The Programming of MOTOROLA HC05, HC705, HC11 with the Polish Programmer

The programming of MOTOROLA HC05, HC705, HC11 with the polish programmer:

The files:

Motor05.exe is designed for HC05-B5,B16,C4 processors, conected to the pins nr.16, 17, trough a 4 MHz quartz cristal

Motor705.exe is designed for HC705B6 and B16(described more detailed than HC705),functionaly is valid in another type of conection

If the processor HC705 is secured the computer can’t read the data from it.

The program starts with a test option and with the finger you should touch the quartz rezonator until the program signals ; conection established.Sometimes this operation should be repeted until the conection is established.The deficency of this method is that the information contained by the EEPROM could get deterioreted.The original processors made by factory are never secured.

The files:

Motor11.exe is for HC11E1 with an 8 MHz quartz cristal conected to the pins nr. 7, 8

Motor411.exe is for HC11E1 processor with an 4MHz quartz crital and doesn’t need desoldering.

Motor11s.exe;Motor411s.exe are used if the programs that where mentioned above don’t work,usualy for older processors.

In the processor family HC11 there is the securing posibility(at the address 0100 H or $00 or, in the case of polish programmer the security bit should have the value od FF to be inactive)If the security bit is active ,is imposible to read the EEPROM.(no comunication with the PC)-this happens when the processor is in special test mode(pin nr 2 to the ground,pin nr. 3 at +5V)

If the processor is in “bootstrap mode”(pins 2 and 3 to the ground) trying to read the EEPROM will have as result the loss of its content,therefore is good, as comon practice, to have a spare one before you procede.

Using the programmer is simple, the operation could be selected by its corespondent key.

Options

The start of the editor E- HEX, serves to the modification of the EEPROM. The introduction of the new values means reprogramming the EEPROM.

The functioning is possible only in system O-OFFLINE The modification is made only in the computer’s memory. The actualisation of the EEPROM is made trough the option U.

G- reading and introduction of the data in the computer’s memory

H – ROM reading of the processor and writing in a file on HDD

P – programming, transcribing the information in the EEPROM’s buffer.

R – loading of a file from the HDD in the buffer

T – test for the communication with the processor

W – save the content of the EEPROM to a file on HDD

X – exit

The starting password is “darek”

A possible order for the actions could be:

T – verify the communication with the processor

G – red the internal EEPROM

E – 1-display on the screen the content of the EEPROM –proceed with the necessary

modifications(reset the timer if you don’t know the exact location for the timer do two consecutive reading after introducing the wrong code and see the location that suffers modifications)Editing is made ON LINE when presing key ESC. After the introduction of each location , this is transmitted to the processor.

E – 2 if the internal content is FF all over press key”ESC” to exit the editor , then ”R”

And load a spare dump with the extension “.eep”(the name of the file should be no more then 8 characters long).Press again “E” to verify if the dump is the correct one.

Press key “ESC” and finally “P” key.

For the internal EEPROM programming (on the display is seen the incrementation of the addresses), the data is verified by presing the “G” and “E” keys and exit with “X”.

Processor configuration:

The processor is connected to the PC trough 4 connections(RxD TxD RESET GROUND)To be able to read the HC05 processor is mandatory the introduction of a resistor .

The converting assembly: the system is powered from the computer’s RS point .

The system is based on MAX 232 (Atention! Not all are functioning corectly)

The lines Rxd Txd from the processor are conected to the TxD, RxD of the PC,

RESET to RTS(trough MAX 232)

The processor is configured as follows:(see the drawing in MOTOROLA documentation regarding HC05)

1.The line GND, pin 41 ,to the PC’s ground.

2.TxD ,pin 52,to RxD of the PC trough MAX

5.RxD, pin 50 ,to TxD of the PC trough MAX

7.RESET ,pin 18, to the RST of the PC trough MAX

9.IRQ, pin 19, trough 10k and the switch(?) +12V

11.PD4 ,pin 9, is wired to the ground

13.PD3, pin 11, trough a resistance 1k-2k2 to +5V

15.TCAP1, pin 22, trough a resistor 1k-2k2 to +5V(processor’s pin 10)

After system is configured it should be connected to the radio .If all the connections are valid the programmer should signal “active connection”. After connecting the converter verify the voltages on the introduced resistors (5V on pin 11,22,10;

10-11V for the pin 19; 4.5-5V reset impulses on pin 18; 4,5-5 V amplitude impulses for pins 50 and 52)

You could find that the above mentioned pins are sometimes linked direct to the ground and in this case the connections need breaking.

For HC705 connection the link is a little different ,pin 9 is connected to +5V ,not to the ground.

The HC11 connections is simple;

1.GND, pin 1,to the PC’s ground

2.pin 21,TxD, to PC’s RxD trough MAX

5.pin 20,RxD,to PC’s TxD trough MAX

6. pin17,RESET, to PC’s RST trough MAX

9.pin 2,MODB to GND

After system configuration conect the radio.If all the connections are valid the programmer should signal “active conection”The connecting conditions for the converter are similar to HC05.After EEPROM reading if all the values read FF it means that the processor is secured and it was erased.The codes for the radio are quiet simple.In most of the situation the code is in the folowing fields $01,$02.(CAR300,BP.BAVARIA RDS) at $00 the content should be FF which means -inactive security –the timer adress is :$0A-00= timer 0;01= inactiv code.

There are a few exceptions:

Grundig,Blaupunct,Bremen

Blaupunct SC202(with or whithout display)

Blaupunct Koln

Processor 68HC05B6 other marks ZC422193,ZC408800,ZC408963,ZC400803

The code field is at the adress :$18 digit 1 and 2

$19 digit 3 and 4

at the address $1A is the timer(the one that count haw many wrong codes you introduce):without mistake 01

0E:one mistake

04:two mistake

81:inactive code

To majority Grundig:Beta iv Grundig 4870RDS with 68HC11E9 processor,the code field is at the adress:$00;digit 1 and 2 , $03: digit 3 and 4.

Adress $06:the timer.Whithout mistake – 19

ATTENTION!!! In S01 field should be S00 EXOR #FF,in field S02 ,S00 EXOR #5A.

For example

S00;43 BC 19 27 D8 7D 19 E6 43 – 4327 is a corect code.

For calculating the first line of this processors use Grundig code calculator.

My E-mail: