• In large menus with lots of selections, instead of lots of up or down button presses to get to the menu item you want, press the P1 button; this will scroll the menu selection down one entire page of selections, allowing you to get to your desired selection quicker and with fewer button presses.
  
• The P2 button in menu mode will take you one step back / up in the menu, even if Exit or Back doesn’t appear on the display.
  
• If you are deep within multiple selections of menus, rather than pushing Back and Exit multiple times to get to the main screen, you can simply push either # or * once to exit the menus and go back to the main screen in one step.
  

• Top orange button + PTT for main firmware update mode
• Top orange button + # for DSP SCT update mode
• PTT + PF1 enters the reset radio confirmation menu
• PTT + PF2 enters a display icon update mode
• PTT + 1 enters test mode where you can select operational bands and/or adjust alignment parameters
• PTT + 3 enters a GPS module test mode

Standard bands selectable 868 / 6x2 (878 bands are slightly different):

Mode	UHF RX	UHF TX	VHF RX	VHF TX
0	400-480	400-480	136-174	136-174
1	400-480	400-480	144-146	144-146
2	430-440	430-440	136-174	136-174
3	430-440	430-440	144-146	144-146
4	440-480	440-480	136-174	136-174
5	440-480	440-480	144-146	144-146
6	446-447	446-447	136-174	136-174
7	446-447	446-447	144-146	144-146
8	400-470	400-470	136-174	136-174
9	430-432	430-432	144-146	144-146
10	400-480	430-450	136-174	144-148
11	400-480	430-440	136-174	144-146
12	403-470	403-470	136-174	136-174

1. Make sure you have saved your codeplug / rdt configuration file first.
2. For AnyTone AT-D868UV, download the expanded frequency coverage firmware (based on version 2.33) here:
   http://members.optuszoo.com.au/jason.reilly1/868UV_V2.33_official_expanded.zip (289kb)
   For BTech DMR-6x2, download the expanded frequency coverage firmware (based on version 1.02) here:
   http://members.optuszoo.com.au/jason.reilly1/DMR_6x2_V1.2_expanded.zip (291kb)
   For AnyTone AT-D878UV, download the expanded frequency coverage firmware (based on version 1.06) here:
   http://members.optuszoo.com.au/jason.reilly1/D878UV_V1.06_expanded.zip (496kb)
   
3. Unzip this firmware into a folder
4. Using the regular firmware updating software & process, send this frequency expanded firmware to the radio.
5. Power off your radio, press and hold the PTT and number 1 button while turning it on. Hold these keys until TEST MODE is displayed on the screen. Then release the buttons, the radio will power up into a test mode.
6. At the bottom of the screen will be a MODE:0000x display. Use the top selector rotary knob to select whichever mode you want according to your desired TX frequency range from the table below; RX permitted tuning range for all bands (modes) will be set to the same 120-200 MHz and 210-520 MHz. The text displayed on the LCD sometimes will not match the actual bands selected, refer to the table below which will be correct. Power off the radio.
7. If necessary, update your codeplug / rdt configuration file to be compatible with version 2.33 (AT-D868UV), version 1.06 (AT-D878UV) or version 1.02 (DMR-6x2) firmware. If you want to reuse your saved codeplug rdt configuration file, you may need to modify one byte with a hex editor as detailed below in red.
8. Enjoy extra receive frequency coverage of around 127-178 MHz, 190-280 MHz (with a gap between 200-210 MHz) and 380-520 MHz.

Modified frequency coverage when using the expanded RX firmware files above:

Mode	UHF RX	UHF TX	VHF RX	VHF TX
0	210-520	400-480	120-200	136-174
1	210-520	400-480	120-200	144-146
2	210-520	430-440	120-200	136-174
3	210-520	430-440	120-200	144-146
4	210-520	440-480	120-200	136-174
5	210-520	440-480	120-200	144-146
6	210-520	446-447	120-200	136-174
7	210-520	446-447	120-200	144-146
8	210-520	400-470	120-200	136-174
9	210-520	430-432	120-200	144-146
10	210-520	430-450	120-200	144-148
11	210-520	430-440	120-200	144-146
12	210-520	403-470	120-200	136-174

• BCD - binary coded decimal. Example: 146.500 MHz might be seen in a hex editor as 01 04 06 05 00 00. That’s quite wasteful on memory, so it could be represented in a ’packed’ form and you would see in a hex editor the following sequence: 14 65 00. The Radioddity GD-77 happens to use this method, combined with little endian format as explained below.
• Direct hexadecimal notation. Continuing to use the example of 146.500 MHz, if we convert this to a kHz value of 146500 kHz, that is equal to hexadecimal 23C44, or if we break it up into bytes as seen by a hex editor: 02 3C 44. More commonly though, the frequency is represented as a value in Hz, as 12.5kHz step frequencies couldn’t be represented with a whole number value in just kHz. So again using our frequency of 146.500 MHz, that’s 146500000 in Hz. Converting that to hex gives 8BB69A0, and broken up into bytes: 08 BB 69 A0.
• Other methods that might be convenient to use: it might be feasible to represent frequencies in a form that is directly used by the frequency synthesis hardware. In PLL schemes, this might be in the form of a ’divider word’ that is sent to a programmable divider.
• For radios using the AT1846S ’radio-on-a-chip’ they receive data in the form of a hex representation of frequency in kHz x16. Yet again using 146.500 MHz as an example: 146.500 MHz is 146500 kHz, and then multiply by 16 = 2344000 in decimal. Then convert to hex: 23 C4 40. It is possible some radios may store frequencies in a form that can be directly sent to the AT1846S.

1. Install your desired TTF font as a system font on your PC
2. Select Capture System Font, then select your desired font from the list
3. Select input size by point, and play around with the value to get each character fully visible. Typically the letters M and W are difficult to fit in smaller pixel widths and get truncated at the sides, and lower case letters g, j, p, q and y can get cut off at the bottom: try smaller point values to get the font small enough to fit or manually tweak the problem letters yourself. As an example, the Courier New TTF font works well if imported at 10 point size
4. Select Output character size - Change font size and enter height and width to suit the font you are replacing, and click OK
5. Examine your characters that have been imported to make sure they all fit nicely and are fully legible. You can edit the appearance and shift characters up/down/left/right to make them look nice.
6. Select Font settings, and choose character range starting at 32 and ending at 126, as those are the only characters the 868 needs
7. Select Export font. You want to select ’custom’, format is binary file, scan direction set to start top-left, scan vertical and leave the other settings as they are. Give your font a name and save it
8. Rename the extension of your font from a .dat to .bin and you have a file that’s ready to go into the 868.

If you need a good hex editor, download HxD in your preferred language here (about 860kb)

• Begin by downloading one of the following zip files that applies to your model:
  http://members.optuszoo.com.au/jason.reilly1/AT868testmodes.zip (2kb)
  http://members.optuszoo.com.au/jason.reilly1/AT878testmodes.zip (2kb)
  http://members.optuszoo.com.au/jason.reilly1/6X2testmodes.zip (2kb)
  
• Unzip your chosen file into a new folder. There are two sets of files in there, one to switch the radio into full test mode, and another to return back to normal test mode where only MODE is selectable.
• Connect your radio to the PC with it’s programming cable
• Start up the firmware / icon updating software, QXCodePro_Update
• Point that updater to the new folder and select fulltestmode.spi file
• Place the radio in icon update mode by holding PTT and the bottom side button together while turning on the radio, you should see UPDATE MODE appear on the radio screen
• Make sure you have the right COM port selected and hit write, it will only take a fraction of a second to complete.
• Turn the radio off and on again. The radio will take a few extra seconds more than normal to boot up, this is OK as it is reconfiguring internal memory
• To activate test mode, turn off the radio, hold down the PTT + keypad 1 buttons until TEST MODE is displayed on the radio screen, then let the two buttons go. The radio will boot up into it’s full test / self adjustment mode.

I strongly recommend you go through each setting and write down what they are before making any adjustments

CH	Setting	Adjustment range	Description
1	nil	nil	nil
2	nil	nil	nil
3	nil	nil	nil
4	nil	nil	nil
5	nil	nil	nil
6	nil	nil	nil
7	FQCU	0-65535	Frequency fine tune
8	PAHU	0-255	UHF RF power output turbo setting
9	PAMU	0-255	UHF RF power output high setting
10	PALU	0-255	UHF RF power output medium setting
11	PASU	0-255	UHF RF power output low setting
12	MODU	0-255	Overall deviation setting for both UHF & VHF (value copied to 39 below)
13	TONEU	nil	Push PTT to transmit a test 1000 Hz tone on a UHF FM frequency
14	CTCW	0-63	Deviation setting for CTCSS in both UHF & VHF (value copied to 41 below)
15	DCSW	0-63	Deviation setting for DCS in both UHF & VHF (value copied to 42 below)
16	RXVLU	0-4095	UHF receive tracking gain, low end of band
17	RXVMU	0-4095	UHF receive tracking gain, mid band
18	RXVHU	0-4095	UHF receive tracking gain, top end of band
19	SQTHU	60-134	UHF squelch tight threshold
20	RSSIU	nil	UHF RSSI, inject RF at desired level for 1 bar reading, rotate top dial to sample and lock in value
21	A OBHU	0-65535	not yet known, but seems to adjust screen brightness (suspect this is a bug)
22	A OBLU	0-65535	not yet known
23	D OBHU	0-65535	not yet known, unable to adjust from test menu
24	D OBLU	0-65535	not yet known, unable to adjust from test menu
25	D CTCW	0-65535	not yet known
26	D DCSW	0-65535	not yet known
27	DIGIU FSKL	nil	Push PTT to send test FSK signal (heard as 2400 Hz) at low end of UHF band
28	DIGIU FSKM	nil	Push PTT to send test FSK signal (heard as 2400 Hz) at mid UHF band
29	DIGIU FSKH	nil	Push PTT to send test FSK signal (heard as 2400 Hz) at high end of UHF band
30	DIGIU 600Hz	nil	Push PTT to send test 600Hz signal UHF band (heard on FM as 200 & 400 Hz?)
31	DIGIU 300Hz	nil	Push PTT to send test 300Hz signal UHF band (heard on FM as 800 Hz?)
32	DIGIU 1031	nil	Push PTT to send test signal UHF band, heard on DMR as 1031 Hz
33	DIGIU BER	nil	Display received BER of DMR test signal
34	DIGIU TEST	nil	Test UHF DMR for both TX & RX as if it were on a regular DMR channel
35	PAHV	0-255	VHF RF power output turbo setting
36	PAMV	0-255	VHF RF power output high setting
37	PALV	0-255	VHF RF power output medium setting
38	PASV	0-255	VHF RF power output low setting
39	MODV	0-255	Overall deviation setting for both VHF & UHF (value copied to 12 above)
40	TONEV	nil	Push PTT to transmit a test 1000 Hz tone on a VHF FM frequency
41	CTCWV	0-63	Deviation setting for CTCSS in both UHF & VHF (value copied to 14 above)
42	DCSWV	0-63	Deviation setting for DCS in both UHF & VHF (value copied to 15 above)
43	RXVLV	0-4095	VHF receive tracking gain, low end of band
44	RXVMV	0-4095	VHF receive tracking gain, mid band
45	RXVHV	0-4095	VHF receive tracking gain, top end of band
46	SQTHV	60-134	VHF squelch tight threshold
47	RSSIV	nil	VHF RSSI, inject RF at desired level for 1 bar reading, rotate top dial to sample and lock in value
48	A OBHV	0-65535	not yet known
49	A OBLV	0-65535	not yet known
50	D OBHV	0-65535	not yet known
51	D OBLV	0-65535	not yet known
52	DIGIV FSKL	nil	Push PTT to send test FSK signal (heard as 2400 Hz) at low end of VHF band
53	DIGIV FSKM	nil	Push PTT to send test FSK signal (heard as 2400 Hz) at mid VHF band
54	DIGIV FSKH	nil	Push PTT to send test FSK signal (heard as 2400 Hz) at high end of VHF band
55	DIGIV 600Hz	nil	Push PTT to send test 600Hz signal VHF band (heard on FM as 200 & 400 Hz?)
56	DIGIV 300Hz	nil	Push PTT to send test 300Hz signal VHF band (heard on FM as 800 Hz?)
57	DIGIV 1031	nil	Push PTT to send test signal VHF band, heard on DMR as 1031 Hz
58	DIGIV BER	nil	Display received BER of DMR test signal
59	DIGIV TEST	nil	Test VHF DMR for both TX & RX as if it were on a regular DMR channel
60	VBAT	0-200	Calibrate displayed voltage of battery
61	MODE	0-12	Changes operational frequency bands of radio
62	087.50M	nil	Receiver test of FM broadcast band
63	097.50M	nil	Receiver test of FM broadcast band
64	108.00M	nil	Receiver test of FM broadcast band

• 1 bar -113 dBm or about S-5
• 2 bars -108 dBm or about S-6
• 3 bars -103 dBm or about S-7
• 4 bars -98 dBm or about S-9

• Turn off your clock display and GPS. It appears as if any display updates or GPS data that is multiplexed on the data lines connecting the display front half of the radio to the main PCB will cause some interference on VHF. The primary culprit for this is the clock flashing colon between the hours and minutes. Updating to firmware version 2.33 can help, as this stops the colon / time separator symbol from flashing.
• Shielding the small flat flexible ribbon cable with some adhesive aluminium or copper tape helps a little bit, according to Colin G4EML, especially if you have the older white style flat flexible ribbon cable. If you have a brown cable with no tracks visible on the back side as indicated by the single grey arrow in the picture below, your cable is already upgraded and won’t benefit much from any adding any extra shielding to the cable.
• Noise from display. Yet more noise appears to come from the LCD itself, and in later revisions of the radio, Anytone reduced this noise by earthing the metal frame that surrounds the display. You can see this indicated by two small grey arrows in the picture below. If your display doesn’t have this, then thoroughly scrape the paint from the two metal tabs poking through the bottom of the display PCB and solder them to the ground plane as pictured. Use a 60-100 watt soldering iron to rapidly heat the components and solder quickly. Use of a smaller iron will take longer to heat components up which isn’t ideal.
• Chassis to PCB shielding: A good connection between the PCB earth and the chassis will ensure the best RF shielding possible. Critical for this good connection, you should ensure that all screws are done up snugly, but not so tight that they will strip the threads.
• Nickel shielding spray paint. (Only for the really keen & fastidious radio operator: very extensive disassembly!) While AnyTone have done a good job of shielding sensitive parts of the circuitry with brass shields and the cast aluminium chassis, you can amp up the shielding by use of nickel shielding spray. If you look inside some cellular mobile phones or portable two way radios, you will sometimes see a coating of paint on the inside of any plastic parts. This paint could be black, brown, pink, grey or silver, and they all have a similar job: they’re conductive and add a thin layer of RF shielding to the electronics inside. Electrolube’s NSCP400H nickel spray paint is sold by Element14 (Farnell), or you might be able to find alternative products from other suppliers. You’ll need to follow these general steps:
  
  1. Completely disassemble the radio. You need a bare plastic shell with the keypad and LCD display, speaker, orange top button and the plastic ’light pipe’ for the top mounted TX/RX LED removed.
  2. Use masking tape to cover every surface that you don’t want the nickel spray paint to go. That not only includes all the visible exterior parts, but also many interior areas as well. Cut out a circle of cardboard to fit on the inside of the speaker grille, and also cut out a rectangle of cardboard to the same size as the LCD clear display window. Also block up any openings such as the holes where the keypad goes with cotton wool - I use craft work decorative soft balls for this and it works well. If you have a GPS model, you will also need to leave the area around the GPS antenna clear of any coating. This job of masking every surface you don’t want covered by the paint is fiddly and tedious in the extreme, but is necessary because the spray paint will go everywhere, trust me!
  3. Nickel spray paint is known to be rather hazardous. You will want to do this job outside, and on a calm wind free day. Wear goggles, dust mask, long sleeve shirt and rubber gloves. Place the masked up shell onto a piece of scrap cardboard and use good spray painting techniques to apply a thin coat of nickel spray on the inside of the shell. The spray will look uneven as you apply it, and don’t let that tempt you into applying more paint in those areas. Too much paint will attack the plastic and cause the coating to crack once dried.
  4. Let the first coat of nickel paint dry, about 24 hours. Apply one more very thin coat of nickel spray paint and let dry again.
  5. Slowly remove any masking tape, cardboard protective bits and cotton wool stuffing. You should have your same bare radio shell but with a nice grey coating of nickel spray paint on the inside.
  6. Refit the speaker and use hot melt glue or a contact type of glue to hold it in place.

The back side of the GPS & LCD screen board. Ribbon cables removed for clarity. Note the mini GPS antenna to the right - it sits underneath the AnyTone badge above the display.

The 868 main board back side, with brass RF shield fitted

The 868 main board back side, with brass RF shield removed this time

The 868 main board front side

You can download higher resolution pictures of the main boards here:
http://members.optuszoo.com.au/jason.reilly1/868mainboard_back_full.jpg (3.6Mb)
http://members.optuszoo.com.au/jason.reilly1/868mainboard_front_full.jpg (3.7Mb)

• Analogue transmissions with CTCSS using ’reverse tone burst’ for squelch tail elimination do not quietly mute 100% reliably
• FM broadcast band VFO only permits tuning from 87.5 to 108 MHz no matter what ’Mode’ the radio is set to, where as programming software allows 76.0 to 108.0 MHz to be programmed as a memory
• When first starting the FM broadcast band receiver, it defaults to around mid-volume no matter what your volume setting is

• GD32F303VTG6 ARM Cortex-M4 32 bit MCU with 1024kbyte flash and 96kbyte SRAM & 12.0 MHz oscillator
• Toshiba TC58CVG0S3HRAIG 1Gbit / 128Mbyte NAND flash memory
• Sicomm CT3258TD baseband processor for DMR & dPMR with built in AMBE2+ vocoder & 12.2 MHz oscillator
• Texas Instruments TLV320AIC3204 DSP / codec
• AT1846S radio-on-a-chip & 26.0 MHz reference oscillator
• RDA 5802N FM broadcast band receiver
• H&M Semiconductor HM8872 8 watt audio power amp
• NXP AFT05MS006NT1 LDMOS 6 watt RF power amp, 18dB narrowband gain, for independent VHF & UHF power amp stages
• 2SC3356 based low noise preamps for VHF & UHF receiver stages
• VHF and UHF receive front ends each have four stages of varactor track tuned filtering
• Infineon BGM781N11 GPS front end and ATGM336H GPS / GNSS positioning module (GPS models only)
• Battery backup for real time clock
• Solder pads for expansion memory SOIC size IC and a small push fit expansion connector for add on Bluetooth or extra memory module. (Not found on the 868 version 1 hardware)

• Lower half of flash is used for codeplug storage, icon data & RF ’soft’ alignment
• 0x00000000 to 0x0014FFFF holds alternate language fonts eg: Pinyin (Chinese), Japanese, Greek, Cyrillic, Roman numerals. There is some English font there but it doesn’t appear to be used at all
• 0x00150000 to 0x00159FFF holds the default AnyTone start-up picture
• 0x0015A000 to 0x00200000 holds the multi colour icons bitmaps
• 0x02F00000 to 0x02F8061F holds active RF ’soft’ alignment data and backup copies
• 0x02FA0000 to 0x02FDFFFF holds active ’local information’ data and backup copy
• Upper half of flash holds the DMR ID database and custom start up image, actually less than half the flash is used for this! (Plenty of scope for expansion by database compression, more efficient use of memory etc.)
• 0x042C0000 to 0x042C9FFF is for custom start up image bitmap
• 0x04500000 onward for DMR ID database, with other support data being written from 0x04000000

• 0x08000000 to 0x08003FFF used by the 868 / 6X2 boot loader for firmware updating etc.
• 0x08004000 to 0x0807FFFF used by firmware and display fonts
• 0x08080000 to 0x080FFFFF is empty (believed that at least half of this is available for firmware use on the 878)

• Better understanding and modification of receive tracking gain scheme to improve sensitivity between 210 & 400 MHz
• Exploiting the capabilities of the TLV320AIC3204 audio codec chip inside the 868. This is a very powerful chip with the possible scope to facilitate DSP noise reduction, equalisation, tone control and digital AGC audio.
• Explore some new fonts, perhaps some screen colour changes and icon customisation

© Copyright Jason Reilly, 2018