TYT MD-9600 / Retevis RT90 hardware (mobile)

The TYT MD-9600 and the Retevis RT90 are one dual-band mobile radio: an STM32F405VGT6 MCU, an HR_C6000 DMR baseband and codec chip, two complete RF chains (one VHF, one UHF), each with its own synthesizer, its own RX and TX VCOs, its own IF receiver chip and its own PA supply switch, a 49.95 MHz first IF, a 128 x 64 monochrome LCD (ST7567) on SPI, a 4 x 3 front panel key matrix, a quadrature channel encoder, a 16-key DTMF hand microphone on an RJ-45 jack read as two analog levels, a GPS option, and USB full speed on the MCU's own OTG_FS core (mini-USB on the rear). There is no AT1846S and no RF transceiver chip at all; the HR_C6000 sees a 450 kHz IF from the IF receiver chip.

TYT changed the synthesizer and IF parts during production. The board revision decides how the synthesizers (and on V5 the IF) are programmed, and nothing in the firmware can read the revision, so a build is made per revision (section 16).

Status (2026-10-20): nothing in this file has been checked on a radio. No MD-9600 is in hand, and every value is unverified until one is. RadioFoundry builds for it and drives FM receive on every board revision (section 19). Section 17 lists every open question.

Conventions: register values are hex; HR_C6000 registers are written page:reg = value as in modem-hrc6000.md. Frequencies are given in Hz or MHz. A value marked (datasheet) is from the STM32F405 data sheet and RM0090 or the Skyworks SKY72310-11 data sheet; (unverified) is not confirmed on a radio or in a datasheet; ? means not found or contradictory.

---

1. MCU, clocks, memory

1.1 Part

STM32F405VGT6, LQFP100, 1 MB flash, 128 KB SRAM + 64 KB CCM, 4 KB backup SRAM. The backup SRAM is used (section 10.2). Read-out protection level 1 assumed, as on every TYT STM32 radio (?).

1.2 Clocks

RadioFoundry derives every time constant from the clock it set up (SystemCoreClock), so a wrong HSE guess shows as a wrong USB clock and a wrong tick, not as a silent offset.

Standby (section 10.2) drops SYSCLK to HSE / 512 with both APBs / 16 and voltage scale 2 while waiting for the power key.

1.3 Internal flash layout

Same TYT loader and layout as the DM-1701 and MD-380: loader in sectors 0-2 (0x08000000-0x0800BFFF, never written), application from 0x0800C000, VTOR 0xC000. The codec sits at a different address in every vendor version and variant (0x08074B18 to 0x08079630 for the code; 0x0807537C in V26.45; codec-md9600.md).

1.4 RAM

RadioFoundry maps CCM (as on the DM-1701). Backup SRAM: 4 KB at BKPSRAM_BASE, kept while DC is applied, used for the standby flag (10.2) and for non-permanent settings.

---

2. Pin assignments

2.1 Port A

2.2 Port B

2.3 Port C

2.4 Port D

2.5 Port E

2.6 Reset-time levels and SWD

Reset levels: HR_C6000 CS/CLK/MOSI and power-down low, IF chip selects/data/clock high, IF reset low, both synthesizer chip selects and the voice port CS high, synthesizer data/clock low, LCD lines low, Power_Control low, all T5/R5/C5 supply switches low, U_V_MOD_SW low, FM_SW and FM_MUTE low, CTC_DCS_PWM high. Then radioPowerOn sets both T5 low, all C5 and R5 high (both receivers are always powered together, "as the TYT firmware does"), then Power_Control high.

RadioFoundry's transmitter-off levels (board_rf_safe, on any fault, crash or reset; crash-log.md): APC_EN, T5_V and T5_U low, VCO_U and VCO_V high (the receive VCOs), the PA reference DAC (DAC1 channel 2) at 0.

PA13 / PA14 are the receiver supplies of both bands: like the MD-380, the radio takes the SWD pins at run time, and a debugger has to connect under reset (D for the pins; the consequence ours).

---

3. Interrupts, DMA, timers

---

4. HR_C6000

4.1 Hookup

Configuration port bit-banged on PE2-PE5, voice port on SPI1 (PB3-PB5, CS PD7, CPOL high, CPHA first edge, PCLK2 / 64 = about 560 kHz), I2S3 slave full duplex Philips 16-bit (extended) 8 kHz, power down PE6, interrupts PC0-PC2: the DM-1701's wiring except the voice port, which is on SPI1 here instead of the DM-1701's SPI. The register behavior is the DM-1701's (modem-hrc6000.md).

4.2 Differences from the DM-1701 set-up

4.3 Voice port and I2S

As the DM-1701 (4.3 / 4.4 of hardware-dm1701.md) apart from the SPI instance. DMR receive AGC maps a peak level to the HR_C6000 DAC gain; not a hardware fact.

4.4 Burst timing

The MD-9600 is reported to lack the hardware for the receive-side interrupt the other STM32 radios use to end a TX burst (unverified); the burst can end from the timeslot interrupt once the PA has been on 20 ms. Whether the RF TX interrupt (PC2) works as on the DM-1701 is not stated (?). gotchas.md 14.6: every TX/RX switch means a new synthesizer word and a different VCO (5.2), so the per-burst relock time is the main DMR timing risk.

---

5. RF

5.1 Bands, power

Dual band, 136-174 MHz and 400-480 MHz (unverified); 127-178 and 380-564 MHz are reported outside the data-sheet mode (unverified; not a recommendation). Rated 50 W VHF / 45 W UHF (40 W on some retailer pages); one review measured 44 W at 146 MHz and 40 W at 446 MHz (unverified). Band selection is by frequency: below 300 MHz is VHF.

5.2 Frequency plan (all revisions)

One synthesizer per band drives both of that band's VCOs, so RX and TX (49.95 MHz apart) always mean reprogramming.

5.3 Synthesizer per revision

All write-only, chip select low during the word, data MSB first, data set while the clock is low and latched on the rising edge. Fractional rule in V1/V2/V4: if the fraction is above one half, N is rounded up and the fraction used as a negative offset (signed modulator).

V1, V2 (and V3): Skyworks SKY72310, one per band. 16-bit words, 4-bit address in the top bits (as hardware-md380.md 5.2, data sheet):

N = VCO / f_pd; reg 0 = N - 32; 18-bit fraction (x 2^18), reg 1 = fraction >> 8, reg 2 = low 8 bits. Fixed: reg 6 = 0x01F, reg 7 = 0x3D0, reg 8 = 0, reg 9 = 0. Write order: 8, 9, 5, 0, 2, 1, 6, 7 ("the order the TYT firmware uses") .

V1-V3 reference divider: R 6 (VHF) and 4 (UHF) is one case. The divider also depends on a per-channel setting and on which side of the signal the LO sits, giving R 5 / 4 / 6 or 3 / 2 / 4. What the setting means is not known (unverified); RadioFoundry uses 6 and 4.

V4: "PLL1590" synthesizer, one per band. TYT's own folder for the V4 firmware (V16.45) is named "firmware for PLL1590", which confirms the part family earlier notes call AK1590; the exact part number is still unconfirmed (?). The V16.45 stock images (all four variants) hold the 24-bit words 0x1FF404 and 0x19F404 as literals, that is reg 4 = 0x1FF40 and 0x19F40 in the format below; the V06.09 images hold neither (from our own reading of the stock images). 24-bit words: 20 data bits then the 4-bit address in the low nibble. N in reg 2 (VHF 0x20000 | N, UHF 0x38000 | N), the 18-bit fraction in reg 1, reg 3 = 0x6000 | R, reg 4 = 0x1FF40 for VHF and for UHF receive, 0x19F40 only for UHF transmit (unverified), reg 5 = reg 6 = 0. R: VHF 12, UHF RX 8, UHF TX 4. No x2 on VHF here (VCO on the LO). Write order 5, 6, 3, 4, 1, 2. The V4 VHF synthesizer must be programmed (145 MHz RX) right after power-on or it never locks.

V5 (and V4A): TI LMX2571, one per band, as the original V26.45 firmware programs it (read from its image, not yet checked on a radio). 24-bit words: 8-bit address then 16 data bits. R: VHF 8, UHF 4; 24-bit fraction, the remainder of VCO / f_pd times 2^24, truncated; reg 0x04 = 0x3000 + N, reg 0x01 = fraction >> 16, reg 0x02 = fraction low 16, reg 0x03 = 0, reg 0x05 = 0x100 + R, reg 0x06 = 0x8581, reg 0x07 = 0x1024, reg 0x08 = 0x0430, reg 0x29 = 0x0230, reg 0x2A = 0x0108, reg 0x00 = 0x003E. Sequence on every retune: 0x00, 0x04, 0x01, 0x02, 0x03, 0x05, 0x06, 0x07, 0x08, 0x29, 0x2A, then 0x00 = 0x003F (start calibration) and 0x00 = 0x003E. The clock is left low after each word. The reset (0x00 = 0x2000) goes to each chip once at power-up, VHF then UHF, followed by a wait of 10 system ticks (nominally 10 ms), and never on a retune. The words are the same for RX and TX; only the frequency and R change.

The R above is for the default of a 2-bit per-channel setting (probably the CPS reference frequency choice; inferred). Its other values give R 5 or 4 (VHF) and 3 or 2 (UHF); RadioFoundry uses only the default. The LO side follows the band's upper edge from calibration (11.2): at or below 200 MHz high side, else low side, so VHF is high side and UHF low side as in 5.2.

From the LMX2571 data sheet [TI]: the word is a R/W bit (0 = write), a 7-bit address and 16 data bits, clocked in on the rising edge and latched when LE rises. In these values R4 is FRAC_ORDER 3 (third-order modulator) and PLL_N (12 bits, at most 1023), R1 holds PLL_DEN[23:16] (0) and PLL_NUM[23:16], R2 PLL_NUM[15:0], R3 PLL_DEN[15:0] (0), R5 PLL_R 1 and the pre-divider R, R6 the multiplier bypassed, R8 EXTVCO_SEL (PLL mode with an external VCO) and FSK_EN. The data sheet asks for DEN = 0 when FSK_EN is set; the fraction is then over 2^24, as V26.45 computes it. R7 turns both of the chip's RF output buffers off (the external VCO is the output). R42's charge pump down current is not equal to R41's up current, though the data sheet asks for equal; that is V26.45's value. The data sheet's power-on sequence also writes R60, R58, R53 and the rest; V26.45 writes no register outside the set above, and neither does RadioFoundry. A reset restores the chip's defaults (its own VCO, the TX output buffer on, the external VCO's charge pump off) until R7 and R8 come again, which is why neither resets on a retune.

No lock detect input is known for any revision (?). V26.45 reads no synthesizer pin and never enables the LMX2571's lock detect output.

5.4 IF receiver per revision

V1-V4: AKM AK2365A, one per band. Bit-banged 16-bit words on IF_DATA (PE13) / IF_CLK (PE14) with chip selects PE11 (VHF) / PE12 (UHF), reset PE15 (pulse low for at least 1 us). Data set while the clock is low, latched on the rising edge. Written each time the receiver is turned on: soft reset 0x08AA, then 0x02F1 (25 kHz) or 0x02E9 (12.5 kHz), 0x041D (AGC), 0x0600 (IF gain 6 dB), 0x1601, 0x1880 (auto AGC). The chip's 450 kHz output feeds the HR_C6000, its demodulated audio the FM path (6.1).

From the AK2365 data sheet [AKM] (the A part taken to be the same, unverified): a frame is 16 clocks, MSB first, latched on the rising edge of SCLK while CSN is low: R/W (0 = write), a 6-bit address, one low bit, 8 data bits. That is the word reg << 9 | data above. SCLK high and low are at least 500 ns. Register 1 = 0xF1 is mode 7 (everything on), the wide demodulator level, the +-6 kHz filter and the 50.4 MHz second LO; 0xE9 the narrow level and the +-3 kHz filter. Register 2 = 0x1D starts the discriminator calibration (1.3 ms). Register 4 = 0xAA is the software reset. After power-up the chip needs a hardware reset (RSTN low at least 1 us).

V5: no programmable IF chip. As V26.45 drives the lines: PE11 / PE12 set the VHF / UHF IF filter, high for a 20 or 25 kHz channel and low for 12.5 kHz (only the receiving band's line is written). PE13 / PE14 connect the VHF / UHF IF to the HR_C6000, high = connected: the receiving band's high and the other low, both high in dual watch, both low before a transmit retune and back on last in the return to receive. PE15 is not used. The V5 IF part is not identified (?); the firmware doesn't name it.

5.5 Receive and transmit switching

RX: Power_Control on, both R5 and both C5 on, T5 off, RF_APC_SW off; synthesizer to the LO with VCO_VCC high for the band; DAC1 (UHF) or DAC2 (VHF) = the calibrated front-end tuning voltage; IF set up for the band and bandwidth; U_V_AF_SW to the band.

TX: both R5 off, synthesizer to the carrier with VCO_VCC low, DAC2 = APC drive (for both bands: PA5 serves the APC in TX), then the band's T5 on and the other off, then RF_APC_SW on. On V4 and V4A / V5 the other band's C5 supply goes off while one band transmits (V4A / V5: as V26.45 does it); V1-V3 leave both on (unverified). Per DMR burst only T5 and RF_APC_SW toggle, with no retune; return to RX drops RF_APC_SW, both T5, then reprograms for RX. There is no lock check.

V26.45 (V4A / V5) timing: the transmit retune drops RF_APC_SW, both R5 and both IF routes, sets the supplies and VCO lines, writes the words, then waits 12 system ticks (nominally 12 ms) before T5 and RF_APC_SW. The return to receive writes the words, turns R5 on, waits 4 ticks, then connects the IF routes. The ordering beyond that is the reference port's.

5.6 Power levels and control

DAC2 (12 bit) is the APC reference: the PA drive, in DAC counts. The factory calibration (11.2) holds four PA rows per frequency point, labeled 5 W, 10 W, 25 W and 40 W. The labels are wrong: the rows put out about 10, 14-21, 24-28 and 40-50 W. Measured on one radio with a wattmeter into a dummy load (FM carrier, procedure in power-calibration.md):

• The cliff. Below the zero point by 5-20 counts the power loop loses control and the PA puts out about 10 W. A drive of 0 is below it: the ramp starts and ends at the band's zero point (UHF 440, VHF 870), and the drive goes to 0 only with the loop open. Ramping from 0 gave a carrier at key-up and a splash at key-down.
• The low end follows the absolute drive: the zero point moved 10 counts between the two UHF frequencies and not at all on VHF. The low levels are fixed drives per band. At the very bottom that spread is 2-3 dB: drive 457 gave 0.18 W at 446.100 and 0.10 W at 440.000, so 50 mW can't hold ±2 dB across the band.
• The upper levels move with frequency and follow the factory rows: 25 W is interpolated in watts between the rows around it, the top level is the top row plus a fixed step.
• Lowest level. The margin above the cliff is 20 counts (hot shift 5). UHF: 100 mW (456), the lowest name that fits ±2 dB at both frequencies. VHF: the curve is steeper, and 250 mW (880) is the lowest level that keeps the margin.

The short check with this table (section 4 of the procedure, FM carrier, watts):

On VHF the low levels' output rises toward the bottom of the band at a fixed drive: level 0 (880) read 0.37 W at 144.010, 0.25 W at 146.000 and 147.990, and 0.14 W at 151.5125 (−2.5 dB: outside ±2 dB). Drive 882 read 0.45 W at 144.100 and 0.20 W at 151.5125. One fixed drive can't hold 250 mW from 144 to 152 MHz, so the VHF low levels are calibrated at 146 MHz, the middle of 2 m, and hold ±2 dB across it. The HIL wattmeter check keys at 445 and 146 MHz for that reason.

A radio whose rows give levels that don't rise, or a top level over 2300 counts, transmits on no level. The debug link's tx_drive view key shows each level's drive, and RADIO op 36 sets one transmission's drive (debuglink.md). RadioFoundry refuses TX without an accepted table.

5.7 RSSI, noise, squelch

Analog per band: VHF RSSI PA0, UHF RSSI PB0, VHF noise PC5, UHF noise PB1. A fit, not a measurement (?): V1/V2/V4 -135 dBm (VHF) / -145 dBm (UHF) + raw8 / 2; V5 -155 dBm + raw8 / 1.95 (raw8 = the 12-bit average >> 4). V26.45 has no dBm conversion (it compares raw readings with the calibration's squelch rows), so the V5 fit doesn't come from it. Calibration also has RSSI points at -120 and -70 dBm and squelch open / close rows (11.2).

The noise line follows the modulation. Under a -73 dBm NOAA carrier (VHF, 25 kHz), it reads about 100 counts in a pause and peaks at 900-1500 in speech for tens of ms; an empty channel holds 1700-1900 (first radio, 2026-11-03). The squelch therefore takes the lowest reading over the last 160 ms (radio_md9600.c), cleared on every retune: one reading a poll let speech close it. RSSI holds steady through the modulation and falls about 11 dB within one 25 ms poll when the carrier ends (UHF, -127 dBm), so a fall of 8 dB or more since the last poll starts the window over and the squelch closes on the next reading (md9600_noise_floor, rfseq_md9600.c). Without it, the noise kept the squelch open about 170 ms after the carrier dropped.

The calibration's squelch rows suit the 12.5 kHz filter. Through the 25 kHz one the noise line reads about twice as high under the same weak signal: a -89 dBm VHF carrier reads about 1350 instead of 710, while an empty channel moves only from about 1750 to 1850 and a full-quieting one stays near 220. A 25 kHz FM channel therefore multiplies both thresholds by 3/2 (md9600_rf_sql_wide); without that, the carrier stayed shut at level 1. 7/4 opened level 1 on empty UHF channels. DMR is always narrow and keeps them.

---

6. Audio

6.1 Paths

FM: IF chip discriminator -> U_V_AF_SW (band) -> FM_SW (stages on) -> FM_MUTE (high = to the volume control) -> analog volume knob -> amplifier. DMR and beeps: HR_C6000 line out -> volume control. The amplifier mute is AF_SW (PB6) driven as PWM from TIM4: 0 % = unmuted, 100 % = muted; a partial duty (30 %) can be used for click suppression. The volume knob is analog only (no ADC input): no software volume.

6.2 Microphone

Hand mic on the RJ-45 jack: mic audio to the HR_C6000 line input, PTT on PE10, keypad on PA6 / PA7 (9.3). Mic and GPS share one supply switched by PA9 high; it can stay on whenever the radio runs. VOX / mic level on PA3 only.

---

7. Display

7.1 Panel and bus

128 x 64 monochrome, ST7567, on SPI2 shared with the SPI flash: SCK PB13, MOSI PB15, CS PD14, RS PD13 (low = command, high = data), reset PD12. The flash and the LCD must not be accessed at the same time.

7.2 Init, orientation, contrast

Reset low 1 ms, then high, wait 5 ms. Commands: 0xE2 (reset), 0x2F (booster, regulator, follower on), 0x81 0x12 (electronic volume = contrast 18), 0xA2 (bias 1/9), 0xA1 (SEG reverse), 0xC0 (COM normal), 0xA4 (normal, not all pixels on) or 0xA7 (inverse), 0xAF (display on). Writes per page: 0xB0 | page, 0x10, 0x04 (column 4 offset), then 128 data bytes. Contrast 0x81 + value; the usable range is about 5-30. Sleep: 0xAE then 0xA5. 0xA6 (non-inverse video) is the reset state (?: RadioFoundry should send it).

7.3 Backlight

PC6, TIM8 CH1, period 256 (unverified). On V2 and later the LEDs are off below about 16 % duty and fully on by 19.3 %, so RadioFoundry maps 1-99 % into counts 41-49 of 256 and 100 % to always on. A bit in the hardware option block (11.1) marks radios whose backlight is only switched on and off (unverified). On V1 the duty is proportional; V1 has different backlight hardware,. The keys share the backlight (?).

---

8. LEDs

No MCU pin drives an LED (unverified). The front panel's TX / RX indicator may be driven by the HR_C6000 or by the RF hardware; unknown (?).

---

9. Keys, encoder, mic keypad, PTT

9.1 Front panel matrix

Rows K0 PE0, K1 PE1, K2 PD0, K3 PD1 (open drain, idle high, driven low one at a time); columns K6 PD4, K5 PD3, K4 PD2 (pull-up inputs, low = pressed):

9.2 Channel encoder

Quadrature on PB10 (A, interrupt on both edges) and PB11 (B); one step per A edge, direction = (A != B). No pull-ups configured (?: external).

On a V1-V3 radio (2026-11-02): two steps per detent, resting where A and B differ (01 or 10), and B leads A turning clockwise. RadioFoundry samples (B, A) with the rest mask for 01 and 10: 10 clicks each way count 10, a wobble counts none. With the A = B mask, every run lost its first click.

9.3 Hand-mic keypad

20 positions as two analog levels: row = 4 - (PA6 raw / 800), column = PA7 raw / 1000 (12-bit raw); row < 5 and column < 4 means a key is down:

The mic has 16 keys plus its own up / down / A/B (unverified). Level windows in raw 12-bit counts, both levels at or above 3445 with no key down (unverified):

9.4 PTT

Hand-mic PTT on PE10, pull-up, active low. No separate accessory PTT input is known (?).

9.5 Remote head (not a TYT part)

A community-built remote front panel exists: if PD2 (column K4) reads low at boot, PB10 / PB11 become USART3 at 250000 baud and keys, encoder, mic keys, PTT and GPS characters arrive as 3-byte messages, while display rows go out over the link (unverified). RadioFoundry doesn't support it and must not take a P1, P4 or Enter key held at boot for the panel (whether those keys pull PD2 low is unverified).

---

10. Power

10.1 Supply and main switch

13.8 V mobile supply. The MCU is powered whenever DC is applied; there is no latch the MCU releases to turn itself off. Power_Control (PD15) switches the RF and audio sections. No ignition-sense input is known (?).

10.2 "Off" is standby

Power key = matrix K0 x K6. The radio can be turned "off" by saving settings, writing a standby flag to backup SRAM word 0, and resetting; at boot the flag is found, the clock drops to HSE / 512, row K0 is driven low and K6 is awaited (power key), then the radio runs again after a release and a second reset. Settings that need not survive a supply cut also live in backup SRAM. Removing DC is the only true off. The flag values are RadioFoundry's choice.

10.3 Supply voltage ADC and scan

ADC1 scans eight channels with DMA, ranks IN9 UHF noise, IN15 VHF noise, IN8 UHF RSSI, IN0 VHF RSSI, IN3 mic level, IN1 supply, IN6 mic keypad row, IN7 mic keypad column (unverified). RadioFoundry keeps that order, 480 cycles each at PCLK2 / 8, in a circular DMA buffer. Supply: tenths of a volt = raw / 21.3 (D, plus a user trim); maximum 15.0 V; cutoff hysteresis 8.0 / 10.0 V.

---

11. Calibration

11.1 Location

512 bytes in the SPI flash security registers, read as one 512-byte security read from register offset 0 (the same mechanism as the MD-380, hardware-md380.md 11.1). A copy can also be kept at main-array address 0x010000, recognized by the first 8 bytes of the UHF frequency list (00 25 00 40 00 45 01 40, 400.025 / 400.145 MHz). RadioFoundry reads the security registers and never writes them. The vendor CPS backs the table up.

Registers 1 and 2 hold 256 bytes each (unverified). Register 3 holds a hardware option block: band edges at +0x14, +0x16, +0x18, +0x1A (16-bit, BCD MHz in the top bits: 0x1450 = 145.0 MHz) and bit 4 of +0x1D, set when the backlight is only switched on and off (unverified).

11.2 Layout (dual band: UHF 9 points, VHF 5 points)

Everything else is unknown. DAC values are byte x 16.

11.3 Interpolation

UHF points every 10 MHz from 400 MHz (index 0-8); VHF every 9.5 MHz from 136 MHz (0-4); linear between neighbors, extrapolated with the last slope above the top point, clamped to 0-4095.

---

12. SPI flash

12.1 Device and bus

W25Q128 class, 16 MB, JEDEC 0x4018, on SPI2 with CS PB12, shared with the LCD (7.1). The bus runs in mode 3 at PCLK1 / 2 = 18 MHz for both the flash and the LCD (unverified). Commands in use: 0x03 read, 0x06 write enable, 0x05 status, 0x02 page program, 0x20 4 KB erase, 0xD8 64 KB erase, 0x44 / 0x42 / 0x48 security register erase / program / read with the register number in address bits 15-12. RadioFoundry reads the JEDEC ID but accepts any part that answers with a size. Security registers hold the calibration (11.1).

12.2 Map

Earlier notes put the codeplug / "EEPROM" image at 0 and the calibration copy at 0x010000. The stock TYT codeplug and the stock user database (CSV builds) also live in this flash: the stock firmware needs its flash content restored to run again, so a full backup before the first RadioFoundry flash is mandatory.

What the stock firmware keeps where (unverified; the meaning of most blocks is open):

The update file rewrites the resource segment at 0x060000, but nothing restores the codeplug, settings or lists except a backup. The security registers are the only factory data that a backup can't put back without the stock CPS, which is why RadioFoundry never writes them (19.5).

---

13. GPS

13.1 Module

Optional, JS-M710 (unverified); the "MD-9600-5P GPS" FCC class II change. NMEA on USART1 RX (PA10), 9600 baud, 8N1, DMA. Bursts of invalid ('V') frames are reported from time to time (unverified).

13.2 Power and detection

PA9 high powers the GPS and the microphone together, so it stays on. No presence pin: detect by listening for valid NMEA, as on the MD-380 (ours).

---

14. Bootloader and images

14.1 Entering the loader

Disconnect DC (the power key is not enough), hold P1 and the orange (alarm) key while reconnecting. The screen stays blank and the backlight blinks at 1 Hz (checked on a V1-V3 radio, 2026-11-02). The loader's DFU interface string for the internal flash, @Internal Flash /0x0800C000/01*016Kg,01*064Kg,07*128Kg, tells it apart from the original firmware in normal mode, which shows /0x08000000/03*016Kg under the same USB IDs and strings.

14.2 Protocol and encryption

USB DFU 0483:DF11 with TYT's commands, the DM-1701's protocol (hardware-dm1701.md 15.2). The image is XORed with the MD-9600's 1024-byte key, index from the start of the application image; key SHA-256 c3d665b297651b52310ec098e87440b147136241359c1154d474e517b048c9ae, first bytes A2 FA BB 4B (hardware-dm1701.md 15.3). The key can be derived from an original firmware file (as for the DM-1701 and MD-380): it works on every original firmware file listed in 14.3 (measured).

14.3 Stock firmware files

TYT names the files by feature: P = CSV + GPS, V = CSV, S = recorder + GPS, D = recorder (unverified). TYT's V4 firmware and CPS (for the "new updated PLL", V4 and later boards) are not compatible with V1-V3 radios (unverified). TYT's download page offers only CPS installers for the MD-9600, no firmware. Retevis's firmware download offers the RT90's V5 firmware (two zips, RT90-Firmware-v5 and RT90-Firmware-GPS-v5). Dealers and community pages mirror the older TYT files.

Files examined):

Files named MD9600-CSV(V4)-V26.45.bin and -CSV-GPS(V4)-P26.45 also circulate; they hold the V16.45 V4 ("PLL1590") application, not LMX2571 code. The D26.57 V4A build programs the synthesizers and the IF lines exactly as the V26.45 builds do.

All of them: two segments, (0x00060000, 0x59800) for the external flash resources and (0x0800C000, 0xB1800..0xB6800) for the application, payload at 0x100, 0x100 trailing bytes. The leading digit of the version number is the board family (0 = V1-V3, 1 = V4, 2 = V4A / V5) (F: inferred from the known files). The V06.09 images report SP 0x20001BA0, the V16.45 ones 0x20001BB0.

14.4 Flashing: stock bootloader and stub

Nothing below has run on an MD-9600 yet: every row is unverified.

The stub is the DM-1701's and MD-380's image. The host sends it this radio's board record: SPI flash on SPI2 (PB13 SCK, PB14 MISO, PB15 MOSI, AF5), chip select PB12, mode 3, at most 4.5 MHz, the LCD's chip select PD14 held high while the stub runs, an 8 MHz crystal, the bootloader ending at 0x0800C000. The stub never touches SPI1 / PD7, the HR_C6000's voice port here.

An update with the stub writes the changed sectors of 3-8 only. It leaves the codec in sectors 9-11 alone unless the image is merged with the codec (rfoundry_md9600_codec.bin), and never touches the bootloader in 0-2. Sector 3 is erased first and its first word written last, so an interrupted update leaves the application invalid. Whether the TYT bootloader then stays in DFU on its own, as the DM-1701's does, is unverified. If it doesn't, the key combination of 14.1 still reaches DFU. The stub also backs up and verifies the whole internal flash and the 16 MB SPI flash (--progmem, --q128), which covers the backup 12.2 asks for once RadioFoundry runs. Before the first install the web flasher backs up what the original firmware or the bootloader gives (15.2).

---

15. USB

OTG_FS on PA11 / PA12, mini-USB on the rear, straight to the MCU (no UART bridge). The bootloader's DFU device is separate (14.2). No VBUS sensing: PA9, the OTG_FS VBUS pin, is the mic and GPS supply switch (unverified), so the core must run with VBUS sensing off. The stock application's device is DFU class with two alternate settings, the internal flash and the SPI flash, self powered. TYT's CPS reads and writes the radio through it; most of the commands inside its transfers are not known (17 #21).

15.1 The original firmware's version over USB

Checked on a radio (V06.09, 2026-11-02). Running normally, the original firmware enumerates as USB 0483:DF11, manufacturer "AnyRoad Technology", product "Digital Radio in USB mode": the same IDs and strings as the bootloader. Its interface's alternate settings are "@Internal Flash /0x08000000/03016Kg" and "@SPI Flash Memory /0x00000000/16064Kg"; wTransferSize is 1024. It starts in dfuIDLE. The bootloader's first interface string is "@Internal Flash /0x0800C000/01016Kg,01064Kg,07*128Kg" (seen on a radio): the strings tell the two apart without a request, and the installers send the requests below only to a device showing the original firmware's string.

It reports its version, and nothing on the radio changes, with these requests on interface 0 (wIndex 0, wValue 0):

A block 0 command is matched on its first byte and its exact length; an unknown one stalls. The bootloader answers the same sequence too, with 54 02 10 06 (first byte 0x54, 'T'; from its code, not yet sent to a radio): only a first byte 0x56 ('V') is the original firmware's version. 0x54 means the bootloader; a stall or any other answer, unknown. The other block 0 commands, DNLOAD with block 2 and above, and a zero-length DNLOAD (its manifest step writes the SPI flash and resets the radio) are never sent by RadioFoundry's tools. The version's leading digit is the board family (16), so the installers read it to learn the board revision (19.3).

15.2 Backup before the install

The original firmware (running normally) and the bootloader both let a host read the radio without writing anything. The web flasher backs up through either before an install (board.toml [flash.original_backup], web-flasher.md). Every block 0 command below is DNLOAD block 0, then GETSTATUS twice (bState 4, then 5), then ABORT, as in 15.1.

The codeplug areas are within the first 2 MB (0x002000-0x03EFFF and 0x110000-0x197FFF in the map of 12.2); the 11.7 MB above 0x204000 (a contact database) is most of the time a full read takes. The internal flash above 0x08010000 can't be read by either: the media read of the internal flash returns a RAM buffer.

Never sent by the backup: 41 (erase), DNLOAD with block 2 and above (write), a zero-length DNLOAD (the original firmware's manifest writes the SPI flash at 0x02F000 and restarts), 91 with any second byte but 01 and 05 (05 only to the original firmware), B2-B5, C4, D5, an UPLOAD of block 1, and an UPLOAD above 1024 bytes in program mode. The flasher refuses each of them in code before it reaches the radio.

---

16. Board revisions

The original firmware follows the same split: V06.09 for V1-V3, V16.45 for V4, V26.45 for V5 (and D26.57 for V4A). The V4A and V5 images program the radio the same way, and neither reads anything that tells V4A from V5. TYT sometimes changed chips without changing the label; a wrong build boots but neither receives nor transmits, and does no harm (unverified). GPS models have been reported working with the V5 build. Radios needing TYT's V4 firmware are V4 or later.

No part of the radio reports its board revision, and TYT ships one firmware per revision (14.3). The GPS and recording models use the same pins as the others (unverified).

The original firmware does report its version over USB (15.1), and its major version follows the revision: 06.xx V1-V3, 16.xx V4, 26.xx V4A/V5. Any other major says nothing about the revision. A radio someone moved to another revision's firmware would report that firmware's line (unverified whether that boots, 14.3).

Detection: no ID pin or register is known. A run-time probe is possible because the families differ in the bus they need, but every candidate needs a radio: for example, program the V1/V2 SKY72310 words and watch RSSI / noise on a known signal, then the V5 words. The safer first design is one image with the revision as a setting chosen at first boot (or in the bring-up menu), defaulting to V5, with TX blocked until RX works (?: our proposal).

Target first: V5 / V4A. It is the current production board (the codec comes from the "2571V5" file), GPS models report V5, and it has the simplest IF path. V1/V2 come next (SKY72310: the driver exists from the MD-380). V4 last (unidentified synthesizer, needs its power-on quirk).

---

17. Unknowns that need a radio

18. Sources

---

19. RadioFoundry on the MD-9600

Bring-up state (2026-11-02): runs on a V1-V3 radio (original firmware v06.09). Checked: boot, display (orientation 7.2 and 17 #22), keys, the debug link and CPS, the data flash, calibration and option block reads, FM receive on VHF (a NOAA station through a dummy load). Open: the receive audio level is high at the bottom of the volume knob and sounds overdriven (the HR_C6000 settings, the FM_SW line and the IF chip words match the original firmware's; whether the original firmware sounds the same on this radio is not checked); UHF receive, DMR, transmit. boards/md9600/.

19.1 What the image does

19.2 Clock plan and memory map

19.3 Board revisions in one image

All three are on by default; a build with fewer drives only those boards. The revision in use comes from, in order:

1. The stored record (8 bytes at 0x01F000: "M96R", a format byte, the revision and its complement). Only a stored record confirms the revision; transmit will need it.
2. The receiver probe, when built with MD9600_REV_PROBE=1. With the transmitter supplies and the PA loop held off and the RX VCOs selected, it programs the UHF synthesizer with each built revision's words for 446.0 MHz receive and reads the UHF noise level against the unprogrammed baseline. A revision wins when its change is at least the threshold and twice every other one's. It never drives PE15. The thresholds are unmeasured, so it is off by default.
3. The build default, MD9600_REV_DEFAULT (v5).

A stored revision this image can't drive leaves the receiver off rather than programming the wrong chip. The record is set with Settings > Advanced > Hardware > Board revision or the debug link's HWOPT (rfoundry_debug.py hwopt "Board revision" V4A/V5); it applies from the next start-up. The installers set it themselves: before the install they read the original firmware's version (15.1, 16), and after the first start they store the revision it gives when the radio holds none (board.toml [flash.original_version], web-flasher.md). A stored revision that differs is reported and kept. A version read by the installer counts as a person's statement: the record it stores confirms the revision like one set by hand. The open-firmware CPS has no item for it. Until a record is stored the radio receives with the probe's or the default's revision and never transmits, and the diagnostics page asks for one ("Set rev: Adv>Hardware"). Its first three lines show the revision and its source ("unbuilt" for a stored revision this image doesn't drive), that prompt or "rev confirmed", and the probe ("off" when not built).

The default is one constant, MD9600_REV_DEFAULT in boards/md9600/board.mk. It is v5, the current production board.

19.4 Pin use in RadioFoundry

19.5 Data flash, calibration and the board record

This is the DM-1701's map; a part smaller than 16 MB gets no map and the radio runs from RAM. The settings ring and the journal sit under the foreign region guard (settings-store.md 5), so stock data found there is left alone until the debug link claims it.

Board record. Records of 8 bytes ("M96R", a format byte, the revision and its complement, a spare byte) are appended to the sector, and the newest valid one counts. A power cut while one is written leaves the one before it. The sector is erased only when its 512 slots are used; a cut during that erase leaves no record, which the radio treats as a new radio (probe or build default, transmit refused).

Security registers. RadioFoundry reads registers 1-3 once at start-up and never erases or programs them, and never writes a status register (the registers' one-time lock bits are there). The SPI NOR driver has no command for either, and tests/host/spiNorTest.c checks that no such command reaches the chip. The open-firmware CPS can read them as area 10 and can't write them.

Calibration. boards/md9600/cal_md9600.h is the interface for the radio code, on the generic reader in drivers/cal/calblock/. Both blocks are kept whole as read, unknown bytes included.

A row whose points are all 0xFF or all 0x00 has no value. Rows interpolate linearly between points (rounded) and continue the last slope past the top point. Front-end tuning without a value is mid scale (2048). The four band edges are sorted by value, so the order of the halfwords in the block doesn't matter: the two below 300 MHz are VHF, the two above UHF, and anything else (a nibble above 9, three edges in one band, two equal) gives none. With the backlight bit set, any brightness above 0 drives the backlight fully on. Transmit stays refused whatever the PA rows hold.

19.6 Debug link keys

The board view section (debuglink.md 3.7) carries these keys, each as board.<key>. The supply voltage is the generic supply_mv key instead (hal_power_t.supply_mv; the divider's scale is unverified, 10.3).

tests/hil/test_md9600.py checks them on a radio: identity, every key present, the transmitter switches low, the clock, the flash and its map, both blocks readable, no key or PTT down at rest, the ADC scan in range and a plausible supply, and the receiver tuned when the revision is driven. It never transmits and skips on any other radio.

19.7 USB, programming and updates

The rfoundry board entry, the web flasher's radio entry and the release images come from boards/md9600/board.toml.

19.8 RF sequencing

boards/md9600/rfseq_md9600.c holds the order of every RF step for every revision; radio_md9600.c maps its lines to the pins of 19.4. No synthesizer has a lock detect line (5.3), so each gets a fixed settle time after its words. All times are unverified on a radio; the V4A / V5 transmit settle and reset wait are V26.45's (5.3, 5.5).

Return to receive ramps the APC reference down in the same steps, opens the loop, drops both T5, then runs the receive column with the last receive settings. For DMR bursts the PA alone (T5, the loop, the ramp) switches while the synthesizer stays on the carrier. DMR receive uses the 12.5 kHz IF setting.

DMR transmit (CONFIG_MD9600_DMR_TX): the HR_C6000 glue's prepare hook runs steps 1-4 without the waits (TX VCO on the carrier, receivers off) at the start of a transmission, and the task waits the synthesizer's transmit settle (step 4) plus 1 ms. Each burst then, 0.7 ms after the RF TX interrupt (a timer, no waits in an interrupt): the band's T5 on, 500 us, RF_APC_SW on, the APC reference up in 4 steps of 100 us; at its end (the timeslot interrupt) the same ramp down, RF_APC_SW off, T5 off. T5 alone leaks the carrier about 13 dB under full power, and that counts as on air: keyed at the interrupt itself (about 1.3 ms ahead of the slot), every burst was 31.7-31.9 ms long at floor + 10 dB on the SDR bench (2026-11-06, 461.4625 MHz, lowest power; the bench allows 27-31.5 ms). Delayed, full power still comes about 0.2 ms after the slot boundary, inside the guard ahead of the payload. The split duplex TX half (a BS outbound) keys once and has no guard: its slot starts with the CACH. Its key-up is timed from the slot clock instead, full power 6 ms ahead of a timeslot interrupt, after that slot's sync (docs/spec/modem-hrc6000.md 9.1). The receiver comes back at the last burst's PA drop when the engine says no burst follows (stm32_hrc_dmr_tx_last_out), else at the slot engine's TX done, on every channel, with the receive column's synthesizer, front-end and line steps and no waits. Back only at TX done, the receiver was set up a slot later, as an answer starting at our last burst's end came in. On a split channel a wake-up then hears the repeater's answer (left on the carrier, every key-up to a repeater that was down ended in no_repeater). On simplex the reply to a confirmed packet comes in the next frame, 30 ms after the last burst, before the radio task ends the transmission. That end goes through the modem glue's shared path (docs/spec/dmr-modem.md 6.4): with the receiver back from TX done, the board's tx_end keeps the synthesizer and only sets the front-end tune again (on VHF it shares the DAC with the PA drive, which the end of the transmission zeroes); rx() is a full set-up. An SFR receives between its bursts (below).

SFR (CONFIG_SFR; the transmission receives between its bursts, docs/spec/sfr.md 3 item 1, gotchas 14.6): at each burst's end, after the ramp down, the synthesizer goes back to the receive LO (receivers on, RX VCOs, the words, the front-end DAC, FM_SW off; on V4A / V5 the IF routes) without waits; the IF chip keeps its set-up. RF_TX_INTER moves to 1.5 ms ahead of the slot (HR_C6000 0x12 = 15, back to 0 when the transmission ends). There the TX retune runs, then 0.6 ms for the lock, then the burst's T5 and ramp. The original firmware never retunes between bursts, so it gives no figure for this; the 0.6 ms holds for V1-V3 only, and V4A / V5 needs its own sweep. Swept on air (V1-V3, UHF 446.125 MHz, 5 W, 2026-11-03), the bench's 3-superframe call repeated by the MMDVM SFR:

The call goes up whole (18 voice frames and the terminator). About 15-25% of the inbound AMBE frames fail their C0 check, and the first frame of each burst carries most of the corrected bits: the receiver's recovery after the drop at the slot start. Keeping the receivers' supplies on while transmitting changed nothing measurable. One run in three repeated two superframes of three at any setting (not explained yet).

Status (2026-11-03): SFR on V1-V3 is not fully supported yet. The HIL repeater-quality run (4 superframes, 72 inbound voice frames) repeats 27 bursts and passes the slot, CW ID and user-role checks, but loses 13 of 72 inbound frames (about 18%; the limit is 3), with 64 of the 76 corrected bits in the first frame of each burst. The SKY72310's charge pump is already at its maximum (register 6 gain 0x1F) and it has no fast-lock mode, so the receiver's recovery after each outbound burst is set by the loop filter. Next step: scope the synthesizer's lock detect and the receive AGC after a burst to tell the relock from what follows it. Measured off air (UHF, 5 W, 2026-11-03): T5 left on between bursts leaks the carrier at -13 dB, hence T5 per burst. With it, between bursts the carrier is below the measuring receiver's floor (26 dB down). On air at key-up: a 0.5 ms step to -13 dB (T5), then full power 0.4 ms later; key-down takes 0.4 ms. On-time 30.7 ms, same-slot spacing 60.0 ms, outer symbol deviation 1933 Hz, every burst of a 3 s call decoded (headers, 9 superframes, terminator).

At power-up, with the revision known: receivers on, then on V1-V4 the AK2365A reset (PE15 low for 10 us), and on V4 the VHF synthesizer set for 145 MHz receive. On V4A / V5 the LMX2571 reset goes to both chips, then 10 ms; PE15 stays an input.

Transmit is refused unless all hold: the build has CONFIG_MD9600_TX (on by default); a person armed it for this power cycle (Settings > Advanced > Hardware > Transmit, or HWOPT; every start is unarmed); the revision comes from a stored record; the frequency is in a band; the calibration's PA rows are present at every point and rise with the power level (11.2). A refusal or a bus failure leaves the PA loop and both T5 off and the receiver back on. Disarming drops the PA at once.

Calibration as the RF code uses it (11.2, all unverified): front-end tuning, PA drive per level (5 W row 0x20, 10 W 0x1A0, 25 W 0x190, 40 W 0x10, VHF 9 bytes later), squelch level 1 and level 9 opening thresholds. DAC values and noise thresholds are the byte x 16. The noise reading maps linearly onto the core's squelch scale through the two thresholds: level 1's maps to 64, level 9's to 40. Without them it is the 12-bit reading / 16. RSSI uses the curves of 5.7. The diagnostics page shows which row groups each band accepts ("calrf V RPS U RPS"), the sequencer state, the arm and the last refusal.

19.9 Other RF-side lines

19.9.1 VHF transmit

Checked off air (V1-V3, 151.5125 MHz, 5 W into a dummy load, 2026-11-03), the bench board's receiver retuned to VHF:

19.10 Build switches

The board's own switches, in boards/md9600/board.mk and config.mk (the shared ones: build-config.md):

The 16.8 MHz TCXO has no control line (5.2), so the reference trim (REF_TRIM) programs each synthesizer for f x (1 + trim) at every tune and burst, the IF unchanged (rfseq_md9600.c; radio-features.md 6.1).

Feature switches that differ from the platform's defaults (config.mk; the two lists: build-config.md):