Homepage
Crypto
Index
Glossary
Enigma
Hagelin
Fialka
Nema
Voice
Hand
OTP
EMU
Mixers
Phones
FILL
Codebooks
Algorithms
USA
USSR
UK
Germany
Yugoslavia
Ascom
AT&T
Bosch
Datotek
Gretag
HELL
ITT
Motorola
Mils
OMI
Philips
Racal
Siemens
STK
Tadiran
Telsy
Teltron
Transvertex
TST
Spy radio
Burst encoders
Intercept
Covert
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Click for homepage
Motorola SABER
Secure hand-held radio

The SABER series of portable radios was developed by Motorola in 1989. The radios were initially developed for the US Military and were noted for their long thin shape. The SABER later became popular with other users as well. Some SABER radios have built-in speech encryption (crypto). In some countries, SABER-variants were sold as rebatched products with different names, such as the European MX-1000 and the Stornophone 7000. Some of these had a different controller.

The image on the right shows the secure (crypto) version of the SABER II. It is slightly higher than the standard (non-secure) version, providing space for the crypto-module (below the speaker grill). It also has SECURENET printed on the top panel, just above the volume control.

On top of the unit is the volume control and the channel selector with 12 positions. It has 48 channels in 4 zones (or 120 channels in 10 zones). The unit has a built-in crypto module with is operated with a switch on the top panel, allowing clear (O) and secure (Ø) operation.
  
Motorola Saber II donated by Barry Wels [1]

There were three basic models, known as SABER I, SABER II and SABER III. Basically, they are all the same radio, but with more or less features. The SABER I has no controls at the front panel, but the SABER II and III have a display and some push-buttons, with the SABER III being the most complete one. In addition to the three buttons of the SABER II, it has a full telephone keypad. The features, functions and frequencies of all versions of the SABER are programmed with proprietary software from Motorola, known as the Radio Service Software (RSS).

Motorola Saber Portable Radios are no longer in production, but replacement parts are still available from some Motorola Dealers and from auction sites, such as Ebay. The Motorola Saber-series is also very popular among radio amateurs (HAMs), and many have been converted to HAM-radio frequencies [2]. Especially the secure versions of the radio are popular, as the extra space can be used to build-in, for example, an APRS module instead of the crypto module.

SABER 1 with battery and antenna, ready for use Motorola SABER II with battery Motorola Saber II Perspective top view Top view Pressing the PTT switch Operating the Motorola Saber II Motorola Saber Battery Charger
A
×
A
1 / 8
SABER 1 with battery and antenna, ready for use
A
2 / 8
Motorola SABER II with battery
A
3 / 8
Motorola Saber II
A
4 / 8
Perspective top view
A
5 / 8
Top view
A
6 / 8
Pressing the PTT switch
A
7 / 8
Operating the Motorola Saber II
A
8 / 8
Motorola Saber Battery Charger


 Programming a SABER
 Loading the crypto keys


Controls
The image below shows the controls of a SABER II hand-held radio. Please note that the controls differ between models and that some functions are optional. The most frequently used features are all located on the top panel of the radio. From right to left are the antenna socket, the channel selector, the volume control (combined with ON/OFF switch) and a 2-position switch that is used to select between secure and non-secure operation. On radios that are not crypto-capable, this switch may either be missing, or might be used to select between channel banks.

Controls of a SABER II hand-held radio

At the left side of the radio are a number of recessed buttons. At the top is the squelch button, which allows the squelch (noise cancellation) to be open for as long as the button is depressed. Keeping it depressed for more than 3 seconds, will permanently open the squelsh. In the middle is the (large) Push-To-Talk (PTT) switch. The radio transmits as long as this button is depressed. The radio can be programmed to send an identification at the start of a transmission.

Below the PTT are two small buttons for Repeater Access Tones (RAT). They can only be used if the radio has version 6D or later of the CORE firmware. On older versions of the CORE, such as the common 5D, they will not work. On early case variants the RAT buttons were omitted.

A few examples of the many different models, versions and options

Models
There are several series of SABER radios, that are compatible and interoperable to some extent. This page only deals with the SABER I, II and III (and the European MX-1000), but not with some of the later analogue and digital trunking systems. The latter are listed below in red.

Model Display Keypad Remark
SABER I 12 channels
SABER IE 24 channels (in 2 zones)
SABER II 3 keys 48 or 120 channels 1
SABER III 15 keys 2 120 channels
Systems SABER 3 Analogue trunking
Astro SABER 3 Digital (and trunking)

Note that the Systems SABER and the Astro SABER are backwards compatible with the SABER, as they can be programmed for 200+ analogue channels (using a different version of the RSS). They have the same casing as the SABER. Almost all accessories are interchangeable between SABER, MX-1000 and Systems SABER. Some accessories of the Astro SABER can be used as well, with the exception of antennas, microphones, programming cables and vehicle adapters.

  1. There are 2 versions of the SABER II: one with 2KB of memory (48 channels in 4 zones) and one with 8KB of memory (120 channels in 10 zones) and DTMF. The memory is located behind the front panel.
  2. The keyboard consists of 15 keys: the 3 keys of the SABER II plus 12 keys (not 16) for DTMF.
  3. Most of the accessories of the Systems SABER will work with the SABER, but some of the accessories of the Asto SABER are not compatible. Systems SABER and Astro SABER are not covered on this page.

Variants
Many different versions and variants of the SABER radio, have been made over the years, for a variety of frequency ranges. Used SABER held-helds are often found in surplus stores and on auction sites such as Ebay. As it is often difficult to tell which models you are dealing with, the description below can be used as a guide. Luckily, the frequency band and a number of features can be deduced from the FACTORY ID that is normally present on a label at the back.

Unfortunately, the FACTORY ID doesn't tell you which section of the frequency band (the split) is used. Furthermore, the FACTORY ID might be missing completely on rebatched versions of the radio, as many of them were given a different name by telecom operators in Europe. For example, a UHF MX-3000 was sold by the Dutch PTT as the Portavox 3165. The many different versions of the Motorola SABER are discussed in detail below.


First of all there are two different case sizes:

  • Non-secure - short case
    SABER radios that are not crypto-capable have a case that is slightly shorter that radio that do have this provision. Such radios can never be used for secure communication, and can not be modified for that. This version is shown on the left.

  • Secure - long case
    A slightly longer case is used for SABER radios that care crypto-capable. This doesn't means that a suitable crypto module is present though; the relevant slot might still be empty or contain a dummy. It just means that the radio has space for a crypto module. These radios are generally marked with the word SECURENET, or something similar on the top panel. The longer version is shown on the right in the image above.
Furthermore, there are two case variants that look identical:

  • Standard
    This is the standard (non-submersible) version of the SABER radio. Most radios found on the surplus market and on auction sites, such as Ebay, are of this type.

  • Submersible
    As a manufacturing option it was possible to order SABER radios that were submersable in water. Such radios had appropriate seals and rubber gaskets at all openings in the case, including the speaker grille. Generally, these variants have the word SUBMERSIBLE printed on the top panel. Externally, submersible radios are identical to the standard version.

There are three front panel variants of the SABER radio:

  • SABER I - No controls
    This is the most simple version of the SABER. It has no controls on the front panel and no display. The only two controls (the volume adjustment and the channel selector) are at the top of the radio. This version is suitable for 12 pre-programmed channels (or 15 after a modification). The SABER IE is a variant of the SABER I, which features 24 channels.

  • SABER II - Simple controls
    This is a more advanced version of the SABER I that is menu-driven and has some extra features and channels. The front panel contains a micro controller, memory, a small LCD display and 3 red push-buttons.

  • SABER III - Full controls
    This is the most complete version of the SABER. The case is identical to the two previous versions (above), but the front panel is different. It contains a micro controller, memory, a display and a 15-button keypad.
There are three band variants of the SABER radio:

  • MIDBAND - 66-88 MHz
    This band was used by many Police Agencies world-wide until the late 1990s. As the band is pretty close to the FM broadcast band, the MIDBAND has gradually been phased out. Radios in this band are of no use to radio HAMs, unless they can be converted to 51 MHz (6m) or the 4m band can be used (in some countries the 4m band can be used by HAMs).

  • VHF - 136-174 MHz
    For many years, public services, commercial services, government agencies and radio amateurs have been (and still are) using the 2m band. Please note that none of the radios cover the full frequency range, but only a section of it (see below). Some of these ranges are suitable for used by radio amateurs (HAMs).

  • UHF - 403-512 MHz
    Once the 2m band got exhausted, the 70cm band became a popular space for all kinds of services. Most of these frequencies are still in use today for analogue and/or digital voice and data. Although the 70cm amateur band is within this range (430-440 MHz, or even 430-450 MHz in some countries), there is no SABER that covers the entire range.
The following bandwidths are available (VHF only):

  • Narrow band
  • Wide band

 More about the FACTORY ID


SABER I
The SABER I is the simplest version of the SABER hand-held radio. That doesn't mean however, that it lacks the features of it 'big brothers', the SABER II and SABER III, it just misses the direct controls to these features. Channel programming, output power and feature selection are done when programming the radio, e.g. in a service center, using Motorola's proprietary RSS software.

The SABER I was available in two case variants: the standard version in the lower case, and the higher version that has room for a security module. The latter adds digital voice encryption to the SABER. The image on the right shows a typical SABER I without its large NiCd battery, and with a DES encryption module fitted.

Furthermore, the SABER I was available for a variety of frequencies, in MIDBAND (66-88 MHz), VHF (136-174 MHz) and UHF (403-512 MHz). Note that no radio covers the full frequency range, but just a limited range or band split.
  
The basic SABER I unit

A SABER I can hold up to 12 pre-programmed channels, each of which can be selected directly with the rotary channel selector on the top panel, to the left of the antenna mount. Each channel can be set up for split-frequency operation (repeater), hi/low power, CTCSS, etc., all under control of the RSS. Note that the MX-1000 (a European SABER-variant) has just 10 channels.

The basic SABER I unit SABER 1 with battery and antenna, ready for use Top panel of a crypto-capable SABER I Toggle switch set to SECURE Toggle switch set to non-secure (CLEAR) Switching to non-secure (CLEAR) Serial number label at the back of a crypto-capable SABER I Accessory socket at the rear
B
×
B
1 / 8
The basic SABER I unit
B
2 / 8
SABER 1 with battery and antenna, ready for use
B
3 / 8
Top panel of a crypto-capable SABER I
B
4 / 8
Toggle switch set to SECURE
B
5 / 8
Toggle switch set to non-secure (CLEAR)
B
6 / 8
Switching to non-secure (CLEAR)
B
7 / 8
Serial number label at the back of a crypto-capable SABER I
B
8 / 8
Accessory socket at the rear

SABER IE
The SABER IE is actually an enhanced version of the SABER I. The front panel is identical, but the radio is equipped with 24 channels rather than just 12, divided over 2 banks (zones). The toggle switch to the left of the volume control is used to select between the two zones.

On secure versions of the SABER I (i.e. the crypto-capable variant), this switch is used to select between secure (Ø) and non-secure (O). For that reason, the SABER IE is only available in the non-secure version (i.e. the lower case variant). The only way to tell the difference is by checking the presence of the bank switch or by decoding the FACTORY ID (when present).

The image on the right shows a Dutch MX-1000 with 20 channels (two banks of 10 channels each). Note that the knob of the zone switch is missing from the radio shown here.

  
SABER 1E (international MX-1000). The knob of the toggle switch is missing here.

SABER II
The SABER II can been regarded as a SABER I with a simple User Interface (UI), consisting of a single-line LCD display and three orange buttons. The case is similar to the case of the SABER I, but has a different front panel, behind which an extra microcontroller with memory is located.

Like the SABER I, the SABER II was available in secure and non-secure versions, and in the same frequency variants (MB, VHF and UHF). Switching between secure (Ø) and non-secure (O) operation is done with the small toggle switch to the left of the volume control.

The extra microcontroller is used for the User Interface, whilst the memory is used to store the channels with their corresponding features. Early versions of the radio had 2KB of RAM, allowing 48 channels to be used in 4 zones. Later models had 8KB, allowing 120 channels in 10 zones.
  
A SABER II programmed for the 2m HAM radio band

The image above shows a typical SABER II that has been programmed for the 2 meter amateur radio band, covering 144-146 MHz (USA: 144-148 MHz). In the example above, the zone has been named 145, whilst the channel name is 250. This effectively shows the frequency on which it is used (145.250 MHz). The three orange buttons are used for a simple cyclic user interface:

  • MENU - Select between ZONE, LOCK, PL, SCAN, SCANLIST and channel display
  • SELECT - Alter the currently selected item in each menu
  • ENTER - Activate a selected item
PL is Motorola's variant of CTCSS, called Private LineTM. All other features, such as split-frequency operation (repeater), output power, secure voice, etc., can be programmed on a per-channel basis, using Motorola's proprietary RSS software. The SABER II can be seen as a cut-down version of the SABER III (see below). Although the telephone keypad is missing from the front panel, the actual switches are present on the orange foil behind the plastic front.

A SABER II programmed for the 2m HAM radio band Close-up of the display Selecting the MENU (here the ZONE menu is selected) Selecting the appropriate channel ZONE Selecting the appropriate CTCSS tone Pressing the PTT switch Keyboard and display Interior of the Motorola Saber II
C
×
C
1 / 8
A SABER II programmed for the 2m HAM radio band
C
2 / 8
Close-up of the display
C
3 / 8
Selecting the MENU (here the ZONE menu is selected)
C
4 / 8
Selecting the appropriate channel ZONE
C
5 / 8
Selecting the appropriate CTCSS tone
C
6 / 8
Pressing the PTT switch
C
7 / 8
Keyboard and display
C
8 / 8
Interior of the Motorola Saber II

SABER III
The SABER III is effectively an enhanced version of the SABER II. The display is identical, but the keyboard has been extended with 12 additional buttons, adding a standard telephone keypad to the radio (0-9 plus * and #). This way the radio can be used for auto-patch and DTMF tones.

Like the enhanced version of the SABER II, this radio has room for 120 channels, organized as 10 banks (zones) of 12 channels each. The channels and their features can be programmed on a per-channel basis or per-radio basis, using Motorola's proprietary Radio Service Software.

Note that only 12 keys are available for DTMF, rather than the usual 16. The 4th column (i.e. 1633 Hz), normally used for the ABCD-keys, is missing. If these additional tones are required, an external DTMF encoder (e.g. combined with an external microphone, should be used instead.
  
Motorola SABER III radio (VHF version)

The SABER III was typically used in situations where the radio had to be able to be connected (patched) to the regular telephone network. Pressing the keys would produce the corresponding DTMF tones. The image above shows a VHF crypto-capable version of the SABER III.

Motorola SABER III radio (VHF version) Motorola SABER III Bare SABER III unit Controls at the top Top view of the SABER III Complete SABER III with battery and antenna Rear view of the SABER III Close-up of the ID tag
D
×
D
1 / 8
Motorola SABER III radio (VHF version)
D
2 / 8
Motorola SABER III
D
3 / 8
Bare SABER III unit
D
4 / 8
Controls at the top
D
5 / 8
Top view of the SABER III
D
6 / 8
Complete SABER III with battery and antenna
D
7 / 8
Rear view of the SABER III
D
8 / 8
Close-up of the ID tag

MX-1000, 2000 and 3000
The MX-1000 series was a European two-way radio that was also produced by Motorola. It was based on the SABER design, albeit with a different set of features and driven by a different controller. The channel selector, for example, had only 10 positions, whereas the channel selector on a SABER had 12 positions. As a result, the MX-1000 series can not be programmed with the same Radio Service Software (RSS), but only with a proprietary version of the RSS.

Like the SABER, the MX-1000 series consisted of three basic models, with the MX-1000 being related to the SABER I, the MX-2000 to the SABER II and the MX-3000 to the SABER III. The MX-1000 was available in most design variants, including VHF, UHF, submersible and high/low power. There was also a secure variant that worked with all of the SABER crypto modules except for the OTAR/Multikey and FASCINATOR modules; these were restricted to the Systems SABER.

The MX-1000 was sold in some European countries, including Germany, Denmark, Norway, Sweden, Finland and The Netherlands. It was either (re)batched with the name of the national telecom operator (e.g. PTT Telecom in The Netherlands) or under the brand name of Storno, at the time a well-known Danish radio manufacturer. Since 1986, Storno is a Motorola subsidary [7].


CTCSS or PL
Different techniques have been developed to prevent the squelch of a receiver from opening on weak unwanted signals, as is often the case with repeaters. An example of such a technique is CTCSS: Continuous Tone-Coded Squelch System. Motorola calls it PL or Private LineTM. It is implemented in the SABER radios and can be programmed globally or on a per channel basis, using Motorola's RSS [4]. On many (amateur) repeaters, CTCSS is mandatory these days.

Please note that CTCSS can not be used in combination with voice encryption. As a result it might not be possible to send encrypted signals via a repeater [4]. The only ways to overcome this, is to turn off the repeater's CTCSS (not needed for encrypted signals anyway), or to use an intelligent repeater, such as the Motorola MSF5000TM, which can be loaded with the same encryption key. Such repeaters can generally pass both types of traffic: encrypted and unencrypted (using CTCSS).


Squelch
SABER radios do not have a noise suppression (squelch) control similar to the volume adjustment. Instead, the squelch is set in software when programming the radio, using the RSS. In order to prevent the squelch from closing on weak signals, the push-button at the side of the radio, just above the PTT, can be used to open the squelch manually. Holding this button for 3 seconds, opens the squelch permanently. Press the button once more to close it again.

Note that some radios are programmed for CTCSS or a 5-tone sequence. The squelch of such radios will only open when the appropriate CTCSS tone, or the appropriate 5-tone sequence, is received. The latter is commonly called a tone-lock, or selective tone call (selcall).


Programming
As SABER radios have a set of pre-determined frequencies (channels) on which they operate, they need to be programmed prior to use, using dedicated software. This is not an easy task, that needs the following prerequisites:

  • Programming cable
    A special interface cable is needed for virtually every type of radio ever made by Motorola. Such cables have a special motorola accessory plug at one end and a 25-way D-type (parallel) connector at the other end, suitable for connection to the RIB (see below).

  • Radio Interface Box (RIB) RLN4008
    A small interface box is needed between the radio (programming cable) and the PC. It converts the 2-wire serial data and levels into bi-directional data stream, suitable for connection to the COM port of a PC. Most RIBs are suitable for nearly all Motorola radios.

  • Radio Service Software (RSS)
    For each different radio, Motorola developed a dedicated RSS that can not be used on other radios. Please note that the MX-1000 (a European derivative of the SABER) requires a different version of the RSS. The RSS is no longer available from Motorola, but copyright restrictions prevent it from being distributed freely. All we can suggest is to do a Google search. Please do not ask us for a copy of this software.

  • Old 386 PC with DOS
    This is probably the most difficult-to-find part. As the RSS software was written many years ago (when Windows and faster processors were not yet available), the software uses built-in timing loops that are processor speed-dependent. As a result the RSS can only be used on an old PC with a 386 processor that runs no faster than 50MHz and has no cache (or that has it cache disabled). Any attempt to use a faster PC will break your radio.

 More about programming


Key loading
Apart from programming frequencies and other features into the SABER, the crypto-capable variants (Securenet) also need to be loaded with a valid cryptographic key before secure (voice) communication is possible. This is done by using a so-called Key Variable Loader or KVL.

KVLs are also known as Key Fillers or Fill Guns. Initially, Motorola had a separate key filler for each individual encryption algorithm, such as the T3010 (DVP), T3014 (DVP-XL), T3020 (DES), T3011 (DES-XL) and T3012 (DVI).

Later these KVLs were discontinued and replaced by the KVL-3000 shown in the image on the right. It supports all known algorithms and is suitable for the Astro 25 Saber as well.

 More about loading keys into the SABER
 More about the KVL-3000

  
Operating the KVL-3000

Zeroizing
If security is compromised — in the case of a crypto-enabled version of the SABER — it may be necessary to purge all cryptographic keys stored inside the device quickly. This procedure of deleting the key material is commonly known as zeroizing. With the SABER, zeroizing is done by removing the battery from a switched-on device. Once the device is zeroized, it can no longer be used in secure mode, until a new key has been loaded by means of a Key Variable Loader.

Note that the above proceduce may cause problems when swapping the battery. If the battery is nearly empty, switch off the device before removing the battery. This is the only way to retain the cryptographic keys that are stored inside the device. After fitting a fresh battery, turn the device ON again and resume operation.


Accessories
As the SABER was a professional radio, used by many different agencies, public services and commercial users, a wide range of accessories was available [6]. Most of these accessories were sold directly by Motorola, but a wealth of add-ons and reproduction parts were available from a variety of other companies as well. Although it is beyond the scope of this page to describe every single accessory ever made for the SABER, the most important ones are highlighted below.

Various battery types for the Motorola SABER Battery charger Microphone/speaker Convert surveillance kits Various antennas Carrying cases and pouches Belt clip
Batteries
Many different batteries have been produced for the SABER series over the years. As the high-power version of the SABER can produce an output power as high as 6W, high-capacity batteries are needed. There were three battery sizes, but the most common ones are the standard battery (84 mm) and an ultra-high capacity variant, that is somewhat higher (103 mm).

Either type can be charged with a dedicated Motorola SABER battery charger, such as the one shown below. Such chargers typically status of the battery and will indicate a faulty one. The recommended Motorola batteries are shown in the table below [6]. Good alternatives were available from other manufacturers as well.

The image on the right shows a typcial high-capacity Motorola NiCd battery, aside a SABER I hand-held radio. When carrying the radio on the belt in a carrying case or holster, ensure that the case is suitable for the higher batteries.
  
Antenna, SABER I and high-capacity battery

As the SABER radios were produced many years ago, their batteries are likely to be worn-out out by now, resulting in shorter usage times or completely dead batteries. In such cases it might be wise to replace the batteries with modern alternatives. Good replacement batteries, using Li-ION technology, are available from various sources and even from auction sites, such as Ebay.

Part No Voltage Capacity Type Remark
NTN4537 7.5V 700 mAh NiCd Light capacity
NTN4592 7.5V 700 mAh NiCd Light capacity
NTN4538 7.5V 1000 mAh NiCd Medium capacity
NTN4593 7.5V 1100 mAh NiCd Medium capacity
NTN4595 7.5V 1800 mAh NiCd Ultra-high capacity
NTN4596 7.5V 1800 mAh NiCd Ultra-high capacity
NTN4992 7.5V 1800 mAh NiCd Ultra-high capacity
NTN7014 7.5V 950 mAh NiMH Light capacity
NTN7426 7.5V 950 mAh NiMH Intrinsically safe
NTN7058 7.5V 1800 mAh NiMH Ruggedized
NTN4905 7.5V ? Li Disposable, not rechargeable

 
Battery charger
A wide range of battery chargers was available for the SABER, ranging from single slow-charging units, to super fast chargers that can take up to six radios simultaneously. The image on the right shows the most common fast charger for a single SABER hand-held radio.

The complete radio (with battery) can be placed directly in the charger, but it is also possible to charge individual batteries separately this way. A set of back-lit icons on the sloped panel at the right shows the charging status.
  
Fast charger for Motorola SABER

Fast charger for Motorola SABER Fast charger with SABER I Close-up of a SABER hand-held radio in a Motorola fast charger Charging single batteries
E
×
E
1 / 4
Fast charger for Motorola SABER
E
2 / 4
Fast charger with SABER I
E
3 / 4
Close-up of a SABER hand-held radio in a Motorola fast charger
E
4 / 4
Charging single batteries

Microphone
When used as a hand-held radio, the built-in microphone and speaker of the SABER, located at the front panel, are used. When the radio is carried on the belt however, it is often more convenient to use an external speaker/mike with it, such as the one shown below.

External microphones can be connected to the accessory socket at the rear of the radio, near the antenna socket. The image on the right shows a typical Motorola speaker/microphone that was commonly used with SABER radios.

The microphone has an adjustable spring-loaded clip at the back, allowing it to be attached to the clothing of the operator. At the other end of the curly cord is the plug that connects it to the accessory socket of the radio. It usually fits around the corner of the radio and is held in place by a single hex safety bolt.
  
External speaker/mike for the SABER

Fitting the microphone to the radio sometimes requires special tools, such as a special bit for the hex safety bolt. On other versions, the plug is held in place by a simple cross-head screw. The microphone shown in the image has its cord coming out of the plug under a 45 degree angle.

Furthermore, it has a large connector that is fitted around the corner of the radio to provide extra strength. Most other models however, have a straight cable entry and a somewhat simpler connector that is fitted only at the back.

The accessory socket also carries the antenna signal, allowing the use of microphones with an helical antenna mounted on top of it. Such microphones are commonly called Public Safety Microphones. The image on the right shows an example. Because of the size of the antenna, these models are only practicle for use on UHF.
  
Motorola public safety microphone with UHF antenna

Public Safety Microphones were often used in cities with large buildings, as the extra height of the antenna (usually on the shoulder, whilst the radio was carried at the belt) expands the operational range. Public Safety Microphones always have a straight cable rather than a curly one.

External speaker/mike for the SABER Close-up of the external microphone Adjustable clip at the rear of the external microphone Accessory socket at the rear Fitting the external microphone Fixing the external microphone, using a security hex tool Hex safety bit Saber I with external microphone
Two SABER I UHF radios side by side. The one on the right has a Public Safety Microphone UHF Motorola SABER I with Public Safety Microphone Motorola public safety microphone with UHF antenna Operating the PTT on a Public Safety Microphone Operating the PTT Small switch on top of the microphone (volume)
F
×
F
1 / 14
External speaker/mike for the SABER
F
2 / 14
Close-up of the external microphone
F
3 / 14
Adjustable clip at the rear of the external microphone
F
4 / 14
Accessory socket at the rear
F
5 / 14
Fitting the external microphone
F
6 / 14
Fixing the external microphone, using a security hex tool
F
7 / 14
Hex safety bit
F
8 / 14
Saber I with external microphone
F
9 / 14
Two SABER I UHF radios side by side. The one on the right has a Public Safety Microphone
F
10 / 14
UHF Motorola SABER I with Public Safety Microphone
F
11 / 14
Motorola public safety microphone with UHF antenna
F
12 / 14
Operating the PTT on a Public Safety Microphone
F
13 / 14
Operating the PTT
F
14 / 14
Small switch on top of the microphone (volume)

Surveillance Kits
Especially for surveillance and inconspicious operation, Motorola had a range of surveillance kits available, ranging from skin-coloured acoustic ear tubes and hidden PTT switches, to invisible inductive earpieces. Similar surveillance kits were available from other manufacturers as well.

Most surveillance kits make use of a so-called quick-disconnect 6-pin Hirose plug, requiring a special adapter on the SABER radio. Using such a standardized connector allows the surveillance kits to be used on a variety of radios, and allows them to be disconnected quickly without the need to remove the universal connector at the back of the SABER each time (e.g. for keyload).

The image on the right shows a Motorola ZMN-6031 surveillance kit with three wires, consisting of an earphone, a minature microphone and a so-called bullet-type Push-To-Talk switch (PTT).
  
ZMN6031 surveillance kit

Other surveillance kits are available with two wires (combined microphone and PTT) and one wire (receive only). In addition, there are variants with a higher audio output level. These surveillance kits all have a 6-pin Hirose connector, allowing them to be quickly connected to the SABER with a Hirose adapter. Please note that there are different versions of this adapter. If the radio is crypto-capable, the NTN5664 adapter is needed, as it is the only one that supports keyloading.

The adapter can be installed permanently on the SABER radio whilst a sturdy plastic enforcement ring, mounted to the antenna base, prevents the connector breaking off. When mounted to the SABER, a 6-pin Hirose socket is available on the top of the adapter, close to the SABER's antenna base. Please note that the NTN5664 (i.e. the keyload capable version) has the limitation that it can only be used with low volume accessories such as a surveillance kit. Tuning the volume up too high when using a standard microphone/speaker combination, will cause a cracking sound, whilst the radio switches intermittently into keyload mode. Hirose connections can be found here.

Hirose Adapters

Part No Audio Key fill Remark
NTN5598 -
NTN5213 -
NTN5664 With key loading capability

Surveillance kits

Part No HA 1 Mic PTT 2 Ear Wires Remark
ZMN6031 3 -
ZMN6032 2 -
ZMN6038 2 Extra loud version of ZMN6032
ZMN6039 3 Extra loud version of ZMN6031
NSN6050 1 Earpiece only

  1. Requires a Hirose adapter
  2. Separate PTT switch (i.e. not combined with microphone).

Hirose Adapter with Key-load capability Keyloader cable and SABER Hirose Adapter (NTN5664) Hirose adapter connected to the SABER KVL-3000 connected to a SABER radio ZMN6031 surveillance kit Earpiece Miniature microphone Hand-held bullet-type PTT switch
G
×
G
1 / 8
Hirose Adapter with Key-load capability
G
2 / 8
Keyloader cable and SABER Hirose Adapter (NTN5664)
G
3 / 8
Hirose adapter connected to the SABER
G
4 / 8
KVL-3000 connected to a SABER radio
G
5 / 8
ZMN6031 surveillance kit
G
6 / 8
Earpiece
G
7 / 8
Miniature microphone
G
8 / 8
Hand-held bullet-type PTT switch

Antenna
SABER hand-held radios are commonly used in combination with short helical-type antennas. Depending on the frequency band and section (split) on which the radio is used, a different type of antenna is required. Older rubber-encapsulated original Motorola antennas were usually marked with a coloured dot at the bottom of the screw at the base of the antenna (see below).

The image on the right shows a typical original Motorola VHF antenna, which has a yellow dot at the tip of the screw, indentifying its frequency range from 136 to 151 MHz. For other band sections, use the table below as a guide [2].

Please note that a helical antenna is always a compromise. In an ideal situation, the antenna length should be a quarter of the wavelength, often indicated as ¼λ. As the wavelength of a 150 MHz signal is 2 meters, a ¼λ antenna would be 50 cm, which would not be very practicle. In such situations, the shorter helical was used.
  
Different antenna types and models

A helical is in fact a ¼λ antenna which is wound-up, like a coil, and is far from ideal compared to a full ¼λ antenna. The antenna is shorter than the original one and can be seen as a compromize, resulting in a reduced operational range. The range is further reduced by the fact that in most situations the antenna is carried close to the human body (e.g. on a belt).

The range can be improved by using a full ¼λ antenna, such as the UHF whip antenna (see the table below). By making the antenna thicker, Motorola has managed to cover the entire UHF band from 403 to 512 MHz with a single antenna. Alternatively, the operational range could be extended by using a so-called Public Safety Microphone with a helical mounted on top. Due to the size of the antenna, this was only practicle for UHF radios. Please note that the antennas listed here can not be used on the Public Safety Microphone, as it has a different fitting.

Colour Section Remark
Yellow 136-151 MHz VHF
Black 146-162 MHz VHF
Blue 157-174 MHz VHF
Red 403-435 MHz UHF
Green 435-470 MHz UHF
Black 470-512 MHz UHF (shorter than the black VHF antenna)

According to the SABER spare parts catalogue [6], the following antennas could be ordered:

Part No Section Remark
8505477T02 74-88 MHz MIDBAND helical
8505816K22 136-150.8 MHz VHF helical, was 8505816K01
8505816K21 146-162 MHz VHF helical, was 8505816K03
8505816K23 157-174 MHz VHF helical, was 8505816K05
8505816K24 403-433 MHz UHF helical, was 8505816K07
8505816K25 440-470 MHz UHF helical, was 8505816K08
8505816K26 460-512 MHz UHF helical, was 8505816K09
8505247K04 403-512 MHz UHF whip, full range
NAE6440B 403-520 MHz UHF whip, full range

 
Typical original Motorola VHF helical antenna Yellow dot on the screw of the antenna, indicating the VHF band (136-151 MHz) Close-up of the Motorola logo on an original helical antenna Different antenna types and models SABER I radio with UHF whip antenna
H
×
H
1 / 5
Typical original Motorola VHF helical antenna
H
2 / 5
Yellow dot on the screw of the antenna, indicating the VHF band (136-151 MHz)
H
3 / 5
Close-up of the Motorola logo on an original helical antenna
H
4 / 5
Different antenna types and models
H
5 / 5
SABER I radio with UHF whip antenna

Carrying case
A variety of carrying cases was available for the SABER series, allowing the radio to be carried on the belt. The image on the right shows a typical original Motorola leather carrying case, with the optional T-Strap to hold the radio in place [6].

Note that not all carrying cases can cope with the large (corner) plug of some external microphones, as the side of the case might be in the way. Special versions, with a lower cut-out, were available for such microphones.
  
Original Motorola leather carrying case for SABER

Original Motorola leather carrying case for SABER Rear of the straight leather carrying case Leather carrying case for the SABER hand-held radio Rear view of an enforced leather carrying case, with separate T-Strap Fitting a SABER in a leather carrying case Close-up of SABER in a leather carrying case, with the T-Strap in place. large microphone plug, requiring a low cut-out of the carrying case SABER I with microphone in leather carrying case
I
×
I
1 / 8
Original Motorola leather carrying case for SABER
I
2 / 8
Rear of the straight leather carrying case
I
3 / 8
Leather carrying case for the SABER hand-held radio
I
4 / 8
Rear view of an enforced leather carrying case, with separate T-Strap
I
5 / 8
Fitting a SABER in a leather carrying case
I
6 / 8
Close-up of SABER in a leather carrying case, with the T-Strap in place.
I
7 / 8
large microphone plug, requiring a low cut-out of the carrying case
I
8 / 8
SABER I with microphone in leather carrying case

Belt clip
Rather than using a heavy duty leather or nylon carrying case, such as the one illustrated above, it was also possible to carry the SABER radio on the belt, using a special Motorola belt clip. As the radio comes in two different case sizes, two different belt clips were available from Motorola.

The belt clip is a rather simple metal bracket that can be attached to the rear size of the radio. One side hooks into a rig at the top of the radio, whilst the other end 'clicks' into a cut-out at the bottom of the radio, close to the battery fitting.

The belt clip can be removed again, by putting a screwdriver into a small rectangular hole in the battery fitting, and pushing the clip out. The image on the right shows two different belt clips; one for each case variant.
  
Belt clips (the one on he left is the longer one)

Belt clips (the one on he left is the longer one) Belt clips, rear view Positioning the belt clip Hooking the belt clip in at the top Lining the clip up at the bottom side Pressing it firmly to lock it Belt clip fitted in place Unlocking the belt clip
J
×
J
1 / 8
Belt clips (the one on he left is the longer one)
J
2 / 8
Belt clips, rear view
J
3 / 8
Positioning the belt clip
J
4 / 8
Hooking the belt clip in at the top
J
5 / 8
Lining the clip up at the bottom side
J
6 / 8
Pressing it firmly to lock it
J
7 / 8
Belt clip fitted in place
J
8 / 8
Unlocking the belt clip

Factory ID
As the exterior of all SABER radios are more or less identical, it is often difficult to determine the exact type of radio. In most cases it is possible to establish the model (not the exact frequency range) fom the FACTORY ID (not the MODEL NO) that is present on a label at the back of the radio. This ID consists of 12 characters. For example, the ID of a VHF crypto-capable SABER I is:


Each character or group of characters describes a specific feature of the radio. Use the table below to 'decode' the FACTORY ID of your radio. Although it is possible to determine the frequency band this way (VHF, UHF), it is not possible to identify the band section installed in the radio. The only way to do that, is by examining the numbers on the individual modules inside the radio, or by connecting the radio to a PC and reading it out with Motorola's special RSS software.

On some radios, the FACTORY ID is not present. In such cases the MODEL NR is often used instead. It might, however, be preceeded by two additional letters, e.g. MD. This is often the case with international version of the Motorola SABER. For example, we found an international low power UHF submersible SABER I, with the following MODEL NR on the label at the back:




Product type
H
Handheld
Z
Special product

  

Output power
3
Low - 1 or 2.5W (VHF), 1 or 2W (UHF)
4
High - 1 or 6W (MB), 2 or 6W (VHF), 2 or 5W (UHF)

  

Frequency band
2
MB: 68-88 MHz
3
VHF: 136-174 MHz
4
UHF: 403-512 MHz

  

Case variant
SA
Standard, non-secure (clear)
YB
Submersible, non-secure
QX
Standard, secure (crypto-capable)
YX
Submersible, secure

  

Features
N
Standard, one channel zone, no keypad, SABER I
G
Two channel zones, no keypad, SABER IE
J
Display, three red buttons, menu, SABER II
K
Display, full keyboard, menu, DTMF, SABER III

  

Firmware
7
Binary CORE (US)
9
Tone CORE (international)

  

Bandwidth (VHF only)
1
Wide band
5
Narrow band - 12.5 kHz

  

Channel selector
0
10 channels (international)
3
12 channels (US)

  

Unknown parameter
9
?

  

Revision
A
Original revision
C
Scan capable version 1

  
  1. A SABER I radio is not capable of using the SCAN feature, even if it is a C-revision, simply because there are no buttons to control it.

Package
-
(blank) Warranty replacement radio, bare radio
N
Complete package, with antenna and battery

  


Frequency ranges
There are many types/versions of SABER, each with their own specific frequency band and range (also known as frequency split). Only the band can be determined from the model number at the back of the radio; the specific band section (i.e. the split) can only be determined by examining the numbers on the internal modules. The following frequency bands/sections are known:

Band Section Remark
MB 66-84 MHz  
MB 74-88 MHz  
VHF 136-150.8 MHz Government split. Ideal for HAM, MARC and CAP
VHF 146-162 MHz Suitable for HAM (144-148) with modified RSS
VHF 146-174 MHz Wideband version, suitable for HAM
VHF 148-174 MHz Wideband used in lower power version
VHF 157-174 MHz Public and commercial services
UHF 403-433 MHz Government split. Suitable for EU HAMs (430-438).
UHF 440-470 MHz Suitable for all HAMs (431-450)
UHF 458-490 MHz  
UHF 482-512 MHz  

 
Opening the case
A SABER radio can easily be opened, by removing the battery and then loosening (not removing) two large safety nuts in the battery fitting. Do not remove the other cross-head bolts. Ensure that the cover over the accessory socket (at the rear, near the antenna) has been removed. The interior can now be taken out of the case, simply by pulling the antenna (recommended by Motorola).

The interior is shielded at both sides. The shield at the rear is held in place by 4 bolts that can be removed in order to reveal the component side of the main PCB. The shield at the front side holds the speaker and the microphone. It can be removed by lifting the panel with a screwdriver.

Be careful not to damage the flex wiring of the front panel when removing it. The flex connects to the main board by means of a small connector that is fitted in the bottom corner of the radio. Pull carefully to remove it. SABER II and III units have an extra flex cable for the control panel.
  
Separating the speaker from the radio

All modules can be accessed from the front side of the radio (i.e. the side that is visible in the image above). They are all socketed and can be removed easily, making the SABER into a service-friendly radio. Some modules are bolted to the main PCB at the bottom. The diagram below shows the location of each of the modules of a crypto-capable SABER, seen from the front.


The crypto module is not present in the non-secure version of the SABER. It can be removed by inserting a small screwdriver at either side and carefully wiggeling it until it comes out. The synthesizer can be pushed put of its socket by inserting a push tool or a screwdriver into two holes in the main PCB (bottom). The Power Amplifier (PA) is bolted to the side frame (2 bolts) and to the main PCB (1 bolt). It needs the frame of the radio for sufficient cooling when transmitting.

The FDS (short for Filter, Detector and Switch) is the antenna relay. It is fitted to the receiver with a single bolt. The receiver is connected to the main PCB by means of just 3 contact pins at the bottom, and can be removed easily, by removing two bolts (bottom). The receiver consists of two parts that are mounted together: the actual receiver and a 5-pole filter. Finally, the reference oscillator can be pulled from its socket, leaving the radio empty. All modules are listed below.

Loosening the safety nuts in the battery fitting Removing the metal shield Removing the shield holding the speaker and the mike Separating the speaker from the radio Socket for the speaker/microphone flex cable Main board component side Modules inside a non-secure SABER Modules inside a crypto-capable SABER
Removing the accessory socket cover Removing the crypto module Removing the PA Pushing the synthesizer out of its socket Removing the synthesizer Receiver removed from the radio Close-up of the receiver (bottom view) All modules removed from the case
Removing the PA Removing the PA Removing the PA Removed PA PA module Removing the DFS Removed FDS Looking inside the FDS
K
×
K
1 / 24
Loosening the safety nuts in the battery fitting
K
2 / 24
Removing the metal shield
K
3 / 24
Removing the shield holding the speaker and the mike
K
4 / 24
Separating the speaker from the radio
K
5 / 24
Socket for the speaker/microphone flex cable
K
6 / 24
Main board component side
K
7 / 24
Modules inside a non-secure SABER
K
8 / 24
Modules inside a crypto-capable SABER
K
9 / 24
Removing the accessory socket cover
K
10 / 24
Removing the crypto module
K
11 / 24
Removing the PA
K
12 / 24
Pushing the synthesizer out of its socket
K
13 / 24
Removing the synthesizer
K
14 / 24
Receiver removed from the radio
K
15 / 24
Close-up of the receiver (bottom view)
K
16 / 24
All modules removed from the case
K
17 / 24
Removing the PA
K
18 / 24
Removing the PA
K
19 / 24
Removing the PA
K
20 / 24
Removed PA
K
21 / 24
PA module
K
22 / 24
Removing the DFS
K
23 / 24
Removed FDS
K
24 / 24
Looking inside the FDS

Secure operation
The radio is extremely well built with only first class components. At the front is the keyboard and the LCD screen (if present). At the bottom is the main PCB with 7 purpose-built chips clearly visible. The PCB is also the carrier for a number of modules on the inside of the radio.

The keyboard at the front can be lifted and folded away, so that the interior is revealed. At the bottom of the unit, the crypto module is clearly visible. A variety of different crypto modules was available from Motorola, including DES, DVP, DES-XL, DVP-XL and DVI-XL.

All crypto modules had the same physical size. Depending on the customer's needs, export restrictions, etc., a different module would be supplied. The module shown here is the NTN5836A, which is probably a Smartnet DVI-XL variant (Digital Voice International).
  
The crypto module inside the Motorola Saber II

Motorola had a wide range of cryptographic modules available, for a variety of secure networks, including Smartnet, Multikey and OTAR (Over The Air Rekeying). For each network type, different cryptographic algorithms were available, including DES (Digital Encryption Standard), DVP (Digital Voice Protection) and DVI (Digital Voice International) [2].

There even was a CCI-version (Controlled Cryptographic Item) that supported the NSA-developed FASCINATOR encryption module. The latter was based on 12 kbit/s CVSD modulation which was encrypted with SAVILLE, an NSA Type 1 encryption algorithm based on the KY-57 Vinson [3].

Keyboard and display PCB inside the Motorola Saber II Interior of the Motorola Saber II The crypto module inside the Motorola Saber II Crypto-module Pressing a key Crypto-module Crypto-module
L
×
L
1 / 8
Keyboard and display
L
2 / 8
PCB inside the Motorola Saber II
L
3 / 8
Interior of the Motorola Saber II
L
4 / 8
The crypto module inside the Motorola Saber II
L
5 / 8
Crypto-module
L
6 / 8
Pressing a key
L
7 / 8
Crypto-module
L
8 / 8
Crypto-module

Crypto modules
Secure capable versions of the Saber (Securenet) are slightly longer than non-secure variants. The extra space is used to accomodate a crypto plug-in module. A variety of modules was available, for different networks and for different crypto algorithms, such as DES, DES-XL, DVP and DVP-XL.

Although all modules are pin compatible, certain modules (such as FASCINATOR) can only be used in authorised radios (US non-export versions). Crypto-capable radios without a crypto module, must have an NTN4720 dummy installed.

All crypto modules have the same form factor and are encapsulated in a metal can (or in a plastic can with metal paint). The image on the right shows the NTN5836 DVI-XL crypto module that came with our SABER II [1]. Don't let the (small) size fool you; encryption modules like this are really complicated electronic circuits.
  
NTN5836A crypto module for Motorola SABER

At the bottom of the module are two rows of pins that are lined up with two rows of holes (sockets) on the main PCB. They carry the necessary voltages, audio signals and (digital) control signals for secure operation. Theoretically, the socket for the crypto module can also be used for other extensions to the radio, such as a customized selective tone call system, or the man-down module shown in the next section below. Note that such a module may not need all contact pins.

The metal can of the module (shield) is soldered to pin 12 and 19 of the socket. After unsoldering these two contact lips, the interior of the module can be removed from the can. The image on the right shows the interior of the DVI-XL module.

The crypto module consists of a square flex PCB with all components on one side. The flex is then folded three times, so that we effectively get 4 sides that carry components. Both ends of the flex are integrated with the plastic connector at the bottom, that consists of two halves. It can be separated in order to unfold the flex PCB.
  
Four sides with components

The crypto module was designed with convenience in mind. Although it would technically be possible to repair a faultly module, it seems unlikely that this was ever done. Unfolding the flex PCB can easily lead to broken tracks. In practice, a broken module would simply be replaced by a new one. The image above shows the flex PCB partly unfolded. On the flex PCB are 6 custom chips, two crystals and several other components. The drawing below shows how the contact pins are ordered, looking into the sockets of the radio. Two large holes (A and B) are used as guides. Pins 12 and 19 are connected to the shield of the module (i.e. tow lips of the metal can).


A crypto-capable SABER, without a crypto module, can not transmit sound. In order to make the radio work, a dummy module should be installed instead. In the dummy module, only the wire between pin 1 and 17 (dotted in the drawing above) is present. Alternatively, a short piece of thin wire could be installed directly between terminals 1 and 17. Some people have reported 'spurious noise' when transmitting. In such cases a shielded (and grounded) wire should be used instead.

NTN5836A crypto module for Motorola SABER Bottom view of the crypto module Inside the crypto module Interior of the crypto module Splitting the base Unfolding the flex PCB Partly unfolded flex PCB inside the crypto module Four sides with components
M
×
M
1 / 8
NTN5836A crypto module for Motorola SABER
M
2 / 8
Bottom view of the crypto module
M
3 / 8
Inside the crypto module
M
4 / 8
Interior of the crypto module
M
5 / 8
Splitting the base
M
6 / 8
Unfolding the flex PCB
M
7 / 8
Partly unfolded flex PCB inside the crypto module
M
8 / 8
Four sides with components

The following crypto modules are known:

Module Version Algorithm Remark
NTN1071 (non) Smartnet DES-XL  
NTN1072 (non) Smartnet DES  
NTN1073 Smartnet DVP-XL Discontinued
NTN1074 (non) Smartnet DVP-XL  
NTN4711 non-Smartnet DVP  
NTN4712 non-Smartnet DES Replaced by NTN1072
NTN4713 non-Smartnet DVP-XL Replaced by NTN1074
NTN4714 non-Smartnet DES-XL Replaced by NTN1071
NTN4720 All - Dummy module (bypass)
NTN5832 Smartnet DVP  
NTN5833 Smartnet DES Replaced by NTN1072
NTN5834 Smartnet DVP-XL Replaced by NTN1073
NTN5835 Smartnet DES-XL Replaced by NTN1071
NTN5836 Smartnet DVI-XL  
NTN5755 Multikey DVP DVP = Digital Voice Protection
NTN5756 Multikey DVP-XL Enhanced version of DVP
NTN5757 Multikey DES DES = Digital Encryption Standard
NTN5758 Multikey DES-XL Enhanced version of DES
NTN5759 Multikey DVI-XL DVI = Digital Voice International (export)
NTN5760 OTAR DVP OTAR = Over The Air Rekeying
NTN5761 OTAR DVP-XL  
NTN5762 OTAR DES  
NTN5763 OTAR DES-XL  
NTN7288 Multikey DVP Replaced by NTN5755
NTN7289 Multikey DVP-XL Replaced by NTN5756
NTN7290 Multikey DES Replaced by NTN5757
NTN7291 Multikey DES-XL Replaced by NTN5758
NTN7292 Multikey DVI-XL Replaced by NTN5759
NTN7298 FASCINATOR SAVILLE Type-1 Controlled Cryptographic Item (CCI)

As you can see in the above table, there are basically 6 different types of encryption available for a Motorola SABER (and in fact for most other analogue Motorola radios). These types can be broken down to four distinct encryption methods or protocols: DVP, DES, DVI and SAVILLE. The first three (DVP, DES and DVI) are protocols that are publicly available (although some export restrictions are imposed), but SAVILLE is for use by the US Government and NATO only.

DVP
DVP is short for Digital Voice Protection (according to the patent) or Digital Voice Privacy (according to some people). It was Motorola's own proprietary encryption algorithm that uses a self-synchronising principle known as an autoclave or Cipher Feedback (CFB) system. DVP allows 2.36 · 1021 (or 271) different keys to be used and is therefore known as an 71-bit protocol. In some respects it is stronger than 56-bit DES [4]. It was later improved to DVP-XL (see below).

DES
DES, or Data Encryption Standard, was developed in the mid-1970s by IBM and the US National Security Agency (NSA) in an attempt to harmonize the encryption systems used by individual government agencies. DES allows interoperable secure voice communication between agencies. The DES protocol allows 7.2 · 1016 (or 256) different keys to be used and is therefore known as a 56-bit encryption protocol. For a long time, DES was considered a strong and classified (US-only) system that could not be exported outside the USA. This is no longer the case.

DVP-XL and DES-XL
Shortly after the introduction of the DVP and DES encryption modules for the Motorola SABER, it became clear that the addition of (digital) voice encryption reduced the operational range of the radios significantly, in some cases by as much as 30% [4]. This was the result of the so-called error propagation in the self-synchronising Cipher Feedback (CFB) system that was used by both encryption modules (DVP and DES). A similar effect was seen in 1976 in the Philips Spendex 10.

Motorola engineers solved the problem by using a different type of self-synchronising algorithm, known as counter addressing, and introduced two new encryption modules, DVP-XL and DES-XL that were drop-in replacements for the earlier DVP and DES modules. Note that the XL-variants are not compatible with the earlier variants. Also note that in the case of DVP-XL the number of possible keys was enhanced to 7.9 · 1028 (or 296), making it a 96-bit protocol [4].

DVI-XL
As DES was a restricted protocol for many years, exporting it from the US required a munitions license. Motorola therefore developed DVI, or Digital Voice International which is similar to DES, but has a reduced number of possible keys. As it uses the same self-synchronising system as DVP-XL and DES-XL, the letters XL were added to DVI as well. Although not very popular in the US, DVI-XL is often found in European countries, such as the UK [4].

FASCINATOR
Although DES can be used for sensitive but unclassified information (in the military sense), it was considered too weak for Government information at the level of TOP SECRET. A special encryption module, known as FASCINATOR was developed for exclusive use by the US Government and by NATO. It uses 12-bit CVSD modulation combinated with the NSA-developed SAVILLE encryption algorithm that was also used in the KY-57 VINSON. Although FASCINATOR modules are restricted Type-1 encryption products, they have been found inside SABER radios on the surplus market.


Man-down module
In an MX-1000 that was issued by the Dutch PTT, we found an unmarked module in the slot that is intended for the secure voice encryption module. After some investigation and with help of some of our readers, we have since determined that this is a so-called man-down module.

The image on the right shows the interior of the man-down module. Compared to a crypto unit, this unit is rather simple. It consists of two small PCBs: one at the bottom, that is basically used as the connector, and the actual circuit that is mounted vertically on top of the bottom PCB.

Most of the components are on the top side of the PCB, where a Motorola custom chip (35U05) forms the heart of the unit. According to the date code on the custom chip, it was made in week 23 of 1995. The small crystal is probably used for the chip's reference oscillator or RTC.
  
Uncanned crypto module

At the far end of the board is a circular metal can that resembles a transistor. It is in fact a tilt switch that uses (liquid) mercury as the switching element. In this case, the tilt switch is used as man-down detection. If the person carrying the radio (e.g. money transport) falls on the ground, the tilt switch is either closed or broken, in which case the radio can send an emergency code.


The image above shows the footprint of the man-down module, when looking into the sockets of the radio's main PCB. Note that not all pins are used on this module. The ones that are used, are marked as black dots in the drawing above. Pins 1 and 17 are connected inside the module, to ensure that the transmitter produces audio. This confirms that this is not en encryption module.

The man-down module was found inside an MX-1000 in The Netherlands, with no FACTORY ID at back. When the module is installed and the SECURE switch in on (i.e. set to I), it start transmitting autonomously at regular intervals. Every transmission starts with a 5-tone sequency, followed by a series of short beeps. After a few seconds of silence, the unit returns to receive mode again.

Update 19 May 2015
The man-down module was developed in the mid-1990s as a special project at Motorola by Michael Wilkinson [9]. It has two separate mercury switches: one for tilt and one for movement, and its timing could be programmed with a special version of the Radio Service Software (RSS), in which 4-bytes of the radio's internal EEPROM were reallocated to the man-down module.

As Motorola initially expected to sell only 100 units, it was not possible to develop a dedicated molding, hense the somewhat improvised enclosure and PCB. The locating pins (to guide the unit into the Saber's motherboard) were simply cut-off pieces of welding rod. The custom 35U05 chip is in fact a Motorola 68HC08 processor that was repackaged in order to fit the available space.

Crypto module top view Motorola SABER crypto module Crypto module bottom view Bottom view of the crypto module Desoldered ground lip Uncanned crypto module Crypto module interior (top view of PCB) Crypto module interior (bottom view)
N
×
N
1 / 8
Crypto module top view
N
2 / 8
Motorola SABER crypto module
N
3 / 8
Crypto module bottom view
N
4 / 8
Bottom view of the crypto module
N
5 / 8
Desoldered ground lip
N
6 / 8
Uncanned crypto module
N
7 / 8
Crypto module interior (top view of PCB)
N
8 / 8
Crypto module interior (bottom view)

Reference Oscillator
Module Section Remark
NXN6268 16.8 MHz Common to all models

 
Synthesizer
Module Section Remark
NLC6240 66-84 MHz -
NLC6241 74-88 MHz  
NLD8201 136-150.8 MHz  
NLD8210 146-178 MHz Used for 146-162, 148-174 and 157-174 sections
NLE9461 403-433 MHz Government split
NLE9462 440-470 MHz  
NLE9463 460-490 MHz  
NLE9464 482-512 MHz  

 
Receiver module
 
Receiver
Module Section Remark
NLC6230 66-84 MHz -
NLC6231 74-88 MHz  
NLD8180 136-174 MHz Used for the entire VHF band (i.e. all sections) 1
NLE9431 403-433 MHz Government split
NLE9432 440-470 MHz  
NLE9433 460-490 MHz  
NLE9434 482-512 MHz  
NLE9501 403-433 MHz 12.5 kHz channel spacing
NLE9502 440-470 MHz 12.5 MHz channel spacing
 
5-Pole Filter 2
Module Section Remark
NFD6091 136-150.8 MHz -
NFD6092 146-162 MHz  
? 403-433 MHz  
? 440-470 MHz  
? 460-490 MHz  
? 482-512 MHz  
 
2-Pole Filter 3
Module Section Remark
? 66-84 MHz -
NLC6382 74-88 MHz  
NLD6111 136-150.8 MHz  
NLD6112 146-162 MHz  
? 146-174 MHz  

 
  1. Only one receiver module is used for the entire VHF band. The 5-Pole Filter determines the actual frequency section (split).
  2. The 5-Pole Filter is the bottom half of the receiver module.
  3. The 2-Pole Filters are only present MIDBAND and VHF receivers. They are located between the actual receiver and the FDS (see below). It is not present in UHF radios.


Filter Detector Switch (FDS)
Module Section Remark
NLC6250 66-84 MHz -
NLC6251 74-88 MHz  
NFD6131 136-150.8 MHz  
NFD6132 146-178 MHz Used for 146-162, 148-174 and 157-174 sections
NFE6061 403-470 MHz  
NFE6062 470-512 MHz  

 
Power Amplifiers
Module Section Power Remark
NLC6260 66-84 MHz -  
NLC6261 74-48 MHz -  
NLD8121 136-150.8 MHz 6W Ideal for HAM radio use
NLD8773 146-174 MHz 6W Suitable for HAM radio use
NLD8122 146-162 MHz 6W Suitable for HAM radio use
NLD8133 146-178 MHz 2.5W Suitable for HAM radio use
NLD8123 157-174 MHz 6W  
NLE4082 440-470 MHz 5W Often hand-written on the case of an NLE9852 1
NLE9471 403-433 MHz 5W  
NLE9472 440-470 MHz 5W  
NLE9473 460-490 MHz 5W  
NLE9474 482-512 MHz 5W  
NLE9483 440-470 MHz 2W  
NLE9852 440-470 MHz 2W Also see NLE4082 1

 
  1. Note that some NLE4082 modules were delivered in the packaging of an NLE9852 (or indeed any other PA module). In such cases, the original number of the module is printed on the case, whilst the new number (NLE4082) is hand-written on it. In such cases, the hand-written number NLE4082 is the actual one.

Universal connector
Each SABER radio has an accessory socket at the back, just below the antenna base. It consists of 12 flat-faced circular contact pads, arranged in a 3 x 4 matrix, plus two concentric contacts for an external antenna. The socket can be used for example for an external speaker/microphone.


The table below shows the pinout of the accessory socket. Please note that the ground pin (GND) is taken from the outer ring of the external antenna connection at the top. A typical accessory plug is hooked into the rectangular gap at the bottom of the socket and covers all contact pads. The plug is then locked in place with a 3mm bolt at the top left. The socket is also used for programming the radio and for loading the cryptographic keys into a crypto-capable radio.

# Name Remark
1 SPK(+) External speaker (+)
2 SPK(-) External speaker (-)
3 DATA Bi-directional programming data
4 MIC External microphone
5 ¬WE Write Enable (when pulled low)
6 BUSY  
7 OPT SEL Voltage selected option (internal 20K pull-up) see table below
8 OPT B(+) +7.5V from radio (raw battery voltage)
9 KEY  
10 KEYLOAD  
11 AUX TX or DVP CLK
12 n.c.  
13 GND RF Ground, also used as 0V rail (same as 15)
14 ANT Antenna, RF output
15 GND RF Ground, also used as 0V rail (same as 13)

The voltage at pin 7 (OPT SEL) allows the selection between the internal or external microphone, speaker and antenna. The pin is internally pulled-up to the +5V rail with a 20K resistor. By connecting a resistor (or a zener diode) from this pin to ground, a voltage divider can be created, that selects the appropriate voltage for any of the configurations in the table below.

# Voltage MIC SPK ANT Remark
1 5.00 V INT INT INT Default operation
2 1.24 V EXT EXT INT External microphone/speaker and standard antenna
3 2.50 V EXT EXT EXT All external (microphone, speaker and antenna)
4 3.74 V INT INT EXT External antenna only
TX 0.00 V - - - PTT (Push-To-Talk switch)



External microphone
Please note that shortening pin 7 to ground (i.e. making it 0V as indicated in the table above) causes the radio to transmit. The diagram below shows how to connect a standard microphone-speaker combination to the universal connector, whilst using the standard (internal) antenna.

Two possible circuits for an external mic/speaker

Note that a zenerdiode (Z) is used to clamp the voltage level at pin 7 (OPT SEL) to 1.24V in order to select option 2 (external microphone and speaker, and internal antenna). The Push-To-Talk switch (PTT) is connected in parallel to this diode and momentarily changes the voltage to 0V when closed. Alternatively, the zenerdiode may be replaced by two standard signal diodes (e.g. 1N4148) in reverse direction. Ground (GND) is taken from the ring of the antenna connector.

The easiest way of connecting an external microphone

As an alternative to the above, it is also possible to use a simple 6K8 resistor instead of the diodes above. In fact, this is the way it is done in most Motorola accessories. As pin 7 of the accessory socket is internally tied to the 5V rail via a 20K resistor (Ri), we can calculate the value of the external resistor (Re) as follows: Re = (20·U7) / (5-U7) [K]. U7 is the voltage at pin 7. Ideally, the value for the external resistor would be 6.666K, but as this is not available, we can safely round it off to the nearest one in the E12-range: 6K8. This calculation can also be used for the other voltages: 62K for 3.75V (external antenna) and 20K for 2.5V (all external).


External Antenna
It is also possible to use the internal microphone and speaker, but an external antenna. This can be useful, for example, when using the radio from within a car or when measuring the RF output when adjusting the radio. By applying a voltage of 3.74V to pin 7 of the universal connector, the radio switches to the external antenna. The external antenna adapter is wired as follows:

External antenna adapter

As pin 7 of the universal connector is internally pulled up to +5V with a 20K resistor, the 59K resistor in the adapter effectively forms a voltage divider, resulting in a voltage of approx. 3.74V. Most external antenna adapter only have a few pins present in the universal connector, but there are some that are fully populated with pins. The latter can be converted to a full test cable.


Hirose socket
When using a Hirose adapter, e.g. for connecting a surveillance kit or a keyloader with a Hirose plug, the accessory needs to be wired according to the connection diagram below. Please note that the accessory sensing pin 6 (EXT) needs to be tied to ground (pin 4) to select the external microphone and speaker. A special voltage (as described above) is not necessary; this is provided by a special chip inside the Hirose adapter. The pin-out of the socket is as follows:


6-pin Hirose socket when looking into the socket

When rewiring an existing microphone, headset or surveillance kit, or when creating your own external audio set for the SABER, you may follow the wiring diagram below. If an electret microphone is used, you may need to connect the +5V (B+) to it. This is either done via a separate pin, if it is a 3-pin microhone, or via a 4K7 resistor if it is a 2-pin electret microphone. In the latter case a capacitor should be inserted in the MIC line to block the DC voltage.


Connecting an external microphone, speaker and PTT-switch

The plug (i.e. the cable end) has Hirose part number HR10A-7P-6P(73). The receptacle (i.e. the socket) has part number HR10A-7R-6S(73). If you want to make an extension cable, you might need a jack (female cable part) with part number HR10A-7J-6S(73). These parts are readily available from companies such as Farnell and Digi-Key.


Glossary
The following expressions and abbreviations are used on this page. For additional keywords, please check the global crypto glossary.

APRS   Automatic Packet Reporting System
(Website) (Wikipedia)
CFB   Cipher Feedback
A block cipher mode that enhanced ECB mode by chaining together blocks of cipher text it produces, and operating on plaintext segments of variable length, less than or equal to the block length.
CTCSS   Continuous Tone-Coded Squelsh System
System to reduce interference and annoyance of listening to unwanted transmissions on the same channel of a two-way radio communications channel. By including a sub-audio tone of a pre-determined frequency in the transmission, the receiver at the other end will only 'open up' if the sub-audio tone matches. (Wikipedia)
DES   Data Encryption Standard
Universal encryption algorithm developed in the mid-1970s by the US National Security Agency (NSA) for the protection of voice, data and financial transactions. Although initially intended for use exclusively by the US Government, it was later released for use by the general public. (Wikipedia)
DVP   Digital Voice Privacy
Motorola's own proprietary voice encryption system, based on a self-synchronising Cipher Feedback (CFB) principle. The algorithm is also known as Digitial Voice Protection.
DTMF   Dual-Tone Multiple-Frequency
(Wikipedia)
ECB   Electronic Codebook
A block cipher mode in which a plaintext block is used directly as input to the encryption algorithm and the resultant output block is used directly as cipher text.
FASCINATOR   Encryption module for the Motorola SABER, with the same form factor as the other encryption modules, that uses the classified NSA-developed SAVILLE algorithm for the protection of speech (voice). As SAVILLE is a Type-1 cryptographic product, is was produced exclusively for use by the US Government.
OTAR   Over The Air Re-keying
Method for the distribution of (new) cryptographic keys via the existing radio channels, rather than manually using a Key Variable Loader (KVL). In most cases OTAR requires the use of a dedicated Key Distribution Center (KDC).
PL   Private Line
Motorola's trademark for CTCSS.
RSS   Radio Service Software
Dedicated (DOS-based) software, developed by Motorola, for programming frequencies and features of a Motorola two-way radio. (More...)
SAVILLE   Type-1 encryption product, developed by the US National Security Agency (NSA) for exclusive use by the US Government and Agencies that are approved by the US Government, such as NATO. (More...)
Acknowledgement
SABER, Systems SABER, Astro SABER, Motorola, the 'bat' logo, DVP, DVP-XL and RSS are registered trademarks of Motorola Inc., USA.


Related patents
  • US5363447 (key loading) - 26 March 1993
    Method for loading encryption keys into secure transmission devices. This patent describes how encryption keys (typically DES, DVP, DES-XL, DVP-XL or DVI-XL) are loaded into a device (radio) and how they are protected against evesdropping. The latter is done by using a Key Encryption Key (KEK) generated by an internal free-running counter.

  • US4167700 (DVP)- 2 May 1977
    Digital Voice Protection System and Method. A description of Motorola's own proprietary encryption algorithm, known as DVP.

  • US5301232 (OTAR) - 5 November 1992
    Method and Apparatus for over-the-air programming of communication devices. This document describes Motorola's implementation of OTAR, a method for distributing the cryptographic keys via a radio channel, typically using a control device, such as a Key Management Controller (KMC). The patent refers to earlier Motorola publications regarding Advances Securenet, Multikey, OTAR and KMC.

  • US5528691 (Group OTAR) - 5 October 1994
    Method for Automatically Assigning Encryption Information to a Group of Radios. This patent is an addition to US5301232 and descibes how (group) keys can be sent to a group of radios rather than to each radio individually.

  • USD390554 (KVL 3000) - 31 May 1996
    This patent protects the (case) design of the later KVL-3000 Key Variable Loader (key filler). It was a universal device that could be used to load virtually any type of key into any type of (crypto-capable) Motorola radio.
Documentation
  1. Saber I instructions Manual
    6881065C60

  2. Saber I, II Instruction Manual
    6881065C65

  3. System Saber, Saber ATS Instruction Manual
    6881060C10

  4. SecureNet High Band Service Manual
    6881043C90

  5. SecureNet UHF Band Service Manual
    6881045C75

  6. Systems Saber and Saber ATS Service Manual
    6881067C10

  7. System Saber, UHF Service Manual
    6881066C95
References
  1. Barry Wels, Motorola SABER II - THANKS !
    SABER II radio featured on this page kindly donated by Barry Wels.

  2. The Motorola SABER Information Page 1
    This site provides a wealth of information about SABER radios.
    Retrieved May 2012.

  3. Wikipedia, FASCINATOR
    Retrieved May 2012.

  4. Doug G. Encryption Protocols
    Batdude. 14 March 2006, first draft. Retrieved May 2013.

  5. Batwing Laboratories, Miscellaneous information about (programming) Motorola stuff
    BatLabs (website). Retrieved March 2013.

  6. Motorola, Saber Series Parts List
    Retrieved from [2] March 2013.

  7. Storno, Storno History
    Website, 19 June 2003. Retrieved April 2013.

  8. Crypto Museum, The SAVILLE encryption algorithm
    Interview at Crypto Museum. December 2011.

  9. Michael Wilkinson, Development of Man-Down module at Motorola
    Personal correspondence. 1 May 2015.
  1. Website no longer available in 2017.

Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Saturday 12 February 2011. Last changed: Friday, 29 September 2017 - 07:08 CET.
Click for homepage