Kenwood TK-810 Land Mobile Radio Service band UHF 2-way radio

The Kenwood TK-810/TK-810L

Kenwood TK-810 UHF FM Land Mobile Radio Service Band Radio
Kenwood's TK-810L UHF FM Land Mobile Radio Service Band Radio. Hacked with two green LEDs to fake the tens digit for channel 12 along with mechanical unlocking of the channel selector for all 12 channels.

The TK-810 is an old land mobile radio service band FM radio. It's now considered obsolete due to FCC rule change for narrowband. However, the hope is that it can still be reused for 70cm amateur radio.


Story

I got this radio at a hamfest for fairly cheap hoping one day I'd get my amateur radio license and use it as my radio. I was a bit hesitant on purchasing it because I didn't know anything about these radios, and luckily I took good caution. If I had needed to also buy the virtually unobtainable KPT-20 programmer, this radio would belong in the trash heap. I took a chance and it may have panned out fairly well as I found out how to
program and tune the unit.
The radio came mechanically channel locked to two channels - so that it could select only channel 1 or channel 2. Since it apparently was OEM - custom built for a company that only needed 2 channels (one for repeater use, other for simplex on repeater output in case the repeater was down), the tens digit was omitted from the display to reduce costs. Anyway, after it got retired, it appears to be played with - missing one of the internal covers - it was surely disassembled at one point.

Hardware description

The TK-810 was provided by Kenwood that can be customized to the specific needs of the customer. The fully enabled model appears to have these features:
up to 12 channels, Transmit and Receive frequencies can be different for repeater/base station use, or same for simplex use.
UHF FM Radio, 300-520MHz (as per KPT-20 documentation)
CTCSS/PL code: apparently can only use one code for all send/receive and 12 channels, handled by the board on top using the MN6520 chip.
max 10W transmit power, it's smaller than my ICOM IC-U400.

Service manual data swiped from an ebay post:
Frequency range: 450-470MHz (TK-810-1, TK-810L), 470-490MHz (TK-810-2), or 490-512MHz (TK-810-3). As ham frequencies are 420MHz to 450MHz this radio is not usable as-is for amateur radio.
The TK-810-1 and TK-810L support FRS/GMRS frequencies, and passes FCC rules part 95.
Channels: 4
Channel spacing: 25KHz (PLL step of 12.5KHz)
Voltage: 13.6V negative ground; TK-810L specced at 13.8V
Current drain: 0.45A standby, 8A transmit. TK-810L drains 3.5A for transmit
Duty cycle: Receiver 100%, Transmitter 20%
Sensitivity: 0.45µV
Transmit power: TK-810: 5-25W adjustable; TK-810L: 2-10W adjustable (the two use different output boards and output driver circuit. Main radio/transmit boards are the same.)


Hacking the hardware

As I have a gimped unit, I had to "revert" these changes. To do so, one will need to add another 7-seg common anode LED (which holes are provided) and the channel locks removed in the channel switch. To remove the channel switch locks, first remove the switch from the front panel. To do this, first pull knob straight out and off, then open case: 4 screws on back. Separate the two halves of the case and remove. Then remove 4 screws on faceplate and remove round brass slotted nut in front of the switch. You should be able to then pull the switch along with pcb out of the face panel.

12-position switch partially disassembled: shaft: rotation bracket, nut, two channel locks. Note how they feed into holes on the switch body to prevent use of those channels.

Slide off rotation bracket if it's still on the switch (the metal shim with two ears bent towards the FRONT of the radio that mesh with two holes in the front panel - don't lose it, it may still be in the front panel!) After pulling the switch, remove the nut on the switch and set aside. At this point you should be able to remove the detent blocks which look like washers with a peg sticking into one of the 12 holes on the switch. There will be two of them, unless your radio was originally locked to 11 channels. Pull them straight off and replace the nut. Reassemble, and now the radio can be set to all 12-channels now! However there will no longer be a stop to tell you when you reached channel 1 without looking at the display.

Note that now you will probably want to deal with the display at the same time. I found it easier to remove all the boards from the front panel (4 self tapping screws for the PCB and the nut on the volume control). Don't lose the plastic button extenders for the two pushbuttons, they may fall off the switches. The display PCB on the front of the unit are held in by plastic hooks on both sides - be careful spreading them apart to remove the display board else they may break. If one or both break, game over. New front panel needed.

The display sits flush to the gray front filter. If you're using discrete LEDs like I'm using in the first photo, you'll need to make sure they do not extend past the height of the 7-seg display. I ground off the tops of the LED to make them fit. The OEM for this display is the LA301DB:D15 but believe a 2mm pitch 10-pin similar to HP/Agilent/Avago/Broadcom HDSP-U411, which should still be available, will fit if you want it to look more natural rather than a hack.


Programming


All programming is done through a connector on the top of the front face board, underneath the external case panels. An 8 pin card edge slot provides connection to a 93C46 1Kbit EEPROM which holds all programming information. Kenwood expects the use of their tool, the KPT-20, to program the channels. It does NOT support RS-232 serial programming through the microphone jack like some of the newer TK-series radios.
As this is a proprietary system, documentation is sparse as well as KPT-20s. To try to reuse these old radios, it would require reverse engineering to determine how to program the radio without the KPT-20.
From a bit of continuity checking, it was found this KPT-20 connector connects to the 93C46 1Kb EEPROM through 10K resistors, and any 93C46 programmer could be used to in-circuit program the eeprom. The KPT-20 connector also appears to have direct access to the clock and data lines to program the PLL and the Quiet Talk / Multiple Signalling boards. However back to the EEPROM... the question is *what* to program into it...


93C46 EEPROM organization


After a bit of experimentation, it was determined that the TK-810 EEPROM seems to follow the same coding method is used in the
TKR-820 repeater for frequencies. The first two words in the eeprom describe the frequency programming for channel 1 of 12. Depending on how ORG is set on your eeprom reader/writer, you will get either natural big endian 16-bit (if ORG is floating or high, forcing 16-bit mode) or little endian 16-bit numbers (if ORG is grounded by your programmer forcing 8-bit mode).
The word at 0x00 contains the representation for channel 1's receive frequency. The second word at 0x01 (0x02 for character addressing) contains the representation for channel 1's transmit frequency. Note that the eeprom does not use the typical frequency, offset pairs that are usually described for repeater use - it uses absolute frequencies, so you must calculate out the actual frequency using the offset.
Now, to convert the EEPROM data to frequencies, the translation of the hex number works like this:
  1. Byte swap if you read in 8-bit mode. If the eeprom was read as words, use as-is
  2. Convert the 16-bit hexadecimal number to decimal
  3. Multiply by the channel spacing, 12.5KHz for the TK-810
  4. Add the intermediate frequency (I-F used for its superheterodyne receiver), 21.4 MHz
After this computation you will get the actual frequencies used by the radio. Both the receive and transmit locations use the same formula as the transmitter also uses a superheterodyne structure to transmit using the same 21.4MHz VCO to generate an intermediate frequency to drive the final transmitter VCO/PLL.

Example: if you see "83 89" in your EEPROM and you want to calculate the frequency being used. First check if you need to byte swap. The last bytes in the EEPROM image is a clue whether it was read 8 or 16 bit. If it reads "R820N1" in ASCII (versus 8R021N - btw I don't know if this is a magic word or actually means something), the frequency bytes need to be swapped to 0x8983. Now convert 0x8983 to decimal: 35203. Then multiply 35203 by 12.5 (KHz) and add 21400 (KHz; 21.4MHz), resulting in 461437.5 KHz.

To program your desired frequency, just go backwards. Example: if you want to program 446.000MHz - First convert to KHz: 446000 KHz. Then subtract the IF of 21400 KHz, 446000-21400=424600. Then divide by the channel spacing: 424600/12.5=33968 which becomes the PLL divider. Converting to hex it becomes 0x84B0. Now byte swap for little endian if necessary depending if your programmer deals with bytes or words, in my case it would be bytes: B0 84 -- and this now is what needs to be programmed into the radio to get 446.000 MHz. You'll need to repeat B0 84 at word location 0x1 to transmit/receive simplex. Note that this example is probably not a good example to use because this frequency falls below the lowest possible frequency of a stock TK-810 (450MHz to 512MHz) but should work with a bit of tweaking.

In any case, the other 11 channels simply follow in sequence pairs (receive, transmit) for the next 44 bytes in the eeprom. The 12 channels' worth of receive/transmit frequencies take up 12 channels times 2 (one receive, one transmit) times 2 (two bytes per word) equals 48 bytes of data, thus filling locations 0x00 to 0x2F.

Note that this is still a work in progress as it's unknown if other data is encoded into the eeprom. It seems that CTCSS/PL codes are likely hardcoded on the tone board DIP switches installed in the top of the unit (KQ-7 CTCSS option), and the same code used for all channels, both transmit and receive. The eeprom from 0x30 to 0x79 appear to be unused, and the last 6 bytes show up as R820N1 just like the TKR-820. I don't know if this will be the case if you have the KMS-4 Kenwood Multiple Signalling board, the data may be stored in the eeprom as well. The CTCSS tones are stored on a different chip, not this specific chip for the transmit/receive frequencies, and it appears the rest of the unused portions of the chip is indeed unused/wasted.


Frequency hacks

I was a bit dismayed that I could not receive 447MHz stock, despite being only 3MHz under the supposed 450MHz lower frequency. However I have found that it's possible to change the passband a bit by turning the inductor coils on the radio board. These are the 6 flat screw-slotted metal shielded inductors towards the rear of the main radio board that rests underneath the tone board. After futzing with them a bit, I was able to receve below 450MHz. Note that this is a passband, reducing the low end will also reduce the high end receiving, so don't expect to be able to widen the pass band much at all. This is the analog portion - the EEPROM changes to program the PLLs are still necessary of course.
Of course if it won't receive the low end in the ham bands, it figures that it will also not transmit there either. Attempting to program 442MHz resulted in failure, however it can be coaxed to transmit by adjusting the trim capacitors in both VCOs. Note that once again, these changes will not increase the spread of frequencies you can utilize - only shifts the spread, downwards. Keep in mind you may have problems if your repeater offsets point off to different directions, causing a larger spread than expected.


Pinouts

Programming port:
Programmer
pin
93C46 pinDescription
14DO output TO KPT-20
23DI input FROM KPT-20
32SK/CLK
41CS/Chip Enable
5n/cnot connected
6(8)Reset TK810 CPU - Enable Programming
75Ground
8n/cnot connected

Note the ORG pin of the 93C46 (pin 6, Organization, HIGH or FLOAT=16-bit words, LOW=8 bit) is not ported to the interface nor is the DC (pin 7, Don't Connect) pin. Both pins are floating on the TK-810, meaning the TK-810 uses the 93C46 as a 16 bit device.

TK-810 PL KQT-7 tone board
As far as I know now, CTCSS/PL is done by a board installed on the top board position. The board I have is the cheaper KQT-7, the Kenwood Quiet Tone. There are 6 DIP switches that enable most of the standardized 38 CTCSS tone frequency codes.

KQT-7 CTCSS codes

The KQT-7 uses the same CTCSS code for all channels, both transmit and receive.

Microphone pinout (6P6C RJ-12 for electret, 6P4C RJ-11 for dynamic):
Pin(Ignore)Usage
1blwMonitor (connect to PTT when off)
2grMicrophone (10K pulldown, couple with capacitor)coupled
3orwMicrophone ground
4orPTT
5grwPTT GND
6blElectret Power-13.2V (110 ohm to 78L06 to 680 ohms to transistor collector, 56 ohms emitter bias)
The microphone can be a 4-pin dynamic or a 6-pin condenser/electret unit with a preamplifier.


Notes

TK-810 control board
Note that I ended up desoldering the 93C46, though it can be programmed through the port described above.

If you would like me to socket your 93C46 so that you can program it at your whim in the future, and do initial programming for your TK-810/TK-810L, this service will be available for a fee:

Send only the base radio, do not send microphone, brackets, or any accessories as they may be lost. You may send just the controller board with the EEPROM, for a $5 return shipping discount, but of course you will need to do tuning.

The TK-810L (FCC ID ALH-9TKTK-810L-1) is certified for FCC rules part 15B, 22, 74, 90, and 95 along with the TK-810-1. The TK-810 -2 and -3 were not part 95 certified. Note that tuning will cancel certifications. Each of the TK-810s are only good for 20MHz band spread, so it's impossible to use, say, 440MHz and 480MHz without hardware tuning every time you switch to each frequency.

I can add receive-only programming if desired, there are no restrictions for this programming as long as it's valid for the 70cm band.


Modifying the control

It seems that the firmware is quite lacking in terms of capabilities. A current project is being thought about that would allow:
These would require a new control board and modifications to the CTCSS board to pass data to and from the board (mostly receiving squelch data and passing the CTCSS code)