When I heard last week that the Motorola branding was going to be shelved and replaced by “Moto by Lenovo”, like many others online, I felt a tinge of sadness as if another great tech brand had fallen by the wayside. In the new phone market dominated by Apple, Samsung and LG, formerly great brands such as Nokia and HTC are in deep trouble, and Motorola seems to be joining them.
Motorola was important in bringing cellular phones to the masses, with their DynaTAC being the first commercially available portable cellular phone, the StarTAC being the first flip-phone and the ever-so-popular Razr with excellent sensitivity. Motorola products generally had good reputations and often premium price-tags. I never had the fortune of owning a Motorola device first-hand, but I’d often see others carrying them around.
Instead, I knew Motorola more from a radio aspect, as they were very much involved in the NSW GRN trunked radio system, which ran on Motorola Smartnet technology, before being upgraded to P25. You would see the XTS series radios being carried around by front-line public servants all the time. I was also aware of them from their paging equipment.
My Earliest Recollections
Sometimes it shocks me just how far back I can remember, and indeed, my earliest recollections of pagers was from when I was in second grade primary school. One of my teachers had a small black “box” which he clipped to himself, and from time to time, it would beep rather loudly and a light would flash. At the time, I was a very inquisitive person and I remember asking him “What is that?” to which he replied “It’s a pager.”
I didn’t exactly understand what a “pager” was. After staring at him bemused, he turned the unit and showed me the screen where a bunch of letters appeared. He explained to me that this was a message that had been delivered to him asking him to call someone.
At the time, being roughly seven years of age, I was completely taken aback. At the time, I was just mastering the art of writing a letter and posting it by snail-mail. Home internet access was not popular, and e-mail services were not quite as ubiquitous as they are today. Mobile phones existed, although analog was most popular and early digital models had no SMS ability. You could call someone, but that takes time, they need to answer, and it comes with its own costs. The idea that a text message could be delivered instantaneously without anyone visibly doing something felt so futuristic to me at the time.
That being said, paging was very much something which was mainly viewed as a “poor man’s cellular service,” and mainly popular with business-people. Eventually, my Mum and Dad both got mobile phones, and we never even considered nor owned a pager ourselves. As a result, the whole “paging thing” remained somewhat intriguing to me.
It wasn’t until about 2007 when I first bought a radio scanner that I rediscovered paging after stumbling upon several POCSAG, MOBITEX and a single FLEX carrier on the air. Thanks to software such as PDW and multimon-ng, it’s possible to decode many paging formats, provided a good enough signal and you have a radio that provides unfiltered audio or is modified to do so, also known as a discriminator tap. More variable results can be had with RTL-SDR based reception. Today, many of the companies offering paging services have shut down, and there is no longer any FLEX in Sydney, and fewer POCSAG carriers than before.
Then, in about 2009 when I got into ham radio, I visited the Wyong Hamfest. While walking around, I came across a desk piled with Motorola Advisor pagers. I stared at them almost transfixed as they were the exact same unit my teacher had worn over a decade earlier. I couldn’t resist buying a pair of units for some pocket change. I didn’t have any firm ideas what to do with them at the time, and I kept them for tinkering later. At least, I finally got my hands on the elusive black box.
Paging Technology
Paging technology has developed over the years. Some of the earliest commercially successful paging technologies were based on tones, such as the two-tone sequential paging system. This allows for remote receivers to be activated (beep, control a connected device) based on two tones of at least a certain duration. It was relatively inflexible, and can be likened to a selcall type system. Proprietary variants which allowed for more sophisticated abilities did not achieve widespread usage.
In the quest for more flexibility and speed, more sophisticated digital data based systems were used. One of the earlier systems is Motorola’s Golay Sequential Coding. This system incorporated error correction, battery saver modes, group calling, alphanumeric messaging and combination tone and voice on the same channel. It appears that the system uses a hybrid mix of 300/600bps for parts of the transmission. At this time, no Golay transmissions are on the air in Sydney, and indeed, it seems that they are mostly or completely phased out world-wide.
Around the same time (1970’s), the British Post-Office produced a more open standard known as POCSAG (Post-Office Code Standardization Advisory Group). This standard had very similar abilities, implemented differently, and started with 512bps, which was later increased to 1200bps “super-POCSAG” and again to 2400bps. Despite the age of this standard, it was recognized by the ITU and well supported by many vendors, and as a result, it is still heard on the air today. In fact, in Sydney, it is common to hear 512bps as it is used by most hospitals, and 512/1200bps mixed operation used by a commercial operation (Vodafone Messaging).
Europeans may have been in contact with ERMES in the early-mid 1990s, a rival standard intended to be an improvement over POCSAG. It uses 4-level modulation at 6250bps. Sadly, ERMES only had limited traction outside of France, and was never deployed in Australia as far as I know. It is likely still operational in Europe at this time.
A more sophisticated technology also bought to the market by Motorola in the late 1990’s, named FLEX which offered much faster rates than POCSAG (1600bps, 3200bps and 6400bps) by using 4-level modulation, while also retaining 2-level modulation modes to allow for older transmitters to be transitioned over as network planning and coverage testing dictates. This offered a different time-slot based system rather than the asynchronous POCSAG, and had a characteristic “cadence” to the signal on air. Flex is still used currently, and is fairly popular overseas where it can be identified by a slinky-like logo on the pager, but is not in operation in the Sydney area from what I can tell. A later version named ReFLEX also offers a return channel for two-way paging but never became too popular.
Paging transmissions do not operate on cellular-like principles. They, with the exception of two-way paging which never really operated in Australia to my knowledge, are one-way transmissions from transmitter to receiver. These transmissions are unacknowledged, and so important messages may need to be sent several times to be sure of reception. The transmissions also generally take place on one frequency as most pager receivers are fixed or single frequency units, so wide area coverage depends on having multiple transmitters synchronized and sending the same signals across the coverage area. A single page can thus tie up resources across a wide area of linked transmitters, and the slow bit-rate of transmission can cause transmission delays. The pages are generally sent unencrypted, making sending private information unadvisable. However, such technology can really shine when sending messages to multiple receivers simultaneously, as having numerous pagers listen for the same directed transmission does not increase airtime demands. All pagers are identified by a number, which is often programmable. This is loosely known as a Capcode or a RICcode. Only transmissions matching the programmed code in the pager, provided it is tuned to the frequency, are received, decoded and displayed for the user. Most paging protocols are designed for text and uses a restricted character-set to improve speeds, although some are “transparent” and capable of passing pure binary data.
Wide-area paging in Sydney generally takes place in the VHF band, namely 148-150Mhz. The currently licensed transmitters within a 50km radius of the center of Sydney are summarized in the following table:
As a result, it’s quite likely to hear a pager signal on the air – at least the Sydney West Area Health Service and Vodafone Huchison Australia frequencies. Radio amateurs will probably know all about this, as pager transmitters are generally fairly high powered and make reception of 2m amateur satellites challenging as it can cause receiver desensitization requiring front end filters to overcome.
Most of the paging is slowly going away, as the internet and very affordable smartphone and mobile based communications make them less popular and overcome the limitations of paging systems. Instead, paging is now often relegated to supporting legacy alert systems and for machine-to-machine uses as an alternative to using 3G/4G services.
For those interested in pagers, a highly recommended resource is Brad Dye’s Paging Information Resource, where many articles of historical interest are archived for viewing.
The Unit
The two units I purchased appear to both have been formerly issued by Telecom Australia (later known as Telstra). The top unit retains its original Motorola Advisor branding, whereas the lower unit is re-branded. Both seem to be in excellent condition, considering the age. A manual for the unit is still available online.
The front side shows the read (green), function (red) buttons along with directional keys.
My units come complete with their original Motorola branded belt-clip holster, which allows for the pager to slide out. There is a slot in the holster for the internal barcode to show through for inventory control purposes.
The top side has the grille for the alert beeper, a red plastic prism for the LED alert light and an ivory coloured power button. A metal post is also provided for attaching a lanyard to.
The bottom side doesn’t look particularly special, but its importance will be shown in the next part.
The left side houses three holes, which are the programming contacts. The pads are deeply recessed.
The rear of the unit looks a little dirty, but according to the label, the original frequency was 148.0375Mhz. This was likely Telstra’s own frequency, but today, is only used by DoD and one other, both outside of NSW.
The unit itself requires one AAA battery and can run for weeks from it. Inserting the battery causes the pager to start up and beep to confirm it is operating. The battery cover slides in over a rail and is latched into place to make sure it isn’t lost. The battery holder itself features gold-plated terminals, all signs of very sturdy design.
Teardown
Remember that blank panel at the bottom? Well it holds a secret. As it turns out, the sturdy feeling unit can be taken apart with just a good fingernail. Lift the panel at the lanyard end and slide across until it releases and falls out.
The two halves of the shell come apart with fingernail pressure. The back reveals a blue pressure pad that wedges the main PCB and display into place, another that wedges the radio-board into place and a vibration motor for the silent alert feature.
The other half contains the main guts of the pager.
The board closest to us with the Week 29 of 1993 date on it is the radio board. This module is removable and exchangeable and sets the frequency of the pagers’ operation. This board is a 4051 and is highly sought after by radio amateurs as it covers the 2m band at high sensitivity when re-crystalled appropriately.
The board has an antenna (left) which is a ferrite rod with a band on it, and a few variable inductors, a variable cap, and some filters. The bottom crystal, shrouded in blue silicone rubber, is the first IF crystal.
The actual frequency is 65.06875 (likely), but it is also marked with the actual pager channel frequency, in this case 148.0375Mhz. A slight adjustment to frequency can be had by turning the variable inductor slugs.
The other crystal can has the second IF frequency of 17.9Mhz. Because of the multiplier, the actual reception frequency is the first crystal * 2 + 17.9Mhz.
The base board can be seen to have several ceramic-packaged ICs, a backlight inverter transformer, and a sharp LCD controller amongst other things.
The LCD is soldered into place, and comes out with the PCB. The front buttons are like remote-control style buttons with elastomer style pads.
There is also a small back-up battery underneath the blue rubber cover, and this provides battery back-up for messages (probably stored in SRAM) and clock during a short battery change.
Further hardware modification for amateur radio usage is documented in this PDF by Philip N. Anderson, W0XI and serves as a very useful reference for modification and service. Specifically, details on the RF board part numbers, IF and multiplier values needed for custom crystals are provided.
Pager Programming
Programming of the Motorola Advisor requires Motorola-specific software, which you should obtain from Motorola. However, as far as I can tell, Motorola no longer support these pagers, and it wouldn’t be cost effective for a tinker to purchase the whole set-up (think several hundreds of dollars). After some trawling, I found that Blackcrawl pages, archived by HackCanada still has the software available and information on the necessary hardware to program the Advisor.
The three pin interface is basically a TTL-level serial connection, and the software talks to the pager to read/write its internal configuration that way. Figuring that this was the case, the lazy part of me thought, why not try a VM and interface the serial to a USB-serial TTL adapter?
The reason for that became clear straight-away. It seems to require precise timing and hardware register access. While the commands were being sent out to the TTL adapter, and the response lit the RX light indicating it was received, the app “pretended” not to receive anything when running in the VM. A more heavy duty solution (namely, a real computer was required).
In order to do this with the minimum pain, I took the .vmdk file and, using Winimage, converted it to a VFAT style image with a boot sector and wrote that straight to a USB key. I took an old AMD Sempron 3000+ system (Socket 754) with a Gigabyte K8MV800M motherboard with BIOS USB compatibility emulation to boot straight into the USB key. That worked, so I didn’t need to rummage for an IDE hard drive and a floppy drive and do the installation the old way.
The second part was to get the level conversion done – RS232 ports put out “dangerous” voltages for the pager, so luckily, I had a cheap MAX232-based level converter board from eBay several years back.
It was wired up so that Vcc was left to a pin, which I connected to 5v from a USB port with return through the serial port ground. RXD, TXD and GND was connected to three pins on a header that was splayed to be poked through the ports on the pager and held in place to make contact. In the end, this was enough to read and program the pager.
We can see that the capcode of that pager was 0511784 and was configured for 512 bps service. The Advisor appears to be supportive of up to 1200bps. The rules which need to be followed in order to make proper usage of the multiple capcode ability are shown in Brad Dye’s pages. No maildrop features were programmed (used for informational services received without alert and displayed on screen – think of this like a weather widget, or a stock price widget but received on a pager over the air).
Four pages of configurability are available. Interestingly, the out of range indicator is disabled meaning that the user has no idea whether the pager is getting a signal or not. This probably is done so as to make the user feel more at-ease with the pager and prevent lack of coverage complaints – you don’t know when you’ve missed a page until someone complains.
The text prompts have been customized as well, and it seems that the unit is capable of over-the-air programming which is pretty advanced for the time. Data inversion is probably needed where the FSK polarity is inverted. Synthesizer option is available, but turning it on with a crystal-locked RF board doesn’t magically turn your pager into a synthesized unit.
Indeed, the changes for the prompts are to change the default Motorola Inc. text to Telecom Paging, and Low Cell to Low Battery.
A Tribute from the Display
Rather unsurprisingly, after loading up a battery, the unit still works like it was brand new. Of course, the date doesn’t seem Y2K compliant, but it has no problem with accepting 16 for the year.
Pressing and holding the red function button turns on the EL backlight, which is nice and even with a soft glow and a whine from the inverter.
Pressing the function button brings up the icon-based menu. No fancy text here at all. Because there are no messages in memory, the icons to the right of the home position are missing. The first option lets you set the alert tones.
The alert tones are chosen by icons which seem rather cryptic, but indicate for each mode what sort of beeping/melody/mute options are used for alerting. The last option is probably for maildrop, as I had enabled it in the programming just for fun.
The second screen across lets you set the time. Nothing fancy here, just use the arrow keys.
The third option across lets you set an alarm. Yes, just one alarm.
When left alone for a few seconds, it reverts into its power saving mode, displaying a little bullseye indicator in the corner to let you know it’s still alive. Pressing any button except the directional arrows allows you to bring the screen back to life. To shut down the unit, you press the power button, then the function button when prompted. Instead, I chose to reprogram this to say goodbye to Motorola.
Conclusion
When people hear of the brand Motorola, they may instinctively think of phones, but Motorola has been much more than that. They have been involved in semiconductors and virtually anything radio. While I never owned a Motorola phone first-hand, the pager definitely intrigued me, and I managed to come across a second hand unit for my fun.
While paging is in a slow and steady decline, these units feel virtually brand new showing just how durable the Motorola product is. It definitely oozes quality. These crystal-locked pagers are a lot of work to modify and get crystals cut for, so I’m probably going to pay (or overpay) for a synthesized pager just for fun.
Despite the collective positive sentiments around the brand, it looks like Lenovo has pushed the button … goodbye Moto. But at least, hopefully your brand will glow on into the future … much like how this unit seems to never die.
Excellent post, Gough. I always wondered about pagers, but I never cared to research. I appreciate the history section. In Australia, were they commonly called also beepers?
Yes indeed, some people called them beepers mainly as earlier units were tone-only pagers, which emitted different tone patterns to signify different paging types (commonly up to four types per capcode). Later units were still called beepers mainly due to their shrill and rather loud alert tones, and featured 7-segment displays with limited length capabilities, commonly called numeric pagers as they could not display text. This Advisor model is considered a fairly late pager, as it had the full alphanumeric text ability with four-line text display – which took advantage of basically all the old and relatively limited technology had to offer. Modern paging services are increasingly doing e-mail to pager style options where a special e-mail address is used to receive alerts to send to pagers to ease integration, rather than having an old dial-in data line, or by placing a call to a pager operator and telling the lady what message to send to which subscriber number. Unfortunately, due to limited speeds, often e-mail to pager services are limited to 200-600 characters of the e-mail split across one to three pager messages. Even at this scale, the 25-message pager memory store on most units wouldn’t be able to store many of these alerts before overwriting the oldest unread message. Duplicate message detection is used to filter out duplicate messages from using up this precious memory – and often more critical messages would be sent several times in a row to give some “time diversity” against fading as you don’t have an acknowledgement from the receiving pager whether it was received or not.
I was also alerted by a friend that in Asian countries, these were also known as BB-Call units, where BB approximates the sound a pager makes, and call refers to the way the pager was often used – namely to tell someone to get themselves to a payphone and ring a number based on the tone they received (e.g. 1 beep – manager, 2 beeps – floor staff, 3 beeps- cleaner etc.).
– Gough
Thanks for the interesting looks at pagers, never run into any of them myself.
It’s sad that the name Motorola is being phased out of use, when I think of them I think back to the old 68k processors that made such an impact in all the machines they were in. I even programmed one of their embedded chips (M16C) back when I was at uni.
Cheers
Sparcie
Indeed, I normally think of them from the communications side, but their MCUs and CPUs were really significant, especially in older Apple machines. I remember the old Apple LC II back from my primary school days … I didn’t know it then, but yes, it had a Motorola heart :).
– Gough
This is pretty awesome – what OS did you use to run the software?
Good ol’ MS-DOS 6.22.
– Gough
Went with XP in the end… Tried 98SE at first, but that just wouldn’t play happily with the USB > TTL.
Interestingly I had no issues running this as a VM (VMware Fusion) on an iMac.
Thanks for the write up though. Had 4 of these that were about to go in the bin.
Hi Gough, You amaze me, the patience you have to unfold the technicalities of a complicated product. I worked with Motorola for 20 years during this time and some of the technical side was a mystery to me. For you to pick this up later is amazing. I remember the paging transmitters called PURC’s (Programmable Universal Remote Controllers) and some of Motorola’s paging terminals such as the Modem Plus (I think it was called… but can find no reference any longer…maybe 1985)) We also used a large third party controller (2 x cabinets 19 inch rack mount) made by a company called BBL ( I think it stood for Bruce Bob and Loyd the company owners in USA) Sad that Motorola completely dropped the ball with phones I was there when “The Brick” had world wide dominance, and then the first Flip Phone, employees were all given one free (we said it was because they couldn’t sell them..ha) My compliments on your high Educational and recreation achievements it definitely shows in your writings. Another field you may try as I have because I am an Astronomer it was suggested to make a Radio Telescope. After much messing I have two channels running one at 400mhz the other 70mhz tracking noise sources from our amazing universe. Well done Gough and all the best Allen Wallace ZL1AYH… NZ.
Hi,
Very very useful article. I have been able to connect to the pager using Windows XP and a FTDI232 board.
I have a problem, It is russian pager form company InterPaging (after translating cyrillic on the display) and there is a password i can’t find. Does someone has this information?
Thank you in advance
PASSWORDS in SOME EU CONT
Service Password
PageNet THEBEST
MCI THEBEST
SkyNet THEBEST or dictionary
SkyTel THEBEST or dictionary
Dial Page CPIISIT
USA Mobile USAMPGJF
http://www.hackersrussia.ru/Pagers/pagers.php
Need a repair manual. I have a bushel basket of these things here.
can you give me a Pager Programming software? i really need it. thank
Did you have to enter a password in order to read the pager, because in my case it seems the pager is programmed and locked with a password by LINK PAGING (Link Systems), wasn’t your pager locked by Telecom Paging? Thanks.
If I recall correctly, no password was necessary for me – perhaps my unit had been prior unlocked by someone else or was never locked.
– Gough
Got a fourth Advisor and finally its not locked and programmed it successfully. Maybe you just got lucky. And even I transmitted some messages to it!
Maybe my reply is a bit late 🙂 I’ve got the a similar pager from LINK PAGING, I’ve read a password by connecting to EEPROM, the password is L6GG0L.
Could you give some instructions on connecting to/reading the eeprom?
Kind of late, but I found a video demonstrating a successful unlock. All other ways of reading the EEPROM just haven’t worked for me.
https://www.youtube.com/watch?v=rV84X2XpALk
Might need to turn on captions to translate to english.
If by any chance the files used in the video go missing, feel free to ask me to send them.
Hi,
Thanks for the informative post! Do you know if it’s possible to switch these pagers between Golay and POCSAG? Or is that hardware specific?
I recently picked up an old Advisor. The plan was to reprogram it, re-crystal it and get it running on DAPNET. I cobbled together a serial interface and can read and write the config successfully under DOSBox. Unfortunately the ‘coding format’ is reported as GLS and it doesn’t seem possible to change it.
Thanks
I believe that is hardware specific and not a configurable option in software. Only the speeds are configurable to my knowledge.
– Gough
Hi,
Thanks for the reply. I guess the RF board also does the decode then. Oh well. Back to ebay in search of a POCSAG model!
The RF board just gets the raw data from the air and it shapes the waveform for then to be decoded by the digital board. I have a really faint memory of an advisor that could be switched to use either POCSAG or some other protocol, all the others I have don’t have that.
are you still have software ? i want to modify my 172 MHz to use on amateur radio band.
please advise.
Really enjoyed reading this when it was posted in 2016. Revisited the post because I recently bought my own Advisor. I was wondering how you managed to install the programming software? I keep getting an error saying it has to be installed from the setup file but there’s no setup file in the archive.
/Marcus
It’s been many years since I did that – but yes, the archive is of someone’s already installed version.
If I recall correctly, it has to be extracted to a very specific folder location on C:\. It will not run properly if moved anywhere else. I extracted the zip while in C:\ to set it up in the right folder then ran the executable at C:\PAGER\MOTOROLA\ADVISOR\ADVISOR.EXE.
– Gough
Hi, I just read this in October 2022. I found my reciever I bought leaving my first job in an old cellar box. The pager number was still on the back side it. I tried to text the number from my cell phone. And the message showed up on the pager within 30 sec.. I think a small Ericsson team working on mobile alarms got lifetime subsciptions in 1995. The pagers still work in the network. Amazing!
I have a question regarding multiple facilities using the same frequency such as a group of hospitals within a local district. Does each facility have its own transmitter? is there a chance for the signals to clash?