Pager
Motorola Bravo Pagers
 |
 |
I acquired a stack of Motorola Bravo pagers for our 20th Anniversary Hackers party and am attempting to reverse engineering the communication between the RF board and the display board. My goal is to have all of them display a message simultaneously during the movie, such as HACK THE PLANET.
The display board predates wide-spread LEDs -- the message indicator and backlight for the 7-segment display are made from incandescent lamps! Also on the display board are a charge pump to step up the 1.5V AA cell to 3V, which makes it very easy to add a SparkCore or other receiver.
 |
 |
We probed the connector and found what appears to be 5 MHz SPI, with the display board as the master and the RF module as the slave. Note that the spring connector is positive 1.5V, not the ground. This is different from most battery terminals.
The pinout on the Rev J board (starting from the speaker near the display):
| Pin | Name | Notes |
|---|---|---|
| 1 | +3 V | Generated by the boost pump |
| 2 | GND | Common ground with the AA battery |
| 3 | +1.5 V | Positive terminal from the AA battery |
| 4 | RF data? | Data from RF module to display board, not clocked with the SPI |
| 5 | DOUT | Data from display board to RF module, 8 bit SPI |
| 6 | CLK | 5 MHz data clock generated by display board |
| 7 | !SS | Slave select; goes low 20usec before the clock starts. |
| 8 | DIN? | Always 3V, pulled up by RF board, might be SPI data from RF to display board |
I'm still working on decoding the protocol using a Teensy 3 using a software SPI slave. The display board appears to probe the RF module once per second with a three byte command, then polls for a response (and doesn't get one, since we've disconnected the radio and don't have a pager service plan). The command appears to always be the same.
On bootup the pager sends a large number of commands to the RF modules; I do not observe any response on any of the reply pins.
With the radio module connected, one of the pins has a variable length burst in response to the 1 Hz probe. This might be some sort of RF data; it doesn't seem to match up with any serial timings that I recognize. There are occasionally very long bursts; these might correspond to periods when a page was received. After the probe, the display board sends another command, possibly to turn off the radio.
Current hypothesis: first command is turn on the radio, 20ms later a command to dump what has been received, then a command to turn off the radio. This would indicate that the display board is doing the decoding.
There is also a three-pin terminal that is accessible from the battery door on the bottom of the pager. I'm not sure of the protocol there, either.
2015 Retrocomputing Radio Reverse engineering