An experiment in programming the AN6311NFA PLL

Description: The objective was to modify this radio for functionality on the 70cm amateur radio band. However, this attempt failed because the voltage-controlled oscillator (VCO) did not oscillate at the required frequencies for 70cm operation, as the VCO control voltage reached its minimum before achieving the necessary frequency range. The VCO is too compact, making it challenging to trace the multilayer board tracks. Additionally, there is no service manual available for this radio, which complicates the ability to modify the frequency-determining components of the VCO. It should be noted that the antenna was removed and replaced with a dummy load for these tests. Despite these challenges, the project proved to be a valuable learning opportunity, and the tools developed during the process, essentially a rudimentary logic analyzer, may be utilized to reverse engineer other serial phase-locked loop (PLL) control protocols. Although a datasheet for the AN6311NFA was not found, information on two similar integrated circuits (ICs) from the same manufacturer was available. This, in conjunction with the use of an oscilloscope, facilitated the identification of the serial control lines on the AN6311NFA. A board was constructed featuring an ATtiny2313 microcontroller (operating at 18.432 MHz) and an ST232 RS232 to TTL level converter. An issue that arose was that the PLL was powered by a 3.3V DC power supply. Monitoring the serial communications to the PLL posed no issues, as 3.3V was sufficient to register as a logic high on the ATtiny2313's input pins (when supplied with 5V). However, care was necessary to ensure that the voltage on the PLL input pins did not exceed 3.3V. This was achieved by using pull-up resistors between the PLL input pins and the radio's 3.3V rail, while the ATtiny2313's outputs were utilized to pull the PLL input pins low when a logic 0 was required. Three distinct firmware programs were developed: two for monitoring the PLL serial control and logging the data via an RS232 port to a PC, and one for receiving commands from a PC through an RS232 port and transmitting those commands to the PLL. The first firmware, which did not function as intended, transmitted various ASCII serial characters to the PC upon detecting a state change on an input (c = clock low, C = clock high, s = strobe low, S = strobe high, 0 = data low, 1 = data high). Nevertheless, it was adequate to determine which bits control the PLL frequency and the NBIF RX section of the PLL IC. The second firmware continuously checks the input pins for state changes; upon detecting a change, the binary states of all inputs are converted into an ASCII character and sent to the serial transmit buffer. This ASCII character ranges from 0 to 7, derived from the observation that data is clocked into the PLL on the rising edge of the clock signal and latched into the register on the falling edge when the strobe is high. It was observed that the radio operates in a power-saving mode when the squelch is closed, with the PLL and NBIF RX powered for approximately 0.1 seconds every second. These command patterns were discerned by probing the radio's circuitry with an oscilloscope and correlating the commands with the radio's state. The scanning command follows the same pattern as a manual channel change. If channels are manually changed while the squelch is closed, a "sleep" command is sent to the PLL shortly after the channel change if the squelch remains closed. The adjacent PRS channels are spaced 25kHz apart, indicating that the PLL divisor (frequency control data) varies by 8 between adjacent channels. This suggests that the PLL reference frequency is 3.125kHz (25kHz/8), which aligns with the presence of an 8MHz PLL clock crystal (8MHz/2560 = 3.125kHz). The difference in the PLL divisors for RX and TX on the same channel is 3376, corresponding to 10.55MHz (3376 * 3.125kHz), consistent with the hardware as the first intermediate frequency (IF) ceramic filter in the radio is labeled 10.5MHz. For instance, PRS channel #1 operates at 476.425MHz.

The described modifications and observations provide a comprehensive overview of the challenges faced and the methodologies employed in the attempt to adapt the radio for 70cm band operation. The insights gained from this project may serve as a foundation for future endeavors in radio frequency modifications and PLL control protocol analysis. The development of the logic analyzer and firmware solutions highlights the importance of iterative testing and adaptation in electronic engineering projects.The goal was to convert this radio for operation on the 70cm amateur radio band. This was unsuccessful as the VCO will not oscillate at the right frequencies for 70cm operation (the VCO control voltage bottoms out before the VCO gets anywhere near the 70cm band). The VCO is too small and it is too hard for me to trace the multilayer board tracks ( I do not have a service manual for this radio) so I can not change the frequency determining components of the VCO. Please note that the antenna was removed from this radio and replaced with a dummy load for these experiments.

However, all is not lost. This project was a valuable learning experience and with any luck, the tools that I produced in the process (essentially a crude logic analyser) will be able to be used to reverse engineer other serial PLL control protocols. I was unable to find a datasheet for the AN6311NFA, however, I was able to find data on two similar ICs made by the same manufacturer.

This, combined with my oscilloscope, allowed me to identify the serial control lines on the AN6311NFA. One board with an ATtiny2313 microcontroller (clocked at 18. 432 Mhz) and an ST232 RS232<->TTL level converter was constructed. One complication encountered was that the PLL was supplied from a 3. 3V DC power supply, when spying on the serial comms to the PLL this is not a problem as 3. 3V is enough voltage to register as a logic high on the tiny2313`s input pins (when the tiny2313 is supplied with 5v).

However, when driving the PLL, care must be taken to limit the voltage on the PLL input pins to 3. 3V or less, I did this by using pullups between the PLL input pins and the radio`s 3. 3V rail and by using the tiny2313`s outputs to pull the PLL input pins low when a logic 0 was required. Three different firmware programs were written, two which spy on the PLL serial control and dumps the data out an RS232 port for logging on a PC, and the other which receives commands from a PC on an RS232 port and then outputs those commands to the PLL.

The first firmware (which didn`t work as desired), sent different ASCII serial characters to the PC when a state change on an input was detected (c = clock low, C = clock high, s = strobe low, S = strobe high, 0 = data low, 1 = data high). It was however, sufficient for me to establish which bits control the PLL frequency and the NBIF RX portion of the PLL IC.

The second firmware polls the input pins for a state change, and when a state change is detected, the binary states of all these inputs are converted into an ASCII character which is stuffed into the serial transmit buffer. This ASCII character is from 0 to 7 inclusive, and is determined as follows: It appears that data is clocked into the PLL on the rising edge of the clock, and strobed into the register on the falling edge of the clock when strobe is high.

From this we can see that the radio is operating in a power saving mode when the squelch is closed - the PLL and NBIF RX is only powered up for about 1/10second every second. These commands were figured out by probing the radio`s circuitry with an oscilloscope, and comparing the commands to the sate of the radio.

Scanning is same command pattern as manual channel change. If manually changing channels with squelch closed, cmd: sleep will be sent to the PLL a short time after channel change if the squelch remains closed. Adjacent PRS channels are 25Khz apart, and from the above, the PLL divisor (frequency control data) varies by 8 between adjacent channels.

This tells me that the PLL reference is 3. 125Khz (25Khz/8). This also agrees with the presence of the 8Mhz PLL clock crystal (8MHz/2560 = 3. 125KHz). The difference between the PLL divisors for RX and TX on the same channel is 3376, which is equivalent to 10. 55 MHz (3376 * 3. 125KHz) - this agrees with the hardware as the 1st IF ceramic filter in the radio is marked 10. 5MHz. For example, PRS channel #1 is 476. 425MHz and 15