0xdecafbad.com

I am writing some tools to dump the eeprom data from my Yaesu FT-897. I have heard many people argue that this is not safe to do. That I can brick my radio, and these comments are spread out all over on different forums and to different people.

These assertions are largely spreading FUD.  There is some basis in fact, but the claims greatly exaggerate the risks all to tell people not to do something with their own equipment.  I do not understand why they are doing this, other than they have not fully thought through their assertions, but I will address the most common claims they have made.

1. EEPROMs have a limited write lifecycle and you will wear out your eeprom and be unable to use your radio!

This is somewhat laughable to anyone that has done a memory map.  You will notice that many of the regular configuration options are written to the EEPROM.  This is actually required so that the settings can be restored when you turn your radio off and then back on.  In fact the process of doing a memory map is to dump the EEPROM data, make a change, dump it again and look for changes.

You will wear your EEPROM out just as fast by changing the settings, regardless if they are done via the built in contorls, CAT, or by writing directly to the EEPROM.  When you change the frequency, the EEPROM is written to, when you change the repeater offset, CTCSS, mode, etc the EEPROM is written to.  They do not tell people not to use the radio for fear of wearing out their radio, but they do tell people you should not write to the EEPROM even though this is a normal reaction of normal use.

Where these people are right is that if you exceed the number of writes to the EEPROM the data may be corrupted.  This can cause operational problems with the radio.  If you write changes to the eeprom as fast as you can constantly, you can wear it out fairly quick.  Some EEPROMS have a 1 million write cycle lifespan, others are 10 million, and some of the older ones are only 100,000. This is for any specific area on the EEPROM and not for the EEPROM as a whole.  If you write to different areas, then it will not wear out as fast as writing to one area over and over.

At 1 million cycles, it will take 1 write every 30 seconds every minute of the day for a year before you hit that limit.  At 10 million cycles it will take 10 years of this level of abuse.

If you wrote 70 times a minute (more than 1/second!) every minute of the day it would take 10 days at 1 million write cycles and 10 million it would take 100 days.  This would also be quite abusive to the radio, and there is no reason to do anything that causes an EEPROM write this often.

I do not know what EEPROM is actually in the radio, and I have not looked up the datasheet for it to know how many writes it really has before it starts to be unreliable.  Given the way Yaesu uses the EEPROM I have to believe that it would be at least 10 million writes, anything else would make the lifespan of the radio before requiring an EEPROM replacement too short.  They might have found an EEPROM that has even more writes before becoming unreliable.

2. An errant signal can hose the bits on the serial line and you will hose your radio!

This too is somewhat laughable, although not as much as claim #1.  It is a potential, sure you can have some errant signal that would cause problems.  The CAT protocol uses 1 start bit, 8 data bits, 2 stop bits.  The RS232 spec states that you have 2 states, space and mark.  According to that spec, you have nominally +/- 12v (it can be 5-25 volts though), this means that the difference between a 0 (-5v) and a 1 (+5v) is minimally 10 volts.  If it is using the tighter spec of +/-12v it would be a 24 volt difference.  This means that it is far less likely to cause bit errors, although it can happen.

The CAT protocol would require that it only be one of the data bits and not a start/stop bit that gets corrupted.  This means that 3/11 bits sent would cause a transmission error that would result in the command not being processed.  If it is not processed then it is not dangerous.

The CAT protocol is a YAESU official feature.  I do not believe that they would put something in the radio that would cause them to have upset customers and increased service (and waranty) requests.  The undocumented commands that are used to read/write to the EEPROM go over the same medium that you would use to set the frequency and other things.  Certainly if you write to  the wrong area you can hose the radio, but bricking it is unlikely.

The EEPROM is not where the main program that the radio runs is located.  It is not where the “factory reset” code resides.  If you hose the EEPRROM you can do a factory reset which will cause you to lose your factory calibration data (which is stored on the EEPROM) but if you backed it up first, you can restore it.

The main program, the bootloader, and the factory reset code resides elsewhere, and it appears that it is contained inside the CPU itself.  Many embedded systems have enough of an EEPROM on the CPU, which is what contains the code to allow an external EEPROM to be accessed.  This also means that it is more difficult for you to transmit in places that you should not be, since  the Tx/Rx sections are contained on the EEPROM in the CPU allowing for a more difficult time changing them, and in the case of US sold radios all of the different “bandplans” are the same so even if you tell it to use a different one, it has the same data.  Yaesu started doing this in about 1996 when the FCC got after them for their radios being modified, primarily to exclude cellular frequencies which at the time was a hot button item.

In short I do not think it is that dangerous to write to the EEPROM, I do not think it is dangerous to use the CAT protocol, and think that much benefit can be obtained by doing this.  I think there is some risk but not as much as some have indicated.