Storno CQM6000 Service Mode commands and operation

Getting into Service Mode

Although the obvious first question on your lips may be "So how do I get my Stornophone 6000 into Service Mode?" the answer is not the same in all cases. For the purposes of this article we will mainly be discussing Service Mode as it applied to the standard Opus/EC/EF/EL versions of CQM6000 firmware but you should bear in mind that there were also many variations on this theme. This applied particularly if your radio had system specific firmware or hardware and many applications did not directly support Service Mode in any form.

Another consideration is that some system specific radios also had other modes of operation particular to the system application. Examples included 'engineering mode' which could be invoked by a special keypad sequence or password, entry to which permitted engineers access to modify the radio's signalling ID or the famous 'Manuel Mode' which allowed a PhoneNet 2200 trunked mobile to be de-trunked and used as a conventional radio. The Stornomatic 6000 and other mobile phone variants also had special requirements, selection of their multiple power levels, country codes, etc.

One rough indicator to the presence of the comprehensive Service Mode was the size of the application in the main program EPROM. If this chip was a 27C256 it was unlikely to support many of the capabilities listed below, if it used a 27C512 then the chances were better.

Once the presence of a Service Mode was confirmed there were a number of possible different ways of getting the radio to enter that mode as follows:

Hardware method

The radio could be booted up in Service Mode by making a connection from the 'portable' input (normally used to detect when a CQM6000 was being used in a transportable cassette) on pin 3 of the rear D25 connector and linking it to the 'car radio mute' output on pin 16. Also as the mute used an open collector output, some form of pull-up was required, (either a 1k resistor pulling up to +12V or alternatively a 220 ohm resistor pulling up to the internal +5V from pin 9).

Care was required when using this method to ensure that these pins were isolated from external influence if the Service Mode link was used in conjunction with the standard connection arrangement.

The link was normally made using a momentary switch and it was necessary for the switch to be made during the power-up of the radio because the car radio mute output was only enabled for a very short period during the radio initialisation, during which the change in the portable input was noted. Pressing the switch after the self test period would not change the mode.

Codeplug method

The quickest and easiest method of getting a CQM6000 into Service Mode was simply to insert a Service Mode codeplug key into the socket on the control head. This worked even if the radio was already operating in it's normal mode and was a perfect technique for when a quick edit of just a few personality parameters was required. Normal operation was restored by switching the radio off and on again.

There were only a couple of complications about this method. Firstly, the majority of control heads did not have the optional codeplug socket fitted. Secondly, you could never find a Service Mode codeplug key when you really needed one. The reason for that was there was no straightforward way to make a Service Mode codeplug key from a user key. As will be shown below the contents of the EEPROM inside the codeplug key can be edited using Service Mode, however there was a 'feature' within the mask program in the control head processor that prevented the first 2 bytes being edited so the codeplug type was effectvely fixed.

If necessary, the codeplug type could be changed by connecting the codeplug directly to an I2C compatible programmer (or you could make your own). The first 2 bytes were programmed as follows:

Codeplug type	Address 00,01	Part Suffix
CQM6000 Standard User	00,01	G5
CQM6000 Service Mode	00,11	G6
Stornomatic 6000 NMT Service	00,81	G3

H-BUS method

This method used the same technique as the codeplug method above except that the insertion of a Service Mode codeplug was simulated by an external device connected to the radio's H-BUS. This method was used by automatic test equipment setups to control the radio when exercising test scripts and also by personality programming setups including the standard PC with H-RIB interface.

Personality method

Not suitable for performing personality editing but convenient for testing new unprogrammed sets or other cases when the radio had to be opened and serviced, the radio would always be in Service-Mode if the personality (E)EPROM was filled with null data (meaning all bytes programmed to 00, note that with all bytes set to FF the radio would boot normally but fail the self test giving an error message such as "PPROM EMPTY"). Another method was to remove the personality (E)EPROM from it's socket and start the radio with only the main firmware installed. Results for these methods vary according to version.

Keypad method

This method only worked for a few cases, mainly the Stornomatics and radiophone versions. The technique was to press down the 1 and * buttons on the keypad while switching on the radio.

Nothing else works method

This method was used for radios when the installed firmware did not support Service Mode but it was necessary to use Service Mode functionality and consisted of temporarily exchanging the main EPROM for a version that did what was required!

Service Mode operation

Having entered Service Mode you would be able to enter commands directly from the keypad of the control head. All commands were entered using 3 digits representing functions, subfunctions and paramaters. It should be noted that the selection of the digits was determined by the standard keypad layout, regardless of layout variations used on customised control heads.

Only the numeric keys were used plus the * key which was used to escape back to the first function digit entry in case of error or to abort from continuous read and edit functions.

Example: Command to display software package number

The command to display the part number of the firmware was command 0, subfunction 0, parameter 1 so to use the command you would simply use the keypad to enter:

0 0 1

This would cause the display to show the full part number and revision of the firmware:

Commands requiring Decimal data entry

Commands performing more complex functions requiring further entries such as the selection of channels, signalling systems, etc. provided prompts in the display and a flashing cursor where the next digit should be entered.

Commands requiring Hex data entry

Commands for entering signalling digits and reading or editing memory addresses and data required further entries in the form of a 2-digit decimal number representing each byte of address or data.

For example, to read the contents of the main EPROM at address 09AC first the command was entered:

7 1 0

Then the cursor would prompt for the address A: at which point the Hex address could be constructed by entering the 2 decimal digits of each byte:

0 0 - (0)

0 9 - (9)

1 0 - (A)

1 2 - (C)

This would cause the display to indicate the current address at A: and the data at D:

Note that in this mode you could step through the following addresses by pressing a digit button of the required step size.

Stornophone 6000 Service Mode Summary
Function 0 - Special Functions
000	Reset function		EF
001	Display software package number		EF
002	Display radio type		EF
004	Erase encryption keys		EL
Function 1 - Channel Functions
100	Reset all channel functions		EF
110	Select Rx channel from channel group 0		EF
111	Select Rx channel from channel group 1
112	Select Rx channel from channel group 2
113	Select Rx channel from channel group 3
120	Select Tx channel from channel group 0		EF
121	Select Tx channel from channel group 1
122	Select Tx channel from channel group 2
123	Select Tx channel from channel group 3
131	Rx = 66.510 MHz Tx = 66.460 MHz	Alignment channels for CQM633X	EF
132	Rx = 74.520 MHz Tx =74.040 MHz
133	Rx = 87.060 MHz Tx = 86.970 MHz
134	Rx = 77.000 MHz Tx = 77.000 MHz
141	Rx = 136.900 MHz Tx = 136.900 MHz	Alignment channels for CQM611X	EF
142	Rx = 151.150 MHz Tx = 150.400 MHz
143	Rx = 172.450 MHz Tx = 172.300 MHz
144	Rx = 155.000 MHz Tx = 155.000 MHz
161	Rx = 404.600 MHz Tx = 404.700 MHz	Alignment channels for CQM6662/3	EF
162	Rx = 430.200 MHz Tx = 430.700 MHz
163	Rx = 467.300 MHz Tx = 467.400 MHz
164	Rx = 436.500 MHz Tx = 436.500 MHz
165	Rx = 404.600 MHz Tx = 404.700 MHz	Alignment channels for CQM6664	EF
166	Rx = 430.200 MHz Tx = 430.700 MHz
167	Rx = 467.300 MHz Tx = 467.400 MHz
168	Rx = 436.500 MHz Tx = 436.500 MHz
171	Rx = 174.900 MHz Tx = 174.900 MHz	Alignment channels for CQM677X Lo	EF
172	Rx = 188.900 MHz Tx = 188.400 MHz
173	Rx = 208.600 MHz Tx = 208.600 MHz
174	Rx = 192.000 MHz Tx = 192.000 MHz
175	Rx = 190.900 MHz Tx = 190.900 MHz	Alignment channels for CQM677X Hi	EF
176	Rx = 204.560 MHz Tx = 204.300 MHz
177	Rx = 223.650 MHz Tx = 223.600 MHz
178	Rx = 207.500 MHz Tx = 207.500 MHz
Function 2 - Transmit Functions
200	Reset all Tx functions		EF
211	Select high Tx power		EF
212	Select low Tx power		EF
220	Select speech transmission in clear mode		EL
221	Select speech transmission in encrypted mode		EL
230	Select normal range (REX Off)		EL
231	Select extended range (REX On)		EL
Function 3 - Rx Functions
300	Reset all Rx functions		EF
Function 4 - Audio Functions
400	Reset all audio functions		EF
410	Volume level 0		EF
411	Volume level 1		EF
412	Volume level 2		EF
413	Volume level 3		EF
414	Volume level 4		EF
415	Volume level 5		EF
416	Volume level 6		EF
417	Volume level 7		EF
430	Squelch bypass off		EF
431	Squelch bypass on		EF
440	Select audio through DCAP		EF
441	Select standard audio paths		EF
Function 5 - Signalling Functions
500	Reset all signalling functions		EF
521	Enable decoding		EF
522	Select signalling system for decoder		EF
523	Select number of digits in received telegrams		EF
531	Send a telegram		EF
532	Select signalling system for encoder		EF
533	Select number of digits in send telegrams		EF
534	Enter digits of telegram (in Hex)		EF
540	CG encoder (CTCSS tone generation)		EF
541	CG decoder (CTCSS tone decoder - requires CG option board)		EF
Function 6 - Input/Output Functions
610	Rear connector read pins		EF
611	Rear connector reset specified pin		EF
612	Rear connector set specified pin		EF
613	Rear connector change specified pin		EF
62X	Output expander 0 commands		EF
63X	Output expander 1 commands		EF
640	Input expander 1 read port		EF
65X	Internal port 1 commands		EF
66X	Internal port 3 commands		EF
67X	Output expander 2 commands		EF
Function 7 - Memory & Programming Functions
700	Reset memory & programming functions		EF
710	Read main EPROM at specified address in range 0000 - FFFF		EF
720	Read personality (E)EPROM at specified address in range C000 - C7FF		EF
730	Edit personality (E)EPROM at specified address in range C000 - C7FF		EF
740	Read codeplug key at specified address in range 00 - 1F		EF
750	Edit codeplug key at specified address in range 00 - 1F		EF
760	Select codeplug device address for codeplug commands in range 20 - 2A		EF
770	Re-initialize battery backed SRAM memory		TRK

CQM6000 Service Mode