This file contains full details of the PRO-92's data transfer and memory
content.  The lion's share of this file was prepared by Bill Petrowsky.

==========================================================================

Data Flow to/from PRO-92

If you look at a spg file in a hex viewer, there are three parts:

Five "header" bytes: 02 00 00 00 00
26496 bytes of actual data
6272 null bytes (00)

The file size is always 32773.  The actual data plus the null filler at the
end amount to 32768 bytes, an obvious power of two.

When the 92 transmits in clone mode, the data stream consists of:

A sequence of fifty A5's
The sequence 01 98 03 52
26496 actual data bytes, in reverse order from their sequence in a SPG file
A terminating 5A

Serial protocol for the initial A5's and 01 98 03 52 is 4800,E,8,2.

After this 54-byte sequence, there is a pause of 52 msec.  The protocol
changes to 4800,O,8,2 for the actual data.  The data is transmitted in 828
packets of 32 bytes, with a pause of about 16 msec between packets.

After all of the actual data is sent, the protocol is switched back to
4800,E,8,2 for the terminating 5A.  That byte comes after the usual 16 msec
pause.

==========================================================================

Overall outline of the PRO-92 map with bytes in .spg file order.

Five "header" bytes: 02 00 00 00 00, addresses 0 to 4 (decimal).

Scan/search banks beginning with bank 0, addresses 5 to 24,434

        Scan frequency with mode, delay, lockout, attenuator, and PL/DPL
        settings; alpha tag. Repeated for all 50 channels in the bank.

        Search start frequency; mode, delay, lockout, attenuator settings;
        alpha tag; stop frequency; step size.

        Bank alpha tag; open/closed mode; bank type; fleet map.

        Search lockout frequencies, 50 frequencies.

        Talkgroup ID; alpha tag. Repeated for all 100 ID's in the bank.

Following the scan/search banks a preprogrammed weather bank is mapped
from address 24,435 to 24,614.

        Frequency with mode, delay, lockout, attenuator, and PL/DPL settings;
        alpha tag. Repeated for all 10 channels in the weather bank.

Following the weather bank the preprogrammed search banks are mapped
from address 24,615 to 26,414.

        Start frequency, step size, mode, stop frequency, and alpha tag;
        repeated for all 100 preprogrammed search ranges.

The 4 lines of the welcoming message are mapped next, 48 bytes of alpha
tags from address 26415 to 26462.

After the welcoming message a number of settings are defined from address
26,463 to 26,500.  These include backlight time, scan delay time, trunk
rescan delay time, minimum scan delay time, display contrast, priority
channel, last search frequency, priority enable/disable, WX priority
enable/disable, WX priority channel, number of preprogrammed search banks,
keypad tone frequency, a list of scan bank status (enabled/disabled), and a
list of search bank status (enabled/disabled).

The remainder of the file is filled with null bytes (00) from address
26,501 to 32,772.

The ROM in the scanner is a Hitachi HN58V256AT-2 which contains 32768 bytes
(32768 = 2 to the 15th power).  The unused portion of the ROM contains 6272
bytes.

===========================================================================

This section explains the scan bank and search bank mapping by way of an
example.  The bytes begin with channel 49 of bank two and continue through
several talkgroups for bank two.

30 0B 41 00     For each channel, four bytes define the frequency and
                channel settings.  The first two bytes are actual numbers
                giving the frequency, relative to the frequency range. The
                frequency range is given by the high nybble of the third
                byte, 4 in this case. The values mean:

                0 = 29 MHz  1 = 108 MHz  2 = 137 MHz  3 = 380 MHz  4 = 806 MHz

                so this is in the 806 MHz range.

                The first byte is the number of whole MHz to add to the base.
                30 hex is 48 decimal, so it's 854. The second byte is the
                number of fequency steps to add. In the 29 and 137 MHz
                ranges the base step is 0.005 MHz and it is 0.0125 MHz for
                the other ranges. 0B is 11 decimal, times .0125 MHz in this
                range gives 854.1375 MHz, which is what that channel is set
                for.

                The low nybble of the third byte (1 in this case) is the
                receive mode. Values of 0-6 correspond to AM, FM, PL, DPL,
                LTR, MOT, EDACS.  Bits 0,1,2 of the fourth byte are flags
                that tell whether Skip (lockout), Atten, or Delay are set.
                Bit 3 of that byte is set if the channel is unused.

0B 04           These two bytes specify the PL frequency or DPL code. The
                PL range is broken up into eight groups of frequencies,
                each with a step size of 0.1 Hz. The second byte is used to
                specify the range, 02 through 09. Group 02 begins at 51.2
                Hz and contains 256 frequencies 0.1 Hz apart. The first
                byte specifies how many steps above the beginning frequency
                a given PL tone is. The starting frequency for each group
                is listed below.

                GROUP           START FREQUENCY
                02              51.2 Hz
                03              76.8 Hz
                04              102.4 Hz
                05              128.0 Hz
                06              153.6 Hz
                07              179.2 Hz
                08              204.8 Hz
                09              230.4 Hz

                As an example, 103.5 Hz has hex entries of 0B and 04 for
                bytes one and two. The 04 entry indicates group 4 which
                begins at 102.4 Hz. Hex 0B = 11 decimal, so 102.4 + (11 *
                0.1) = 103.5 Hz. These two bytes are also used to specify
                the DPL code. The code is three octal bits and the first
                and second bytes are simply the equivalent hex number with
                the second byte being the most significant byte.

                As an example code D205 is octal 205 = 00 85 hex where 00
                is the second byte and 85 is the first byte. Code D754 is
                octal 754 = 01 EC hex where 01 is the second byte and EC is
                the first byte.

42 61 6E 6B 20 32 30 43 68 20 34 39     Channel alpha tag 'Bank 2 Ch 49'

15              MHz portion of start frequency for search bank 2, 158

92              Remainder of start frequency, 0.730; start frequency =
                158.730 MHz

22              Frequency is in 137 - 174 range and mode is PL

04              Delay is set on

00 00           No PL/DPL code set

50 6F 6C 69 63 65 20 31 35 38 20 20     Search bank alpha tag 'Police 158'

16              MHz portion of stop frequency for search bank 2, 159

2A              Remainder of stop frequency, 0.210; stop frequency =
                159.210 MHz

03              15 kHz step size; for VHF bands multiply the hex byte by 5
                to get 5, 10, 15, 20, 25, 30, 50, and 100 kHz.
                For AIR and UHF bands multiply the hex byte by 12.5 to get
                12.5, 25, 50, and 100 kHz.

4B 67 6E 20 45 64 61 63 73 20 20 20     Scan bank 2 alpha tag 'Kgn Edacs'

00              Open/closed modes and UHF Motorola trunking offset. 00 =
                closed, 02 = open, 04 = closed and 12.5 kHz offset, 06 =
                open and 12.5 kHz offset, 08 = closed and 25 kHz offset, 0A
                = open and 25 kHz offset, 0C = closed and 50 kHz offset,
                and 0E = open and 50 kHz offset.

06              Bank type, 00 = Conv, 04 = LTR, 05 = Mot, and 06 = Edacs

00 00 00 00 00 00 00 00 Motorola type I fleet map, 00 = type II, 01 = S1,
                        02 = S2, .... 0E = S14. Size code is entered into
                        each of the eight blocks to form the fleet map.

FF              This section contains 100 bytes, all FF. The fifty pairs
                of bytes define the fifty search lockout frequency slots
                for search bank 2. Coding is identical with the method used
                for the search bank stop frequency as explained above. FF
                pairs indicate no lockout entered.

1E 03           Talkgroup ID, Edacs 798 (hex 031e = 798 decimal). An entry
                of 1E 83 indicates that the talkgroup is skipped. Motorola
                groups are handled slightly differently: EF 08 is type II
                id 36592 or hex 08EF0. Note that the hex code is
                effectively multiplied by 16 with the addition of a zero in
                the least significant digit. An '8' in the most significant
                digit position indicates that the talkgroup is skipped just
                as for Edacs. LTR talkgroups are six digits abbccc where a
                is the area code (0 or 1), bb is the home repeater (01 -
                20), and ccc is the user ID (000 - 254). As an example of
                the coding, FE 34 specifies the user ID with the first byte
                (FE = 254). The second byte specifies the area code and
                repeater. If the area code is 0 the byte is equal to the
                home repeater number. If the area code is 1, the byte is
                equal to the home repeater number + hex 20.
                In the example 34 = 14 (hex value for repeater 20) + hex
                20. The LTR ID is then 1 20 254, the highest value ID
                allowed. As for the other id types, adding hex 80 to the
                second byte means the id is skipped. Motorola type I ID's
                will display differently depending on the size code in the
                fleet map. The matrix is somewhat involved.

                For all types, unused talkgroups are coded 00 00 or 00 80
                if skip is set to on.

4D 52 44 20 38 30 30 20 20 20 20 20     Talkgroup ID alpha tag 'MRD 800'

1F 03                                   Edacs talkgroup ID 799

55 6C 73 74 65 72 20 39 31 31 20 20     Talkgroup ID alpha tag 'Ulster 911'

20 03                                   Edacs talkgroup ID 800

20 20 20 20 20 20 20 20 20 20 20 20     Blank alpha tag, group unidentified

21 03                                   Edacs talkgroup ID 801

4B 50 44 20 44 69 73 70 61 74 63 68     Talkgroup ID alpha tag 'KPD Dispatch'

This pattern repeats for all ten scan and search banks.

===========================================================================

This section defines the preprogrammed weather bank and search ranges.
These entries are between the last entries for scan bank 9 and the welcoming
message.

xx xx xx xx xx xx xx xx xx xx xx xx     Alpha tag for talkgroup 99, bank 9

19 50 21 04 00 00                       162.400 FM Delay No PL/DPL

57 65 61 74 68 65 72 20 31 20 20 20     Weather 1 (alpha tag)

19 55 21 04 00 00                       162.425 FM Delay No PL/DPL

57 65 61 74 68 65 72 20 36 20 20 20     Weather 2 (alpha tag)

19 5A 21 04 00 00                       162.450 FM Delay No PL/DPL

57 65 61 74 68 65 72 20 33 20 20 20     Weather 3 (alpha tag)

19 5F 21 04 00 00                       162.475 FM Delay No PL/DPL

57 65 61 74 68 65 72 20 34 20 20 20     Weather 4 (alpha tag)

19 64 21 04 00 00                       162.500 FM Delay No PL/DPL

57 65 61 74 68 65 72 20 35 20 20 20     Weather 5 (alpha tag)

19 69 21 04 00 00                       162.525 FM Delay No PL/DPL

57 65 61 74 68 65 72 20 36 20 20 20     Weather 6 (alpha tag)

19 6E 21 04 00 00                       162.550 FM Delay No PL/DPL

57 65 61 74 68 65 72 20 37 20 20 20     Weather 7 (alpha tag)

00 00 01 0C 00 00                       No frequency FM Unused + Delay

42 61 6E 6B 20 3A 20 43 68 20 30 37     Bank : Ch 07 (alpha tag)

00 00 01 0C 00 00                       No frequency FM Unused + Delay

42 61 6E 6B 20 3A 20 43 68 20 30 38     Bank : Ch 08 (alpha tag)

00 00 01 0C 00 00                       No frequency FM Unused + Delay

42 61 6E 6B 20 3A 20 43 68 20 30 39     Bank : Ch 09 (alpha tag)

81                                      MHz portion of start frequency
                                        for first preprogrammed search
                                        range, 935

01                                      Remainder of start frequency, 0.0125;
                                        start frequency = 935.0125 MHz

01                                      Search step size = 12.5 kHz

14                                      Frequency is in the 806 - 960 range
                                        and the mode is FM

85                                      MHz portion of stop frequency, 939

4F                                      Remainder of stop frequency, 0.9875;
                                        stop frequency = 939.9875 MHz

39 30 30 20 54 72 75 6E 6B 20 20 20     '900 Trunk', alpha tag for first
                                        preprogrammed search range. There are
                                        100 preprogrammed ranges and each one
                                        follows the format defined above. The
                                        welcoming message immediately follows
                                        the last preprogrammed search range
                                        alpha tag. Unused preprogrammed search
                                        ranges are coded 00 00 01 10 00 00 00
                                        00 00 00 00 00 00 00 00 00 00 00.

===========================================================================

Immediately following the bytes listed above are 48 bytes that define the
welcoming message that is displayed when the radio is turned on.  There are
four lines of text, each twelve bytes long.  Valid text characters are
listed in the owner's manual.

The settings controls immediately follow the welcoming message.

00      Unknown byte. Initialization value is 14. This byte may be related to
        a timing issue, possibly a delay time, based on its hex value and
        position in the map. The use of 00 as a default should be sufficient
        for programming purposes.

0F      Defines the backlight on-time. Valid values are 1 - 255 seconds with
        a resolution of 1 second. The time is set to 15 seconds in this
        example.

14      Defines the scan delay time. Valid values are 400 - 25500
        milliseconds with 100 milliseconds resolution. The delay is set to
        2000 in this example.

1E      Defines the trunk rescan delay time. Valid values are 400 - 10000
        milliseconds with 100 milliseconds resolution. The delay is set to
        3000 in this example.

4C      Unknown byte. Initialization value is 3F. This byte is related to the
        trunk rescan delay byte. Its value is approximately 2.55 times the
        value of the trunk rescan delay time byte. This implies that the
        practical maximum value of the trunk rescan delay time byte is 10000.
        The functional purpose of the byte is not known.

05      05 is the initialization value. This byte controls minimum scan
        delay time that is effective when channel delay is not set. The
        value is in seconds with a resolution of 0.1 second. If FF is
        entered the delay is 25.5 seconds when the channel delay is set to
        off. If the channel delay is set to on the delay time specified by
        the scan delay byte defined above takes precedence. This allows the
        odd situation where turning delay off can actually increase scan
        delay time, depending on how the bytes are set.

0B      Display contrast; 0B is the default, valid values range from 09
        (very light) to 0E (display blacked out).

00 08   Defines the priority channel, 800 in this case. Note that the
        priority channel cannot be set to trunking modes (MOT, LTR, or
        EDACS). To set WX as the priority channel, the second byte is 0A 
        and the first byte defines the WX channel. 00 = WX1, 01 = WX2, 
        02 = WX3, 03 = WX4, 04 = WX5, 05 = WX6, and 06 = WX7.

40 0A 03        Initialization values are 00 50 00.
                Setting the radio to scan does not change these bytes,
                while using search does. The function is to provide
                temporary storage of the last frequency searched so that
                when returning to search from manual or scan the radio
                picks up where it left off. This also works if the radio
                is turned off and back on, as long as search was exited to
                manual or scan during the last powered on session. In the
                example the last search frequency was 118.800 MHz in search
                bank number 3. Byte 03 indicates the search bank and 0A 40
                corresponds to the frequency. For this range 108 MHz is the
                base frequency so converting 0A to decimal, 0A = 10 and 108
                + 10 = 118. The base step size in this range is .0125 MHz
                so 0x40 = 64 decimal and 64 * .0125 = 0.800. The frequency
                is 118 + 0.800 = 118.800. For programming purposes the
                default 00 50 00 can be used without problem.

00      Priority channel function, 01 = on and 00 = off. 

00      Unknown byte, 00 is the initialization value.

00      Unknown byte, 00 is the initialization value.

45      This byte is the number of preprogrammed search bands,
        initialization value is 3C. If this byte does not match the number
        of bands, corruption results.

0C FE   These two bytes specify the keypad tone frequency. Lower frequencies
        have a resolution of 1 Hz and the resolution rises to 9 Hz at the
        upper end of the highest range. Using 2000 Hz as an example, here is
        how to calculate the frequency from the two bytes.
        Reverse the bytes 0C FE to get FE 0C. Convert to decimal,
        FE0C = 65036 and subtract from 65536 (hex 10000). 65536 - 65036 = 500.
        Divide 1000000 by the result, 1000000 / 500 = 2000. Byte values of
        00 00 indicate that the tone is turned off.

30 A5 32 A5 A5 A5 A5 A5 A5 A5   These bytes indicate which scan banks are
                                enabled. In this example banks 0 and 2 are
                                enabled while the others are coded A5 which
                                indicates that they are skipped

30 31 32 33 34 35 36 37 38 39   These bytes indicate which search banks are
                                active - all of them in this case


