Jelmer's assorted crap NEC 21A - CallMax Maxer A20 - Nec Maxima - Skyper

NEC 21A - CallMax Maxer A20 - Nec Maxima - Skyper

I bought a few of these pagers a few years ago. The NEC 21A was in use in the Netherlands as the CallMax Maxer A20 in the late 90's. It's an Alphanumeric POCSAG pager, with a graphic display capable of showing text messages up to a few kilobytes in length (yeah, I tried). In Germany, this pager is better known as the Skyper, and has found its use with DAPNet, an amateur pager network. The UHF version of these pagers can be converted to receive on a different frequency fairly easily. I'm not going into the details of converting the RF frontend, as there are excellent sources of these conversions found on various DAPnet pages. I'll try to share the things I've found out about this version of the pager, so that you won't have to do a lot of digging.

Hardware
The RF Frontend schematic (Might be useful if you want to figure why your pager isn't receiving anything. Spoiler alert, nearly all commercial services are long gone)

The pager comes apart fairly easily, the case is held together with 2 screws. The radio and CPU are on a separate board, and the display electronics are on another. Many pager manufacturers use this strategy in order to adapt their design easily to different frequencies, for different markets.

The CPU sits on the underside of the CPU/Radio board, and seems to be a custom NEC CPU. It's a Y6367. The two big chips on the topside of the CPU/Radio board are an EPROM and SRAM (32K, of which 20K is usable to store message data). According to this page, the PROM seems to be a MC27C131 something clone. At least, in other NEC's this chip is used. Mine have a Y6452-A03, which appears to be compatible NEC part. Counting the address lines, it should be 128kbyte. Unfortunately, the exact type is difficult to read it from the schematic. There's also a 4Kbit serial EEPROM, the 93LC66. This seems to hold all the configuration data, as the EPROM is not erasable.

The display is a SED1561. If you want to construct a different pager using a different radio, for instance, you might want to reuse the Nec's case and display. This is the pinout.

Serial Interfacing

It's fairly easy to program the pager using a USB to Serial adapter, combined with an inverter. The pager sends out inverted TTL Serial data, and expects the same in return. I took some pins from a PLCC socket and soldered them to a scrap board. If you open the pager, you should be able to solder wires to the pins directly, which might be easier than building a connector. I used a bootleg Arduino Nano as a USB->Serial and Inverter, using a very simple sketch as an inverter. It does the trick just fine.

Yes, I know you can do this with 74-whatever inverter. Yeah, this ís a waste of a perfectly good (clone) mega328. Yeah, I could've used interrupts. No, I do not care :)

void setup() {
  PORTD=0;
  DDRD=(1<<PORTD1)|(1<<PORTD6);
}

void loop() {
  if(PIND&0x01){
    PORTD&=~(1<<PORTD6);
  } else {
    PORTD|=(1<<PORTD6);
  }
  if(PIND&(1<<PORTD5)){
    PORTD&=~(1<<PORTD1);
  } else {
    PORTD|=(1<<PORTD1);
  }
}

The pinout is (from left to right):

  1. GND
  2. key
  3. RX (Arduino Port D5)
  4. TX (Arduino Port D6)
  5. +3v3

The 3v3 rail doesn't seem to draw any significant current, it's just used by the pager to detect a programming interface is present.

I used the NEC's programming software in DosBox, with a direct serial port connection to the Arduino Nano's on-board CH340-or-whatever USB converter. The software to program the NEC 21A can be found online. A simple search on "NEC671.zip" will give you the latest version of the software I could find. I very much doubt this is the version used by CallMax to program the pagers, as it reads the configuration as 'OUT OF RANGE' for a few settings. This might indicate some option is configured that isn't supported in 6.71. If you're aware of later versions of this application, please let me know.

Programming
After connecting the USB interface, remove, then reinsert the battery to enter the pagers' programming mode. If you hooked up everything correctly, the pager will beep 3 times. At least, mine did. Other firmware revisions might be different. Fire up UCPV671.exe from within DosBox, and you're off to the races. After launching, the program will ask you to select a ROM firmware file. I selected 21A.ROM (seemed appropriate). Then, the app will try to communicate with the pager. If the interface is working, you'll see the main screen with RIC settings. Beware: The addresses you'll see there aren't the current settings! To read the settings, hit F1 and wait a little while. All the interesting settings are accessed with 'F4'.

Settings for CallMax

The primary RIC for receiving pages on the CallMax network was apparently the first address. The (translated) programming guide advises this, as this RIC cannot be disabled 'over the air' The other addresses are used as 'Maildrop' RICs that probably required an extra subscription to these services.

To enable the reception of these additional information services, CallMax used to send out Over-The-Air programming commands that enabled or disabled these channels. The directory names can be set by the programming software, but I can imagine there was some additional sequence to set directory names OTA. The sequence to enable/disable these channels is mentioned in the programming guide, but I had a hard time figuring out how this works.

Eventually I found out that the NEC uses a strange mapping to enable channels. It turned out all the information was there to begin with, but I just didn't understand it. NEC calls the control characters 'RIH' codes; not a single clue what it stands for.

To enable reception of a channel, send <SOH><Header><Release><ID><SUBID><STX> . For the ID / SubId to unlock, the following table is used:

RIC ID:

Sub ID:

Weird, right? I wasn't expecting that. They're probably using this weird table to avoid random enables. Okay, so to unlock/enable info channel 2D ('Koersen'), the following sequence (when using the CallMax RIH codes) should be sent:

0x01-0x68-0x51-0x19-0x23-0x02

To unlock/disable the same channel, the following sequence would apply:

<SOH><Header><Lock><ID><SUBID><STX>

0x01-0x68-0x68-0x19-0x23-0x02

The messages may be sent to a Sub ID of the main RIC, even SubID's that aren't activated in the settings. If you send the sequence to an active SubID (in my case, D), the pager will process the request, but also generate a 'Tone only' page alert. Not sure why that would be useful, so that might actually be a bug or unintended side-effect.

Cool! Now we can enable reception of these RIC over-the-air. Very useful! Enabling them from the programming interface works fine as well ;)

Questions and things I haven't figured out

There seems to be an interesting setting at the User Function Parameter option; it looks like there is a setting that isn't available in the my version of the software. OUT OF RANGE is a strange alert type... I'm not sure what's happening, but it might be that my pager was programmed using a different version of the NEC Programmer software. If anyone knows whats up, please let me know!

Also, there are some weird discrepancies between my version (CallMax) and the German 'Skyper'. It seems the same software can be used to program the pagers, but the way the respond to over-the-air messages seems very different. In short, my pager doesn't seem to respond AT ALL to the Skyper OTA commands for rubrics and time setting options. Not sure what's up.

The Skyper uses RIC 2504 to send time synchronisation. However, the pager is limited (for power management reasons) to reception of only two address frames. For CallMax, RIC 2504 does not fall in the same address frame as the other broadcast RIC's, which would mean the pager cannot listen to RIC 2504. It seems this is a significant difference in firmware.

It looks like the Skyper uses a totally different philosophy, where the subscriptions can be selected from a list with a certain end-date. Also, the 'splash' screen uses a significantly larger font. Any and all additional information about this specific pager, CallMax or whatever cool information about pagers in general is always more than welcome!

Comments