GE index
Back to Home
  Secrets of the GE MLS
and MLS2 Mobile Radios

Written by Robert W. Meister
From data by Pierre Drolet VE2DID
With help from Miles Jackson N9MJ
  Print this Page


Background:

The GE MLS and MLS2 radios store their transmit and receive frequencies and coded squelch information, as well as other radio-wide settings, in an EEPROM. They call this data a "personality", which is similar to what Motorola people call a "code plug". This defines the radio's operating parameters.

The MLS radios use a TQ2310 suitcase unit for programming. These units are rare and hard to use. The MLS radio stores its data in a socketed 2816 (or 28C16) 2,048 byte parallel EEPROM. The MLS2 radios use a DOS computer program and serial interface cable for programming. The MLS2 radio stores its data in a more modern socketed generic 2404 (or 24C04) 512 byte serial EEPROM.

I actually own a two-channel VHF MLS radio (it was supposed to be an MLS2 radio) and borrowed a TQ2310 to program it. Not an easy task but I waded through and got the two channels working. That was the extent of my MLS experience. I own several MLS2 radios and have the programming software and cable to play with them. I much prefer the MLS2 radios over the MLS radios, but they both operate and perform the same once you've programmed them.

Sometime in 2012 Pierre decoded some of the channel information in the MLS radio. Someone sent me the information he compiled (I think it had been posted on a Yahoo group) consisting of a DOC file and an XLS file. It was incomplete and limited but it did provide some details of the personality memory layout and how channel information was encoded.

Earlier in 2015 Miles contacted me with a request for some additional MLS information and we started investigating the MLS2 memory with a goal to completely detail the MLS memory. I read the EEPROMs from the MLS and MLS2 radios and started analyzing the data. An eventual goal is to be able to correctly write new programming information into the MLS radio's EEPROM without requiring a TQ2310. This article presents the results of our findings.

Most of the MLS2 data was gathered by programming the radio with a DOS computer, pulling the EEPROM, inserting it into an EPROM reader, and analyzing the data with a hex editor in a Windows computer. We then compared this to the MLS data for verification. Just about every feature was exercised this way. I'm hoping to try a similar tactic with the MLS radio if I can borrow a TQ2310 and manage to plod my way through the user interface.

General Notes:

Most of the data is the same format for both the MLS and MLS2 radios. The locations changed slightly because of the size of the EEPROM. The MLS2 also has the ability to do both analog and digital Channel Guard while the MLS can only do analog Channel Guard. That seems to be about the only major difference between the radios. Both handle the same band splits and have the same specifications. From the outside they look identical.

So we'll all be talking the same language, I'll be using hexadecimal notation and identifying individual bits starting with bit00 as the least significant bit, the one on the right side of the 8-bit byte. I'll also split binary values with a comma every four bits. These groupings of four bits (half of a byte) are commonly called a nibble; they are referred to as the high nibble (the left four bits 07 through 04) and the low nibble (the right four bits 03 through 00).

EEPROM Layout:

The EEPROM data is laid out in two distinct areas. The low area (000-3FF in the MLS, 000-0FF in the MLS2) is used for some volatile storage, things that, if erased or reset, aren't terribly important. The high area is used for radio-wide parameters and channel data that are programmed for the user. Since the memory capacity is different, data must be kept at different addresses and there are two tables describing the layout, one for the MLS, one for the MLS2. The channel data is the same for both radios and will be described separately. All addresses and data values are in hex. First here's the MLS layout.

AddressValueMLS Function and Use
00000-FF Channel 1-8 scan list; bit00=ch1, bit01=ch2, etc. [1]
00100-FF Channel 9-16 scan list; bit00=ch9, bit01=ch10, etc. [1]
00200-10 Priority 1 channel number. 00 means no P1 channel.
00300-10 Priority 2 channel number. 00 means no P2 channel.
004FFApparently unused.
005FFApparently unused.
006FFApparently unused.
00769 Always 69 (unless no channels programmed, then 00).
00800-10 Last channel number selected.
00900-0F Last volume level selected.
00A00Unknown.
00B-3FFFFApparently unused.
400-404Var. Radio-wide Parameters. See below.
405-40EVar. Channel 1 RX and TX data. See below.
40F-418Var. Channel 2 RX and TX data. See below.
419-422Var. Channel 3 RX and TX data. See below.
423-42CVar. Channel 4 RX and TX data. See below.
42D-436Var. Channel 5 RX and TX data. See below.
437-440Var. Channel 6 RX and TX data. See below.
441-44AVar. Channel 7 RX and TX data. See below.
44B-454Var. Channel 8 RX and TX data. See below.
455-45EVar. Channel 9 RX and TX data. See below.
45F-468Var. Channel 10 RX and TX data. See below.
469-472Var. Channel 11 RX and TX data. See below.
473-47CVar. Channel 12 RX and TX data. See below.
47D-486Var. Channel 13 RX and TX data. See below.
487-490Var. Channel 14 RX and TX data. See below.
491-49AVar. Channel 15 RX and TX data. See below.
49B-4A4Var. Channel 16 RX and TX data. See below.
4A5-4FD00Unused.
4FE-4FFVar. Checksum, high byte at 4FE, low byte at 4FF. [2]
500-7FFFFUnused.

Notes:
[1]: If a channel is selected as the Priority 1 or Priority 2 channel, it will be scanned but it will not show up as a bit in the Channel Scan List bytes.
[2]: The checksum is a simple 16-bit addition of all the bytes from address 400 through 4A4.

In the MLS2, the data is similar to the MLS but they moved the radio-wide data down to the lowest addresses.

AddressValueMLS2 Function and Use
000-004Var.Radio-wide Parameters. See below.
00500Unknown.
00600-10Last channel number selected.
00700-0FLast volume level selected.
00800Apparently unused.
00900Apparently unused.
00A00Apparently unused.
00B00Apparently unused.
00C00Apparently unused.
00D00Apparently unused.
00E00Apparently unused.
00F69 Always 69 unless no channels programmed, then 00.
01000-FF Channel 1-8 scan list; bit00=ch1, bit01=ch2, etc. [1]
01100-FF Channel 9-16 scan list; bit00=ch9, bit01=ch10, etc. [1]
01200-10 Priority 1 channel number. 00 means no P1 channel.
01300-10 Priority 2 channel number. 00 means no P2 channel.
014-0FF00Apparently unused.
100-109Var. Channel 1 RX and TX data. See below.
10A-113Var. Channel 2 RX and TX data. See below.
114-11DVar. Channel 3 RX and TX data. See below.
11E-127Var. Channel 4 RX and TX data. See below.
128-131Var. Channel 5 RX and TX data. See below.
132-13BVar. Channel 6 RX and TX data. See below.
13C-145Var. Channel 7 RX and TX data. See below.
146-14FVar. Channel 8 RX and TX data. See below.
150-159Var. Channel 9 RX and TX data. See below.
15A-163Var. Channel 10 RX and TX data. See below.
164-16DVar. Channel 11 RX and TX data. See below.
16E-177Var. Channel 12 RX and TX data. See below.
178-181Var. Channel 13 RX and TX data. See below.
182-18BVar. Channel 14 RX and TX data. See below.
18C-195Var. Channel 15 RX and TX data. See below.
196-19FVar. Channel 16 RX and TX data. See below.
1A0-1A1Var. Checksum, high byte at 1A0, low byte at 1A1. [2]
1A2-1FF00Apparently unused.

Notes:
[1]: If a channel is selected as the Priority 1 or Priority 2 channel, it will be scanned but it will not show up as a bit in the Channel Scan List bytes.
[2]: We haven't figured out the checksum yet. It is NOT a simple 16-bit addition. It covers the bytes from addresses 100 through 19F and probably some of the bytes in low memory, but the result eludes us. Since the MLS2 programming software is readily available and easy to use, this really is not a big issue. I'm just presenting it for completeness.

Radio-wide Parameters:

The radio-wide parameters occupy five bytes at different locations. While they are in the same order and have the same usage, the values are slightly different between the two radios. In the MLS2 software, these parameters are specified on the "Setup" screen and the "Options" screen. The table and text below explain the various bytes and nibbles.

Byte #NibbleMLSMLS2 Function or Use (see text for details)
00High0 3Unknown.
00Low2 4Unknown.
01High0-7 0-7Operating Band.
01Low0-1-F F-0-ECCT in 0.5 minute increments.
02High??? ???Unknown.
02Low0-3 0-3Flashing Priority (bit00) and Channel (bit01) LEDs.
03Byte0 0Unknown.
04Byte2/8/10 2/8/10Maximum number of channels allowed.

The high nibble of byte 1 is the operating band. The table below shows the possible values. Note that there is no band 3 or band 6; these may have been reserved for expansion of the VHF and UHF bands.

BandFrequency RangeValue
VHF-L129.7 - 42.0 MHz0
VHF-L242.0 - 50.0 MHz1
VHF-H150 - 170 MHz2
UHF-1403 - 430 MHz4
UHF-2450 - 470 MHz5
800 MHz806 - 870 MHz7

The low nibble of byte 1 is the Carrier Control Timer (CCT) value in 0.5 minute increments from 0 to 7.5 minutes. The MLS starts at 0 for 0.0 minutes and goes all the way up to F for 7.5 minutes. Unfortunately the MLS2 did it differently (and in my opinion incorrectly) by starting at 0 for 0.5 minutes and going all the way up to E for 7.5 minutes, leaving F for 0.0 minutes. Dumb. See the table below.

Mins0.00.51.01.5 2.02.53.03.54.04.5 5.05.56.06.57.07.5
MLS01 234 567 89A BCD EF
MLS2F0 123 456 789 ABC DE

The low nibble of byte 2 has the Flashing LEDs option bits. Bit00 handles the Priority LEDs. Bit01 handles the Channel LEDs. These select whether the LEDs will flash or not when the radio is scanning. A 2-channel radio doesn't offer scanning.

The TQ2310 programmer asks one additional question regarding the front panel LEDs but I haven't figured out if this sets its own bit or sets the other two Flashing LED bits. The only MLS radio I could access has a 2-channel control panel with no scanning ability but I have since acquired other panels that have more channels and scanning; I just have to play with the bits.

The maximum number of channels is what the radio is capable of, which really depends on the front panel (2, 8, or 16 channel units are different). You can have up to this many channels programmed into the radio. Channels with a blank receive frequency can't be selected. Channels can be left completely blank and will be skipped by the radio. It would seem that you can program more channels than the control panel is capable of.

Channel RX and TX Data:

The radio maintains its channel information in two groups of five bytes, one group for the receiver followed by one group for the transmitter. Both groups are coded the same. Three bytes deal with the synthesizer frequency and the remaining two bytes deal with Channel Guard and some channel-specific features. There's room for up to 16 channels but the radio will only utilize as many as it was set up to handle: 2, 8, or 16. The 800 MHz radio doubles the synthesized frequencies, so the radio would actually contain frequency data as if it's a 400 MHz radio.

When you program the radio, you must specify a receive frequency for each channel you want to use. The software lets you enter just a transmit frequency but the radio won't let you select that channel; what good is a channel that you can't listen to? You can also skip channels, i.e. fill out channels 1, 2, 4, and 5, although I don't know the benefit of doing that. The radio just skips channels with no receive frequency.

Synthesizer Math:

The synthesizer needs two values to set up its dividers properly. The datasheets and texts refer to these as "N" and "A". "N" is the integral quotient and "A" is the integral remainder. As a simple example, if we take the decimal value 42 and divide it by 8, we get 5.25. The whole number quotient is obvious: "5" for "N". The remainder is 0.25 8ths, so you need to multiply the remainder by the divisor to get "2" for "A". The MLS needs these two values and devotes 10 bits for "N" and 7 bits for "A". This occupies one bit more than two bytes can hold, so the radios allocate three bytes for the frequency information. Additional bits are used to specify the step size (5.0 kHz or 6.25 kHz) and whether the divisor is 64 or 128.

The various bands (VHF, UHF, 800 MHz) have different requirements for their frequencies, summarized below. Even though the calculations use 6.25 kHz for step size, the actual frequencies are usually 12.5 kHz apart, or twice the 6.25 kHz step. Frequencies can be any multiple of 5.0 or 6.25 kHz depending on the band. For VHF, if the frequency is divisible by both 5.0 and 6.25 kHz, a step size of 5.0 kHz is used. This table also provides the I.F. frequency for the receiver offset and whether the radio uses high-side or low-side injection. High-side injection means the oscillator frequency is higher than (above) the carrier frequency. For example, if you want to receive 162.400 MHz, the synthesizer must be programmed to receive (162.400 + 82.2) or 244.600 MHz. Doubled means that the bytes are programmed with half of the desired frequency and it is doubled in the oscillator circuit. So when transmitting on 820 MHz, the three bytes of programming data would specify 410 MHz.

BandStep SizeDivisorI.F. MHzInj.Doubled?
VHF-L5.0 or 6.2564 20.8HighNo
VHF-H5.0 or 6.2564 82.2HighNo
UHF6.25128 82.2LowNo
800 MHz6.25128 82.2LowYes

Bytes 1 through 3:

The first byte holds the most significant bit (bit09) of the "N" value as well as bits that determine the divider and step size. "Div" is set to 1 for a Divider of 128 or set to 0 for a Divider of 64. "Step" is set to 1 for a Step Size of 5.0 kHz or set to 0 for a Step Size of 6.25 kHz. The other bits are set as shown below.

Bit #76543210
DataN090 000 1DivStep

The second byte holds the middle 8 bits (bit08 through bit01) of the "N" value.

Bit #76543210
DataN08N07 N06N05N04 N03N02N01

The third byte holds the least significant bit (bit00) of the "N" value as well as the entire "A" value.

Bit #76543210
DataN00A06 A05A04A03 A02A01A00

Transmit Examples:

So how does this all fit together? Let's take that 410.000 MHz frequency as an example. First I'm going to multiply it by 1000 to convert MHz to kHz. The resulting 410,000 kHz is divided by the step size of 6.25 kHz to yield 65,600. This is then further divided by the divisor value of 128 to come up with a quotient "N" and a remainder "A". The decimal division is 512.5, so "N" is 512 and "A" ends up being 128 times 0.5 or 64. Converting these to hex, we get 200 for "N" (10,0000,0000 in binary) and 40 for "A" (100,0000 in binary). To encode the first byte, we take the most significant bit (the only bit set to 1) from "N" and put that into bit07. Since the divisor is 128, we put "1" into bit01. Since the step size is 6.25, we put "0" into bit00. This gives us a binary value of 1000,0110 or a hex value of 86.

The second byte, from the middle 8 bits of "N", is all zeroes.

The third byte starts out with the least significant bit "0" from "N" followed by the bits from "A", giving us a binary value of 0100,0000 or a hex value of 40. So the three bytes in hex are 86,00,40. This resulted in an awful lot of zero bits but you'd get exactly the same result if you entered 820 MHz for an 800 MHz radio. This was a pretty poor value to use as an example. Let's try another one. How about 456.8875 MHz? That should be a bit more fun.

First, convert MHz to kHz: 456,887.5 kHz. Then divide by the step size (6.25) to get 73,102. We then divide by 128 to get the quotient 571.109375. The integral portion becomes "N", which is 571. The remainder portion is 0.109375 times 128 or 14 for "A". 571 decimal becomes 23B in hex, or 10,0011,1011 in binary. 14 decimal becomes 0E in hex, or 000,1110 in binary. So to encode the first byte, we take the most significant bit from "N" and put that into bit07, then since the divider is 128, we put "1" into bit01 and since the step size is 6.25, we put "0" into bit00. This gives us a binary value of 1000,0110 or a hex value of 86. This just happens to be the same as in the previous example.

The second byte is a bit better. We take the middle 8 bits from "N" (0001,1101) and place them into the second byte, giving us a hex value of 1D.

The third byte starts out with the least significant bit "1" from "N" followed by the bits from "A", giving us a binary value of 1000,1110 or a hex value of 8E. The final three bytes in hex are 86,1D,8E.

For 800 MHz, divide the frequency by 2 then follow the procedure above to encode the (approximately) 400 MHz value into three bytes.

Receive Examples:

We can work the same way on the receive frequency. 456.8875 MHz. First we need to deal with the I.F. frequency and offset, so we subtract 82.2 MHz yielding a synthesized frequency of 374.6875 MHz or 374687.5 kHz. Divide this by 6.25 to produce 59,950. We divide this by the divisor 128 to get 468.359375, so "N" is 468 and "A" is 0.359375 times 128 or 46. Converting these to binary we get 01,1101,0100 for "N" and 010,1110 for "A". Encoding these into the three bytes gives us 06 for the first byte, 1110,1010 or EA for the second byte, and 0010,1110 or 2E for the third byte.

For 800 MHz, first subtract 82.2 MHz, divide the result by 2 then follow the procedure above to encode the (approximately) 400 MHz value into three bytes.

All of these examples exactly match what the MLS2 software writes to the radio. Similar calculations for the VHF frequencies show that the MLS uses exactly the same encoding algorithm. Isn't modern technology wonderful?

Bytes 4 through 5:

These bytes are used for the Channel Guard value as well as some channel-specific options. For analog Channel Guard, they take the tone frequency (typically 50-250 Hz) and multiply that by 10, then utilize 12 bits to hold that value. The low 8 bits of the tone value are stored in the 4th byte, shown below.

FunctionBit07Bit06Bit05Bit04Bit03 Bit02Bit01Bit00
CG CodeCG07CG06 CG05CG04CG03 CG02CG01CG00

The high 4 bits of the tone value are stored in the low half of the 5th byte. The upper half of the 5th byte is used for other purposes, shown below. Only the MLS2 radio can do DPL; this will be explained shortly. STE is Squelch Tail Elimination and refers to the reverse-burst sent by the transmitter at the end of a transmission or how the receiver acts when it receives a reverse burst. CCT is Carrier Control Timeout and is only meaningful in the transmitter's data bytes. Both of these are Yes/No settings in the programming software and the bit is turned on (1) for Yes and turned Off (0) for No.

FunctionBit07Bit06Bit05Bit04Bit03 Bit02Bit01Bit00
Inv. DPL11 00--- ---------
DPL01 00--- ---------
STE00 10--- ---------
CCT00 01--- ---------
CG Code------ ------CG11 CG10CG09CG08

Channel Guard Examples:

So let's try a common tone frequency of 141.3 Hz. This becomes 1413, which is 585 in hex or 0101,1000,0101 in binary. The low 8 bits (1000,0101) go into byte 4 as hex value 85, and the upper 4 bits (0101) go into the low 4 bits of byte 5 as the hex value 5. If both STE and CCT are on, this results in a hex value of 35 in byte 5.

Let's try 67.0 Hz, the lowest legitimate CG code. This becomes 670, which is 0010,1001,1110 in binary. The low 8 bits (1001,1110) go into byte 4 as hex value 9E, and the upper 4 bits (0010) go into the low 4 bits of byte 5 as the hex value 2. If neither STE nor CCT are on, this results in a hex value of 2 in byte 5.

The MLS2 programming manual states that any tone from 50 to 250 Hz can be handled by the radio, but the software checks for the 38 legitimate Channel Guard frequencies and you can over-ride this restriction.

Digital Channel Guard:

Only the MLS2 radio can do Digital Channel Guard. DCG values are three digit octal codes with each digit ranging from 0 to 7. There are also so-called "inverted" digital codes. GE's software may alter the DCG code you've entered to an equivalent code, which can be bothersome, but let it do its thing and see what it changes to.

The same two bytes are used for DCG; they just set additional bits in byte 5 to indicate DCG rather than analog Channel Guard. Note that if you specify an inverted code, this implies the DCG bit would be on as well. The three-digit (9 bit) code occupies the entire byte 4 (the low 8 bits) as well as one bit in byte 5 (the most significant bit). So here's how the 4th byte is encoded.

FunctionBit07Bit06Bit05Bit04Bit03 Bit02Bit01Bit00
DCG CodeDCG07DCG06 DCG05DCG04DCG03 DCG02DCG01DCG00

And here's how the 5th byte is encoded.

FunctionBit07Bit06Bit05Bit04Bit03 Bit02Bit01Bit00
Inv. DPL11 00--- ---------
DPL01 00--- ---------
STE00 10--- ---------
CCT00 01--- ---------
DCG Code------ ------0 00DCG08

Digital Channel Guard Examples:

Only the MLS2 radio can do Digital Channel Guard. Let's try DCG code 762 as an example). The encoding is simple: each octal digit uses three bits, so 7 in binary is 111, 6 in binary is 110, 2 in binary is 010, making the full 9 bit value 1,1111,0010 in binary. The 4th byte will hold the low 8 bits: 1111,0010 in binary or F2 in hex. The 5th byte gets the leading 1 plus the DCG, STE, and CCT bits, so the results are 0111,0001 in binary or 71 in hex. The two byte coding in hex is F2,71.

If we used Inverted 762 instead, the only difference is the extra bit in the high half of the 5th byte, which changes it from 0111,0001 to 1111,0001 in binary or F1 in hex. The two byte coding in hex is F2,F1.

Acknowledgements and Credits:

Some MLS programming information was verified against the TQ2310 suitcase programmer manual, LBI-31717.

Contact Information:

The author can be contacted at: his-callsign [ at ] comcast [ dot ] net.

Back to the top of the page
Up one level (GE index)
Back to Home

This page originally conceived on Monday 15-Jun-2015.



Article text and hand-coded HTML © Copyright 2010 by Robert W. Meister WA1MIK.

This web page, this web site, the information presented in and on its pages and in these modifications and conversions is © Copyrighted 1995 and (date of last update) by Kevin Custer W3KKC and multiple originating authors. All Rights Reserved, including that of paper and web publication elsewhere.