Reprogramming "old" Sennheiser SKM 3072-U - Part 1 - Intro
I'm somehow interested in audio production. But not it more my pet hobby, nothing that would generate decent income. This means I usually don't want to spend much of money on the equipment.
Right about now is quite good time to get some old-ish wireless audio equipment for decent price. The reason is that there was change (info) in wireless bands and bands that used to be free before are not available for the professional audio anymore. That means that lot of productions are ditching their stuff to buy new one, compatible. But not all the old stuff is useless as some of it can be reprogrammed. There is tight window from 822 to 830 MHz in EU. This window is quite narrow, but at least it should granted all the time for professional audio. Other option is to go below 700Mhz, but then you might get into collision with local TV transmitter. Therefore I settled for the narrow band since I don't plan to use too many transmitters at once and this should work for me well.
You can clearly see on top there is AF board, which is not much interesting for our case, but below is LCD, HF, CPU and header socket connector with 6 contacts! That looks promising as this is definitely the interface that is used for reprogramming. The idea is that by connecting it to some kind of UART I might be able to change the frequencies.
My movie production gear was missing wireless lavaliers for long time, so after some exploration I settled on old Sennheiser professional series with receivers EK3041/EK3241 and transmitters SK 50. Managed to get couple of them for price that would otherwise got me single Sennheiser G3 series. Which is the most basic lav set from Sennheiser. These were already in the approved band so no worries. But I also bought really nice SKM 3072-U wireless handheld.
The SKM 3072-U had stated bandwidth 798-830Mhz. That's the bandwidth that HW can provide without any changes. So I was expecting it will not be an issue to pick the right MHz that I need from the free band. Little did I know, that the mic has already pre-programmed set of frequencies within the band. And all of them were outside the gap I wanted. Unfortunately these frequencies cannot be changed by user.
There is a guy on eBay who is doing the reprogramming but it costs 119 Euro! And that's quite a lot, for plugging some cable to microphone. I even tried to propose cheaper price to the guy, but he refused. Anyway I was curious if it would be possible to do it on my own. And if it won't be too complicated I might start sell the reprogramming service on my own... for less the him! (diabolic laughter).
As first, and usually the most interesting step, I took the mic apart.
You can clearly see on top there is AF board, which is not much interesting for our case, but below is LCD, HF, CPU and header socket connector with 6 contacts! That looks promising as this is definitely the interface that is used for reprogramming. The idea is that by connecting it to some kind of UART I might be able to change the frequencies.
I checked the CPU type under the sticker to found out it's PIC16C73A. Datasheet is huge but available.
And it has UART that is indeed connected to the pins on the J1 connector. I tried to connect my USB to UART board.
But, nothing happened. I did some more tests to see if I would be able to make it talk. Pushing some buttons when powering, which can sometimes put some devices into service mode. Or at least that's the trick I learned from embedded developers who use this quite often. It is usually some kind of combination of buttons pushes/holds in weird order. But still without any success. After some attempts that were not fruitful I was little bit despaired, but what could help me is the Service Manual.
And as it was only for 5 USD. I resigned and bought it. And indeed it was full of so many interesting information.
J1 is truly used for setting the frequencies. The frequencies are stored in EEPROM ST24C04M1 which communicates with CPU over I2C.
To program it, you have to use Sennheiser plug with 9V battery connector for powering, then another on top of it to connect UART to the PC with Win 3.1 or higher (This should not be an issue). But the most important part that I'm missing is I don't have the SePT.EXE programming software. Which knows baud rate but mainly how to talk with the CPU. Or lets say makes the CPU talk.
As you can see there is also /RST and WP pin. /RST should be reset pin for CPU as it connects to the MCLR pin. and WP is WriteProtect of EEPROM, which is normally pulled up and had to be grounded in order to write into the memory.
The Service manual has quite many information, but unfortunately, nothing about the UART itself as this is dealt by the SePT.EXE application. And without any specifics about how to start the communication with CPU I run out of ideas.
But, there is quite interesting thing that when the mic starts up, it loads the frequencies from the EEPROM. That means that If I would be able to read then modify the EEPROM, I can change the frequencies. The right way would be to do it with CPU via UART. But since the CPU does not cooperate I could try hooking up to the I2C directly and see how things work and even try to dump the EEPROM and modify it. The only issue is, I don't know much about EEPROMs, uCPU, I2C etc. not really, but that should be part of all the fun.
Next day I borrowed this logic analyzer and connected it to then EEPROM pins to record communication. Below is communication after powering of mic.
write to 0x3E ack data: 0xE0 0xC8 0xF0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00write to 0x3E ack data: 0xE0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00write to 0x50 ack data: 0x10read to 0x50 ack data: 0x11write to 0x51 ack data: 0x1Aread to 0x50 ack data: 0xA9write to 0x51 ack data: 0xB3read to 0x50 ack data: 0x1Fwrite to 0x51 ack data: 0xAEread to 0x50 ack data: 0x03write to 0x51 ack data: 0xAFread to 0x50 ack data: 0x20write to 0x51 ack data: 0xACread to 0x50 ack data: 0xFCwrite to 0x51 ack data: 0xADread to 0x50 ack data: 0x5Dwrite to 0x51 ack data: 0xC4read to 0x50 ack data: 0xFCwrite to 0x51 ack data: 0xC5read to 0x50 ack data: 0x41write to 0x50 ack data: 0x14read to 0x50 ack data: 0x00write to 0x50 ack data: 0x11read to 0x50 ack data: 0x03write to 0x51 ack data: 0x1Dread to 0x50 ack data: 0xBBwrite to 0x51 ack data: 0x1Eread to 0x50 ack data: 0x99write to 0x51 ack data: 0x1Fread to 0x50 ack data: 0x8Cwrite to 0x51 ack data: 0x73read to 0x50 ack data: 0x78write to 0x51 ack data: 0x74read to 0x50 ack data: 0x26write to 0x51 ack data: 0x75read to 0x50 ack data: 0xFEwrite to 0x7F ack data: 0x5D 0x06 0x83 0xF00x370xEF0x88 0x5E 0x260xFC0xE1 0x6Fwrite to 0x3E ack data: 0xE0 0x00 0x00 0x00 0x00 0x00 0x9F 0x00 0x00 0x00 0x00 0x00write to 0x3E ack data: 0xE0 0x00 0xF0 0x00 0x00 0x00 0xFB 0x00 0x00 0x00 0x00 0x90write to 0x3E ack data: 0xE0 0x00 0xBF 0x00 0x09 0x00 0x9A 0x00 0x00 0x00 0x00 0xF0write to 0x3E ack data: 0xE0 0x00 0xAB 0x00 0x0F 0x00 0xBD 0x0F 0x00 0x00 0x00 0x99write to 0x3E ack data: 0xE0 0x00 0xDA 0x00 0x09 0x00 0x00 0x9B 0xF0 0x00 0x00 0xBFwrite to 0x3E ack data: 0xE0 0x00 0x0D 0x00 0x9B 0x00 0x7B 0xFA 0xBF 0x00 0x00 0x09write to 0x3E ack data: 0xE0 0x00 0xF0 0x00 0x00 0x00 0xEF 0x0B 0x00 0x00 0x00 0x2Fwrite to 0x50 ack data: 0x11 0x03write to 0x50 ack data: 0xB1read to 0x50 ack data: 0x11write to 0x50 ack data: 0x73read to 0x50 ack data: 0x79write to 0x50 ack data: 0x74read to 0x50 ack data: 0x87write to 0x50 ack data: 0x75read to 0x50 ack data: 0x00write to 0x50 ack data: 0xB1read to 0x50 ack data: 0x11write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFFwrite to 0x50 ack data: 0x73read to 0x50 ack data: 0x79write to 0x50 ack data: 0x74read to 0x50 ack data: 0x87write to 0x50 ack data: 0x75read to 0x50 ack data: 0x00write to 0x50 ack data: 0xB1read to 0x50 ack data: 0x11write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFFwrite to 0x7F ack data: 0x41 0xF00x37write to 0x3E ack data: 0xE0 0x00 0x37 0xFF 0xE3 0x00 0x75 0x61 0x1C 0xF7 0xBF 0x26write to 0x50 ack data: 0x73read to 0x50 ack data: 0x79write to 0x50 ack data: 0x74read to 0x50 ack data: 0x87write to 0x50 ack data: 0x75read to 0x50 ack data: 0x00write to 0x50 ack data: 0xB1read to 0x50 ack data: 0x11write to 0x3E ack data: 0xE0 0x00 0xBA 0xFF 0x99 0x00 0xFB 0xDF 0xFA 0xF7 0xBF 0xFF
Komentáře
Okomentovat