |'''7'''
|style="padding: 5px" |334
|style="padding: 5px" |343
|-
|style="padding: 5px" |'''8'''
|style="padding: 5px" |398
|style="padding: 5px" |3A7
|-
|style="padding: 5px" |'''9'''
|style="padding: 5px" |3FC
|style="padding: 5px" |40B
|-
|style="padding: 5px" |'''10'''
|style="padding: 5px" |460
|style="padding: 5px" |46F
|-
|style="padding: 5px" |'''11'''
|style="padding: 5px" |4C4
|style="padding: 5px" |4D3
|-
|style="padding: 5px" |'''12'''
|style="padding: 5px" |528
|style="padding: 5px" |537
|-
|style="padding: 5px" |'''13'''
|style="padding: 5px" |5BC
|style="padding: 5px" |59B
|-
|style="padding: 5px" |'''14'''
|style="padding: 5px" |5F0
|style="padding: 5px" |5FF
|-
|style="padding: 5px" |'''15'''
|style="padding: 5px" |654
|style="padding: 5px" |663
|-
|style="padding: 5px" |'''16'''
|style="padding: 5px" |6B8
|style="padding: 5px" |6C7
|-
|}
</div>
</div>
|}

----

===Channel 1 Offsets===
Since most people reusing these will probably only need one channel programmed, heres the exact offsets for channel 1

{|
|+ <U>'''Ch. 1 Offsets'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Parameter
!Value(s)
|-
|style="padding: 5px" |'''RX Frequency'''
|style="padding: 5px"|0xDC-E3
|-
|style="padding: 5px" |'''TX Frequency'''
|style="padding: 5px" |0xE4-EB
|-
|style="padding: 5px" |'''Scan Enable'''
|style="padding: 5px" |0xEC
|-
|style="padding: 5px" |'''RX CTCSS/DCS Option'''
|style="padding: 5px" |0xF8
|-
|style="padding: 5px" |'''RX CTCSS Value'''
|style="padding: 5px" |0x100-107
|-
|style="padding: 5px" |'''TX CTCSS Value'''
|style="padding: 5px" |0x108-10F
|-
|style="padding: 5px" |'''RX DCS Value'''
|style="padding: 5px" |0x110 or 0x110-111
|-
|style="padding: 5px" |'''TX DCS Value'''
|style="padding: 5px" |0x114 or 0x114-115
|}
</div>
</div>
|}

==SD-161==
This is the model that I have, so any of the info I have below is from my experimentaton on this model. It may apply to at least the SD-164, and the SD-171/174 line as well but you are entering unknown territory.

===Resources===
Maxon America functions as a dealer, so as an individual you cannot buy direct from them nor can you create an account to download software. However, after some searching I was able to find a company that is a reseller for these radios and lists the software freely on their site. The company is called MobileTrends.ca

* [https://www.rfwiz.com/upload/SD-160-170%20User%20Manual.pdf SD-160/SD-170 Series Service Manual]
* [https://www.rfwiz.com/upload/ACC-916%20Programming%20Manual.pdf ACC-916 Programming Manual for SD-160/SD-170 Series]

===Programming (With Cable)===
These radios utilise a proprietary programming cable that converts RS-232 to TTL, as well as utilizing the RTS pin to control programming. That last part unfortunately prevents simply connecting TX and RX to a TTL to USB serial adapter...

I contacted Maxon directly and their technical department emailed me a schematic for the out of production ACC-2016 interface cable. After making the circuit on a breadboard trying several times, and swapping TX/RX, I was not able to get the interface cable to work. Maybe you can, but I went for a more direct route.

<gallery>
File:Acc2016_schematic.png|thumb|250px|ACC-2016 Schematic
</gallery>

<br />

===Programming (Without Cable & With Software)===

Inside the radio, there is a small 8 pin SOIC I2C EEPROM (Catalyst 24WC04) which stores all the programmed info. This chip can be easily read and written to using an inexpensive CH341a based programmer.
The programming software (ACC-916E) shows a full EEPROM mapping in hex of the data to be written to the radio. With both of these, we can easily use the software to configure things as we want, then manually remake the hex file and flash it to the EEPROM.

# The first thing to do regardless of your plans is to back up the current state of the EEPROM with the CH341a. This file will also be a good base for modification when you change settings in the software. Save that file in a safe place, then make a copy for modding.
# Install the programming software which can be downloaded here and open it. Select "No Modem" and change your model
#* You will need <i>a</i> serial port, be it in use or just a USB to serial adapter or virtual, just so the software will be happy and allow opening the R/W window
# Setup the channels with your desired info, you can (only tested on the SD-161 by me) go down into the ham bands. The software will let you force an out of band frequency, but from 147.5 and up, it won't say anything.
#* "S" is Standard (25kHz) bandwidth, and "N" is Narrow (12.5kHz) bandwidth. Choose standard if you are using for amateur radio, otherwise narrow for business band use.
# Once you have channels setup, save the config to a file
# Use the saved .dat file (may need to rename it) and flash the contents via CH341a programmer to the EEPROM

===Programming (Without Cable or Software)===
Using the info above and the blank .dat files you could probably piece together a working EEPROM image, though this is risky. As always, you are doing any of this at your own risk!

===Channel Selection Switches===

If everything went well so far, you should have your new config on your radio! One last thing to check is the channel DIP switches. The way maxon illustrated these is kinda confusing, but I figured it out.

* Open the radio if you haven't already, making sure the DB-15 and BNC port are facing up/away from you like the diagram shows.
* The correct way of interpreting the DIP configuration is that the switches on the board should match the <B>BLACK</B> areas on the diagrams. From there, its just a binary sequence.
** For example, channel 1 is all switches DOWN.
** If you get things wrong and select a channel thats not programmed, the radio will flicker the red and green LEDs on boot. As long as you follow the black positions, you should be ok.

<gallery>
File:Maxon_DIP_switch_config.png|thumb|250px|DIP switch configuration diagram
</gallery>

===Debugging===
Here's a table of the status indications showing what the radio is doing, from the service manual page 18. There is plenty of other information in the service manual for troubleshooting and fixing that would be redundant to cover here, so make sure you give it a read.

<gallery>
File:Maxon_radio_status_chart.png|thumb|250px|Status chart from the serivice manual
</gallery>

==SD-125==
Some time ago, a group of amateur radio operators have done similar research into programming the SD-125 for packet radio use on amateur frequencies. [https://tarpn.net/t/builder/builders_radios_maxon_125.html Their work can be found here.]

The programming cable is similar, though uses a DB-9 serial port instead of the DB-15. I suspect you could program via EEPROM directly like I did as well.

Maxon Data Radio

2024-05-25T00:34:11Z

Trevor229: Added EEPROM reverse engineering info, added blank config files zip, reformatting too

Maxon America Inc. is a radio communications manufacturer headquartered in Lenexa, Kansas which makes a variety of Land Mobile Radios (LMR), Digital Mobile Radios (DMR), and original data telemetry modules.

[[File:Maxon_sd_161.jpg|thumb|250px|Maxon Data Radio Model SD-161 (VHF)]]
<br />

==Overview==
Maxon data radios are a line of small radio transcievers developed for industrial telemetry and data reporting use. There are both analog and digital options, but here we will focus on the analog models.

==Analog Models==
*'''SD-125EL'''
**'''V2''' - 5/1W VHF (148-174 MHz)
**'''U1''' - 5/1W UHF (400-430 MHz)
**'''U2''' - 5/1W UHF (440-470 MHz)
*'''SD-170EL'''
**'''SD-171EL''' - 5/1W VHF (146-174 MHz)
**'''SD-174EL''' - 5/1W UHF (450-490 MHz)

Older discontinued models:
*'''SD-161''' - 2W VHF (148-174 MHz)
*'''SD-164''' - 2W UHF (450-490 MHz)
*'''SD-171''' - 5/1W VHF (148-174 MHz)
*'''SD-174''' - 5/1W UHF (450-490 MHz)

==EEPROM Layout==
Work in progress, but I have identified the most important stuff (Freq, CTCSS/DCS, etc)

Here are [[:File:Maxon_sd_blank_configs.zip|blank .dat configuration files for each model.]] I haven't touched the EL series yet. Use these as a base for editing and flashing to your unit.

===Option Bytes===
====Model ID====
The very first byte (0x00) is the model ID 01 through 04 as below. Also 0xB4, that changes based on frequency band. 04 for VHF models, 01 for UHF models.

{|
|+ <U>'''Model ID'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Model
!Value
|-
|style="padding: 5px" |'''SD-161'''
|style="padding: 5px" |01
|-
|style="padding: 5px" |'''SD-164'''
|style="padding: 5px" |02
|-
|style="padding: 5px" |'''SD-171'''
|style="padding: 5px" |03
|-
|style="padding: 5px" |'''SD-174'''
|style="padding: 5px" |04
|}
</div>
</div>
|}

====Squelch====
Most of the time you probably want this on. 0xC8 is the squelch byte. 00 is no squelch, 01 is squelch enabled

====Wide/Narrow====
W/N operation for a given channel is configured using the fifth byte after the end of the TX frequency. 00 is narrowband (default) and 01 is wide.

====Scan Enable====
Scan enable is the first byte after the frequency channel block. 00 is disabled, 01 is enabled.

===CTCSS/DCS===
----
====Enable Byte====
The RX CTCSS/DCS enable byte is located 13 bytes after the end of the channel frequency block. 00 for disabled, 01 for CTCSS, 02 for DCS. The TX CTCSS/DCS enable is 4 bytes after the RX byte.

====Channel/Freq.====
CTCSS is also stored as a float64 of the raw value. The values are stored starting 21 bytes after the channel frequency, with the first 8 for RX CTCSS, the last 8 for TX CTCSS.

Example: '''9A 99 99 99 99 F9 51 40''' = 71.9 (aka 71.9Hz)

DCS is stored starting 37 bytes from the end of the channel frequency block. It may use the 38th byte if the value is too high. These are uint8/uint16 respectively.

Example: '''17''' = 23 (aka DCS setting 023) | '''F2 02''' = 754 (aka DCS setting 754)

----

===Channel Frequencies===
Frequencies are stored as float64 16 byte blocks with the first 8 for the receive frequency, and the last 8 for the transmit frequency. These both end in 0x40.

{|
|+ <U>'''Channel Offsets (Hex)'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Channel
!Start
!End
|-
|style="padding: 5px" |'''1'''
|style="padding: 5px" |DC
|style="padding: 5px" |EB
|-
|style="padding: 5px" |'''2'''
|style="padding: 5px" |140
|style="padding: 5px" |14F
|-
|style="padding: 5px" |'''3'''
|style="padding: 5px" |1A4
|style="padding: 5px" |1B3
|-
|style="padding: 5px" |'''4'''
|style="padding: 5px" |208
|style="padding: 5px" |217
|-
|style="padding: 5px" |'''5'''
|style="padding: 5px" |26C
|style="padding: 5px" |27B
|-
|style="padding: 5px" |'''6'''
|style="padding: 5px" |208
|style="padding: 5px" |217
|-
|style="padding: 5px" |'''7'''
|style="padding: 5px" |334
|style="padding: 5px" |343
|-
|style="padding: 5px" |'''8'''
|style="padding: 5px" |398
|style="padding: 5px" |3A7
|-
|style="padding: 5px" |'''9'''
|style="padding: 5px" |3FC
|style="padding: 5px" |40B
|-
|style="padding: 5px" |'''10'''
|style="padding: 5px" |460
|style="padding: 5px" |46F
|-
|style="padding: 5px" |'''11'''
|style="padding: 5px" |4C4
|style="padding: 5px" |4D3
|-
|style="padding: 5px" |'''12'''
|style="padding: 5px" |528
|style="padding: 5px" |537
|-
|style="padding: 5px" |'''13'''
|style="padding: 5px" |5BC
|style="padding: 5px" |59B
|-
|style="padding: 5px" |'''14'''
|style="padding: 5px" |5F0
|style="padding: 5px" |5FF
|-
|style="padding: 5px" |'''15'''
|style="padding: 5px" |654
|style="padding: 5px" |663
|-
|style="padding: 5px" |'''16'''
|style="padding: 5px" |6B8
|style="padding: 5px" |6C7
|-
|}
</div>
</div>
|}

----

===Channel 1 Offsets===
Since most people reusing these will probably only need one channel programmed, heres the exact offsets for channel 1

{|
|+ <U>'''Ch. 1 Offsets'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Parameter
!Value(s)
|-
|style="padding: 5px" |'''RX Frequency'''
|style="padding: 5px"|0xDC-E3
|-
|style="padding: 5px" |'''TX Frequency'''
|style="padding: 5px" |0xE4-EB
|-
|style="padding: 5px" |'''Scan Enable'''
|style="padding: 5px" |0xEC
|-
|style="padding: 5px" |'''RX CTCSS/DCS Option'''
|style="padding: 5px" |0xF8
|-
|style="padding: 5px" |'''RX CTCSS Value'''
|style="padding: 5px" |0x100-107
|-
|style="padding: 5px" |'''TX CTCSS Value'''
|style="padding: 5px" |0x108-10F
|-
|style="padding: 5px" |'''RX DCS Value'''
|style="padding: 5px" |0x110 or 0x110-111
|-
|style="padding: 5px" |'''TX DCS Value'''
|style="padding: 5px" |0x114 or 0x114-115
|}
</div>
</div>
|}

==SD-161==
This is the model that I have, so any of the info I have below is from my experimentaton on this model. It may apply to at least the SD-164, and the SD-171/174 line as well but you are entering unknown territory.

===Resources===
Maxon America functions as a dealer, so as an individual you cannot buy direct from them nor can you create an account to download software. However, after some searching I was able to find a company that is a reseller for these radios and lists the software freely on their site. The company is called MobileTrends.ca

* [https://www.rfwiz.com/upload/SD-160-170%20User%20Manual.pdf SD-160/SD-170 Series Service Manual]
* [https://www.rfwiz.com/upload/ACC-916%20Programming%20Manual.pdf ACC-916 Programming Manual for SD-160/SD-170 Series]

===Programming (With Cable)===
These radios utilise a proprietary programming cable that converts RS-232 to TTL, as well as utilizing the RTS pin to control programming. That last part unfortunately prevents simply connecting TX and RX to a TTL to USB serial adapter...

I contacted Maxon directly and their technical department emailed me a schematic for the out of production ACC-2016 interface cable. After making the circuit on a breadboard trying several times, and swapping TX/RX, I was not able to get the interface cable to work. Maybe you can, but I went for a more direct route.

<gallery>
File:Acc2016_schematic.png|thumb|250px|ACC-2016 Schematic
</gallery>

<br />

===Programming (Without Cable & With Software)===

Inside the radio, there is a small 8 pin SOIC I2C EEPROM (Catalyst 24WC04) which stores all the programmed info. This chip can be easily read and written to using an inexpensive CH341a based programmer.
The programming software (ACC-916E) shows a full EEPROM mapping in hex of the data to be written to the radio. With both of these, we can easily use the software to configure things as we want, then manually remake the hex file and flash it to the EEPROM.

# The first thing to do regardless of your plans is to back up the current state of the EEPROM with the CH341a. This file will also be a good base for modification when you change settings in the software. Save that file in a safe place, then make a copy for modding.
# Install the programming software which can be downloaded here and open it. Select "No Modem" and change your model
#* You will need <i>a</i> serial port, be it in use or just a USB to serial adapter or virtual, just so the software will be happy and allow opening the R/W window
# Setup the channels with your desired info, you can (only tested on the SD-161 by me) go down into the ham bands. The software will let you force an out of band frequency, but from 147.5 and up, it won't say anything.
#* "S" is Standard (25kHz) bandwidth, and "N" is Narrow (12.5kHz) bandwidth. Choose standard if you are using for amateur radio, otherwise narrow for business band use.
# Once you have channels setup, save the config to a file
# Use the saved .dat file (may need to rename it) and flash the contents via CH341a programmer to the EEPROM

===Programming (Without Cable or Software)===
Using the info above and the blank .dat files you could probably piece together a working EEPROM image, though this is risky. As always, you are doing any of this at your own risk!

===Channel Selection Switches===

If everything went well so far, you should have your new config on your radio! One last thing to check is the channel DIP switches. The way maxon illustrated these is kinda confusing, but I figured it out.

* Open the radio if you haven't already, making sure the DB-15 and BNC port are facing up/away from you like the diagram shows.
* The correct way of interpreting the DIP configuration is that the switches on the board should match the <B>BLACK</B> areas on the diagrams. From there, its just a binary sequence.
** For example, channel 1 is all switches DOWN.
** If you get things wrong and select a channel thats not programmed, the radio will flicker the red and green LEDs on boot. As long as you follow the black positions, you should be ok.

<gallery>
File:Maxon_DIP_switch_config.png|thumb|250px|DIP switch configuration diagram
</gallery>

===Debugging===
Here's a table of the status indications showing what the radio is doing, from the service manual page 18. There is plenty of other information in the service manual for troubleshooting and fixing that would be redundant to cover here, so make sure you give it a read.

<gallery>
File:Maxon_radio_status_chart.png|thumb|250px|Status chart from the serivice manual
</gallery>

==SD-125==
Some time ago, a group of amateur radio operators have done similar research into programming the SD-125 for packet radio use on amateur frequencies. [https://tarpn.net/t/builder/builders_radios_maxon_125.html Their work can be found here.]

The programming cable is similar, though uses a DB-9 serial port instead of the DB-15. I suspect you could program via EEPROM directly like I did as well.

File:Maxon sd blank configs.zip

2024-05-25T00:29:40Z

Trevor229: Blank configuration files for the Maxon SD-161/164 and SD-171/174 line of radios.

== Summary ==
Blank configuration files for the Maxon SD-161/164 and SD-171/174 line of radios.

CD&F (Siren Controller)

2024-05-23T18:56:28Z

Trevor229: Rework to include shared info between models, add info for SC series

Civil Defense & Fire (CD&F) siren controllers function on two-tone Motorola QuikCall, Plectron, or General Electric style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these devices or the company nowadays, but here is what I have discovered.

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* <s>Recreate schematics of each daughterboard to help with figuring out their functionality.</s> Shown in the manual
* <s>Document the theory of operation and create a rough block diagram for functionality.</s> Shown in the manual
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were more commonplace back in the 1980's and 1990's. Despite that, there are many units that were shipped into the mid 2000's, and the company was merged/acquired by Sentry Siren sometime in the mid 2010's. The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:

*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-3'''<ref>https://fccid.io/F498POCDF-2</ref> Not registered on FCC database, but exists. UHF variant of SC series (SC3)
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz.

===Speculation===
My current research shows the existence of at least two or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

* This model that I own, which is always civil defense yellow and measures 325x232x92mm a few times on the internet in videos and photos
** Appears to always have it's radio receiver on the motherboard with descrete components.

* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board, some kind of descrete but shielded radio board, or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards
** I've also noticed a possibly earlier variant that has a screw latch instead of a folding wing type latch.

My large silver unit does not appear to have an FCC ID. This kinda makes sense since the only RF part is a pre-certified radio receiver

I have also noticed at least one unit that has the "PO" of F49POCDF markered out, which would make it F49CDF, which is a vaild ID. I believe that F49CDF and F49POCDF may be the same units with just a different variation or newer/older models.

CD&F makes other products as well, though the only other example I have seen is some sort of electronic siren controller on Twitter (LINK HERE)
<br />

==Shared Components and Info==
This section contains part descriptions and information that is relevant across the entire line of controllers.

===Manual===
I was given a scanned copy of a manual for the SC line of controllers, though there is plenty of info relevant to all models within. I have uploaded it to [https://archive.org/details/cdf-radio-manual archive.org here.]

===Naming/Serial Convention===
According to the manual, this is how the controller units are named. At least, the larger SC variants. Some older units seem to follow slightly different conventions (ex. SC3M0-1322)

<pre>
SC(V)-(W)-(XY)-(ZZZZ)
</pre>

'''SC''' - Siren Controller

'''V''' - Frequency band
** '''1''' - Low Band VHF (30-50MHz)
** '''2''' - High Band VHF (148-173MHz)
** '''3''' - UHF (440-480MHz)

'''W''' - ???

'''X''' - Tone format & timing
** '''P''' - Plectron
** '''M''' - Motorola
** '''G''' - General Electric
** '''F''' - ??? (Mentioned in manual, Maybe Motorola 4 tone?)

'''Y''' - Revision number

'''Z''' - Serial Number

This is how I interpreted it, though I could be wrong about the revision number placement.

===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

{|
|+ <U>'''Tone Filter Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Pin
!Function
|-
|'''P1-1'''
|Audio in
|-
|'''P1-2'''
|Vin (+12v)
|-
|'''P1-3'''
|GND
|-
|'''P1-4'''
|Logic NOT signal out (default high, drops low when signal is in passband)
|-
|'''P1-5'''
|Logic Out (Not used on this board, but is the opposite of P4)
|}
</div>
</div>
|}

====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.

=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.

With that being said, you may want to test your own filters. Here is how I tested mine:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

Through some component changes, you will probably be able to change the adjustable range of the filters. That is something I am going to investigate soon.

====Tone filter troubleshooting====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

{|
|+ <U>'''Decoder Module Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|Output, goes to programming section
|-
|'''P1-3'''
|Input, goes to programming section
|-
|'''P1-4'''
|Output to Timer, thru diode customization section between decoders (CR5 & CR8)
|-
|'''P1-5'''
|From CR5 diode, test output? (N/C on main board)
|}
</div>
</div>
|}

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Modules===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - N/A (Populated on other boards)

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

{|
|+ <U>'''Cycle Timer Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|Signal Out to Relay Driver
|-
|'''P1-2'''
|STOP (Also local control via terminal strip)
|-
|'''P1-3'''
|START (Also local control via terminal strip)
|-
|'''P1-4'''
|??? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|N/C on Main Board
|-
|'''P1-3'''
|Coupled to GND via C44
|-
|'''P1-4'''
|N/C on Main Board
|-
|'''P1-5'''
|N/C on Main Board
|}
</div>
</div>
|}

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />

----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

{|
|+ <U>'''LCRx Relay Driver Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C on Main Board, but traces route to it on driver board
|-
|'''P1-2'''
|Signal Input from timer
|-
|'''P1-3'''
|N/C on driver board
|-
|'''P1-4'''
|N/C on driver board
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|Relay Coil (E9 on I/O header)
|-
|'''P1-3'''
|Relay Coil (E10 on I/O header)
|-
|'''P1-4'''
|N/C on Main Board, but traces route to it on driver board
|-
|'''P1-5'''
|N/C on Main Board, but traces route to it on driver board
|}
</div>
</div>
|}

<br />
----

===I/O connector pinout===
This connector is the one just left of the relay. Houses the relay wires and the start/stop button inputs.

* E10: Relay Coil
* E9: Relay Coil
* E8: Start terminal
* E7: Stop terminal
* E6: Common terminal

<br />
----

===Board Connectors===
The molex connectors that are used on all the modular boards are Molex KK series with a .156" pitch.
* [http://www.mouser.com/catalog/645/usd/1630.pdf Molex KK Series connectors datasheet]
* [https://www.mouser.com/catalog/645/usd/1631.pdf Molex KK series headers datasheet]

==Programming==

There are two small sections below the tone decoders and inbetween the two decoder boards that allow for changing the path of signals in and out of the decoder boards. This allows for changing the behavior of the unit depending on the number of tone filters installed.

For example, my unit has two filters installed and the "on" sequence is A1, A2 (1153/1285 Hz), and "off" is the opposite. Since there are 4 card positions, you can also configure a 3 and 4 card setup

===2 Card Setup===
Probably the most common, and what my unit is configured for. Sending A1, A2 turns the unit on, and A2, A1 turns it off. The jumpers are configured as follows:

*CR1 diode from 1 to A1
*CR2 diode from 2 to A2
*B1 to A2 jumper (in row 3)
*A1 to B2 jumper (in row 4)

*CR5 in place facing the board marking
*CR6 empty
*CR7 empty
*CR8 in place facing the board marking

<gallery>

</gallery>

===3 Card Setup===
One tone filter is a "common" tone, and the other two are completely different frequencies. If for example, 800 Hz is the common tone and the others are 740 and 930, then one could configure the unit to turn on with 800/740, and off with 800/930.

===4 Card Setup===
In this case, there is a different tone pair for each action. On has two completely different frequencies compared to off.

I plan on figuring out what the hell is required to change these configs and document it here soon.

<br />

==LCRx (Simpler Small Yellow Unit)==
This unit is the first type I acquired. It is significantly smaller and simpler than the other types, only allowing for a single function timer, but up to four tone filters. This allows for either a 2, 3 or 4 card setup.

===Specifications===

====Physical====
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''LCRx Series:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#(LCRx) Transformer wiring|(LCRx) transformer wiring]] section below.

----

====Photos====

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
====(LCRx) Transformer wiring====
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

===Architecture & Operation===
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

As for the LCR-1 variant, based on the FCC-ID data it seems that the receiver will be nearly identical, though the resulting IF mixer will most likely be an addition rather than subtraction circuit due to the lower operation frequency.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />

==SCx (Multi-Option Large Silver/Yellow/Red Unit)==
The second type of unit I have acquired (an SC2), is much larger and more complex. It can support up to 3 (technically 4) function timers, 4 decoders, and six tone filters. This allows for a much more complex operation.

The manual specifies a number of optional add-ons:

* ''D1'' - Thermostat controlled heater (mounts below the receiver board)
* ''D2'' - CTCSS decoder board (mostly obsolete, rare)
* ''D3'' - Top deck mount VHF low antenna
* ''D4'' - Top deck mount VHF high antenna
* ''D5'' - Additional heavy duty 10A relay (relay #2)
* ''D6'' - Cabinet painted red
* ''D7'' - Additional intermodulation filter (not sure what this is?)
* ''D8'' - Audio kit (for servicing decoders)
* ''D9'' - Test transmitter encoder (possibly one of the FCC-IDs? Maybe CDF1 and CDF2.)
* ''D10'' - Additional tone filter

===Specifications===

====Physical====

'''SC Series:'''

* '''Height:''' 325mm (12.75") & 387mm (15.25") from bracket top and bottom
* '''Width:''' 320mm (12.59") top section & 288mm (11.33") bottom section
* '''Depth:''' 95mm (3.74") top section & 90mm (3.54") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. ?? lbs

'''Transformer:'''<ref>https://www.hammfg.com/electronics/transformers/power/266.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 24v DC OR 12v DC depending on config (Unloaded is higher)
*'''Max Current:''' 1A/2A (24/12v)
*'''Max VA:''' 24

<gallery>
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

More info on configuring in the [[#(SC) Transformer wiring| SC transformer wiring]] section below.

----
====Photos====

<gallery>
File:Cdf_SC_front_case.jpg|Front case before restoration
File:Cdf_SC_front_restored.jpg|Front case of my unit after restoration
File:Cdf_SC_inside.jpg|Inside my restored unit with missing activation buttons added
File:Cdf_SC_nameplate.jpg|Nameplate with details
File:Cdf_SC_latch_side.jpg|Latch side of my restored unit
File:Cdf_SC_hinge_side.jpg|Hinge side of my restored unit
File:Cdf_SC_back.jpg|Back of my restored unit
File:Cdf_SC_top.jpg|Top of my restored unit showing the antenna bulkhead
File:Cdf_SC_bottom.jpg|Bottom of the restored unit showing optional SO-239 connector
</gallery>

<br />
----

====(SC) Transformer wiring====
The main transformer in the unit is a [https://www.hammfg.com/electronics/transformers/power/266.pdf 266J24 from Hammond Manufacturing].

*'''115v Operation:''' Tie '''black/brown''' together and '''white/orange''' together.

*'''230v Operation:''' Tie '''white/brown''' together and insulate. Input power on '''black''' and '''orange'''.

The main board operates on 12v, so just make sure that the red/grey and yellow/blue wires are tied together in those pairs for 12v operation.

<gallery>
File:Toroid1.gif|Transformer pinout from Hammond
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>

----

===Tone Filter Test Board===
The tone filter test board is pretty self explanatory. It contains six LEDs, one for each tone filter, which are connected to a MC14069BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> hex inverter IC.

When the a tone filter detects a signal within its configured bandwidth and pulls it's P1-4 pin low, the hex inverter IC inverts that signal, pulling the corresponding LED high which illuminates it, indicating the filter is active.

{|
|+ <U>'''Tone Filter Test Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|4th tone filter (J3)
|-
|'''P1-2'''
|3rd tone filter (J4)
|-
|'''P1-3'''
|2nd tone filter (J5)
|-
|'''P1-4'''
|1st tone filter (J6)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|5th tone filter (J2)
|-
|'''P1-3'''
|6th tone filter (J1)
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|N/C
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_decodertester_front.jpg|Front of the SC series tone filter test board
File:Cdf_SC_decodertester_rear.jpg|Rear of the SC series tone filter test board
</gallery>

----

===Programming board===
The programming board is the center of the unit's operation. It's a bare board that allows for jumpers to be placed to route signals from the tone filters to the decoders. The manual details the configuration in more detail, but here's the basics.

There are letter and number combinations printed on the programming board, which correspond to each function and it's inputs.

*V - CD Steady (Alert)
*W - CD Cycle (Attack)
*X - Fire
*Y - Cancel

The numbers corresponding to the letters (eg. Y1) is which order the filter signal should be sent in to trigger the function. 1 is the first signal, 2 is the second signal. Theoretically, this allows for any combination of common or separate tones to be configured to activate any function as desired, though there may be limitations that I am not aware of.

{|
|+ <U>'''Programming Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|2Y (Cancel)
|-
|'''P1-3'''
|1Y (Cancel)
|-
|'''P1-4'''
|Tone filter 1 (J6)
|-
|'''P1-5'''
|Tone filter 2 (J5)
|}
</div>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Center
!Pin
!Function
|-
|'''P2-1'''
|2X (Fire)
|-
|'''P2-2'''
|1X (Fire)
|-
|'''P2-3'''
|Tone filter 3 (J4)
|-
|'''P2-4'''
|Tone filter 4 (J3)
|-
|'''P2-5'''
|2W (CD Cycle/Attack)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P3-1'''
|1W (CD Cycle/Attack)
|-
|'''P3-2'''
|Tone filter 5 (J2)
|-
|'''P3-3'''
|Tone filter 6 (J1)
|-
|'''P3-4'''
|2V (CD Steady/Alert)
|-
|'''P3-5'''
|1V (CD Steady/Alert)
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_prog_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_prog_module_back.jpg|Rear of the SC series programming board
</gallery>

----

===Power Supply Module===
On the LCx series, the power supply section is built into the main board. It is similar in architecture to the SC series, though the latter has it on a removable module. The power supply module takes in the unregulated AC output of the transformer, rectifies it, tames it down to 12v via a 7812 voltage regulator, and finally filters the DC with inductors and capacitors.

{|
|+ <U>'''Power Supply Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vout (+18v unregulated)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|Transformer AC in
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Transformer AC in
|}
</div>
</div>
|}

<gallery>
File:Cdf_SC_psu_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_psu_back.jpg|Rear of the SC series programming board
</gallery>

<br />

==Other Units==
There are more unit types out there which include more variants of the LCR and SCx line:

Smaller Units:
* LCR1 - (most likely) VHF Low band small yellow unit
* LCR2 - VHF High band small yellow unit

Larger Units:
* SC1 - VHF Low band large silver/yellow unit
* SC2 - VHF High band large silver/yellow unit
* SC3 - UHF band large silver/yellow unit

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.

*While the tone filters are labled J1 thru J6 on the PCB, the actual numbering is reversed, tone filter 1 is at the top and 6 is at the bottom. Despite that, my unit (and I suspect others that were reconfigured by a third party) may not start at slot 1. My unit has slots 6, 5, and 4 occupied with the corresponding wiring on the programming board. The nameplate implies slots 1, 2, and 3 however. Overall it doesn't ''really'' matter if things aren't in numerical order, but it sure as hell makes things confusing...
<br />

File:Cdf SC hinge side.jpg

2024-05-23T18:48:45Z

Trevor229: Hinge side of the SC series CD&F

== Summary ==
Hinge side of the SC series CD&F
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC latch side.jpg

2024-05-23T18:48:20Z

Trevor229: Latch side of the SC series CD&F

== Summary ==
Latch side of the SC series CD&F
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC back.jpg

2024-05-23T18:47:48Z

Trevor229: Back of the SC series CD&F

== Summary ==
Back of the SC series CD&F
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC bottom.jpg

2024-05-23T18:47:22Z

Trevor229: Bottom of the SC series CD&F showing optional SO-239

== Summary ==
Bottom of the SC series CD&F showing optional SO-239
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC top.jpg

2024-05-23T18:46:43Z

Trevor229: Top of the SC series CD&F

== Summary ==
Top of the SC series CD&F
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC front restored.jpg

2024-05-23T18:42:14Z

Trevor229: Front of my SC series CD&F after restoration

== Summary ==
Front of my SC series CD&F after restoration
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC inside.jpg

2024-05-23T18:38:56Z

Trevor229: Inside of the SC series CD&F after restoration and adding missing control buttons

== Summary ==
Inside of the SC series CD&F after restoration and adding missing control buttons
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC assembly wo radio.jpg

2024-05-23T02:58:47Z

Trevor229: Sub-assembly of the SC series CD&F without the radio receiver module installed

== Summary ==
Sub-assembly of the SC series CD&F without the radio receiver module installed
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC Button conn pinout.png

2024-05-23T02:56:57Z

Trevor229: Pinout of the local control header on the SC series CD&F

== Summary ==
Pinout of the local control header on the SC series CD&F
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC psu module front.jpg

2024-05-23T02:56:06Z

Trevor229: Front of the SC series CD&F power supply module

== Summary ==
Front of the SC series CD&F power supply module
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC psu back.jpg

2024-05-23T02:55:31Z

Trevor229: Rear of the SC series CD&F power supply module

== Summary ==
Rear of the SC series CD&F power supply module
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC prog module front.jpg

2024-05-23T02:54:34Z

Trevor229: Front of the SC series CD&F programming module

== Summary ==
Front of the SC series CD&F programming module
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC prog module back.jpg

2024-05-23T02:54:20Z

Trevor229: Rear of the SC series CD&F programming module

== Summary ==
Rear of the SC series CD&F programming module
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC front case.jpg

2024-05-23T02:53:46Z

Trevor229: Front case of my SC series unit before restoration. The logo was penciled in by me for measurement and recreation

== Summary ==
Front case of my SC series unit before restoration. The logo was penciled in by me for measurement and recreation
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC decodertester rear.jpg

2024-05-23T02:53:04Z

Trevor229: Rear of the decoder tester board from the SC series CD&F

== Summary ==
Rear of the decoder tester board from the SC series CD&F
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC decodertester front.jpg

2024-05-23T02:52:42Z

Trevor229: Front of the decoder tester board from the SC series CD&F

== Summary ==
Front of the decoder tester board from the SC series CD&F
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC nameplate.jpg

2024-05-23T02:39:28Z

Trevor229: Nameplate of the larger SC series CD&F controller

== Summary ==
Nameplate of the larger SC series CD&F controller
== Licensing ==
{{cc-by-sa-4.0}}

File:Cdf SC transformer details.jpg

2024-05-21T23:34:24Z

Trevor229: CD&F SC series transformer detailed close-up

== Summary ==
CD&F SC series transformer detailed close-up
== Licensing ==
{{cc-by-sa-4.0}}

File:Toroid1.gif

2024-05-21T23:33:02Z

Trevor229: Hammond 266J24 transformer pinout from https://www.hammfg.com/electronics/transformers/power/266

== Summary ==
Hammond 266J24 transformer pinout from https://www.hammfg.com/electronics/transformers/power/266

Maxon Data Radio

2024-05-15T02:51:44Z

Trevor229: Change image positioning

Industrial

2024-05-15T02:47:29Z

Trevor229: add maxon data radio page

[[File:BG Model 250 Side 1.JPG|thumb|Fluid control valves for acid in integrated circuit decapping machine]]
Access Control, Camera Systems, Infrastructure (Power, Gas and Water Meters), SCADA and any other industrial systems.
==Device Index==
[[Advanced Metering Infrastructure]]

[[Power Metering in Germany]]

[[B&G International Decapsulator Model 250]]

[[Digitech-XC0324]]

[[Electronic Parking Meter]]

[[Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem]]

[[LMS-6 Radiosonde]]

[[DFM-17 Radiosonde]]

[[Master Meter 3G Mobile AMR]]

[[Parking_Pilot]]

[[Telematics Wireless FP300RA]] - Automatic Vehicle Identification Reader

[[CD&F (Siren Controller)]]

[[Panasonic Toughpad FZ-G1 MK4]] - Industrial portable field tablet.

[[Maxon Data Radio]] - Low powered VHF/UHF radio module for SCADA/telemetry

Maxon Data Radio

2024-05-15T02:46:03Z

Trevor229: initial creation

File:Maxon sd 161.jpg

2024-05-15T02:44:02Z

Trevor229: Maxon SD-161 data radio installed in a CD&F siren controller

== Summary ==
Maxon SD-161 data radio installed in a CD&F siren controller
== Licensing ==
{{cc-by-sa-4.0}}

File:Maxon DIP switch config.png

2024-05-14T23:50:12Z

Trevor229: Channel selection diagram for maxon data radios

== Summary ==
Channel selection diagram for maxon data radios

File:Maxon radio status chart.png

2024-05-14T23:43:19Z

Trevor229: Status chart from Maxon radio service manual

== Summary ==
Status chart from Maxon radio service manual

File:Acc2016 schematic.png

2024-05-14T23:29:42Z

Trevor229: Schematic for the model ACC-2016 programming cable for Maxon data radios

== Summary ==
Schematic for the model ACC-2016 programming cable for Maxon data radios

CD&F (Siren Controller)

2024-05-03T23:44:18Z

Trevor229: Fix caption in timer module section

Civil Defense & Fire (CD&F) Controllers function on two-tone Motorola QuikCall style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these or the company, but here is what I have discovered.

[[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]
<br />

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* Recreate schematics of each daughterboard to help with figuring out their functionality.
* Document the theory of operation and create a rough block diagram for functionality.
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were only commonplace back in the 1980's and 1990's The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:

*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.

===Speculation===
My current research shows the existence of at least 2 or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

* This model that I own, which is always civil defense yellow and measures 325x232x92mm a few times on the internet in videos and photos
** Appears to always have it's radio receiver on the motherboard with descrete components.

* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards

<br />

==Specifications==

===Physical===
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''F49LCR-2:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#Transformer wiring|transformer wiring]] section below.

<br />

===Photos===

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
===Transformer wiring===
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

==Architecture & Operation==
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />
----
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

'''Tone filter module pinout:'''
* P1 - Audio in
* P2 - VCC (12v)
* P3 - GND
* P4 - Logic NOT signal out (default high, drops low when signal is in passband)
* P5 - Logic Out (Not used on this board, but is the opposite of P4)

====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.

=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.

With that being said, you may want to test your own filters. Here is how I tested mine:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

====Tone filter troubleshooting:====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

'''Pinout (left to right):'''

*'''Left'''
** P1-1:
** P1-2:
** P1-3:
** P1-4:
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2:
** P2-3:
** P2-4:
** P2-5:

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|RC oscillator up close, showing the 1.5s interval
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - N/A (Populated on other boards)

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

'''Pinout (left to right):'''

There are no markings on this board but I will use the same naming convention as the others.

*'''Left'''
** P1-1: Signal Out to Relay Driver
** P1-2: STOP (Local control via terminal strip) I assume this pulls pin 10 of the ICM7240 to GND(?) to reset the chip cycle. COM is referenced to GND on the terminal strip.
** P1-3: START (Local control via terminal strip) I assume this pulls pin 11 of the ICM7240 to GND(?) to trigger the cycle.
** P1-4: Trigger Input? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?)
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2: N/C on Main Board
** P2-3: Coupled to GND via C44
** P2-4: N/C on Main Board
** P2-5: N/C on Main Board

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />
----

===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

'''Pinout (left to right):'''

*'''Left'''
** P1-1: N/C on Main Board, but traces route to it on driver board
** P1-2: Signal Input from timer
** P1-3: N/C on driver board
** P1-4: N/C on driver board
** P1-5: Vin (+17v)

* '''Right'''
** P2-1: GND
** P2-2: Relay Coil
** P2-3: Relay Coil
** P2-4: N/C on Main Board, but traces route to it on driver board
** P2-5: N/C on Main Board, but traces route to it on driver board

<br />

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
<br />

CD&F (Siren Controller)

2024-05-03T23:04:38Z

Trevor229: Add tone filter tuning info and some minor cosmetic adjustments

Civil Defense & Fire (CD&F) Controllers function on two-tone Motorola QuikCall style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these or the company, but here is what I have discovered.

[[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]
<br />

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* Recreate schematics of each daughterboard to help with figuring out their functionality.
* Document the theory of operation and create a rough block diagram for functionality.
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were only commonplace back in the 1980's and 1990's The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:

*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.

===Speculation===
My current research shows the existence of at least 2 or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

* This model that I own, which is always civil defense yellow and measures 325x232x92mm a few times on the internet in videos and photos
** Appears to always have it's radio receiver on the motherboard with descrete components.

* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards

<br />

==Specifications==

===Physical===
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''F49LCR-2:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#Transformer wiring|transformer wiring]] section below.

<br />

===Photos===

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
===Transformer wiring===
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

==Architecture & Operation==
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />
----
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

'''Tone filter module pinout:'''
* P1 - Audio in
* P2 - VCC (12v)
* P3 - GND
* P4 - Logic NOT signal out (default high, drops low when signal is in passband)
* P5 - Logic Out (Not used on this board, but is the opposite of P4)

====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.

=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.

With that being said, you may want to test your own filters. Here is how I tested mine:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:

# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.

====Tone filter troubleshooting:====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

'''Pinout (left to right):'''

*'''Left'''
** P1-1:
** P1-2:
** P1-3:
** P1-4:
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2:
** P2-3:
** P2-4:
** P2-5:

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - N/A (Populated on other boards)

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

'''Pinout (left to right):'''

There are no markings on this board but I will use the same naming convention as the others.

*'''Left'''
** P1-1: Signal Out to Relay Driver
** P1-2: STOP (Local control via terminal strip) I assume this pulls pin 10 of the ICM7240 to GND(?) to reset the chip cycle. COM is referenced to GND on the terminal strip.
** P1-3: START (Local control via terminal strip) I assume this pulls pin 11 of the ICM7240 to GND(?) to trigger the cycle.
** P1-4: Trigger Input? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?)
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2: N/C on Main Board
** P2-3: Coupled to GND via C44
** P2-4: N/C on Main Board
** P2-5: N/C on Main Board

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />
----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

'''Pinout (left to right):'''

*'''Left'''
** P1-1: N/C on Main Board, but traces route to it on driver board
** P1-2: Signal Input from timer
** P1-3: N/C on driver board
** P1-4: N/C on driver board
** P1-5: Vin (+17v)

* '''Right'''
** P2-1: GND
** P2-2: Relay Coil
** P2-3: Relay Coil
** P2-4: N/C on Main Board, but traces route to it on driver board
** P2-5: N/C on Main Board, but traces route to it on driver board

<br />

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
<br />

CD&F (Siren Controller)

2024-04-26T06:49:28Z

Trevor229: Forgot pin number

Civil Defense & Fire (CD&F) Controllers function on two-tone Motorola QuikCall style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these or the company, but here is what I have discovered.

[[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]
<br />

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* Recreate schematics of each daughterboard to help with figuring out their functionality.
* Document the theory of operation and create a rough block diagram for functionality.
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were only commonplace back in the 1980's and 1990's The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:
*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.

===Speculation===
My current research shows the existence of at least 2 or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

<br />

==Specifications==

===Physical===
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''F49LCR-2:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#Transformer wiring|transformer wiring]] section below.

<br />

===Photos===

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
===Transformer wiring===
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

==Architecture & Operation==
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />
----
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

'''Tone filter module pinout:'''
* P1 - Audio in
* P2 - VCC (12v)
* P3 - GND
* P4 - Logic NOT signal out (default high, drops low when signal is in passband)
* P5 - Logic Out (Not used on this board, but is the opposite of P4)

====Tone filter troubleshooting:====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

'''Pinout (left to right):'''

*'''Left'''
** P1-1:
** P1-2:
** P1-3:
** P1-4:
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2:
** P2-3:
** P2-4:
** P2-5:

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - N/A (Populated on other boards)

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

'''Pinout (left to right):'''

There are no markings on this board but I will use the same naming convention as the others.

*'''Left'''
** P1-1: Signal Out to Relay Driver
** P1-2: STOP (Local control via terminal strip) I assume this pulls pin 10 of the ICM7240 to GND(?) to reset the chip cycle. COM is referenced to GND on the terminal strip.
** P1-3: START (Local control via terminal strip) I assume this pulls pin 11 of the ICM7240 to GND(?) to trigger the cycle.
** P1-4: Trigger Input? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?)
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2: N/C on Main Board
** P2-3: Coupled to GND via C44
** P2-4: N/C on Main Board
** P2-5: N/C on Main Board

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />
----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

'''Pinout (left to right):'''

*'''Left'''
** P1-1: N/C on Main Board, but traces route to it on driver board
** P1-2: Signal Input from timer
** P1-3: N/C on driver board
** P1-4: N/C on driver board
** P1-5: Vin (+17v)

* '''Right'''
** P2-1: GND
** P2-2: Relay Coil
** P2-3: Relay Coil
** P2-4: N/C on Main Board, but traces route to it on driver board
** P2-5: N/C on Main Board, but traces route to it on driver board

<br />

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
<br />

CD&F (Siren Controller)

2024-04-26T06:47:32Z

Trevor229: Fix small formatting/spelling and add scope images

Civil Defense & Fire (CD&F) Controllers function on two-tone Motorola QuikCall style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these or the company, but here is what I have discovered.

[[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]
<br />

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* Recreate schematics of each daughterboard to help with figuring out their functionality.
* Document the theory of operation and create a rough block diagram for functionality.
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were only commonplace back in the 1980's and 1990's The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:
*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.

===Speculation===
My current research shows the existence of at least 2 or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

<br />

==Specifications==

===Physical===
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''F49LCR-2:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#Transformer wiring|transformer wiring]] section below.

<br />

===Photos===

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
===Transformer wiring===
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

==Architecture & Operation==
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nearly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />
----
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

'''Tone filter module pinout:'''
* P1 - Audio in
* P2 - VCC (12v)
* P3 - GND
* P4 - Logic NOT signal out (default high, drops low when signal is in passband)
* P5 - Logic Out (Not used on this board, but is the opposite of P4)

====Tone filter troubleshooting:====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

'''Pinout (left to right):'''

*'''Left'''
** P1-1:
** P1-2:
** P1-3:
** P1-4:
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2:
** P2-3:
** P2-4:
** P2-5:

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.

<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - N/A (Populated on other boards)

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

'''Pinout (left to right):'''

There are no markings on this board but I will use the same naming convention as the others.

*'''Left'''
** P1-1: Signal Out to Relay Driver
** P1-2: STOP (Local control via terminal strip) I assume this pulls pin 10 of the ICM7240 to GND(?) to reset the chip cycle. COM is referenced to GND on the terminal strip.
** P1-3: START (Local control via terminal strip) I assume this pulls pin 11 of the ICM7240 to GND(?) to trigger the cycle.
** P1-4: Trigger Input? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?)
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2: N/C on Main Board
** P2-3: Coupled to GND via C44
** P2-4: N/C on Main Board
** P2-5: N/C on Main Board

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />
----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

'''Pinout (left to right):'''

*'''Left'''
** P1-1: N/C on Main Board, but traces route to it on driver board
** P1-2: Signal Input from timer
** P1-3: N/C on driver board
** P1-4: N/C on driver board
** P1-5: Vin (+17v)

* '''Right'''
** P2-1: GND
** P2-2: Relay Coil
** P2-3: Relay Coil
** P2-4: N/C on Main Board, but traces route to it on driver board
** P2-5: N/C on Main Board, but traces route to it on driver board

<br />

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
<br />

File:Cdf timer rc scope2.png

2024-04-26T06:43:09Z

Trevor229: Scope view of the RC oscillator on the CD&F Timer

== Summary ==
Scope view of the RC oscillator on the CD&F Timer
== Licensing ==
{{cc-by-4.0}}

File:Cdf timer RC scope.png

2024-04-26T06:42:44Z

Trevor229: Scope view of the RC oscillator on the CD&F Timer

== Summary ==
Scope view of the RC oscillator on the CD&F Timer
== Licensing ==
{{cc-by-4.0}}

CD&F (Siren Controller)

2024-04-23T04:13:10Z

Trevor229: Add pinouts of daughterboards, more info on cycle timer functionality

Civil Defense & Fire (CD&F) Controllers function on two-tone Motorola QuikCall style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these or the company, but here is what I have discovered.

[[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]
<br />

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* Recreate schematics of each daughterboard to help with figuring out their functionality.
* Document the theory of operation and create a rough block diagram for functionality.
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were only commonplace back in the 1980's and 1990's The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:
*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.

===Speculation===
My current research shows the existence of at least 2 or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

<br />

==Specifications==

===Physical===
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''F49LCR-2:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#Transformer wiring|transformer wiring]] section below.

<br />

===Photos===

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
===Transformer wiring===
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

==Architecture & Operation==
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nerly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />
----
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

'''Tone filter module pinout:'''
* P1 - Audio in
* P2 - VCC (12v)
* P3 - GND
* P4 - Logic NOT signal out (default high, drops low when signal is in passband)
* P5 - Logic Out (Not used on this board, but is the opposite of P4)

====Tone filter troubleshooting:====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

'''Pinout (left to right):'''

*'''Left'''
** P1-1:
** P1-2:
** P1-3:
** P1-4:
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2:
** P2-3:
** P2-4:
** P2-5:

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.

At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s.

'''ICs (Steady Cycle Timer 031-0389-000):'''

'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

'''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

'''U3''' - N/A (Populated on other boards)

'''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

'''Pinout (left to right):'''

There are no markings on this board but I will use the same naming convention as the others.

*'''Left'''
** P1-1: Signal Out to Relay Driver
** P1-2: STOP (Local control via terminal strip) I assume this pulls pin 10 of the ICM7240 to GND(?) to reset the chip cycle. COM is referenced to GND on the terminal strip.
** P1-3: START (Local control via terminal strip) I assume this pulls pin 11 of the ICM7240 to GND(?) to trigger the cycle.
** P1-4: Trigger Input? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?)
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2: N/C on Main Board
** P2-3: Coupled to GND via C44
** P2-4: N/C on Main Board
** P2-5: N/C on Main Board

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />
----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

'''Pinout (left to right):'''

*'''Left'''
** P1-1: N/C on Main Board, but traces route to it on driver board
** P1-2: Signal Input from timer
** P1-3: N/C on driver board
** P1-4: N/C on driver board
** P1-5: Vin (+17v)

* '''Right'''
** P2-1: GND
** P2-2: Relay Coil
** P2-3: Relay Coil
** P2-4: N/C on Main Board, but traces route to it on driver board
** P2-5: N/C on Main Board, but traces route to it on driver board

<br />
----
==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
<br />

CD&F (Siren Controller)

2024-04-23T01:49:31Z

Trevor229: Add info about cycle timer module and sections for pinouts

Civil Defense & Fire (CD&F) Controllers function on two-tone Motorola QuikCall style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these or the company, but here is what I have discovered.

[[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]
<br />

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* Recreate schematics of each daughterboard to help with figuring out their functionality.
* Document the theory of operation and create a rough block diagram for functionality.
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were only commonplace back in the 1980's and 1990's The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:
*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.

===Speculation===
My current research shows the existence of at least 2 or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

<br />

==Specifications==

===Physical===
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''F49LCR-2:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#Transformer wiring|transformer wiring]] section below.

<br />

===Photos===

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />
----
===Transformer wiring===
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

==Architecture & Operation==
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nerly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />
----
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

'''Tone filter module pinout:'''
* P1 - Audio in
* P2 - VCC (12v)
* P3 - GND
* P4 - Logic NOT signal out (default high, drops low when signal is in passband)
* P5 - Logic Out (Not used on this board, but is the opposite of P4)

====Tone filter troubleshooting:====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

'''ICs:'''

'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)

'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)

'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)

'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)

'''Pinout (left to right):'''

*'''Left'''
** P1-1:
** P1-2:
** P1-3:
** P1-4:
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2:
** P2-3:
** P2-4:
** P2-5:

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />
----
===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.

The DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.

Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of 1Hz. The confusing part is that with these figures, we get a cycle time of 165 seconds, not 180 as 3 minutes would work out to. I will have to try setting switches 8, 6, 5 and 4 high which should equal exactly 180s.

'''ICs (Steady Cycle Timer 031-0389-000):'''

U1 - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)

U2 - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)

U3 - N/A (Populated on other boards)

U4 - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)

'''Pinout (left to right):'''

There are no markings on this board but I will use the same naming convention as the others.

*'''Left'''
** P1-1:
** P1-2:
** P1-3:
** P1-4:
** P1-5: Vin (+12v)

* '''Right'''
** P2-1: GND
** P2-2:
** P2-3:
** P2-4:
** P2-5:

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />
----
===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

<br />
----
==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
<br />

Industrial

2024-04-17T00:24:30Z

Trevor229: /* Device Index */ Add CD&F article link

CD&F (Siren Controller)

2024-04-17T00:23:55Z

Trevor229: Initial creation of page

Civil Defense & Fire (CD&F) Controllers function on two-tone Motorola QuikCall style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.
Not much is known about these or the company, but here is what I have discovered.

[[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]
<br />

==Overview & Goals==
Contrary to modern offerings like the FC from Federal Signal<ref>https://www.fedsig.com/product/fc-siren-controller</ref>, these devices are simple two-tone paging decoders that listen at a fixed radio frequency (VHF high or low band) and activate a relay on a timer when the correct signal is sent. There are also provisions for push button activation or remote non-RF activation via telephone relay with dry contacts.
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.

My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* Recreate schematics of each daughterboard to help with figuring out their functionality.
* Document the theory of operation and create a rough block diagram for functionality.
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
* Design and add a small audio amplifier circuit and speaker to listen to the recevier audio feed locally

<br />

==History==
Not much information is available about these devices on the internet unfortunately, as they were only commonplace back in the 1980's and 1990's The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
The FCC ID's associated with F49 are as follows:
*'''F49LCR-2'''<ref>https://fccid.io/F49LCR-2</ref> registered on 02/09/90 with an operating frequency range of 150-174 MHz
*'''F49LCR-1'''<ref>https://fccid.io/F49LCR-1</ref> registered on 02/09/90 with an operating frequency range of 25-50 MHz
*'''F49EMR-3'''<ref>https://fccid.io/F49EMR-3</ref> registered on 02/09/90 with an operating frequency range of 130-148 MHz
*'''F49EMR-2'''<ref>https://fccid.io/F49EMR-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F49EMR-1'''<ref>https://fccid.io/F49EMR-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz

My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.

===Speculation===
My current research shows the existence of at least 2 or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.

<br />

==Specifications==

===Physical===
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.

'''F49LCR-2:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
* '''Depth:''' 92mm (3.62") top section & 85mm (3.34") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. 9 lbs

'''Terminal Strip Pinout (left to right):'''
*1 - COM for dry contacts
*2 - Stop dry contact
*3 - Start dry contact
*4 - Relay N/O
*5 - Relay N/O
*6 - AC in (to xfmr)
*7 - AC in (to xfmr)

Pretty self explanatory with the diagrams

<gallery>
File:Cdf_terminals_closeup.jpg|Terminal closeup. Do note that normally the primary side of the transformer with the fuse goes on the far right two.
</gallery>

'''Transformer:'''<ref>https://www.mouser.com/datasheet/2/410/F_325X-1892699.pdf</ref>
*'''Input:''' Configurable 115 or 230v AC
*'''Output:''' Rated at 12.6v DC (Unloaded is higher)
*'''Max Current:''' 1.5A
*'''Max VA:''' 18.9

<gallery>
File:Cdf_xfmr_pri.jpg|Transformer Primary
File:Cdf_xfmr_sec.jpg|Transformer Secondary
</gallery>

Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15

Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#Transformer wiring|transformer wiring]] section below.

<br />

===Photos===

<gallery>
File:Cdf_front_closed.jpg|Front with door closed
File:Cdf_front_open.jpg|Door open showing mainboard
File:Cdf_top.jpg|Top of the enclosure, showing the antenna mount
File:Cdf_bottom.jpg|Bottom of the enclosure, showing conduit and vent holes as well as an unused SO-239 connector to replace the whip antenna.
File:Cdf_back.jpg|Back of the enclosure, showing the integrated mounting holes.
File:Cdf_latch_side.jpg|Side of the enclosure with latch. First flips out, then rotate the wing to loosen the clamp.
File:Cdf_hinge_side.jpg|Side of the enclosure with the hinge. The hinge cannot be removed from the door, but the door and hinge can be removed from the enclosure with three screws and nuts.
File:Cdf_info_onboard.jpg|Info written near the bottom center of the mainboard. Shows FCC-ID, serial, receive frequency, input voltage, and ship date.
File:Cdf_tone_info.jpg|Configured tone information handwritten on the CD&F main board near the top center. Sequence 1 is to activate, sequence 2 is to deactivate.
File:Cdf_bare_mainboard.jpg|Bare mainboard of the CD&F. All cards removed for visibility.
File:Cdf_bare_mainboard_back.jpg|Back of the CD&F mainboard. There is conformal coating on the back which makes it difficult to probe things. It can be removed with acetone or MEK.
File:Cdf_rx_closeup.jpg|Closeup of the double conversion super heterodyne radio receiver circuitry in the CD&F.
File:Cdf_rx_closeup_back.jpg|Closeup of the rear of the double conversion super heterodyne radio receiver circuitry in the CD&F. Mirrored to match Cdf_rx_closeup.jpg.
</gallery>

<br />

===Transformer wiring===
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.

*'''115v Operation:''' Tie together the '''black''' and '''red/black striped''' wire together and tie the '''yellow/black striped''' wire and the '''green/black striped''' wire together. You now have two pairs of wires for live and neutral.

*'''230v Operation:''' Tie the '''yellow/black striped''' and '''red/black striped''' wires together and insulate them properly. You can now attach live and neutral to the '''black''' and '''black/green''' striped wire.

<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>

==Architecture & Operation==
This is going in order from control signal thru processing, all the way to output contact closure.

RF comes in via 3 pin antenna connector (top right) and goes thru double conversion superhet, then into MC3357P IF.

Demod audio comes out from pin 9 of the MC3357P and goes into the commoned P1 pins of the 4 decoder board sockets.

Tone filters A1 and A2 take input on P1, VCC on P2, GND on P3, and P4 is the logic NOT output of the XR2211A IC on the tone filter PCB.
This output is normally high, and gets pulled low when the input signal on P1 falls within the set passband.
Both filters are in parallel on the input, VCC, and GND, but the outputs of all four sockets are separate and go to the decoder boards.
The decoder boards are composed of logic gates and supporting circuitry to detect the order of pulses from the tone filters and perform the appropriate action in cooperation with the timer board.
When the signal to start the timer is decoded, the LED on the first decoder board blinks breifly, then the timer board signals the relay driver to engage the relay. The indicator lights on the timer board and the relay driver also illuminate.
On my unit, the unit times out after approximately 3 minutes of being activated if no stop signal is received on the radio or locally via contact closure.

===Receiver Circuit===
The receiver on board the F49LCR-2 is a double conversion superheterodyne circuit. RF comes in via the 3 pin header (only 2 used) and immediately goes into what I presume is a preamplifier with a MPS5179 RF transistor<ref>https://www.mouser.com/datasheet/2/149/mps5179-493155.pdf</ref>.

The Local Oscillator (LO) crystal on by unit is marked "154.240" on top of the can, and "47.180" on the side. After messing with some math, I discovered the LO gets tripled (presumably by some magic with the other transistors and passives nearby) to 141.54 MHz.

The incoming RF is then mixed and subtracted with the tripled LO signal to get the 10.7 MHz intermediate frequency (IF). You can calculate different LO crystal frequencies or input frequencies with the following equation, assuming you have one or the other:
<pre>
10.7 = rxFreq - (crystFreq * 3)
</pre>
The downstream Motorola MC3357P<ref>https://www.discriminator.nl/ic/mc3357.pdf</ref> IC takes the standard 10.7 MHz IF input and converts it down again to 455 kHz and does some filtering, then using its internal quadrature FM detector demodulates the audio into a 200-350mV RMS audio signal on pin 9 of the IC.

There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.

====Retuning for the 2 Meter Amateur Radio Band====

=====Original Plan=====
My original plan was to source some kind of crystal between 44.43 to 45.7 MHz which corresponds to 146 to 147.975 MHz when plugged into the above equation. Upper limit of 147.975 chosen assuming a transmitted signal of 25kHz NFM.
After doing some more reasearch though, I discovered the Si5351 and it's breakout board from [https://www.adafruit.com/product/2045 Adafruit] which is a programmable clock generator that can output 3 separate clock signals from 8 kHz to 160 MHz. What a useful chip!
This has the advantage of costing about the same as a vintage hard to find crystal of a specific frequency while also being able to be reprogrammed easily via I2C. The only downside is that the chip has no ROM so any configuration is lost upon power down. Despite this, that IC combined with a low power I2C enabled microcontroller attached to a suitable source of power from the board should yeild a highly versatile replacement to the old crystal.

=====Si5351 Breakout=====
I ordered the board and when it arrived, I attached it to an arduino nano with 5v, GND, SCL and SDA (A4 and A5 on the nano). After programming the board and checking it with my new DSO, it showed 45.55 MHz as programmed using the aforementioned arduino and the Etherkit Si5351 example sketch. I removed the crystal from the LO circuit and attached the Si5351 CLK0 to the collector of Q4 as is done with the original crystal and also grounded the breakout board to the other crystal pad.
Initial tests show nerly identical functionality from stock, even without tuning any filter components onboard. The receiver now responds to signals on 147.350 MHz, comfortably near the top of the 2 meter band.
With that, I taped the arduino and breakout board together, insulated, and hijacked power from the main LM7812 regulator to power it.

<gallery>
File:Cdf_si5351_test.jpg|Testing the breakout board with temporary connections.
File:Cdf_modded_LO.jpg|Final mod. The arduino and breakout taped together and insulated, using the original crystal through holes and taking power from the main L7812 regulator.
File:Cdf_mod_power_connections.jpg|Connections for Vin and GND on the arduino going to the main 12v regulated supply.
</gallery>

<br />

===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.

Example values for my tones are as follows:

*A1 (1153.4 Hz): 5.747kOhms

*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough

<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>

'''Tone filter module pinout:'''
* P1 - Audio in
* P2 - VCC (12v)
* P3 - GND
* P4 - Logic NOT signal out (default high, drops low when signal is in passband)
* P5 - Logic Out (Not used on this board, but is the opposite of P4)

====Tone filter troubleshooting:====

If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.

'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''

<br />

===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.

<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>

<br />

===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches on the top presumably control parameters of the timing cycle, but this needs to be investigated more.

<gallery>
File:Cdf_cycle_timer_front.jpg|Timer module topside
File:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)
</gallery>

<br />

===Relay Driver Module===

The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.

<gallery>
File:Cdf_relay_driver_top.jpg|Relay module topside
File:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)
File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.
</gallery>

<br />

==General Notes/Things to Watch Out For==

*On the back of the main board and parts of the tone filters there is a conformal coating. I suggest removing it before reflowing joints to prevent contamination of the solder. Acetone or M.E.K. seems to do well along with mechanical removal. <u>'''Be careful with your application of force, you can very easily strip off the solder mask! Ask me how I know!'''</u>
*These devices are quite old, and excessive handling and stress seems to not play nice to the solder joints. I have fixed both the tone filters and receiver section by reflowing every joint with leaded solder.
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
<br />