Mobile Data Terminal Research

Data reception of Mobile Data Terminal traffic can lead to some interesting discoveries...

We have recently acquired a Motorola KDT-840 Mobile Data Terminal at a flea market for $1 (yeah - one dollar). This unit appears to have internal transmitting circuitry. It is tuned to receive at 855.8375MHz and transmit at 810.8375MHz. The terminal comes in a handy plastic carry-case. It appears that this unit is designed for inventory-tracking, not police use. The battery wasn't included when we bought it, and unfortunately does not power up when supplied with the proper voltages (+7.5V). If you have any information on this unit, feel free to mail me. 


I've gotten a lot of responses regarding the KDT-840. The battery is a +7.5V NiCd - the unit still doesn't power up, though, so I'm pretty sure it's hosed. Here are some interesting pieces:

A lot of information has been released about the decoding of Moblie Data Terminal data transmissions. I acquired a not-too-old police terminal at a flea market for $7 about a year ago and set upon to restore it to a (semi)-functioning state.

Mobile Data Terminal Repair and Restoration


  Here is a view of an older, non-functioning Mobile Data Terminal we have at the L0pht.

This is the terminal I picked up at the MIT Flea Markret. I don't see any dates or copyrights on the case or boards, but I figure it couldn't be more than 10 years old. I am hoping that it uses the same MDC4800 transmission protocol that the current Moblie Data Terminals use, but I doubt it. I do not know a model number, but it was made by Motorola.

The terminal runs on an Intel 8049 processor using two 2716 EPROMs for code storage. A lot of the circuitry consists of standard TTL ICs. The keyboard, along with a QWERTY keyboard, includes some interesting keys.

There are 11 function keys above the keyboard, 5 of them labeled STS A through STS E and 6 of them labeled MSG A through MSG F. Above the keys are labels relating to each pre-programmed function key. Comments in () are mine. They are:

In the lower-left corner, there is a single button surrounded by a plastic "fence" labeled EMR, which is an emergency "Panic Button". There is also a 3 x 4 "numeric keypad" with the following keys: The display appears to be a 5-line dot-matrix plasma display (see info below).


Here is the inside view of the MDT. There are three boards connected by ribbon cable. This makes it very easy to troubleshoot and reverse-engineer. The PC boards are double-sided and have an interesting red solder mask instead of the typical green.


The two switches on the front are labeled POWER and LIGHT. The light on/off switch just turns on two DC lamps (see the board on the left) to illuminate the keyboard.

There are two unlabeled 8-switch DIP switches which I have not played with. Also on this board is the 8049 processor and two 2716 EPROMs.

There is also a PL Tone receiver, which is labeled "PERMACODE ACTIVE FILTER" set to 192.8Hz. For more information on CTCSS/PL Tones, check out The baud rate and stop bit selection is achieved by jumper selection.

The only possible external connection to the police terminal is via a DB25 male connector. This port is used to supply power to the unit, as well as interface to the external radio transciever.

There are 6 LEDs next to the two big switches, which are labeled:

Initial examination of the PCBs, I noticed multiple test-points labeled as follows: Upon further exploration, I found the most important connections to the DB-25: The standard power supply voltages are +5, -5, +12, -12. However, notice the -250V necessary to power the plasma display! This isn't a voltage that can be easily generated with a DC power supply.

Out of curiosity, I powered the unit with just the + and - 5 and 12V. I knew the display wouldn't power on, but I wanted to see if anything else would happen. Right as power was supplied, the 6 front LEDs illuminated. When I pushed any of the buttons on the keyboard, a relay would trip and the PTT light would illuminate. Although none of this means much, at least I know that the terminal isn't completely fried.

My next challenge was to find or build a -250VDC power supply. I chose to build one, and after 3 weeks of brushing up on power supply theory and getting over the fear of being shocked to death, I finally got the circuit working! For those who are interested:

Bill-of-materials for the power supply circuit.

Schematic of the circuit in PostScript format.

I have yet to plug this circuit into the police terminal. I am going to throw this onto a breadboard instead of leaving so many wires exposed on a prototype board.

10/26/97 UPDATE

I threw together a quick PCB design for the power supply circuit:

PCB Layout in Protel EasyTrax format.

I constructed a complete power supply unit using a PC power supply for +5, -5, +12 and -12 and used the above circuit for -250VDC. I threw everything into a nice looking power supply case (pictures coming soon) and fastened everything up. I plugged everything together and... it works!

The plasma display really powers on, and it looks like it is waiting to receive information from the base station. I get a prompt like this:


Pressing the RCL button on the right side of the keyboard will put me into some kind of form-editing mode, but it is just a blank screen with a few 0's.

The model # is D1118B and the serial # is 253CFJ0013. If anyone knows about the details of mobile data terminal operation, please let me know.

Mobile Data Terminal and Trunked Radio Information

The hardware necessary to decode the Mobile Data Terminal transmissions, MOBITEX, ARDIS, and Trunked Radio systems is the same as the POCSAG Pager Decoder. Just a simple op-amp Schmitt trigger connected to the serial port. A scanner radio is needed, with a discriminator output to bypass the audio filters.                                                                                                                                           Last update occurred on 8/9/98 at 2:46pm