What can you do with an M48?

Radiometrix has had the M48 radio modem chip (and it’s application boards) for a little while, but I’m not 100% sure that all the interesting tricks it can do are entirely obvious.

The M48 is a 4800 baud radio modem, compatible with narrowband radios.

That means MURS band units, low power UHF modules and licensed part90 units

Just a faster i1200, or a simpler RPM1 ? ……. not quite.

What does an m48 do ?

In the simplest possible sense, the M48 is just a radio modem baseband device. It provides an interface between a user’s asynchronous (“RS232 type”) serial port and the audio channel of a low power radio module.

The M48 will transparently handle a half duplex serial stream at 4800 baud, buffering framing and coding the data into a baseband signal that a narrowband wireless module can handle. At the receive end it decodes the audio signal back into serial data. The timing requirements of the radio are allowed for with internal FIFO buffers, while the noisy imperfect radio baseband path is hidden from the user behind S/N efficient bit coding and  data packetisation, with frame synchronization and a CRC error detection protocol.

The interface:

An M48 can be used with just two serial data lines (TXD, RXD). In many applications that is sufficient. If data is being sent in both directions (half-duplex) however, it is necessary to allow for the turnaround time (transmit to receive or vice versa) as the M48 cannot handle transmit data input while it is decoding receive data. (Also, in advanced modes, such as when user interface data rate is higher than 4800 baud (see later), then transmit data hand-shaking is needed)

In these cases it is useful to have more information as to the status and timings of the link. The M48 provides additional ‘handshaking’ lines:

  • RX flow. Goes ‘high’ when the device has valid data to output (“DTR” out)
  • TX flow. High when the transmit buffer is ¾ full, low when empty (“CTS” out)
  • RX hold. When pulled low, prevents device from outputting data (“RTS” in)


As alluded to earlier, data into and out of the M48 is buffered through a pair of small FIFOs. On the transmit path a 128 byte buffer is used, while on receive a 64 byte buffer is implemented. These buffers actually occupy the same memory space on-chip, so the part cannot receive and output serial data simultaneously.  Transmit operations will always over-ride receive. A byte sent to the device will clear the receive buffer, even if it contains valid data. (An algorithm which reads the ‘RX flow’ signal can prevent this occurring)

In simple, transparent mode these buffers are invisible to the user.


In normal usage the M48 uses a 19.6608MHz crystal for a basic 4800 baud transparent throughput. However, elementary communication theory tells us that ultimate range and S/N performance (sensitivity) relates to bandwidth, and hence data rate.

In applications where ultimate range matters more than a fast data path the M48 can be fitted with slower clock crystals. In these cases the fundamental link data rate is reduced (and other timing parameters scaled accordingly) but the link range will be increased.

Crystal frequency    19.6608MHz   Data rate  4800 baud         Sensitivity +0dB

9.8304MHz    Data rate  2400 baud         Sensitivity +3dB

4.9152MHz    Data rate  1200 baud         Sensitivity +5dB

2.4576MHz    Data rate    600 baud         Sensitivity +7dB

[ slower clock frequencies will also allow operation on lower power supply voltages than the basic +5v normally specified, See Microchip PIC16F648A datasheet for more information ]

Radio interface:

The raison d’etre of the M48 device is to insulate the user from the peculiarities and limitations of the radio module’s audio path. While a detailed analysis of  the over-the-link signals is not intended, a basic overview may be useful:

Three signals connect the modem chip to the radio:  tones_out, tones_in and n_txe.

All are digital levels (so connection must be made to the digital baseband pins of the radio, not the low level analogue connections).

At the bit-level the radio link signal generated by the M48 is a proprietary biphase (synchronous) bitstream with a maximum frequency component of 3.2KHz. There is a pseudorandom data whitening function applied to the data, but the code still does not have a perfect 50:50 mark space balance, so should be considered a DC coupled signal.  At the receiver end a conventional averaging data extractor will function but a quasi-dc coupled (peak detecting) type, such as the Radiometrix QR96, will give optimum performance.

The datastream is further formatted into packets. Each packet contains a framing sequence, address and status information, a CRC and 1-16 data payload bytes. Transmitter on-time delay is allowed for by the addition of a preamble sequence, while during continuous data transmission the packets are transmitted end-to-end.

[ Unless otherwise programmed, all units send on address 1 and receive on address 0 (broadcast) and address 1 ]

M48 also has an auxiliary serial output (only) pin, which is used to allow the user to send serial programming strings to the associated radio module through the device.

Programming the M48:

In the simplest case an M48 can be used ‘as supplied’ as a straight forward transparent data link. There are, however, a number of further options and features which require the user to program parameters into the device.

Normal transparent data mode is referred to as ‘data’ mode. To program the device, it is necessary for it to be in ‘setup’ mode.

The device is programmed through the RS232 port (without needing extra ‘pgm mode’ switching pins or extra hardware). The command set uses simple readable ASCII words, and decimal or hex numbers. All commands are in upper case.

When in setup mode the usual radio data communication functions are suspended, but limited one-packet-at-a-time non-transparent operation is possible, via special commands.

The setup mode is activated by means of a ‘break / respond’ protocol

entering setup :        user generates a ‘break’ (long ‘space’ condition)

M48 sends two characters, an @ and a random printable ASCII character

user sends back the random character

M48 replies with a login message “M48 SETUP” and enters setup mode

There is a 5 second timeout following the break within which the response must be sent , or the device reverts to data mode.  An ASCII 1 (ctrl A) resets the timeout and generates a new @ and random character sequence.

[ ‘Break’ conditions can be generated in several ways.  Some terminal emulators have alt or ctrl key sequence.  Dedicated hardware can be used to force a long (50-100mS) logic zero onto the TXD pin. Or an ASCII zero can be sent at a much lower baud-rate ]

Once in setup mode, input bytes are stored in a 32 byte (maximum) command buffer and echoed back to the serial output. Space characters are echoed back, but are not loaded into the buffer.

Commands are either short words or single command characters. (For example, a <cr> character is the evaluate/process command).  After successful execution of a command the device will reply with an ‘OK’ message.  Commands which program a value into the internal non-volatile e2prom take around 50mS for the write cycle,

Single character commands:

Enter            (ASCII 13)        processes the command buffer contents (and clears the buffer)

Escape          (ASCII 27)        terminate setup mode and returns to normal ‘data’ operation

?                     (ASCII 63)        prints the current contents of the command buffer

/                      (ASCII 47)        (as above)

                     (ASCII 54)        shortcut for the STATE command (see later)

&                    (ASCII 38)        shortcut for the RX command         “      “

delete            (ASCII 127)      clears the input buffer

General commands


STATE         Prints out the current operating parameters

LOCK            The unit now defaults to setup (rather than data) mode on power up

EXIT              Return to data mode (same effect as an escape (ASCII 27) byte)

If a LOCK command is in force, an escape byte has no effect, but EXIT overrides LOCK

TEST            Turns on the transmitter, and outputs a continuous 200Hz tone

This mode is disabled by any activity on the TXD input

RX                 Turn on the decoder (as if in data mode) Output received packets as normal

Disabled (and command mode re-entered) by any activity on the TXD input

Baudrate commands

As supplied, the main interface is set to 4800 baud, and the auxiliary port to 2400 baud.


BAUD  b1     Set main port baud rate

BAUX  b2     Set aux port baud rate

b1, b2 are baud rates. Only the first two digits are needed, i.e. BAUD 12 is valid

Main port (b1) supports 1200, 2400, 4800, 9600, 19200, 38400, 57600, 76800

Aux port  (b2) supports  1200, 2400, 4800, 9600  only

These setup parameters are immediately stored in EEPROM, and take effect right away.  Remember that baud rate scales with changes in crystal frequency (for example, if a 4.9152MHz crystal is fitted then BAUD 2400 will set a baud rate of 600).

When the interface baud rate is higher than the (4800 baud nominal) radio link interface speed, the system is no longer truly transparent. As the modem is removing bytes from the buffer slower than the user interface is supplying them, it is possible to over-fill the buffer and lose data, unless the user carefully controls the timing of the data stream or uses the TX_flow signal.

This pin allows the status of the transmit buffer to be monitored. It goes high when the buffer reaches ¾ full, and is then re-set (to low) when the buffer is empty again. It can be used to provide a simple ‘CTS’ signal.

[ It is possible to ‘lose track’ of the baud rate of a unit while manually programming it. In this case an easy way of ‘finding’ the speed can be used: a byte should be sent to the device at each of the valid baud rates, and the echoed character monitored. Only at the correct rate will a valid echo be seen ]

Timing commands

DELAY  dd    Set the initial delay between first byte arrival and transmit start (20mS default)

PREAM  pp   Set the number of (620uS long) preamble bits (80 bits / 50mS default)

TXOFF  oo    Set the tx ramp-down period (20mS default)

Variables dd, pp, and oo are two digit hexadecimal values (00 to FF)

These timing parameters are immediately stored in EEPROM, and take effect right away.

The timing commands directly affect the way the modem device controls the radio module. Beware! If they are set incorrectly then then data errors or unreliable operation will result.

The default settings are a safe, conservative setup for a typical 50mS set-up time multi-channel transceiver. For faster (usually single channel) radios the PREAM value can be reduced. Do not reduce this parameter too far, as it must deal with the settling times of the receiver data recovery circuit as well as the transmitter turn-on time.

The TXON and TXOFF parameters are primarily concerned with optimum channel usage with intermittent user datastreams.  TXON is a delay between first byte received (into an empty buffer) and the transmitter key-up while TXOFF holds the transmitter on after a packet has finished sending.

If a user is controlling their serial datastream more closely, and sending data in discrete, well organised bursts, then TXON and TXOFF can be set to zero.


The M48 data packet includes an address byte. It will only communicate with a unit set to the same address. There are four receive addresses (of which ADR1 is usually set to zero as a ‘broadcast’ mode) and a separate transmit address.

Multiple receive addresses can be useful for multiple node systems, and for setting up simple (manual routing) repeater networks


ADR1  aa      Set receiver address 1

ADR2  aa      Set receiver address 2

ADR3  aa      Set receiver address 3

ADR4  aa      Set receiver address 4

ADTX  aa     Set transmitter address

ADDR  aa     Set rx address 1 to zero. Set tx address and rx addresses 2, 3 and 4 to a

aa is a two digit hexadecimal value (00 to FE). Address FF (255) is not permitted.

Address commands write to volatile memory. To transfer programmed addresses to the power-up settings, the PROM command must be used.

As supplied: adr1 is zero, and adr2, adr3, adr4 and tx address are all set to 1.

Mode commands:

Beyond it’s usual  ‘transparent data’ mode, the M48 can also operate in an ‘extended’ mode. In this case the maximum packet size is reduced from 16 bytes to 14, and a ‘burst identifier’ word is included (obviously this slightly reduces overall throughput).

On transmit, a different burst identifier is attached to each new packet. The receiving unit ignores the second (and subsequent) packet with the same identifier. This allows a receiving M48 to ignore multiple copies of the same data packet (as will be encountered in multiple transmission or repeater/network systems)

MEXT            Extended mode (burst ID on, multiple transmissions set by TRIES)

AKN             The unit now operates in aknowledge/resend (extended) mode

TRIES  rr      Number of transmissions attempts allowed in AKN and MEXT modes

TIMEOUT tt Duration of AKN resend timeout (tt x 0.41mS)

STAF            Operate as a store and forward repeater (with MEXT set, or not)

Variables  rr and tt are all two digit hexadecimal values (00 to FF)

Extended mode (MEXT) is used with repeater systems.  With TRIES greater than one this mode sends each packet several times (increasing the chance of reception at extreme range).

Lastly, the M48 has an ‘AKN/re-transmit ‘ mode. In this case, after each packet is sent, the receiving unit sends back an acknowledge message. If this message is not successfully decoded, at the transmitting end, it will re-send the packet. The acknowledge timeout period and the number of permitted re-tries are both user programmable. [ Do not use AKN mode with STAF repeaters. Timing conflicts occur]

This mode provides the greatest data transfer reliability, although the overall data throughput is markedly reduced.

NORM           The unit returns to standard, transparent mode

PROM           Writes the current volatile settings (addresses and operating modes)

into the E2PROM as the new power-on settings.

DEFAULT    The unit self-reprograms with ALL original factory preset values

DIAG             Enter a diagnostic mode, where the address, length, checksum and

decoder status byte for every received burst are printed

String commands:

There are a series of special commands which allow whole strings of characters to be sent via the transmitter, or the auxiliary serial port (usually connected to the radio module programming input)

Auxiliary port output operations. Square brackets (ASCII 91, 93) delineate the string.

[ (1-30 byte data string) ]

This function outputs the text string between the [ ] characters, to the AUX pin

[ (1-30 byte data string) <cr>

As above, but with an added CR (13) appended to the end of the outputted string

Command mode transmit operations

$ (length byte) (1-16 byte data string)          Note: $ is ASCII 36

This function output a data packet to the transmitter, then returns to setup mode.

‘Length byte’ is a single hex character. It sets the length of a transient data buffer,

The actual buffer length is one more than the value of length, so 0-F corresponds to

a buffer between 1 and 16 bytes long

‘data string’ is a string of bytes equal in number to length+1

After the length byte, the M48 sends back a colon character (ASCII 58)

When the final byte is received, the modem goes into transmit, and sends the packet

By careful use of the & and $ command bytes, the M48 can be used in a non-transparent mode, without ever leaving command mode.

This is especially useful for the master node in point to multi-point operation.