Firmware patch for Kenwood TS-850S/DSP-100 HiFi AM available

BillPaul · Post by **BillPaul** » Fri Apr 13, 2012 4:30 pm

I guess I must just be a glutton for punishment. A while back I produced a firmware patch for the TS-950SDX to allow VooDoo AM operation as well as ESSB. Well, I didn't want TS-850/DSP-100 owners to feel left out, so I made a patch for the TS-850 too.

Now, if you want to do HiFi AM with the TS-850, you're actually better off without the DSP-100. I created a page here that shows what I've done to my radio for analog HiFi AM operation:

http://people.freebsd.org/~wpaul/ts-850/850.html

But if you already have a Voodoo modified TS-850/DSP-100 combo, using this modified firmware will let you use it on AM as well. You'll get the same 6Khz frequency response that you do on SSB.

It turns out the TS-850 has the same CPU as the TS-950SDX, however his patch works a little differently than the one for the TS-950SDX and is not quite as elegant. This is largely because the DSP unit on the TS-950SDX is built in, and the main computer in the radio has greater control over it. With the TS-850, the DSP unit is external. In particular, the DIP switches on the rear panel of the DSP unit which enable the 'off'' options for the HPF and LPF settings can't be controlled or sensed from the radio. Instead, they're connected to the microprocessor in the DSP unit itself, and sadly its firmware can't easily be changed.

Luckily, after I managed to get my hands on an original Kenwood IF-232C, I finally able to inspect the communication protocol between the radio and the DSP unit when they're connected together. It turns out the radio sends commands to the DSP unit via the ACC1 port when the operating mode changes. So the firmware patch sends commands to toggle the DSP from AM to LSB and back to AM again, which has the effect of goosing the DSP-100 into transmitting correctly in AM mode when set for HiFi /Voodoo operation.

Normally, the user can do this trick manually: if you have the DSP-100, just start transmitting in AM mode, then, without releasing the transmitter, press the LSB/USB button and the AM/FM button to toggle the mode. The rig the will now be transmitting properly in AM with HiFi audio. The problem is, you have to do this every time you transmit, which is annoying. With this firmware patch, it's now done automatically.

There are a couple of limitations, however. I discovered that if you toggle the mode like this in MidFi mode (i.e. 3Khz bandwidth) where AM normally works okay anyway, then you may see a momentary burst of excessive output when the rig switches into LSB mode. I'm not sure what causes this, but it's annoying. Ideally, this means we should not perform the mode toggle _unless_ the DSP has been set for HiFi, in particular with DIP switch 1 off. There's no way to sense the state of the DIP switches from the radio though.

As a compromise, I added new power-on hot key to switch the mode toggle function on and off. By default, it's disabled, and the radio behavior is unchanged. To turn in on, you just have to do the following:

- Turn the radio off
- Press and hold the '0' (zero) key on the keypad on the front the radio
- Turn the radio on

Doing the same thing again will turn the mode toggle function back off again. Since you have to manually set the DSP unit for HiFi in the first place, I didn't think people would mind this too much.

I also noticed a similar problem with VOX operation, so the mode toggle is automatically disabled when the VOX key is pressed.

The new firmware can be downloaded from here:

http://people.freebsd.org/~wpaul/ts-850/am_dsp.html

You need to burn it to a 32KB 27C256 EPROM and install it in the digital unit of the radio. This is similar to the TS-950SDX, except the SDX uses a larger chip (64KB 27C512).

This includes the original firmware, the patched firmware, the hardware documentation for the NEC uPD7810 CPU, and the service manual for the TS-850.

The image is based on the JEZA version of the firmware, which is apparently what shipped with radios with a 50 million serial number, dated 1990. There is apparently a JEZB version of the firmware which is newer (dated 1992) but I haven't been able to find a copy.

If anyone has a radio with this firmware or knows where I can find a chip with this version in it, please let me know.

Again, this is really sort of redundant since the TS-850 sounds much better on AM in analog mode (you can get 10Khz of response, compared to 6Khz with the DSP-100), but I was curious to see if I could get this same trick to work on this radio, and apparently I had nothing better to do with my time. You can also blame Rick, VE6CQ, for egging me on.

Share and enjoy!

-Bill, N1GPT

Post by **Voodoo Guru** » Sun Apr 15, 2012 3:32 pm

Good Show Bill Paul!!!
That is the reason you have the "Digital Voodoo Guru" title!
We are always impressed with your Digital Savvy.

You mentioned Rick, would that be VE6CQ as you made mention of VE6CG.

If it was in fact VE6CQ, We know all too well of his persistence!!!!
All you Voodoo Modified SDX owners can thank Rick for how clean and correct the TX Monitor is on the VMSDX. It was his persistence and Golden Ears that drove us to push the envelope on this modification.
So Bill Paul, We understand completely!!

Thanks Bill Paul,

BillPaul · Post by **BillPaul** » Mon Apr 16, 2012 2:15 pm

Yes, I somehow managed to fat-finger Rick's call. I've corrected it in the original post.

Note that he was also making noises about the TS-870 as well. I did a little research and it seems that radio uses a different processor. Kenwood switched from the 8-bit NEC uPD7810 to a 16-bit Mitsubishi M37702 (7700 family). (I think Renesas now owns the intellectual property behind this CPU.) The firmware is still in a socketed EPROM chip (27C512, like the TS-950SDX), and I found the manuals for the M37702 CPU, so in theory I could hack the firmware for this radio too.

However, there's no way to be sure if one should even bother. A few things about the TS-870 confuse me. For instance, it seems like it's really limited to 3Khz and you can stretch it to 4Khz only with some extra EQing. I don't know if this limitation is a matter of the main CPU just not letting you select a wider bandwidth or if the DSP unit itself just isn't designed to yield any wider response.

For example, with the DSP-100 and the DSP unit in the SDX incorporate some filter units (chebychev, I think) which limit the input bandwidth to ~6Khz. I think this is because the DSP sample rate is documented to be 12Khz, and to maintain good resolution they need to ensure the input frequencies are limited to half the sample rate. (I could be totally wrong about this though -- I really don't know that much about DSPs.)

I don't know if the DSP unit in the TS-870 incorporates similar filters, or, since it's only designed for 3Khz response, if it has filters that are even narrower. If so, then no amount of digital arm-twisting will improve the frequency response, unless you also do some hardware mods to those filters.

Of course, there's an even more basic problem which is that I don't have a TS-870, and I'm really not interested in shelling out $1100 or so on one. I know this may be considered blasphemy, but I already own 3 Kenwood HF rigs, and that seems like enough.

-Bill,. N1GPT

Post by **Voodoo Guru** » Mon Apr 16, 2012 2:46 pm

Well...

The Story with the TS-870 is this.
Ken W3JK was at the Tokyo Ham Fair and unknowingly met up with one of the original Kenwood Program writers for the TS-950sdx. He went to drink Sake afterwords and they begin talking about Hi-Fi eSSB. That's when his friend told him about the Power-On mod for the SDX that had been kept secret for 20 years. He was the one that wrote the code for that. According to him, it was a back door to bypass the DSP Low Pass Filters completely for testing purposes. Now they have a bandwidth limit there so he runs the Low Pass Filter Off and engages the analog filter to narrow his bandwidth to about 4k. That is how Ken came back with that glorious information.

I had asked Ken if he could perhaps talk to his engineer friend and ask if they had implemented a similar Power-On Menu for the TS-870.

Ken said that his engineering friend told him he didn't do all the coding for the TS-870 and he would have to talk to the engineer that had. He actually contacted him (they don't work at Kenwood any longer) but it was so long ago that he really couldn't remember allot about it. He did however say that there was absolutely NOT a Power-On Menu to turn off the Low Pass Filter. He was sure about that. He also said that the coding for the DSP is not encrypted and that someone that was savvy enough with it could probably rewrite it to include some wider Low Pass Filter settings or bypass it themselves.

Alan, K2WS was going to give it a go but then thought better of it and dropped the project.

Well that's all I know about it other then the bogus 4kc filter mod for the TS-870. You can read my rant on that here...

http://www.wz5q.net/talkvoodoo/viewtopic.php?t=123

Take Care,

BillPaul · Post by **BillPaul** » Mon Apr 16, 2012 3:35 pm

Part of what you said confused me. You said: "Now they have a bandwidth limit there so he runs the Low Pass Filter Off and engages the analog filter to narrow his bandwidth to about 4k."

I'm not sure what you're saying here. On the one hand, you seem to be saying that the TS-870 doesn't have any gimmick in it that lets you set the LPF in the DSP for anything higher than 3Khz (which is the max). But the on the other hand, you say "he runs the Low Pas Filter Off," which implies that there _is_ way to do this.

Which is it?

In order to figure out how to add my own power-on switch for the AM HiFi mode in the TS-850 firmware, I had to jump through several hoops. I knew that I would need to be able to output stuff through the rig's serial port just to make the AM hack work, so I had to figure out how that worked. Luckily, the uPD7810 has a built-in UART (serial port) and the user's manual for the chip explains how it works. This made it easy to find the serial output code, though I had to make some guesses as to how it worked. Eventually I figured it out enough that I could print things and see them on my computer.

This allowed me to figure out other things, since now I could insert debug instrumentation (i.e. debug print statements) and examine things stored in the radio's memory, albeit in slow stages. (There was so little free space available to add my own code that I had to make a new firmware image each time I wanted to print something new.)

The next thing was to try to decode the keypad matrix so that I could tell when buttons on the front panel were pushed. If you look at the TS-850 service manual, you'll see the keypad is a 6x6 matrix wired to some pins on one of the I/O expander chips. The firmware is constantly scanning the keys and storing their current state in a set of 6 bytes, one byte for each row. However the rows aren't quite sequential. Using some debug printing code though, I was able to dump all 6 bytes at various stages and see which keys corresponded to which row byte. That allowed me to map the rows out properly.

Once I knew that, I could see the code in the start-up portion of the firmware that implemented all the factory supplied power-on key sequences. I added a hack at the start of this code to insert my own sequence.

When I looked at the TS-870 service manual, I saw that it uses a similar keypad matrix scheme, so it occurred to me that using the same tricks I might be able to tell if it had any hidden power-on sequences too. However, from what you say, it sounds like that would be a waste of time.

But this doesn't change my original statements. I know there's an I/O path between the main CPU and the DSP and I might even be able to dump out what's being said over it and when. But even if I decoded the commands used to set the LPF value in the DSP, and even if I found there were additional values that let you choose a wider setting, I don't know if it would do any good. If the DSP has hardware (R-C) filtering at its input that excessively limits the response, then there's no point in fiddling with the computer.

-Bill, N1GPT

Post by **Voodoo Guru** » Mon Apr 16, 2012 4:17 pm

Part of what you said confused me. You said: "Now they have a bandwidth limit there so he runs the Low Pass Filter Off and engages the analog filter to narrow his bandwidth to about 4k."

I'm not sure what you're saying here. On the one hand, you seem to be saying that the TS-870 doesn't have any gimmick in it that lets you set the LPF in the DSP for anything higher than 3Khz (which is the max). But the on the other hand, you say "he runs the Low Pas Filter Off," which implies that there _is_ way to do this.

Which is it?

He is operating a TS-950sdx.
I was saying that they have about a 4Kc Bandwidth limit in Japan and he runs the LPF in the OFF setting on the SDX and uses his analog filter for bandwidth limiting instead of the DSP. This provides for much cleaner sounding audio.

But even if I decoded the commands used to set the LPF value in the DSP, and even if I found there were additional values that let you choose a wider setting, I don't know if it would do any good. If the DSP has hardware (R-C) filtering at its input that excessively limits the response, then there's no point in fiddling with the computer

Well you see, I think the same way as there is no point in trying to R&D modifications on the hardware since the DSP is limiting things so narrow.

Take Care,

BillPaul · Post by **BillPaul** » Mon Apr 16, 2012 4:59 pm

Well, see, there's different kinds of limits. There could be limits in the A/D or D/A conversion design, or in the software that runs in the DSP itself. In that case, no amount of special commands you send to it will make a difference.

But it's also possible the DSP is capable of much wider bandwidth and you just have to know the special handshake to turn it on, like with the TS-850/DSP-100 and TS-950SDX.

The possibility of an R-C filter at the audio input is just another potential complication on top of that.

I don't have enough information about the DSP design right now to even speculate about any of that. And I don't want to end up having to figure it all out for myself. There are limits to my generosity.

-Bill, N1GPT