|
|
|
|
|
|
|
Voice USA Motorola DVP DES ← MX-300
Secure hand-held radio
SABER is a series of handheld two-way radios, developed in 1989 by
Motorola (USA). They were used by the US Armed Forces,
law enforcement agencies and by corporations worldwide.
There are many versions and variants, some of which have
built-in voice encryption (COMSEC).
In some countries, SABER-variants were sold as rebatched products with
different names, such as the European MX-1000 and the Stornophone 7000.
Some of these had a different microcontroller.
|
The image on the right shows the secure (crypto) version of the SABER II.
It is slightly higher than the standard (non-secure) version, providing space
for the crypto-module (below the speaker grill).
It also has SECURENET printed on the top panel, just above the volume control.
On top of the unit is the volume control and the channel selector with 12
positions.
It has 48 channels in 4 zones (or 120 channels in 10 zones).
The unit has a built-in crypto module with is operated with a
switch on the top panel, allowing clear (O) and secure (Ø) operation.
|
|
|
There were three basic models, known as SABER I,
SABER II and
SABER III.
Basically, they are all the same radio, but with more or less features.
The SABER I has no controls at the front panel, but the SABER II and III
have a display and some push-buttons, with SABER III being the most
complete one. In addition to the three buttons of the SABER II,
it has a full telephone keypad.
The features, functions and frequencies of all versions of the SABER are
programmed with proprietary software from Motorola, known as the
Radio Service Software (RSS).
This software is no longer available.
Motorola SABER Portable Radios are no longer in production, but replacement
parts are still available from some Motorola Dealers and from auction sites,
such as eBay. The Motorola Saber-series is also very popular among radio
amateurs (HAMs), and many have been converted
to HAM-radio frequencies [2]. Especially the secure versions of the radio
are popular, as the extra space can be used to build-in, for example,
an APRS module instead of the crypto module.
|
The image below shows the controls of a SABER II hand-held radio.
Please note that the controls differ between models and that some
functions are optional. The most frequently used features are all
located on the top panel of the radio. From right to left are the antenna
socket, the channel selector, the volume control (combined with ON/OFF
switch) and a 2-position switch that is used to select between secure
and non-secure operation. On radios that are not crypto-capable, this
switch may either be missing, or might be used to select between
channel banks.
At the left side of the radio are a number of recessed buttons.
At the top is the squelch button, which allows the squelch (noise
cancellation) to be open for as long as the button is depressed.
Keeping it depressed for more than 3 seconds, will permanently open
the squelch.
In the middle is the (large) Push-To-Talk (PTT) switch.
The radio transmits as long as this button is depressed. The radio
can be programmed to send an identification at the start of a transmission.
Below the PTT are two small buttons for Repeater Access Tones (RAT).
They can only be used if the radio has version 6D or later of the CORE
firmware. On older versions of the CORE, such as the common 5D, they will
not work. On early case variants the RAT buttons were omitted.
|
|
There are several series of SABER radios that are compatible and
interoperable to some extent. This page only deals with the SABER I, II and III
(and the European MX-1000), but not with some of the later
analogue and digital trunking systems.
The latter are listed in the table below in red.
|
|
Model
|
Display
|
Keypad
|
Remark
|
|
|
|
SABER I
|
 | |
12 channels
|
|
SABER IE
|
| |
24 channels (in 2 zones)
|
|
SABER II
|
 |
3 keys
|
48 or 120 channels 1
|
|
SABER III
|
|
15 keys 2
|
120 channels + DTMF
|
|
|
|
Systems SABER 3
|
| |
Analogue trunking
|
|
Astro SABER 3
|
| |
Digital (and trunking)
|
|
Note that the Systems SABER and the Astro SABER are backwards compatible
with the SABER, as they can be programmed for 200+ analogue channels
(using a different version of the RSS).
They have the same casing as the SABER. Almost all accessories are interchangeable
between SABER, MX-1000 and Systems SABER. Some accessories of the
Astro SABER can be used as well, with the exception of antennas, microphones,
programming cables and vehicle adapters.
|
-
There are 2 versions of the SABER II: one with 2KB of memory
(48 channels in 4 zones) and one with 8KB of memory (120 channels in 10 zones)
and DTMF. The memory is located behind the front panel.
-
The keyboard consists of 15 keys: the 3 keys of the SABER II plus 12 keys
(not 16) for DTMF.
-
Most of the accessories of the Systems SABER will work with the SABER,
but some of the accessories of the Asto SABER are not compatible.
Systems SABER and Astro SABER are not covered on this page.
|
Many different versions and variants of the SABER radio have been made
over the years, for a variety of frequency ranges. Used SABER handhelds
are often found in surplus stores and on auction sites like eBay.
As it is often difficult to tell which model you are dealing with, the
description below can be used as a guide. Luckily, the frequency band
and a number of features can be deduced from the FACTORY ID that is
normally present on a label at the back of the radio.
Unfortunately, the FACTORY ID doesn't tell you which section
of the frequency band — Motorola calls this the band-split — is used.
Furthermore, the FACTORY ID
might be missing completely on rebatched versions of the radio,
as many of them were sold by telecom operators in Europe under different
names. For example, a UHF MX-3000 was sold by the Dutch PTT
as the Portavox 3165.
First of all there are two different case sizes:
|
- Non-secure - regular case
SABER radios that are not crypto-capable have a case that is slightly
shorter that radio that do have this provision. Such radios can never be
used for secure communication, and can not be modified for that.
This version is shown on the left.
- Secure - long case
A slightly longer case is used for SABER radios that are crypto-capable.
This doesn't means that a suitable crypto module is present though;
the relevant slot might still be empty or contain a dummy. It
just means that the radio has space for a crypto module.
These radios are generally marked with the word SECURENET, or
something similar on the top panel. The longer version is shown on the right
in the image above.
|
|
Furthermore, there are two case variants that look identical:
|
- Standard
This is the standard (non-submersible) version of the SABER radio.
Most radios found on the surplus market and on auction sites, such as
eBay, are of this type.
- Submersible
As a manufacturing option it was possible to order SABER radios that
were submersable in water. Such radios had appropriate seals and rubber
gaskets at all openings in the case, including the speaker grille.
Generally, these variants have the word SUBMERSIBLE printed on the top panel.
Externally, submersible radios are identical to the standard version.
|
Next, there are three front panel variants of the SABER radio:
|
- SABER I - No controls
This is the most simple version of the SABER. It has no controls
on the front panel and no display. The only two controls (the volume
adjustment and the channel selector) are at the top of the radio.
This version is suitable for 12 pre-programmed channels (or 15 after
a modification). The SABER IE is a variant of the SABER I,
which features 24 channels.
- SABER II - Simple controls
This is a more advanced version of the SABER I that is menu-driven
and has some extra features and channels. The front panel contains
a micro controller, memory, a small LCD display and 3 red push-buttons.
- SABER III - Full controls
This is the most complete version of the SABER. The case is identical to
the two previous versions (above), but the front panel is different. It
contains a micro controller, memory, a display and a 15-button keypad.
|
|
There are three band variants of the SABER radio:
|
- MIDBAND - 66-88 MHz
This band was used by many law enforcement agencies until the late
1990s. As the band is pretty close to the FM broadcast band, the MIDBAND
— also known as VHF-M —
has gradually been phased out. Radios in this band are useful for HAMs
as they can legally be used in the
70.0-70.5 MHz segment.
- VHF - 136-174 MHz
For many years, public services, commercial services, government agencies and
radio amateurs have been (and still are) using the 2m band. Please note that
none of the radios cover the entire frequency range, but only a section of it
(see below).
This is known as the band-split.
Some of these ranges are suitable for used by radio amateurs (HAMs).
- UHF - 403-512 MHz
Once the 2m band got exhausted, the 70cm band became a popular space for
all kinds of services. Most of these frequencies are still in use today for
analogue and/or digital voice and data. Although the 70cm amateur band is within
this range (430-440 MHz, or even 430-450 MHz in some countries),
there is no SABER that covers the entire range.
|
|
The following bandwidths are available (VHF only):
|
Narrowband 12.5 kHz
Wideband 25 kHz
|
|
The SABER I is the simplest version of the SABER hand-held radio.
That doesn't mean however, that it lacks the features of it 'big brothers',
the SABER II
and SABER III, it just misses the direct controls to these
features. Channel programming, output power and feature selection are
done when programming the radio, e.g. in a service center,
using Motorola's proprietary RSS software.
|
The SABER I was available in two case variants: the standard version
in the lower case, and the higher version that has room for a
security module.
The latter adds digital voice encryption to the SABER. The image
on the right shows a typical SABER I without its large NiCd battery,
and with a DES encryption module fitted.
Furthermore, the SABER I was available for a variety of frequencies,
in MIDBAND (66-88 MHz), VHF (136-174 MHz) and UHF (403-512 MHz).
Note that no radio covers the full frequency range, but just a
limited range
or band split.
|
|
|
A SABER I can hold up to 12 pre-programmed channels, each of which
can be selected directly with the rotary channel selector on the
top panel, to the left of the antenna mount.
Each channel can be set up for split-frequency operation (repeater),
hi/low power, CTCSS, etc., all under control of the RSS.
Note that the MX-1000 (a European SABER-variant) has
just 10 channels.
|
|
The SABER IE is actually an enhanced version of the SABER I.
The front panel is identical, but the radio is equipped with 24 channels
rather than just 12, divided over 2 banks (zones).
The toggle switch to the left of the volume control
is used to select between the two zones.
|
On secure versions of the SABER I
(i.e. the crypto-capable variant), this switch is used to select between
secure (Ø) and non-secure (O). For that reason, the SABER IE is only
available in the non-secure version (i.e. the lower case variant).
The only way to tell the difference is by checking the presence of the
bank switch or by decoding the FACTORY ID (when present).
The image on the right shows a Dutch MX-1000 with 20 channels
(two banks of 10 channels each). Note that the knob of the zone switch is missing
from the radio shown here.
|
|
|
|
The SABER II can been regarded as a SABER I
with a simple User Interface (UI), consisting of a single-line LCD
display and three orange buttons. The case is similar to the case of the
SABER I, but has a different front panel, behind which an extra
microcontroller with memory is located.
|
Like the SABER I, the SABER II was available in secure and
non-secure versions, and in the same frequency variants (MB, VHF and UHF).
Switching between secure (Ø) and non-secure (O) operation is done with the
small toggle switch to the left of the volume control.
The extra microcontroller is used for the User Interface, whilst the
memory is used to store the channels with their corresponding features.
Early versions of the radio had 2KB of RAM, allowing 48 channels to
be used in 4 zones. Later models had 8KB, allowing 120 channels in 10 zones.
|
|
|
The image above shows a typical SABER II that has been programmed for
the 2 meter amateur radio band, covering 144-146 MHz (USA: 144-148 MHz).
In the example above, the zone has been named 145, whilst the channel name is
250. This effectively shows the frequency on which it is used (145.250 MHz).
The three orange buttons are used for a simple cyclic user interface:
|
MENU Select between ZONE, LOCK, PL, SCAN, SCANLIST and channel display SELECT Alter the currently selected item in each menu ENTER Activate a selected item
|
|
PL is Motorola's variant of CTCSS,
called Private LineTM.
All other features, such as split-frequency operation (repeater),
output power, secure voice, etc., can be programmed on a per-channel basis,
using Motorola's proprietary RSS software.
The SABER II can be seen as a cut-down version of the SABER III
(see below). Although the telephone keypad is missing from the front panel,
the actual switches are present on the orange foil
behind the plastic front.
|
|
The SABER III is effectively an enhanced version of the SABER II.
The display is identical, but the keyboard has been extended with 12
additional buttons, adding a standard telephone keypad to the radio
(0-9 plus * and #). This way the radio can be used for auto-patch and
DTMF tones.
|
Like the enhanced version of the SABER II, this radio has room for 120
channels, organized as 10 banks (zones) of 12 channels each.
The channels and their features can be programmed on a per-channel
basis or per-radio basis, using Motorola's proprietary
Radio Service Software.
Note that only 12 keys are available for DTMF, rather than the usual
16. The 4th column (i.e. 1633 Hz), normally used for the ABCD-keys, is missing.
If these additional tones are required, an external DTMF encoder (e.g.
combined with an external microphone, should be used instead.
|
|
|
|
The SABER III was typically used in situations where the radio had
to be able to be connected (patched) to the regular telephone network.
Pressing the keys would produce the corresponding DTMF tones.
The image above shows a VHF crypto-capable version of the SABER III.
|
The MX-1000 series was a European two-way radio that was also produced by
Motorola. It was based on the SABER design, albeit with a different set of
features and driven by a different controller. The channel selector,
for example, had only 10 positions, whereas the channel selector on
a SABER had 12 positions.
As a result, the MX-1000 series can not be programmed with the same
Radio Service Software (RSS), but only with a proprietary version
of the RSS.
Like the SABER, the MX-1000 series consisted of three basic models,
with the MX-1000 being related to the SABER I, the MX-2000 to the SABER II
and the MX-3000 to the SABER III. The MX-1000 was available in most design
variants, including VHF, UHF, submersible and high/low power. There was also
a secure variant that worked with all of the SABER crypto modules
except for the OTAR/Multikey and FASCINATOR modules;
these were restricted to the Systems SABER.
The MX-1000 was sold in some European countries, including Germany, Denmark,
Norway, Sweden, Finland and The Netherlands. It was either (re)batched with
the name of the national telecom operator (e.g. PTT Telecom in The Netherlands)
or under the brand name of Storno, at the time a well-known Danish radio
manufacturer. Since 1986, Storno is a Motorola subsidary [7].
|
Different techniques have been developed to prevent the squelch of a
receiver from opening on weak unwanted signals, as is often the case
with repeaters. An example of such a technique is CTCSS:
Continuous Tone-Coded Squelch System. Motorola calls it PL or
Private LineTM. It is implemented in the SABER radios
and can be programmed globally or on a per channel basis, using
Motorola's RSS
[4].
On many (amateur) repeaters, CTCSS is mandatory these days.
Please note that CTCSS can not be used in combination with voice
encryption. As a result it might not be possible to send encrypted
signals via a repeater [4].
The only ways to overcome this, is to turn off the repeater's
CTCSS (not needed for encrypted signals anyway), or to use an
intelligent repeater, such as the Motorola MSF5000TM, which can
be loaded with the same encryption key. Such repeaters can generally
pass both types of traffic: encrypted and unencrypted (using CTCSS).
|
SABER radios do not have a noise suppression (squelch) control similar to
the volume adjustment. Instead, the squelch is set in software when
programming the radio, using the RSS.
In order to prevent the squelch from closing on weak signals, the
push-button at the side of the radio, just above the PTT, can be used
to open the squelch manually. Holding this button for 3 seconds,
opens the squelch permanently. Press the button once more to close
it again.
Note that some radios are programmed for CTCSS or a 5-tone sequence.
The squelch of such radios will only open when the appropriate CTCSS
tone, or the appropriate 5-tone sequence, is received. The latter is
commonly called a tone-lock, or selective tone call (selcall).
|
|
As SABER radios have a set of pre-determined frequencies (channels) on which
they operate, they need to be programmed
prior to use, using dedicated software.
This is not an easy task, that needs the following prerequisites:
|
- Programming cable
A special interface cable is needed for virtually every type of radio ever
made by Motorola. Such cables have a special motorola accessory plug at one end
and a 25-way D-type (parallel) connector at the other end, suitable for
connection to the RIB (see below).
- Radio Interface Box (RIB) RLN4008
A small interface box is needed between the radio (programming cable) and the PC.
It converts the 2-wire serial data and levels into bi-directional data
stream, suitable for connection to the COM port of a PC. Most RIBs are suitable
for nearly all Motorola radios.
- Radio Service Software (RSS)
For each different radio, Motorola developed a
dedicated RSS that can not be
used on other radios. Please note that the MX-1000 (a European
derivative of the SABER) requires a different version of the RSS.
The RSS is no longer available from Motorola, but copyright restrictions
prevent it from being distributed freely. All we can suggest is to do a
Google search.
Please do not ask us for a copy of this software.
- Old 386 PC with DOS
This is probably the most difficult-to-find part. As the RSS software was written
many years ago (when Windows and faster processors were not yet available),
the software uses built-in timing loops that are processor speed-dependent.
As a result the RSS can only be used on an old PC with a 386 processor that
runs no faster than 50MHz and has no cache (or that has it cache disabled).
Any attempt to use a faster PC will break your radio.
|
|
Apart from programming frequencies and other features into the SABER,
the crypto-capable variants (Securenet) also need to be loaded with a
valid cryptographic key before secure (voice) communication is possible.
This is done by using a so-called Key Variable Loader or KVL.
|
KVLs are also known as Key Fillers or Fill Guns.
Initially, Motorola had a separate key filler for each individual
encryption algorithm, such as the T3010 (DVP), T3014 (DVP-XL),
T3020 (DES), T3011 (DES-XL) and T3012 (DVI).
Later these KVLs were discontinued and replaced by the KVL-3000
shown in the image on the right. It supports all known algorithms
and is suitable for the Astro 25 Saber as well.
➤ More about loading keys into the SABER
➤ More about the KVL-3000
|
|
|
If security is compromised — in the case of a crypto-enabled version
of the SABER — it may be necessary to purge all cryptographic keys stored
inside the device quickly. This procedure of deleting the key material
is commonly known as zeroizing. With the SABER, zeroizing is done by
removing the battery from a switched-on device. Once the device is
zeroized, it can no longer be used in secure mode, until a
new key has been loaded
by means of a Key Variable Loader.
Note that the above proceduce may cause problems when swapping the battery.
If the battery is nearly empty, switch off the device
before removing the battery. This is the only way to retain
the cryptographic keys that are stored inside the device.
After fitting a fresh battery, turn the device ON again and resume operation.
|
|
As the SABER was a professional radio, used by many different
agencies, public services and commercial users,
a wide range of accessories was available [6].
Most of these accessories were sold directly by Motorola, but
a wealth of add-ons and reproduction parts were available
from a variety of other companies as well.
Although it is beyond the scope of this page to describe
every single accessory ever made for the SABER, the most important
ones are highlighted below.
|
|
Many different batteries have been produced for the SABER series
over the years. As the high-power version of the SABER can produce
an output power as high as 6W, high-capacity batteries are needed.
There were three battery sizes, but the most common ones are
the standard battery (84 mm) and an ultra-high capacity variant,
that is somewhat higher (103 mm).
|
Either type can be charged with a dedicated Motorola
SABER battery charger, such as the one shown below.
Such chargers typically status of the battery and will indicate
a faulty one. The recommended Motorola batteries are shown in the
table below [6]. Good alternatives were available from other
manufacturers as well.
The image on the right shows a typcial high-capacity Motorola NiCd
battery, aside a SABER I hand-held radio. When carrying the radio
on the belt in a carrying case or holster, ensure that the case is
suitable for the higher batteries.
|
|
|
As the SABER radios were produced many years ago, their batteries
are likely to be worn-out out by now, resulting in shorter usage times
or completely dead batteries. In such cases it might be wise to
replace the batteries with modern alternatives. Good replacement
batteries, using Li-ION technology, are available from various
sources and even from auction sites, such as Ebay.
|
|
Part No
|
Voltage
|
Capacity
|
Type
|
Remark
|
|
|
|
NTN4537
|
7.5V
|
700 mAh
|
NiCd
|
Light capacity
|
|
NTN4592
|
7.5V
|
700 mAh
|
NiCd
|
Light capacity
|
|
NTN4538
|
7.5V
|
1000 mAh
|
NiCd
|
Medium capacity
|
|
NTN4593
|
7.5V
|
1100 mAh
|
NiCd
|
Medium capacity
|
|
NTN4595
|
7.5V
|
1800 mAh
|
NiCd
|
Ultra-high capacity
|
|
NTN4596
|
7.5V
|
1800 mAh
|
NiCd
|
Ultra-high capacity
|
|
NTN4992
|
7.5V
|
1800 mAh
|
NiCd
|
Ultra-high capacity
|
|
|
|
NTN7014
|
7.5V
|
950 mAh
|
NiMH
|
Light capacity
|
|
NTN7426
|
7.5V
|
950 mAh
|
NiMH
|
Intrinsically safe
|
|
NTN7058
|
7.5V
|
1800 mAh
|
NiMH
|
Ruggedized
|
|
|
|
NTN4905
|
7.5V
|
?
|
Li
|
Disposable, not rechargeable
|
|
A wide range of battery chargers was available for the SABER,
ranging from single slow-charging units, to super fast chargers
that can take up to six radios simultaneously.
The image on the right shows the most common fast charger
for a single SABER hand-held radio.
The complete radio (with battery) can be placed directly in the
charger, but it is also possible to
charge individual batteries separately
this way. A set of back-lit icons on the sloped panel at the right
shows the charging status.
|
|
|
|
When used as a hand-held radio, the built-in microphone and speaker
of the SABER, located at the front panel, are used. When the radio
is carried on the belt however, it is often more convenient to use
an external speaker/mike with it, such as the one shown below.
|
External microphones can be connected to the
accessory socket at the
rear of the radio, near the antenna socket.
The image on the right shows a typical Motorola speaker/microphone
that was commonly used with SABER radios.
The microphone has an
adjustable spring-loaded clip at the back,
allowing it to be attached to the clothing of the operator.
At the other end of the curly cord is the plug that connects it
to the accessory socket of the radio. It usually
fits around the corner
of the radio and is held in place by a single
hex safety bolt.
|
|
|
Fitting the microphone to the radio sometimes requires
special tools,
such as a special bit
for the hex safety bolt. On other versions, the plug is held in place
by a simple cross-head screw. The microphone shown in the image
has its cord coming out of the plug under a 45 degree angle.
|
Furthermore, it has a large connector that is fitted around
the corner of the radio to provide extra strength.
Most other models however, have a straight cable entry and a somewhat
simpler connector that is fitted only at the back.
The accessory socket
also carries the antenna signal, allowing the use of microphones
with an helical antenna mounted on top of it. Such microphones are
commonly called Public Safety Microphones. The image on the right
shows an example. Because of the size of the antenna, these models
are only practicle for use on UHF.
|
|
|
Public Safety Microphones
were often used in cities with large buildings, as the extra height
of the antenna (usually on the shoulder, whilst the radio was carried
at the belt) expands the operational range. Public Safety Microphones
always have a straight cable rather than a curly one.
|
|
Especially for surveillance and inconspicious operation, Motorola had a
range of surveillance kits available, ranging from skin-coloured acoustic
ear tubes and hidden PTT switches, to invisible inductive earpieces.
Similar surveillance kits were available from other manufacturers as well.
|
Most surveillance kits make use of a so-called quick-disconnect 6-pin
Hirose plug, requiring a special adapter on the SABER radio.
Using such a standardized connector allows the surveillance kits to be
used on a variety of radios, and allows them to be disconnected quickly
without the need to remove the universal connector at the back of the
SABER each time (e.g. for keyload).
The image on the right shows a Motorola ZMN-6031 surveillance kit
with three wires, consisting of an earphone, a minature microphone
and a so-called bullet-type Push-To-Talk switch (PTT).
|
|
|
For operation with a wireless earpiece,
the Saber can be fitted with an induction loop (neckloop),
or with a flat induction coil, such as the one made by MPS
shown in the image on the right.
The induction coil has a safety pin by which it can be fitted
to the user's clothing, and connects to the Saber by means of
a Hirose plug. A skin-coloured push-to-talk switch (PTT) is
provided for in-hand operation.
|
|
|
When the Saber is used with an inductor or neckloop,
a wireless in-ear inductive earpiece was used, such as the
Danavox 131-CD/T
shown in the image on the right. The device is powered by a single
button-type battery cell, and fits entirely inside the user's ear canal.
➤ More information
|
|
|
Surveillance kits are available with two cables (combined
microphone and PTT), or one cable (receive only). In addition,
there are variants with a higher audio output level. These
surveillance kits all have a 6-pin Hirose connector, allowing them
to be quickly connected to a SABER that is fitted with a Hirose adapter.
Please note that there are different versions of this adapter.
If the radio is crypto-capable, the
NTN5664 adapter is required.
➤ Hirose pinout
|
|
|
-
Please note that the NTN5664 (i.e. the keyload capable version)
has the limitation that it can only be used with low-volume accessories
such as a surveillance kit. Tuning the volume up too high when
using a standard microphone/speaker combination, will result in
a cracking sound, whilst the radio switches intermittently
into keyload mode. Hirose connections can be found here.
|
|
Part No
|
HA 1
|
Mic
|
PTT 2
|
Ear
|
Wires
|
Remark
|
|
|
|
ZMN6031
|
| | | |
3
|
-
|
|
ZMN6032
|
| | | |
2
|
-
|
|
ZMN6038
|
| | | |
2
|
Extra loud version of ZMN6032
|
|
ZMN6039
|
| | | |
3
|
Extra loud version of ZMN6031
|
|
NSN6050
|
| | | |
1
|
Earpiece only
|
|
-
Requires a Hirose adapter
-
Separate PTT switch (i.e. not combined with microphone).
|
|
SABER hand-held radios are commonly used in combination with short
helical-type antennas.
Depending on the frequency band and section
(split) on which the radio is used, a different type of antenna is
required. Older rubber-encapsulated
original Motorola antennas
were usually marked with a coloured dot
at the bottom of the screw at the base of the antenna (see below).
|
The image on the right shows a typical original Motorola VHF antenna,
which has a yellow dot at the tip of the screw, indentifying its
frequency range from 136 to 151 MHz. For other band sections, use
the table below as a guide [2].
Please note that a helical antenna is always a compromise.
In an ideal situation, the antenna length should be a quarter of
the wavelength, often indicated as ¼λ. As the wavelength of
a 150 MHz signal is 2 meters, a ¼λ antenna would be 50 cm,
which would not be very practicle. In such situations, the
shorter helical was used.
|
|
|
A helical is in fact a ¼λ antenna which is wound-up, like
a coil, and is far from ideal compared to a full ¼λ antenna.
The antenna is shorter than the original one and can be seen as a compromize,
resulting in a reduced operational range.
The range is further reduced by the fact that in most situations the
antenna is carried close to the human body (e.g. on a belt).
The range can be improved by using a full ¼λ antenna,
such as the UHF whip antenna (see the table below). By making the
antenna thicker, Motorola has managed to cover the entire UHF band
from 403 to 512 MHz with a single antenna.
Alternatively, the operational range could be extended by using
a so-called Public Safety Microphone with a helical mounted on top.
Due to the size of the antenna, this was only practicle for UHF radios.
Please note that the antennas listed here can not be used on the Public
Safety Microphone, as it has a different fitting.
|
|
Colour
|
Section
|
Remark
|
|
|
|
Yellow
|
136-151 MHz
|
VHF
|
|
Black
|
146-162 MHz
|
VHF
|
|
Blue
|
157-174 MHz
|
VHF
|
|
|
|
Red
|
403-435 MHz
|
UHF
|
|
Green
|
435-470 MHz
|
UHF
|
|
Black
|
470-512 MHz
|
UHF (shorter than the black VHF antenna)
|
|
According to the SABER spare parts catalogue [6], the following antennas could be ordered:
|
|
Part No
|
Section
|
Remark
|
|
|
|
8505477T02
|
74-88 MHz
|
MIDBAND helical
|
|
|
|
8505816K22
|
136-150.8 MHz
|
VHF helical, was 8505816K01
|
|
8505816K21
|
146-162 MHz
|
VHF helical, was 8505816K03
|
|
8505816K23
|
157-174 MHz
|
VHF helical, was 8505816K05
|
|
|
|
8505816K24
|
403-433 MHz
|
UHF helical, was 8505816K07
|
|
8505816K25
|
440-470 MHz
|
UHF helical, was 8505816K08
|
|
8505816K26
|
460-512 MHz
|
UHF helical, was 8505816K09
|
|
8505247K04
|
403-512 MHz
|
UHF whip, full range
|
|
NAE6440B
|
403-520 MHz
|
UHF whip, full range
|
|
A variety of carrying cases was available for the SABER series,
allowing the radio to be carried on the belt. The image on the
right shows a typical original Motorola leather carrying case,
with the optional T-Strap to hold the radio in place [6].
Note that not all carrying cases can cope with the large (corner)
plug of some external microphones, as the side of the case might
be in the way. Special versions,
with a lower cut-out, were available
for such microphones.
|
|
|
|
Rather than using a heavy duty leather or nylon carrying case, such as
the one illustrated above, it was also possible to carry the SABER radio
on the belt, using a special Motorola belt clip. As the radio comes in two
different case sizes, two different belt clips were available from
Motorola.
|
The belt clip is a rather simple metal bracket that can be attached to
the rear size of the radio. One side hooks into a rig at the
top of the radio,
whilst the other end
'clicks' into a cut-out at the bottom of the radio,
close to the battery fitting.
The belt clip can be removed again,
by putting a screwdriver into a small
rectangular hole in the battery fitting, and pushing the clip out.
The image on the right shows two different belt clips; one for each case
variant.
|
|
|
As the exterior of all SABER radios are more or less identical, it is
often difficult to determine the exact type of radio. In most cases
it is possible to establish the model (not the exact frequency range)
fom the FACTORY ID (not the MODEL NO) that is present on a label
at the back of the radio. This ID consists of 12 characters.
For example, the ID of a VHF crypto-capable SABER I is:
Each character or group of characters describes a specific feature
of the radio. Use the table below to 'decode' the FACTORY ID of
your radio. Although it is possible to determine the frequency
band this way (VHF, UHF), it is not possible to identify
the band section installed in the radio. The only way to do
that, is by examining the numbers on the individual modules
inside the radio, or by connecting the radio to a PC and reading
it out with Motorola's special RSS software.
On some radios, the FACTORY ID is not present. In such cases the
MODEL NR is often used instead. It might, however, be preceeded
by two additional letters, e.g. MD. This is often the case with
international version of the Motorola SABER. For example, we found
an international low power UHF submersible SABER I,
with the following MODEL NR on the label at the back:
|
Product type
HHandheld
ZSpecial product
|
|
|
Output power
3Low - 1 or 2.5W (VHF), 1 or 2W (UHF)
4High - 1 or 6W (MB), 2 or 6W (VHF), 2 or 5W (UHF)
|
|
|
Frequency band
2MB: 68-88 MHz
3VHF: 136-174 MHz
4UHF: 403-512 MHz
|
|
|
Case variant
SAStandard, non-secure (clear)
YBSubmersible, non-secure
QXStandard, secure (crypto-capable)
YXSubmersible, secure
|
|
|
Features
NStandard, one channel zone, no keypad, SABER I
GTwo channel zones, no keypad, SABER IE
JDisplay, three red buttons, menu, SABER II
KDisplay, full keyboard, menu, DTMF, SABER III
|
|
|
Firmware
7Binary CORE (US)
9Tone CORE (international)
|
|
|
Bandwidth (VHF only)
1Wide band
5Narrow band - 12.5 kHz
|
|
|
Channel selector
010 channels (international)
312 channels (US)
|
|
|
Revision
AOriginal revision
CScan capable version 1
|
|
|
-
A SABER I radio is not capable of using the SCAN feature, even
if it is a C-revision, simply because there are no buttons to control it.
|
Package
-(blank) Warranty replacement radio, bare radio
NComplete package, with antenna and battery
|
|
|
|
There are many types/versions of SABER, each with their own specific frequency
band and range (also known as frequency split). Only the band can be determined
from the model number at the back of the radio; the specific band section
(i.e. the split) can only be determined by examining the numbers on the
internal modules. The following frequency bands/sections are known:
|
|
Band
|
Section
|
Remark
|
|
|
|
MB
|
66-84 MHz
|
|
|
MB
|
74-88 MHz
|
|
|
|
|
VHF
|
136-150.8 MHz
|
Government split. Ideal for HAM, MARC and CAP
|
|
VHF
|
146-162 MHz
|
Suitable for HAM (144-148) with modified RSS
|
|
VHF
|
146-174 MHz
|
Wideband version, suitable for HAM
|
|
VHF
|
148-174 MHz
|
Wideband used in lower power version
|
|
VHF
|
157-174 MHz
|
Public and commercial services
|
|
|
|
UHF
|
403-433 MHz
|
Government split. Suitable for EU HAMs (430-438).
|
|
UHF
|
440-470 MHz
|
Suitable for all HAMs (431-450)
|
|
UHF
|
458-490 MHz
|
|
|
UHF
|
482-512 MHz
|
|
|
The interior is shielded at both sides. The
shield at the rear is held in place by 4 bolts
that can be removed in order to reveal the
component side of the main PCB. The shield at
the front side holds the speaker and the microphone. It can be removed
by lifting the panel with a screwdriver.
Be careful not to damage the flex wiring of the front panel when
removing it.
The flex connects to the main board by means of a small connector that is
fitted in the bottom corner of the radio.
Pull carefully to remove it. SABER II and III units have an
extra flex cable for the control panel.
|
|
|
All modules can be accessed from the front side of the radio (i.e. the
side that is visible in the image above). They are all socketed and can
be removed easily, making the SABER into a service-friendly radio.
Some modules are bolted to the main PCB at the bottom. The diagram below
shows the location of each of the modules of a crypto-capable SABER,
seen from the front.
The crypto module is not present in the non-secure version of the SABER.
It can be removed
by inserting a small screwdriver at either side and
carefully wiggeling it until it comes out.
The synthesizer can be pushed
put of its socket by inserting a push tool or a screwdriver into two
holes in the main PCB (bottom). The Power Amplifier (PA)
is bolted to the side frame (2 bolts)
and to the main PCB (1 bolt). It needs the
frame of the radio for sufficient cooling when transmitting.
The FDS (short for Filter, Detector and Switch)
is the antenna relay. It is fitted to the receiver
with a single bolt. The receiver is
connected to the main PCB by means of just 3 contact pins at the bottom,
and can be removed easily, by removing two bolts (bottom).
The receiver consists of two parts that are mounted together:
the actual receiver and a 5-pole filter.
Finally, the reference oscillator can be pulled from its socket,
leaving the radio empty.
All modules are listed below.
|
Communications security
The radio is extremely well built with only first class
components. At the front is the
keyboard and the LCD screen (if present).
At the bottom is the main
PCB with 7 purpose-built chips clearly visible.
The PCB is also the carrier for a number of modules on the inside of the radio.
|
The keyboard at the front can be lifted and folded away,
so that the interior is revealed.
At the bottom of the unit, the crypto module
is clearly visible. A variety of different crypto modules
was available from Motorola,
including DES, DVP, DES-XL, DVP-XL and DVI-XL.
All crypto modules had the same physical size.
Depending on the customer's needs, export restrictions, etc.,
a different module would be supplied.
The module shown here is the NTN5836A, which is probably a
Smartnet DVI-XL variant (Digital Voice International).
|
|
|
Motorola had a wide range of cryptographic modules available, for a variety
of secure networks, including Smartnet, Multikey and OTAR (Over The Air
Rekeying). For each network type, different cryptographic algorithms were
available, including DES (Digital Encryption Standard), DVP
(Digital Voice Protection) and DVI (Digital Voice International) [2].
There even was a CCI-version (Controlled Cryptographic Item)
that supported the NSA-developed
FASCINATOR encryption module.
The latter was based on 12 kbit/s CVSD modulation which was encrypted
with SAVILLE,
an NSA Type 1
encryption algorithm based on the
KY-57 (VINSON) [3].
|
|
Secure-capable versions of the Saber (Securenet) are slightly longer
than non-secure variants. The extra space is used to accomodate a crypto
plug-in module.
A variety of modules was available, for different networks and for different
crypto algorithms, such as DES, DES-XL, DVP and DVP-XL.
|
Although all modules are pin compatible, certain modules
(such as FASCINATOR) can only be used in
authorised radios (US non-export versions). Crypto-capable radios
without a crypto module, must have an NTN4720 dummy installed.
All crypto modules have the same form factor and are encapsulated in a
metal can (or in a plastic can with metal paint). The image on the right
shows the NTN5836 DVI-XL crypto module that came
with our SABER II [1]. Don't let the (small) size fool you; encryption
modules like this are really complicated electronic circuits.
|
|
|
|
At the bottom of the module are two rows of pins that are lined up with
two rows of holes (sockets) on the main PCB. They carry the necessary
voltages, audio signals and (digital) control signals for secure operation.
Theoretically, the socket for the crypto module can also be used for other
extensions to the radio, such as a customized selective tone call system,
or the man-down module shown in the next section below.
Note that such a module may not need all contact pins.
|
The metal can of the module (shield) is soldered to pin 12 and 19 of
the socket. After unsoldering these two contact lips, the interior
of the module can be removed from the can.
The image on the right shows the interior
of the DVI-XL module.
The crypto module consists of a square flex PCB with all components
on one side. The flex is then folded three times,
so that we effectively get 4 sides that carry components. Both ends of the
flex are integrated with the plastic connector at the bottom, that consists
of two halves. It can be separated in order to
unfold the flex PCB.
|
|
|
The crypto module was designed with convenience in mind.
Although it would technically be possible to repair a faultly
module, it seems unlikely that this was ever done. Unfolding the flex
PCB can easily lead to broken tracks. In practice, a broken module would
simply be replaced by a new one.
The image above shows the flex PCB partly unfolded.
On the flex PCB are 6 custom chips, two crystals and several other components.
The drawing below shows how
the contact pins are ordered, looking into the sockets of the radio. Two large
holes (A and B) are used as guides. Pins 12 and 19
are connected to the shield of the module (i.e. tow lips of the metal can).
A crypto-capable SABER, without a crypto module, can not transmit sound.
In order to make the radio work, a dummy module should be installed instead.
In the dummy module, only the wire between pin 1 and 17 (dotted in the
drawing above) is present. Alternatively, a short piece of thin wire could
be installed directly between terminals 1 and 17. Some people have reported
'spurious noise' when transmitting. In such cases a shielded (and grounded)
wire should be used instead.
|
|
The following encryption modules are known:
|
|
Module
|
Version
|
Algorithm
|
Remark
|
|
|
|
NTN1071
|
(non) Smartnet
|
DES-XL
|
|
|
NTN1072
|
(non) Smartnet
|
DES
|
|
|
NTN1073
|
Smartnet
|
DVP-XL
|
Discontinued
|
|
NTN1074
|
(non) Smartnet
|
DVP-XL
|
|
|
|
|
NTN4711
|
non-Smartnet
|
DVP
|
|
|
NTN4712
|
non-Smartnet
|
DES
|
Replaced by NTN1072
|
|
NTN4713
|
non-Smartnet
|
DVP-XL
|
Replaced by NTN1074
|
|
NTN4714
|
non-Smartnet
|
DES-XL
|
Replaced by NTN1071
|
|
|
|
NTN4720
|
All
|
-
|
Dummy module (bypass)
|
|
|
|
NTN5832
|
Smartnet
|
DVP
|
|
|
NTN5833
|
Smartnet
|
DES
|
Replaced by NTN1072
|
|
NTN5834
|
Smartnet
|
DVP-XL
|
Replaced by NTN1073
|
|
NTN5835
|
Smartnet
|
DES-XL
|
Replaced by NTN1071
|
|
NTN5836
|
Smartnet
|
DVI-XL
|
|
|
|
|
NTN5755
|
Multikey
|
DVP
|
DVP = Digital Voice Protection
|
|
NTN5756
|
Multikey
|
DVP-XL
|
Enhanced version of DVP
|
|
NTN5757
|
Multikey
|
DES
|
DES = Digital Encryption Standard
|
|
NTN5758
|
Multikey
|
DES-XL
|
Enhanced version of DES
|
|
NTN5759
|
Multikey
|
DVI-XL
|
DVI = Digital Voice International (export)
|
|
|
|
NTN5760
|
OTAR
|
DVP
|
OTAR = Over The Air Rekeying
|
|
NTN5761
|
OTAR
|
DVP-XL
|
|
|
NTN5762
|
OTAR
|
DES
|
|
|
NTN5763
|
OTAR
|
DES-XL
|
|
|
|
|
NTN7288
|
Multikey
|
DVP
|
Replaced by NTN5755
|
|
NTN7289
|
Multikey
|
DVP-XL
|
Replaced by NTN5756
|
|
NTN7290
|
Multikey
|
DES
|
Replaced by NTN5757
|
|
NTN7291
|
Multikey
|
DES-XL
|
Replaced by NTN5758
|
|
NTN7292
|
Multikey
|
DVI-XL
|
Replaced by NTN5759
|
|
|
|
NTN7298
|
FASCINATOR
|
SAVILLE
|
Type-1 Controlled Cryptographic Item (CCI)
|
|
As you can see in the above table, there are basically 6 different types
of encryption available for a Motorola SABER (and in fact for most other
analogue Motorola radios). These types can be broken down to four distinct
encryption methods or protocols: DVP, DES, DVI and SAVILLE. The first
three (DVP, DES and DVI) are protocols that are publicly available
(although some export restrictions are imposed), but SAVILLE
is for use by the US Government and
NATO only.
|
According to the patent,
DVP is short for Digital Voice Protection.
It is a proprietary encryption algorithm, which was internally known
as VULCAN [11].
Using a self-synchronising cipher known as an autoclave
or Cipher Feedback (CFB) or Ciphertext Auto-Key (CTAK),
it was approved for export.
DVP allows 2.36 · 1021 = 271 different keys to be
entered (71 bits) but internally requires 138 bits 1 for its operation.
Research has meanwhile demonstrated that DVP is notoriously weak and
easy to break, even by the standards of the 1970s when it was developed [11].
➤ The VULCAN (DVP) encryption algorithm
|
-
The encryption chip inside the DVP module needs a 138-bit key.
Inside the keyloader (e.g. T3010) the 71 user-entered bits are
expanded to 138 bits.
|
|
DES, or Data Encryption Standard, was developed in the mid-1970s
by IBM and the US National Security Agency (NSA)
in an attempt to harmonize the encryption systems used by
individual government agencies. DES allows interoperable secure voice
communication between agencies. The DES protocol allows 7.2 · 1016
(or 256) different keys to be used and is therefore known as
a 56-bit encryption protocol.
It was used for example by many police forces in the US.
For a long time, DES was considered
a strong and classified (US-only) system that could not be exported
outside the USA. This is no longer the case.
|
Shortly after the introduction of the DVP and DES encryption modules
for the Motorola SABER, it became clear that the addition of
(digital) voice encryption reduced the operational range of the
radios significantly, in some cases by as much as 30% [4].
This was the result of the so-called error propagation in the
self-synchronising Cipher Feedback (CFB) system that was
used by both encryption modules (DVP and DES).
A similar effect was seen in 1976 in the
Philips Spendex 10.
Motorola engineers solved the problem by using a different type of
self-synchronising algorithm, known as counter addressing,
and introduced two new encryption modules, DVP-XL
and DES-XL that were drop-in replacements for the earlier
DVP and DES modules. Note that the XL-variants are not
compatible with the earlier variants. Also note that in the
case of DVP-XL the number of possible keys was enhanced to
7.9 · 1028 (or 296), making it a 96-bit protocol [4].
Furthermore, DVP-XL is based on the proprietary LINUS algorithm
and not on VULCAN (DVP).
|
|
As DES was a restricted protocol for many years, exporting it
from the US required a special license. Motorola therefore
developed DVI, or Digital Voice International which
is similar to DES, but has a reduced number of possible keys.
As it uses the same self-synchronising system as DVP-XL and
DES-XL, the letters XL were added to DVI as well.
Although not very popular in the US, DVI-XL is often found
in European countries, such as the UK [4].
|
Although DES was allowed for sensitive but unclassified
information, it was too weak for TOP SECRET communication.
A special encryption module, known as FASCINATOR, was
developed for exclusive use by the US Government and NATO.
It was adopted as
Federal Standard 1023 [12].
It uses 12 Kb/s CVSD modulation combined with the
GCHQ/NSA-developed
SAVILLE encryption algorithm
that was also used in the
KY-57 (VINSON).
For interoperability with KY-57,
the KY-57 had to be modified for 12 Kb/s
rather than the default 16 Kb/s.
Although FASCINATOR modules are CCIs
(NSA Suite A,
Type-1),
they have been found inside SABER radios
on the surplus market.
Keys were initially supplied by NSA on 8-level
punched paper tape for loading by means of a
KOI-18 fill device, in combination with a special adapter
box and cable. As the SAVILLE keys are 128 bits long, it is also possible
to use a KYK-13 or CYZ-10 fill device
for distribution of the keys.
|
|
In an MX-1000 that was issued by the Dutch PTT, we found an
unmarked module in the slot that is intended for the secure voice encryption
module. After some investigation and with help of some of our readers,
we have since determined that this is a so-called man-down module.
|
The image on the right shows the interior of the man-down module.
Compared to a crypto unit, this unit is rather simple.
It consists of two small PCBs: one at the bottom, that is
basically used as the connector, and the actual circuit that is mounted
vertically on top of the bottom PCB.
Most of the components are on the
top side of the PCB, where a Motorola custom
chip (35U05) forms the heart of the unit. According to the date code on
the custom chip, it was made in week 23 of 1995.
The small crystal is probably used for the chip's reference oscillator
or RTC.
|
|
|
At the far end of the board is a circular metal can that resembles
a transistor. It is in fact a tilt switch that uses (liquid) mercury
as the switching element. In this case, the tilt switch is used as
man-down detection. If the person carrying the radio (e.g. money transport)
falls on the ground, the tilt switch is either closed or broken,
in which case the radio can send an emergency code.
The image above shows the footprint of the man-down module, when
looking into the sockets of the radio's main PCB. Note that not
all pins are used on this module. The ones that are used, are
marked as black dots in the drawing above. Pins 1 and 17 are connected
inside the module, to ensure that the transmitter produces audio.
This confirms that this is not en encryption module.
The man-down module was found inside an MX-1000 in The Netherlands,
with no FACTORY ID at back. When the module is installed
and the SECURE switch in on (i.e. set to I), it start transmitting autonomously
at regular intervals. Every transmission starts with a 5-tone
sequency, followed by a series of short beeps. After a few seconds
of silence, the unit returns to receive mode again.
Update 19 May 2015
The man-down module was developed in the mid-1990s as a special project
at Motorola by Michael Wilkinson [9]. It has two separate mercury switches:
one for tilt and one for movement, and its timing could
be programmed with a special version of the Radio Service Software (RSS),
in which 4-bytes of the radio's internal EEPROM were reallocated to the
man-down module.
As Motorola initially expected to sell only 100 units,
it was not possible to develop a dedicated molding, hense the somewhat
improvised enclosure and PCB. The locating pins (to guide the unit into
the Saber's motherboard) were simply cut-off pieces of welding rod.
The custom 35U05 chip is in fact a Motorola 68HC08 processor that was
repackaged in order to fit the available space.
|
|
Module
|
Section
|
Remark
|
|
|
|
NXN6268
|
16.8 MHz
|
Common to all models
|
|
|
Module
|
Section
|
Remark
|
|
|
|
NLC6240
|
66-84 MHz
|
-
|
|
NLC6241
|
74-88 MHz
|
|
|
|
|
NLD8201
|
136-150.8 MHz
|
|
|
NLD8210
|
146-178 MHz
|
Used for 146-162, 148-174 and 157-174 sections
|
|
|
|
NLE9461
|
403-433 MHz
|
Government split
|
|
NLE9462
|
440-470 MHz
|
|
|
NLE9463
|
460-490 MHz
|
|
|
NLE9464
|
482-512 MHz
|
|
|
-
Only one receiver module is used for the entire VHF band. The 5-Pole Filter
determines the actual frequency section (split).
-
The 5-Pole Filter is the bottom half of the receiver module.
-
The 2-Pole Filters are only present MIDBAND and VHF receivers. They are located
between the actual receiver and the FDS (see below). It is not present in UHF radios.
|
|
|
Filter Detector Switch (FDS)
|
|
|
|
Module
|
Section
|
Remark
|
|
|
|
NLC6250
|
66-84 MHz
|
-
|
|
NLC6251
|
74-88 MHz
|
|
|
|
|
NFD6131
|
136-150.8 MHz
|
|
|
NFD6132
|
146-178 MHz
|
Used for 146-162, 148-174 and 157-174 sections
|
|
|
|
NFE6061
|
403-470 MHz
|
|
|
NFE6062
|
470-512 MHz
|
|
|
|
Module
|
Section
|
Power
|
Remark
|
|
|
|
NLC6260
|
66-84 MHz
|
-
|
|
|
NLC6261
|
74-48 MHz
|
-
|
|
|
|
|
NLD8121
|
136-150.8 MHz
|
6W
|
Ideal for HAM radio use
|
|
NLD8773
|
146-174 MHz
|
6W
|
Suitable for HAM radio use
|
|
NLD8122
|
146-162 MHz
|
6W
|
Suitable for HAM radio use
|
|
NLD8133
|
146-178 MHz
|
2.5W
|
Suitable for HAM radio use
|
|
NLD8123
|
157-174 MHz
|
6W
|
|
|
|
|
NLE4082
|
440-470 MHz
|
5W
|
Often hand-written on the case of an NLE9852 1
|
|
NLE9471
|
403-433 MHz
|
5W
|
|
|
NLE9472
|
440-470 MHz
|
5W
|
|
|
NLE9473
|
460-490 MHz
|
5W
|
|
|
NLE9474
|
482-512 MHz
|
5W
|
|
|
NLE9483
|
440-470 MHz
|
2W
|
|
|
NLE9852
|
440-470 MHz
|
2W
|
Also see NLE4082 1
|
|
-
Note that some NLE4082 modules were delivered in the packaging
of an NLE9852 (or indeed any other PA module). In such cases, the
original number of the module is printed on the case, whilst the
new number (NLE4082) is hand-written on it. In such cases, the
hand-written number NLE4082 is the actual one.
|
Each SABER radio has an accessory socket at the back, just below
the antenna base. It consists of 12 flat-faced circular contact pads,
arranged in a 3 x 4 matrix, plus two concentric contacts for an external
antenna. The socket can be used for example for an external speaker/microphone.
The table below shows the pinout of the accessory socket. Please note
that the ground pin (GND) is taken from the outer ring of the
external antenna connection at the top. A typical accessory plug is hooked
into the rectangular gap at the bottom of the socket and covers all contact
pads. The plug is then locked in place with a 3 mm bolt at the top left.
The socket is also used for programming the radio and for loading the
cryptographic keys into a crypto-capable radio.
|
|
#
|
Name
|
Remark
|
|
|
|
1
|
SPK(+)
|
External speaker (+)
|
|
2
|
SPK(-)
|
External speaker (-)
|
|
3
|
DATA
|
Bi-directional programming data
|
|
4
|
MIC
|
External microphone
|
|
5
|
WE
|
Write Enable (when pulled low)
|
|
6
|
BUSY
|
|
|
7
|
OPT SEL
|
Voltage selected option (internal 20K pull-up) see table below
|
|
8
|
OPT B(+)
|
+7.5V from radio (raw battery voltage)
|
|
9
|
KEY
|
|
|
10
|
KEYLOAD
|
|
|
11
|
AUX TX
|
or DVP CLK
|
|
12
|
n.c.
|
Unused
|
|
13
|
GND
|
RF Ground, also used as 0V rail (same as 15)
|
|
14
|
ANT
|
Antenna, RF output
|
|
15
|
GND
|
RF Ground, also used as 0V rail (same as 13)
|
|
The voltage at pin 7 (OPT SEL) allows the selection between the internal
or external microphone, speaker and antenna. The pin is internally pulled-up
to the +5V rail with a 20K resistor. By connecting a resistor (or a zener
diode) from this pin to ground, a voltage divider can be created, that
provides the appropriate voltage for selecting one of the configurations
in the table below.
|
|
#
|
Voltage
|
MIC
|
SPK
|
ANT
|
Remark
|
|
|
|
1
|
5.00 V
|
INT
|
INT
|
INT
|
Default operation
|
|
2
|
1.24 V
|
EXT
|
EXT
|
INT
|
External microphone/speaker and standard antenna
|
|
3
|
2.50 V
|
EXT
|
EXT
|
EXT
|
All external (microphone, speaker and antenna)
|
|
4
|
3.74 V
|
INT
|
INT
|
EXT
|
External antenna only
|
|
TX
|
0.00 V
|
-
|
-
|
-
|
PTT (Push-To-Talk switch)
|
|
Please note that shortening pin 7 to ground (i.e. making it 0V as indicated
in the table above) causes the radio to transmit. The diagram below
shows how to connect a standard microphone-speaker combination to the
universal connector, whilst using the standard (internal) antenna.
Note that a zenerdiode (Z) is used to clamp the voltage level at pin 7
(OPT SEL) to 1.24V in order to select option 2 (external microphone and
speaker, and internal antenna).
The Push-To-Talk switch (PTT) is connected in parallel to this diode
and momentarily changes the voltage to 0V when closed.
Alternatively, the zenerdiode may be replaced
by two standard signal diodes (e.g. 1N4148) in reverse direction.
Ground (GND) is taken from the ring of the antenna connector.
As an alternative to the above, it is also possible to use a simple
6K8 resistor instead of the diodes above. In fact, this is the way it
is done in most Motorola accessories. As pin 7 of the accessory socket
is internally tied to the 5V rail via a 20K resistor (Ri),
we can calculate the value of the external resistor (Re)
as follows:
Re = (20·U7) / (5-U7) [K].
U7 is the voltage at pin 7.
Ideally, the value for the external resistor would be 6.666K, but as
this is not available, we can safely round it off to the nearest one in
the E12-range: 6K8. This calculation can also be used for the
other voltages: 62K for 3.75V (external antenna) and 20K for 2.5V
(all external).
|
It is also possible to use the internal microphone and speaker, but an
external antenna. This can be useful, for example, when using the radio
from within a car or when measuring the RF output when adjusting the radio.
By applying a voltage of 3.74V to pin 7 of the universal connector, the
radio switches to the external antenna. The external antenna adapter
is wired as follows:
As pin 7 of the universal connector is internally pulled up to +5V
with a 20K resistor, the 59K resistor in the adapter effectively forms
a voltage divider, resulting in a voltage of approx. 3.74V. Most
external antenna adapters only have a few pins present in the universal
connector, but there are some that are fully populated with pins.
The latter can be converted to a full test cable.
|
|
When using a Hirose adapter, e.g. for connecting a
surveillance kit
or a keyloader with a Hirose plug,
the accessory has to be wired according
to the connection diagram below. Please note that the accessory sensing
pin 6 (EXT) has to be tied to ground (pin 4) to select the external
microphone and speaker. A special voltage (as described above) is not
necessary; this is provided by a special chip inside the Hirose adapter.
The pin-out of the socket is as follows:
|
MIC Microphone B(+) +5V DC SPK Speaker GND Ground PTT Push-To-Talk EXT External accessory select
|
|
|
|
Hirose with external microphone
|
|
|
When rewiring an existing microphone, headset or surveillance kit,
or when creating your own one, you may follow the leftmost
wiring diagram below. When using an electret microphone,
you must connect the +5V (B+) to it. This is either done directly
– if it is a 3-pin microphone – or via a 4K7 resistor
if it is a 2-pin electret microphone. In the latter case a capacitor
must be inserted in the MIC line to block the DC voltage,
as shown in the rightmost diagram below.
|
| |
Connecting an external microphone, speaker and PTT-switch
|
The plug (i.e. the cable end) has Hirose part number HR10A-7P-6P(73).
The receptacle (i.e. the socket fitted to the radio) has part number
HR10A-7R-6S(73).
If you want to make an extension cable, you might need a jack (female
cable part) with part number HR10A-7J-6S(73). These parts are
readily available from companies like Farnell and Digi-Key.
|
|
The following expressions and abbreviations are used on this page.
For additional keywords, please check the
global crypto glossary.
|
|
APRS
|
|
Automatic Packet Reporting System
(Website)
(Wikipedia)
|
|
CFB
|
|
Cipher Feedback
A block cipher mode that enhanced ECB mode by chaining together
blocks of cipher text it produces, and operating on plaintext segments
of variable length, less than or equal to the block length.
|
|
CTCSS
|
|
Continuous Tone-Coded Squelch System
System to reduce interference and annoyance of listening to unwanted
transmissions on the same channel of a two-way radio communications
channel. By including a sub-audio tone of a pre-determined frequency
in the transmission, the receiver at the other end will only 'open up'
if the sub-audio tone matches.
(Wikipedia)
|
|
DES
|
|
Data Encryption Standard
Universal encryption algorithm developed in the mid-1970s by the US
National Security Agency (NSA) for the protection
of voice, data and financial transactions.
Although initially intended for use exclusively by the US Government,
it was later released for use by the general public.
➤ More
➤ Wikipedia
|
|
DVP
|
|
Digital Voice Privacy
Motorola's own proprietary voice encryption system, based on a
self-synchronising Cipher Feedback (CFB) principle. The algorithm
is also known as Digitial Voice Protection.
➤ More
|
|
DTMF
|
|
Dual-Tone Multiple-Frequency
(Wikipedia)
|
|
ECB
|
|
Electronic Codebook
A block cipher mode in which a plaintext block is used directly as input
to the encryption algorithm and the resultant output block is used directly
as cipher text.
|
|
FASCINATOR
|
|
Encryption module for the Motorola SABER, with the same form factor as
the other encryption modules, that uses the classified GCHQ/NSA-developed
SAVILLE algorithm for the protection of speech (voice).
As SAVILLE is a Suite A (Type-1) cryptographic product, is was
produced exclusively for use by the US Government.
|
|
OTAR
|
|
Over The Air Re-keying
Method for the distribution of (new) cryptographic keys via the existing
radio channels, rather than manually using a Key Variable Loader (KVL).
In most cases OTAR requires the use of a dedicated Key Distribution Center
(KDC).
|
|
PL
|
|
Private Line
Motorola's trademark for CTCSS.
|
|
RSS
|
|
Radio Service Software
Dedicated (DOS-based) software, developed by Motorola, for programming
frequencies and features of a Motorola two-way radio.
➤ More...
|
|
SAVILLE
|
|
NSA
Suite A
(Type-1) encryption product,
jointly developed by GCHQ (UK) and NSA (USA)
for exclusive use by the US Government and organisations that are
approved by the US Government, such as NATO.
➤ More
|
SABER, Systems SABER, Astro SABER, Motorola, the 'bat' logo, DVP, DVP-XL
and RSS are registered trademarks of Motorola Inc., USA.
|
- US5363447 (key loading) - 26 March 1993
Method for loading encryption keys into secure transmission devices.
This patent describes how encryption keys (typically DES, DVP, DES-XL,
DVP-XL or DVI-XL) are loaded into a device (radio) and how they are
protected against evesdropping. The latter is done by using a Key
Encryption Key (KEK) generated by an internal free-running counter.
- US4167700 (DVP)- 2 May 1977
Digital Voice Protection System and Method. A description of Motorola's
own proprietary encryption algorithm, known as DVP.
- US5301232 (OTAR) - 5 November 1992
Method and Apparatus for over-the-air programming of communication
devices. This document describes Motorola's implementation of OTAR,
a method for distributing the cryptographic keys via a radio channel,
typically using a control device, such as a Key Management Controller (KMC).
The patent refers to earlier Motorola publications regarding Advances
Securenet, Multikey, OTAR and KMC.
- US5528691 (Group OTAR) - 5 October 1994
Method for Automatically Assigning Encryption Information to a Group
of Radios. This patent is an addition to US5301232 and descibes how
(group) keys can be sent to a group of radios rather than to each
radio individually.
- USD390554 (KVL 3000) - 31 May 1996
This patent protects the (case) design of the later
KVL-3000 Key Variable Loader (key filler).
It was a universal device that could be used to load virtually any
type of key into any type of (crypto-capable) Motorola radio.
|
- SABER, Theory/Maintenance Manual 1
68P81044C05-A. Motorola, 1989-1990.
- SABER series, (VHF/H) 136-174 MHz, Service Manual 1
68P81043C90-O. Motorola, 1988-1991.
- SABER series, (UHF) 403-512 MHz, Service Manual 1
68P81043C95-A. Motorola, 1988-1992.
- SABER series SECURENET, (VHF/M) 68-88 MHz, Service Manual 1
68P81063C30-O. Motorola, 1989-1991.
- SABER series SECURENET, (VHF/H) 136-174 MHz, Service Manual 1
68P81045C70-O. Motorola, 1987-1992.
- SABER series SECURENET, (UHF) 403-512 MHz, Service Manual 1
68P81045C75-O. Motorola, 1988-1992.
- SYSTEMS SABER and SABER ATS, Theory/Maintenance Manual 1
68P81060C20-O. Motorola, 1990-1991.
- SYSTEMS SABER SECURENET, (VHF/H) 146-174 MHz, Service Manual 1
68P81067C10-O. Motorola, 1990-1992.
- SYSTEMS SABER SECURENET, (UHF) 403-512 MHz, Service Manual 1
68P81066C95-O. Motorola, 1990-1997.
- SABER R, SECURENET SABER R, SECURENET SYSTEMS SABER, Service Manual
68P81071C20-A. Motorola, 1991-1992.
- SABER, Radio Service Software, User's Guide 1
68P81062C95-F. Motorola, 1990-1993.
- SABER Single-Unit Battery Charger, Instruction Manual 1
NTN4734A and NTN4786A single-unit rapid battery chargers.
68P81106C65-O. Motorola, 1987-1992.
- SABER and SYSTEMS SABER, Submersible Models, Instruction Manual 1
68P81107C16-A. Motorola, 1990.
- Remote Speaker Microphone NMN6128B (coiled cord), Instruction Manual
68P81107C36-O. Motorola, 1988.
|
 |
- Barry Wels, Motorola SABER II - THANKS !
SABER II radio featured on this page kindly donated by Barry Wels.
The Motorola SABER Information Page 1
This site provides a wealth of information about SABER radios.
Retrieved May 2012.
- Wikipedia, FASCINATOR
Retrieved May 2012.
- Doug G. Encryption Protocols
Batdude. 14 March 2006, first draft.
Retrieved May 2013.
- Batwing Laboratories, Miscellaneous information about (programming) Motorola stuff
BatLabs (website). Retrieved March 2013.
- Motorola, Saber Series Parts List
Retrieved from [2] March 2013.
Storno, Storno History 2
Website, 19 June 2003. Retrieved April 2013.
- Crypto Museum, The SAVILLE encryption algorithm
Interview at Crypto Museum. December 2011.
- Michael Wilkinson, Development of Man-Down module at Motorola
Personal correspondence. 1 May 2015.
- Bryan Fields (W9CR), SABER
Scanned SABER service manuals. Retrieved June 2022.
- Cornelius Jenkins Riddler, Vulcan: A Proprietary Cipher of the 1970s
September 2014.
- US Government, Federal Standard 1023
FED-STD 1023, 25 September 1989.
|
|
-
Website no longer available in 2017.
-
Website no longer available in 2023.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Saturday 12 February 2011. Last changed: Tuesday, 30 April 2024 - 12:34 CET.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| | |
![Motorola Saber II donated by Barry Wels [1]](img/301222/023/full.jpg)
