Reprogramming "old" Sennheiser SKM 3072-U - Part 1 - Intro

Im somehow interested in audio production, but only as my hobby. My main job is lead of control system installation in research facility. So that means I usually dont want to spend huge money on the equipement. 
And rigth about now is quite good time to get some old-ish wireless audio equipement for decent price. The reason is that there was change (info) in wireless bands and bands that were free before are not avaliable for the professional audio eq. That means that lot of productions are ditching their stuff to buy new one, compatible. But not all the old stuff is useless as some of it can be reprogrammed. As there is tigth window from 822 to 830 Mhz in EU. This window is quite narrow, but at least it free all the time. Other option is to go below 700Mhz, but then you migth get into collision with local TV transmitter. So I settled for the narrow band since I dont plan to use too many transmitters at once.




My movie production gear was missing wireless lavaliers for long time, so after some exploration I settled on old sennheiser profi series with recievers EK3041/EK3241 and transmitters SK 50. Managed to get couple of them for price that would otherwise got me sennheiser G3 series. Which is the most basic from Sennheiser. These were already in the approved band so no worries. But I also bougth really nice SKM 3072-U wireless handheld.




The SKM 3072-U had stated bandwith 798-830Mhz. Thats the bandwidth that HW can provide without any changes. So I was expecting it will not be an issue to pick the rigth Mhz I need from the free band. Little did I know, that the mic has already pre-programmed set of frequencies within the band of the mic. And all of them were outside the gap I wanted. These frequencies cannot be changed by user. 
There is a guy on ebay who is doing the reprogramming but it costs 119 Euro! And thats quite a lot for pluggin some cable to microphone. I even tried to propose cheaper price to the guy, but was refused. Anyway I was curiouse if it would be possible to do it on my own. And if it won't be too complicated I migth start sell the repogramming service on my own... for less (diabolic laught). 

As first, and usually the most interesting step, I took the mic apart. 

Quite clearly on top is AF board, which is not much interesting for the purpouse but below is LCD, HF, CPU and socket connector with 6 contacts! That looks promising as this is definitely the IF that is used for reprogramming. The idea is that by connecting to some kind of UART I migth be able to change the frequencies.
I checked the CPU type under the sticker and its PIC16C73A. Datasheet is huge but avaliable.

And it has UART that is indeed connected to the pins on the J1 connector. I tried to connect my USB to UART board.
Well, nothing happened. I did some more test to see if I would be able to make it talk. Like pushing some buttons when powering, which can sometime put some devices into service mode. At least thats the tricked I learned from embeded develepores which use this quite often. It is usualy some weird combination of buttons pushes/holds in weird order. But still without any success. After some attempts that were not fruitfull I was little bit despared, but what could help me is the Service Manual.
And as it was only for 5 usd. I resigned and bougth it. And indeed its full of so much interesting information.

J1 is trully used for setting the frequencies. The frequencies are stored in EEPROM ST24C04M1 which communicates with CPU over I2C. 
To program it you have to use sennheiser plug with 9V bat connector for powering, then another on top of it to connect UART to the PC with Win 3.1 or higher (This should not be an issue). But what I dont have is all these adaptors and mainly the SePT.EXE. Which knows baudrate and how to talk with the CPU.  Or lets say makes the CPU talk.


As you can see there is also /RST and WP pin. /RST should be reset pin for CPU as it connectes to the MCLR pin. and WP is WriteProtect of EEPROM, whic is normaly pulled up and had to be grounded in order to write into the memory.


The Service manual has quite many information but unfortunatelly nothing about the UART itself as this is dealt by the SePT.EXE application. And without any specifics about how to start the communication with CPU I run out of ideas.

But, there is quite interesting thing that when the mic starts up, it loads the frequencies from the EEPROM. That means that If I would be able to read then modify the EEPROM, I can change the frequency. Correct way is by the CPU via UART. But since the CPU does not cooperate I could try hooking up to the I2C directly and see how things work and even try to dump the EEPROM and modify it. The only issue is, I dont know much about EEPROMs, uCPU, I2C etc. not really and thats part of the fun.

So next day I borrowed this beatiful logic analyzer anb conneted it to then EEPROM pins and recorder the communication. Below is communication after powering of mic.

write to 0x3E ack data: 0xE0 0xC8 0xF0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
write to 0x3E ack data: 0xE0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 
write to 0x50 ack data: 0x10 
read to 0x50 ack data: 0x11
write to 0x51 ack data: 0x1A 
read to 0x50 ack data: 0xA9
write to 0x51 ack data: 0xB3 
read to 0x50 ack data: 0x1F
write to 0x51 ack data: 0xAE 
read to 0x50 ack data: 0x03
write to 0x51 ack data: 0xAF 
read to 0x50 ack data: 0x20
write to 0x51 ack data: 0xAC 
read to 0x50 ack data: 0xFC
write to 0x51 ack data: 0xAD 
read to 0x50 ack data: 0x5D
write to 0x51 ack data: 0xC4 
read to 0x50 ack data: 0xFC
write to 0x51 ack data: 0xC5 
read to 0x50 ack data: 0x41
write to 0x50 ack data: 0x14 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0x11 
read to 0x50 ack data: 0x03
write to 0x51 ack data: 0x1D 
read to 0x50 ack data: 0xBB
write to 0x51 ack data: 0x1E 
read to 0x50 ack data: 0x99
write to 0x51 ack data: 0x1F 
read to 0x50 ack data: 0x8C
write to 0x51 ack data: 0x73 
read to 0x50 ack data: 0x78
write to 0x51 ack data: 0x74 
read to 0x50 ack data: 0x26
write to 0x51 ack data: 0x75 
read to 0x50 ack data: 0xFE
write to 0x7F ack data: 0x5D 0x06 0x83 0xF0
0x37
0xEF
0x88 0x5E 0x26
0xFC
0xE1 0x6F
write to 0x3E ack data: 0xE0 0x00 0x00 0x00 0x00 0x00 0x9F 0x00 0x00 0x00 0x00 0x00 
write to 0x3E ack data: 0xE0 0x00 0xF0 0x00 0x00 0x00 0xFB 0x00 0x00 0x00 0x00 0x90 
write to 0x3E ack data: 0xE0 0x00 0xBF 0x00 0x09 0x00 0x9A 0x00 0x00 0x00 0x00 0xF0 
write to 0x3E ack data: 0xE0 0x00 0xAB 0x00 0x0F 0x00 0xBD 0x0F 0x00 0x00 0x00 0x99 
write to 0x3E ack data: 0xE0 0x00 0xDA 0x00 0x09 0x00 0x00 0x9B 0xF0 0x00 0x00 0xBF 
write to 0x3E ack data: 0xE0 0x00 0x0D 0x00 0x9B 0x00 0x7B 0xFA 0xBF 0x00 0x00 0x09 
write to 0x3E ack data: 0xE0 0x00 0xF0 0x00 0x00 0x00 0xEF 0x0B 0x00 0x00 0x00 0x2F 
write to 0x50 ack data: 0x11 0x03 
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x50 ack data: 0x73 
read to 0x50 ack data: 0x79
write to 0x50 ack data: 0x74 
read to 0x50 ack data: 0x87
write to 0x50 ack data: 0x75 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFF 
write to 0x50 ack data: 0x73 
read to 0x50 ack data: 0x79
write to 0x50 ack data: 0x74 
read to 0x50 ack data: 0x87
write to 0x50 ack data: 0x75 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFF 
write to 0x7F ack data: 0x41 0xF0
0x37
write to 0x3E ack data: 0xE0 0x00 0x37 0xFF 0xE3 0x00 0x75 0x61 0x1C 0xF7 0xBF 0x26 
write to 0x50 ack data: 0x73 
read to 0x50 ack data: 0x79
write to 0x50 ack data: 0x74 
read to 0x50 ack data: 0x87
write to 0x50 ack data: 0x75 
read to 0x50 ack data: 0x00
write to 0x50 ack data: 0xB1 
read to 0x50 ack data: 0x11
write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFF 

 





Komentáře

Populární příspěvky z tohoto blogu

Reprogramming "old" Sennheiser SKM 3072-U - Part 2 - I2C

Reprogramming "old" Sennheiser Microphone - Part 4 - PLL