Open main menu

Changes

Rework to include shared info between models, add info for SC series
Civil Defense & Fire (CD&F) Controllers siren controllers function on two-tone Motorola QuikCall , Plectron, or General Electric style paging to wirelessly activate warning sirens. The device can be activated via radio or locally via dry contacts.Not much is known about these devices or the companynowadays, but here is what I have discovered. [[File:Cdf_front_open.jpg|thumb|250px|The Smaller CD&F I own, opened up]]<br />
==Overview & Goals==
These controllers tended to be known by siren enthusiasts as unreliable and flaky, though I have theories on why that is later on.
Regardless, they are completely analog in circuitry which offers some relative simplicity in understanding and reverse engineering.
 
My goals in experimentation and reverse engineering this thing are as follows:
* Retune the onboard radio receiver to function within the 2 meter amateur radio band instead of the VHF high band my unit is configured for.
* Reverse engineer and document the functionality of the tone decoding circuitry and determine the maximum and minimum limits for the tone frequencies based on the onboard components.
* <s>Recreate schematics of each daughterboard to help with figuring out their functionality.</s> Shown in the manual* <s>Document the theory of operation and create a rough block diagram for functionality.</s> Shown in the manual
* Document any theories, issues that arise and their fixes, as well as things to watch out for
* Potentially design a new tone decoder daughterboard using more common components
==History==
Not much information is available about these devices on the internet unfortunately, as they were only more commonplace back in the 1980's and 1990's . Despite that, there are many units that were shipped into the mid 2000's, and the company was merged/acquired by Sentry Siren sometime in the mid 2010's. The company, however, was located at 140 North Tyler Street in Elm Creek, Nebraska. The company was registered with the FCC on 4/14/98 by a R. E. Kugler.
Some municipalities still have these devices deployed in old systems because "if it ain't broke, don't fix it" always prevails of course. There appears to exist at least 3 types that I have personally seen online including my own unit.
The most I have discovered amounts to what I have seen regarding FCC filings from the 1986 to 1990 under the company name (under grantee code '''F49'''<ref>https://fccid.io/F49</ref>) and what I have seen in various sources of media from Google images and YouTube videos.
*'''F49CDF-2'''<ref>https://fccid.io/F49CDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz(Possibly suggests use of Maxon Data Radio?)
*'''F49CDF-1'''<ref>https://fccid.io/F49CDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
*'''F498POCDF-3'''<ref>https://fccid.io/F498POCDF-2</ref> Not registered on FCC database, but exists. UHF variant of SC series (SC3)
*'''F498POCDF-2'''<ref>https://fccid.io/F498POCDF-2</ref> registered on 02/09/90 with an operating frequency range of 148-174 MHz (Possibly suggests use of Maxon Data Radio?)
*'''F498POCDF-1'''<ref>https://fccid.io/F498POCDF-1</ref> registered on 02/09/90 with an operating frequency range of 25-54 MHz
My unit is marked '''F49LCR-2''' and is tuned for 152.240 MHz. I will refer to any models by their FCC ID unless I come across their actual names.
===Speculation===
My current research shows the existence of at least 2 two or three types of these devices. Obviously there are more devices produced by the company, but I have zero clue what they are.
* A larger more rectangular one, which I have acquired (yay!) that can be either silver or civil defense yellow.
** This unit is even more modular and can contain either a descrete radio receiver board , some kind of descrete but shielded radio board, or a maxon data radio board (which is reprogrammable)
** These units have built-in local activation buttons and no terminals for remote activation. Just AC in and one or two relay contacts
** These units also can do multiple signals including alert (steady), attack (wail), and fire (not quite sure what it means, fast wail maybe?) and have more tone decoders and timer cards
** I've also noticed a possibly earlier variant that has a screw latch instead of a folding wing type latch.
 
My large silver unit does not appear to have an FCC ID. This kinda makes sense since the only RF part is a pre-certified radio receiver
 
I have also noticed at least one unit that has the "PO" of F49POCDF markered out, which would make it F49CDF, which is a vaild ID. I believe that F49CDF and F49POCDF may be the same units with just a different variation or newer/older models.
 
CD&F makes other products as well, though the only other example I have seen is some sort of electronic siren controller on Twitter (LINK HERE)
<br />
 
==Shared Components and Info==
This section contains part descriptions and information that is relevant across the entire line of controllers.
 
===Manual===
I was given a scanned copy of a manual for the SC line of controllers, though there is plenty of info relevant to all models within. I have uploaded it to [https://archive.org/details/cdf-radio-manual archive.org here.]
 
===Naming/Serial Convention===
According to the manual, this is how the controller units are named. At least, the larger SC variants. Some older units seem to follow slightly different conventions (ex. SC3M0-1322)
 
<pre>
SC(V)-(W)-(XY)-(ZZZZ)
</pre>
 
'''SC''' - Siren Controller
 
'''V''' - Frequency band
** '''1''' - Low Band VHF (30-50MHz)
** '''2''' - High Band VHF (148-173MHz)
** '''3''' - UHF (440-480MHz)
 
'''W''' - ???
 
'''X''' - Tone format & timing
** '''P''' - Plectron
** '''M''' - Motorola
** '''G''' - General Electric
** '''F''' - ??? (Mentioned in manual, Maybe Motorola 4 tone?)
 
'''Y''' - Revision number
 
'''Z''' - Serial Number
 
This is how I interpreted it, though I could be wrong about the revision number placement.
 
 
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.
 
Example values for my tones are as follows:
 
*A1 (1153.4 Hz): 5.747kOhms
 
*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was rough
 
 
<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>
 
 
{|
|+ <U>'''Tone Filter Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|-
!Pin
!Function
|-
|'''P1-1'''
|Audio in
|-
|'''P1-2'''
|Vin (+12v)
|-
|'''P1-3'''
|GND
|-
|'''P1-4'''
|Logic NOT signal out (default high, drops low when signal is in passband)
|-
|'''P1-5'''
|Logic Out (Not used on this board, but is the opposite of P4)
|}
</div>
</div>
|}
 
 
====Tuning====
Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.
Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.
 
 
=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.
 
With that being said, you may want to test your own filters. Here is how I tested mine:
 
# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.
 
 
=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:
 
# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Turn on your function generator and set it to the frequency you wish for the module to respond to.
# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.
# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.
# Test the bandwidth by changing frequency slightly above and below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.
 
Through some component changes, you will probably be able to change the adjustable range of the filters. That is something I am going to investigate soon.
 
====Tone filter troubleshooting====
 
If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence of tones through the unit.
If that fails, I have encountered issues with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connections.
 
'''Do be aware, on the mainboard and parts of the tone decoders there is conformal coating. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate the solder joints'''
<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.
 
 
'''ICs:'''
 
'''U1''' - Motorola MC14069UBCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)
 
'''U2''' - Motorola MC14050BCP<ref>https://www.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer)
 
'''U3''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)
 
'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)
 
 
{|
|+ <U>'''Decoder Module Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|Output, goes to programming section
|-
|'''P1-3'''
|Input, goes to programming section
|-
|'''P1-4'''
|Output to Timer, thru diode customization section between decoders (CR5 & CR8)
|-
|'''P1-5'''
|From CR5 diode, test output? (N/C on main board)
|}
</div>
</div>
|}
 
 
<gallery>
File:Cdf_decoder_module_a_front.jpg|Decoder modules topside
File:Cdf_decoder_module_a_back.jpg|Decoder modules bottom side (mirrored to match top side)
</gallery>
 
<br />
----
===Timer Modules===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.
 
 
The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.
 
 
Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.
 
<gallery>
File:Cdf_timer_rc_scope2.png|Wide view of the RC oscillator via pin 13
File:Cdf_timer_RC_scope.png|Decoder modules bottom side (mirrored to match top side)
</gallery>
 
==Specifications==At low values it seems to be pretty accurate (eg. 5 sec), but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing the stock setting gets 2m57s, or 177s.
 '''ICs (Steady Cycle Timer 031-0389-000):'''  '''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate) '''U2''' - Motorola MC14011BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate) '''U3''' - N/A (Populated on other boards) '''U4''' - Maxim ICM7240IPE<ref>https://www.analog.com/media/jp/technical-documentation/data-sheets/1360.pdf</ref> (Programmable Timer/Counter IC)  {||+ <U>'''Cycle Timer Pinout'''</U>|<div style="display: flex;"> <div> {| class="wikitable" style="" |+Left !Pin !Function |- |'''P1-1''' |Signal Out to Relay Driver |- |'''P1-2''' |STOP (Also local control via terminal strip) |- |'''P1-3''' |START (Also local control via terminal strip) |- |'''P1-4''' |??? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?) |- |'''P1-5''' |Vin (+12v) |} </div>|<div> {| class="wikitable" style="" |+Right !Pin !Function |- |'''P1-1''' |GND |- |'''P1-2''' |N/C on Main Board |- |'''P1-3''' |Coupled to GND via C44 |- |'''P1-4''' |N/C on Main Board |- |'''P1-5''' |N/C on Main Board |} </div></div>|}  <gallery>File:Cdf_cycle_timer_front.jpg|Timer module topsideFile:Cdf_cycle_timer_back.jpg|Timer module bottom side (mirrored to match top side)</gallery> <br /> ----===Relay Driver Module=== The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it. <gallery>File:Cdf_relay_driver_top.jpg|Relay module topsideFile:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)File:Cdf_relay_driver_schematic.png|Reverse engineered schematic of the relay driver.</gallery>  {||+ <U>'''LCRx Relay Driver Board Pinout'''</U>|<div style="display: flex;"> <div> {| class="wikitable" style="" |+Left !Pin !Function |- |'''P1-1''' |N/C on Main Board, but traces route to it on driver board |- |'''P1-2''' |Signal Input from timer |- |'''P1-3''' |N/C on driver board |- |'''P1-4''' |N/C on driver board |- |'''P1-5''' |Vin (+12v) |} </div>|<div> {| class="wikitable" style="" |+Right !Pin !Function |- |'''P1-1''' |GND |- |'''P1-2''' |Relay Coil (E9 on I/O header) |- |'''P1-3''' |Relay Coil (E10 on I/O header) |- |'''P1-4''' |N/C on Main Board, but traces route to it on driver board |- |'''P1-5''' |N/C on Main Board, but traces route to it on driver board |} </div></div>|} <br />---- ===I/O connector pinout===This connector is the one just left of the relay. Houses the relay wires and the start/stop button inputs. * E10: Relay Coil* E9: Relay Coil* E8: Start terminal* E7: Stop terminal* E6: Common terminal <br />---- ===Board Connectors===The molex connectors that are used on all the modular boards are Molex KK series with a .156" pitch.* [http://www.mouser.com/catalog/645/usd/1630.pdf Molex KK Series connectors datasheet]* [https://www.mouser.com/catalog/645/usd/1631.pdf Molex KK series headers datasheet]  ==Programming== There are two small sections below the tone decoders and inbetween the two decoder boards that allow for changing the path of signals in and out of the decoder boards. This allows for changing the behavior of the unit depending on the number of tone filters installed. For example, my unit has two filters installed and the "on" sequence is A1, A2 (1153/1285 Hz), and "off" is the opposite. Since there are 4 card positions, you can also configure a 3 and 4 card setup ===2 Card Setup===Probably the most common, and what my unit is configured for. Sending A1, A2 turns the unit on, and A2, A1 turns it off. The jumpers are configured as follows: *CR1 diode from 1 to A1*CR2 diode from 2 to A2*B1 to A2 jumper (in row 3)*A1 to B2 jumper (in row 4)  *CR5 in place facing the board marking*CR6 empty*CR7 empty*CR8 in place facing the board marking <gallery> </gallery> ===3 Card Setup===One tone filter is a "common" tone, and the other two are completely different frequencies. If for example, 800 Hz is the common tone and the others are 740 and 930, then one could configure the unit to turn on with 800/740, and off with 800/930. ===4 Card Setup===In this case, there is a different tone pair for each action. On has two completely different frequencies compared to off.  I plan on figuring out what the hell is required to change these configs and document it here soon. <br /> ==LCRx (Simpler Small Yellow Unit)==This unit is the first type I acquired. It is significantly smaller and simpler than the other types, only allowing for a single function timer, but up to four tone filters. This allows for either a 2, 3 or 4 card setup.  ===Specifications=== ====Physical====
Again, not much known aside from anything made by CD&F to funciton in the VHF high or VHF low bands. My motherboard can take up to 4 tone filter modules, though my unit seems to be hard wired for the first two? Has 2 identical decoder modules (slots A and B), a timer module, and a relay driver module.
'''F49LCR-2LCRx Series:'''
* '''Height:''' 325mm (12.75") & (387mm (15.25") from bracket top and bottom
* '''Width:''' 232mm (9.13") top section & 229mm (9") bottom section
Marked as "F-325X Filament Transformer" on the primary, "MagneTek Triad" on the secondary. Seems to suggest prior life in tube equipment but amazingly it's still made, just modernized. If you want, you can even [https://www.mouser.com/ProductDetail/Triad-Magnetics/F-325X?qs=b1anAsPanWwvgBfb3HaWKQ%3D%3D buy a new one on Mouser] for ~$15
Primaries are in series for 230v, parallel for 115v. More info on configuring in the [[#(LCRx) Transformer wiring|(LCRx) transformer wiring]] section below. 
<br />----
====Photos====
<gallery>
<br />
----
====(LCRx) Transformer wiring====
The F-325X "filament" transformer used to power the entire board can be reconfigured for 115 or 230v primary voltage and is detailed on the windings themselves. The secondary should be on a 3 pin molex style connector with both wires green.
The output of the transformer should be around 12v AC, but as with any unregulated supply it will be a bit higher than expected.
<u>'''I suggest you confirm winding integrity with a multimeter and/or use a dim bulb tester to prevent any catastrophies from happening.'''</u>
===Architecture & Operation===
This is going in order from control signal thru processing, all the way to output contact closure.
There is some more audio filtering that pin 9 feeds into, but afterwards the cleaned up audio goes right into the tone filter boards on a common trace.
 
As for the LCR-1 variant, based on the FCC-ID data it seems that the receiver will be nearly identical, though the resulting IF mixer will most likely be an addition rather than subtraction circuit due to the lower operation frequency.
====Retuning for the 2 Meter Amateur Radio Band====
<br />
----
===Tone Filters===
The tone filters are simple little daughterboards based on the Exar/MaxLinear XR2211ACP<ref>https://assets.maxlinear.com/web/documents/xr2211av104.pdf</ref> FSK/Tone decoder IC.
The board contains the necessary passive components to enable tone decode functionality of the IC. Audio comes in from the recieve circuit on pin P1 and runs through the IC. When a tone matched the configured settings, the receiver module drops pin P4 low, otherwise it is held high. Thats pretty much it.
The variable resistor is used to change the set frequency of the module, but I do not know to what extent yet. Testing needs to be done.
Example values ==SCx (Multi-Option Large Silver/Yellow/Red Unit)==The second type of unit I have acquired (an SC2), is much larger and more complex. It can support up to 3 (technically 4) function timers, 4 decoders, and six tone filters. This allows for my tones are as follows:a much more complex operation.
*A1 (1153.4 Hz): 5.747kOhms
*A2 (1285.8 Hz) 4.9 to 5kOhms, contact was roughThe manual specifies a number of optional add-ons:
* ''D1'' - Thermostat controlled heater (mounts below the receiver board)
* ''D2'' - CTCSS decoder board (mostly obsolete, rare)
* ''D3'' - Top deck mount VHF low antenna
* ''D4'' - Top deck mount VHF high antenna
* ''D5'' - Additional heavy duty 10A relay (relay #2)
* ''D6'' - Cabinet painted red
* ''D7'' - Additional intermodulation filter (not sure what this is?)
* ''D8'' - Audio kit (for servicing decoders)
* ''D9'' - Test transmitter encoder (possibly one of the FCC-IDs? Maybe CDF1 and CDF2.)
* ''D10'' - Additional tone filter
<gallery>
File:Cdf_filters_top.jpg|Tone filters top side
File:Cdf_filters_bottom.jpg|Tone Filters bottom side (mirrored to match top side)
</gallery>
'''Tone filter module pinout:'''* P1 - Audio in* P2 - VCC (12v)* P3 - GND* P4 - Logic NOT signal out (default high, drops low when signal is in passband)* P5 - Logic Out (Not used on this board, but is the opposite of P4)===Specifications===
====Physical====
====Tuning====Tuning the onboard pots was a little odd at first, but it appears <b>CCW is higher frequency, CW is lower frequency.</b> It seems that out of circuit (or at least with my crackpot test setup) the logic NOT output of the chip appeared to not function. I thought I had broken the chip at first, but after using the standard logic output to retune back to the original frequency, things worked when back in the main board. So, moral of the story is to use the standard logic output when tuning and just be careful.Looking at the datasheet for the XR2211A, the signal input on pin 2 can be anywhere from 10mV RMS to 3V RMS which is quite nice. Keep that in mind when injecting a signal from a function generator.'''SC Series:'''
* '''Height:''' 325mm (12.75") & 387mm (15.25") from bracket top and bottom
* '''Width:''' 320mm (12.59") top section & 288mm (11.33") bottom section
* '''Depth:''' 95mm (3.74") top section & 90mm (3.54") bottom section
* '''Antenna length (installed):''' 470mm (18.5")
* '''Weight:''' Approx. ?? lbs
=====Searching for tone filter max/min/current frequency=====
I tested filter A2 and the highest seems to be ~1.44kHz and lowest at ~1.12kHz with its components. I suspect that due to this small range, there may be either multiple model numbers (other than 031-0392-000) which have slightly different component values or possibly a different potentiometer. One other possibility is that this model just cant go outside those ranges, but I highly doubt that since many times these has to work with existing fire department/police department paging systems.
With that being said, you may want to test your own filters'''Transformer:'''<ref>https://www.hammfg. Here com/electronics/transformers/power/266.pdf</ref>*'''Input:''' Configurable 115 or 230v AC*'''Output:''' Rated at 24v DC OR 12v DC depending on config (Unloaded is how I tested minehigher) *'''Max Current:''' 1A/2A (24/12v)*'''Max VA:''' 24
# Hook up your function generator or audio source (pure sine wave) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.
#* You may also want to hook a second oscilloscope channel to the function generator output.
# Without touching the onboard pot, slowly sweep through frequencies from about 300Hz to 2.5kHz. Most paging systems are probably within these.
# Watch for the logic output of the filter to go high, indicating you have found the proper frequency.
#* There is a certain amount of passband in the filter, so tune back and forth slowly around the points where the filter triggers to find the upper and lower bounds, then you can calculate the approximate center frequency from there.
# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.
<gallery>
File:Cdf_SC_transformer_details.jpg|Transformer details
</gallery>
=====Tuning filters to a different frequency=====
If you aren't searching for the frequency bounds like I was, I suggest tuning the filters in the following way:
More info on configuring in the [[# Hook up your function generator or audio source (pure sine waveSC) on pin P1, VCC (12v DC) on pin P2, GND on P3, and your oscilloscope or voltmeter on pin P5.#* You may also want to hook a second oscilloscope channel to the function generator output.# Turn on your function generator and set it to the frequency you wish for the module to respond to.# If you haven't already, dig the silicone out of the pot and make sure its clean. VERY slowly rotate CCW for a higher frequency or CW for a lower frequency.# Once you have the pot tuned properly, the logic output of the filter will go high. You are within the bandwidth of the filter now.# Test the bandwidth by changing frequency slightly above and Transformer wiring| SC transformer wiring]] section below your desired set point. Slowly adjust the pot to center in the passband to your desired frequency.# You may want to re-silicone the pot and also mark the set frequency on the PCB in marker.
----====Tone filter troubleshooting:Photos====
If you suspect the tone filters are not functioning properly, check that you have installed them in the correct order and are running the right sequence <gallery>File:Cdf_SC_front_case.jpg|Front case before restorationFile:Cdf_SC_front_restored.jpg|Front case of tones through the my unitafter restorationFile:Cdf_SC_inside.jpg|Inside my restored unit with missing activation buttons addedIf that fails, I have encountered issues File:Cdf_SC_nameplate.jpg|Nameplate with the main board as well as these modules that required reflowing all solder joints due to being brittle and most likely cracking and making poor connectionsdetailsFile:Cdf_SC_latch_side.jpg|Latch side of my restored unitFile:Cdf_SC_hinge_side.jpg|Hinge side of my restored unitFile:Cdf_SC_back.jpg|Back of my restored unit'''Do be aware, on the mainboard and parts File:Cdf_SC_top.jpg|Top of my restored unit showing the tone decoders there is conformal coatingantenna bulkheadFile:Cdf_SC_bottom. Acetone or MEK should help remove this. I suggest removing before soldering to not contaminate jpg|Bottom of the solder joints'''restored unit showing optional SO-239 connector</gallery>
<br />
----
===Decoder Modules===
The decoder modules take in the logic low pulses from the tone filters and use some logic circuitry to eventually send a signal to the timer module to start a cycle.
====(SC) Transformer wiring====
The main transformer in the unit is a [https://www.hammfg.com/electronics/transformers/power/266.pdf 266J24 from Hammond Manufacturing].
'''ICs:'''
*'''U1115v Operation:''' Tie ''' - Motorola MC14069UBCP<ref>https:black/brown''' together and '''white/www.mouserorange''' together.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> (Hex Inverter)
*'''U2230v Operation:''' - Motorola MC14050BCP<ref>https:Tie '''white//wwwbrown''' together and insulate.mouser.com/datasheet/2/308/1/mc14049b_d-1193035.pdf</ref> (Hex Buffer) Input power on '''black''' and '''U3orange''' - Motorola MC14073BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series Triple 3−Input AND Gate)
'''U4''' - Motorola MC1455P1<ref>https://www.onsemi.com/pdf/datasheet/mc1455-d.pdf</ref> (555 Timer)
 '''Pinout (left to right):'''  *'''Left'''** P1-1:** P1-2:** P1-3:** P1-4:** P1-5: Vin (+The main board operates on 12v)  * '''Right'''** P2-1: GND** P2-2:** P2-3:** P2-4:** P2-5:, so just make sure that the red/grey and yellow/blue wires are tied together in those pairs for 12v operation.
<gallery>
File:Cdf_decoder_module_a_frontToroid1.jpggif|Decoder modules topsideTransformer pinout from HammondFile:Cdf_decoder_module_a_backCdf_SC_transformer_details.jpg|Decoder modules bottom side (mirrored to match top side)Transformer details
</gallery>
<br />
----
===Timer Module===
More examination needs to be done, but this module appears to latch the relay for a configured amount of time. I have seen multiple of these on other models that can do more signals such as "Attack" or "Fire", some with more DIP switches populated.
The covered DIP switches of SW1 control parameters of the timing cycle, feeding configuring the 8 bits of the Maxim timer IC. Those bits configure the time delay by connecting each of the pins 1 through 8 on the IC through the a 10kOhm resistor (R3) to VCC.
===Tone Filter Test Board===
The tone filter test board is pretty self explanatory. It contains six LEDs, one for each tone filter, which are connected to a MC14069BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14069UB_D-2315482.pdf</ref> hex inverter IC.
 
When the a tone filter detects a signal within its configured bandwidth and pulls it's P1-4 pin low, the hex inverter IC inverts that signal, pulling the corresponding LED high which illuminates it, indicating the filter is active.
The stock DIP switch config for the steady 3 min cycle timer is, from left to right (Up = ON): up, down, up, down, down, up, down, up. This sets pins 1, 3, 6 and 8 high, and 2,4,5,and 7 low (the DIP switch numbers are backwards in reference to the IC pins). This equates to a RC time constant of 165.
{|
|+ <U>'''Tone Filter Test Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|4th tone filter (J3)
|-
|'''P1-2'''
|3rd tone filter (J4)
|-
|'''P1-3'''
|2nd tone filter (J5)
|-
|'''P1-4'''
|1st tone filter (J6)
|-
|'''P1-5'''
|Vin (+12v)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|5th tone filter (J2)
|-
|'''P1-3'''
|6th tone filter (J1)
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|N/C
|}
</div>
</div>
|}
Pin 13 of the IC is the RC input which is fed by a 1.1MOhm resistor and a 1uF 35v tantalum capacitor. Cross referencing those values in the datasheet chart, we get a RC timebase of ~1Hz, though measuring via scope it shows the period to be 0.66Hz (1.5sec/cycle exactly). The confusing part is that with these figures, we get a cycle time of ~110 seconds, not 180. Still not super clear how this works.
<gallery>
File:Cdf_timer_rc_scope2Cdf_SC_decodertester_front.pngjpg|Wide view Front of the RC oscillator via pin 13SC series tone filter test boardFile:Cdf_timer_RC_scopeCdf_SC_decodertester_rear.pngjpg|RC oscillator up close, showing Rear of the 1.5s intervalSC series tone filter test board
</gallery>
At low values it seems ---- ===Programming board===The programming board is the center of the unit's operation. It's a bare board that allows for jumpers to be pretty accurate (egplaced to route signals from the tone filters to the decoders. 5 sec)The manual details the configuration in more detail, but with my test of "180s" (8, 6, 5 and 4 high) yielded approximately 3m18s (almost 200s). Timing here's the stock setting gets 2m57s, or 177sbasics.
There are letter and number combinations printed on the programming board, which correspond to each function and it'''ICs (Steady Cycle Timer 031-0389-000):'''s inputs.
*V - CD Steady (Alert)
*W - CD Cycle (Attack)
*X - Fire
*Y - Cancel
'''U1''' - Motorola MC14081BCP<ref>https://www.mouser.com/datasheet/2/308/1/MC14001B_D-2315187.pdf</ref> (B-Series CMOS Quad 2−Input AND Gate)
'''U2''' - Motorola MC14011BCP<ref>https://wwwThe numbers corresponding to the letters (eg.mouserY1) is which order the filter signal should be sent in to trigger the function.com/datasheet/1 is the first signal, 2/308/1/MC14001B_D-2315187is the second signal. Theoretically, this allows for any combination of common or separate tones to be configured to activate any function as desired, though there may be limitations that I am not aware of.pdf</ref> (B-Series CMOS Quad 2−Input NAND Gate)
'''U3''' - N/A (Populated on other boards)
{||+ <U>'''U4Programming Board Pinout''' - Maxim ICM7240IPE<ref/U>https|<div style="display:flex;"> <div> {| class="wikitable" style="" |+Left !Pin !Function |- |'''P1-1''' |N/C |- |'''P1-2''' |2Y (Cancel) |- |'''P1-3''' |1Y (Cancel) |- |'''P1-4''' |Tone filter 1 (J6) |- |'''P1-5''' |Tone filter 2 (J5) |} </www.analog.comdiv>|<div style="display: flex;"> <div> {| class="wikitable" style="" |+Center !Pin !Function |- |'''P2-1''' |2X (Fire) |- |'''P2-2''' |1X (Fire) |- |'''P2-3''' |Tone filter 3 (J4) |- |'''P2-4''' |Tone filter 4 (J3) |- |'''P2-5''' |2W (CD Cycle/mediaAttack) |} </jpdiv>|<div> {| class="wikitable" style="" |+Right !Pin !Function |- |'''P3-1''' |1W (CD Cycle/technicalAttack) |- |'''P3-2''' |Tone filter 5 (J2) |- |'''P3-3''' |Tone filter 6 (J1) |- |'''P3-documentation4''' |2V (CD Steady/dataAlert) |-sheets |'''P3-5''' |1V (CD Steady/1360.pdfAlert) |} </refdiv> (Programmable Timer</Counter IC)div>|}
<gallery>
File:Cdf_SC_prog_module_front.jpg|Front of the SC series programming board
File:Cdf_SC_prog_module_back.jpg|Rear of the SC series programming board
</gallery>
'''Pinout (left to right):'''
There are no markings on this board but I will use the same naming convention as the others.----
===Power Supply Module===
On the LCx series, the power supply section is built into the main board. It is similar in architecture to the SC series, though the latter has it on a removable module. The power supply module takes in the unregulated AC output of the transformer, rectifies it, tames it down to 12v via a 7812 voltage regulator, and finally filters the DC with inductors and capacitors.
*'''Left'''
** P1-1: Signal Out to Relay Driver
** P1-2: STOP (Local control via terminal strip) I assume this pulls pin 10 of the ICM7240 to GND(?) to reset the chip cycle. COM is referenced to GND on the terminal strip.
** P1-3: START (Local control via terminal strip) I assume this pulls pin 11 of the ICM7240 to GND(?) to trigger the cycle.
** P1-4: Trigger Input? (Goes to STOP terminal on terminal block as well as P2-4 on decoder module B?)
** P1-5: Vin (+12v)
{|
|+ <U>'''Power Supply Board Pinout'''</U>
|<div style="display: flex;">
<div>
{| class="wikitable" style=""
|+Left
!Pin
!Function
|-
|'''P1-1'''
|N/C
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|N/C
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Vout (+18v unregulated)
|}
</div>
|<div>
{| class="wikitable" style=""
|+Right
!Pin
!Function
|-
|'''P1-1'''
|GND
|-
|'''P1-2'''
|N/C
|-
|'''P1-3'''
|Transformer AC in
|-
|'''P1-4'''
|N/C
|-
|'''P1-5'''
|Transformer AC in
|}
</div>
</div>
|}
* '''Right'''
** P2-1: GND
** P2-2: N/C on Main Board
** P2-3: Coupled to GND via C44
** P2-4: N/C on Main Board
** P2-5: N/C on Main Board
<gallery>
File:Cdf_cycle_timer_frontCdf_SC_psu_module_front.jpg|Timer module topsideFront of the SC series programming boardFile:Cdf_cycle_timer_backCdf_SC_psu_back.jpg|Timer module bottom side (mirrored to match top side)Rear of the SC series programming board
</gallery>
<br />
----
===Relay Driver Module===
The relay driver is super simple, consisting of just 2 transistors (NTE85 and 2N3414), some resistors and 2 diodes. Not to mention the two LEDs as well.
The whole purpose of the driver seems to be level shifting and driving the coil using the main DC supply of the board. Not much else to it.
<gallery>==Other Units==File:Cdf_relay_driver_top.jpg|Relay module topsideFile:Cdf_relay_driver_back.jpg|Relay module bottom side (mirrored to match top side)File:Cdf_relay_driver_schematic.png|Reverse engineered schematic There are more unit types out there which include more variants of the relay driver.</gallery> '''Pinout (left to right):'''  *'''Left'''** P1-1: N/C on Main Board, but traces route to it on driver board** P1-2: Signal Input from timer** P1-3: N/C on driver board** P1-4: N/C on driver board** P1-5LCR and SCx line: Vin (+17v)
Smaller Units:
* LCR1 - (most likely) VHF Low band small yellow unit
* LCR2 - VHF High band small yellow unit
* '''Right'''
** P2-1: GND
** P2-2: Relay Coil
** P2-3: Relay Coil
** P2-4: N/C on Main Board, but traces route to it on driver board
** P2-5: N/C on Main Board, but traces route to it on driver board
<br Larger Units:* SC1 - VHF Low band large silver/>yellow unit* SC2 - VHF High band large silver/yellow unit* SC3 - UHF band large silver/yellow unit
==General Notes/Things to Watch Out For==
*Due to the XR2211A IC being obsolete and quite hard to source nowadays, I may try to design my own tone decoder board using the LM567 IC which is still available in SMD form factors. The LM567 also outputs a logic low when signal is detected, but the design will have to incorperate a LDO 5v regulator to power the chip from the 12v the cards get.
*I have not adjusted any of the filter components on the receiver circuit yet, but I did run an experiment by leaving the device plugged in with the antenna attached inside my house while sending the activation signal from a few dense suburban blocks away. The board operated perfectly with 5W from my Anytone 878, turning on and off.
 
*While the tone filters are labled J1 thru J6 on the PCB, the actual numbering is reversed, tone filter 1 is at the top and 6 is at the bottom. Despite that, my unit (and I suspect others that were reconfigured by a third party) may not start at slot 1. My unit has slots 6, 5, and 4 occupied with the corresponding wiring on the programming board. The nameplate implies slots 1, 2, and 3 however. Overall it doesn't ''really'' matter if things aren't in numerical order, but it sure as hell makes things confusing...
<br />