Baofeng UV-5R ~ 800MHz transmission enabled

Question

Today I got to mess around my Baofeng UV 5R 5W (as stated on back of the radio) which works perfectly fine during the past year of use. In my area, there are some private repeaters which receive on VHF and transmit on UHF ( f.ex. TX 434.000 and RX 144.000 ). As I tried to reenter my channels in the baofeng, I mistyped the offset and suddenly realised that my radio is thansmitting in the 1.25 meters band.

Repeater I needed was 437.837 and an offset of 293.000 which leads to repeater input frequency 144.837. I did not realise that I entered 193.000 into offset until, on my big surprise, radio DID TRANSMIT on 244.837 !

So I am really confused, I know this is not something that should happen in this radio station ( I tried this with identical uv 5r that i bought in same time as this one, and it could not do it, when i press ptt button it does not go into tx mode ). Obviously the radio is not trible band, nor can i enter manually any frequency outside 136-174 and 400-520. But I can transmit on f.ex. 250.000 with the right offset, whether going with vhf + or uhf - )

I did use a receiver to test this audio on these frequencies and it doesn't have a difference compared to vhf or uhf transmissions on this radio.

I searched the web but had no luck with explanations. Does anybody have similar experiences ?

UPDATE: Turns out that the transmission is not only on 1.25m enabled, here is a PoC picture:

I am genuinely surprised. Is it even possible for baofeng chip to transmit such high frequency ? Could anybody provide me an explanation to this case ?

Answer 1

There's a schematic of an early Baofeng floating around the internet which shows the main RF chip as an RDA1846. A datasheet from 2009 for that chip (leaked at https://github.com/phishman/RDA1846) specifies the chip "support worldwide frequency band" of 134-174 MHz and 400–500 MHz.

However a comment at https://github.com/phishman/RDA1846/issues/4#issuecomment-602231375 mentions an RDA1846S variant which seems to extend that range to:

• 134–174 MHz
• 200–260 MHz
• 400–520 MHz

…and so I presume that chip must be the one used by the Baofeng models that intentionally offer tri-band (2m/1.25m/70cm) support.

And who knows, there may be other variants of the chips/circuits now as well? But I suspect you've just found a sort of "noclip" glitch in whatever version of the firmware your radio is running. It would be interesting to analyze the actual spectrum output of your radio while used like that — it's possible the RF chip simply ignores unsupported frequencies requested by the microcontroller, or perhaps it does oblige but with poor actual results (e.g. attenuated/misaligned/distorted).

(As an aside, I wish I could find more hacks/mods/reverse engineering of these radios. Maybe since they're so configurable and relatively pleasant menu system to begin with there's not as much demand to extend or improve them software-wise. Or maybe there's not a good microcontroller drop-in matching the non-reprogrammable OEM chip's footprint.)

Answer 2

Thank you for your reply. As you mentioned, the goal here really is to understand a bit of this unexpected operation and possibly make something useful out of it.

The firmware version displayed when pressed button 3 while turning radio on is BFB298. Not sure if this is real version or should I look it up in chirp. Also, how could I find which RF Chip is inside my radio?

As one might guess I continued to test this case on my radio and got the following results of TX range:

124.380 MHz - 178.175 MHz

186.581 MHz - 277.680 MHz

373.100 MHz - 519.998 MHz

520.030 MHz - 555.345 MHz

Above range has to be achieved by + or - offset, from both VHF and UHF RX frequencies, by NOT passing the 0 MHz line!

735.622 MHz - 917.622 MHz

and this range has to be achieved by crossing the 0 MHz line in minus offset mode. For example (150.000 - 300.000 offset = 799.672 TX frequency ), but cannot be done with +offset, and yes, it does for some reason lose 28 KHz in that substraction!

Attempting to transmit in any other frequency that is not specified above will freeze the radio. It simply displays the freq but does not transmit on it, nor can any other button be pushed on to do something else.

Unfortunately I do not have an analyzer of any kind (but I wish so much) to but this behaviour to test and share actual results. The only thing I do have is a receiver and up to this point, ALL out of band frequencies did transmit audio fine, with little to no audio quality drop compared to 2m and 70cm transmissions.

One thing I also noticed is that such offsets work in VFO and in CHANNEL mode also. Memorizing those channels does not affect this behaviour. However, by trying to set offset to 999.999 in order to land in aproxx. same valid ransmit frequency did not work in VFO mode, either with + or - offset, but DID WORK in memory mode.