Understanding Connect Plus trunking

[wa6yvx]

Fisher Wireless System

Looks like it will get more complicated!

Fisher Wireless Launches Digital SMR Network in California (4/15/11)
TeamTalk Networks, powered by Fisher Wireless Services, plans to launch its new commercially available digital voice and data network this month. The SMR plans to provide up to 50 connected digital high sites encompassing a single footprint covering the majority of California and Arizona.

From: MissionCritical Communications, Radio Resource International, and Public Safety Report - wireless voice and data communications for mobile, remote and public safety operations

 

[inigo88]

Yep looks like we stumbled on their new "TeamTalk Connect" system, which is going to cover much of the same footprint of their existing TeamTalk PassPort system (I hope it doesn't go away, I like PassPort... it's analog ). I think I read there can only be a maximum of 6 sites per network ID, so I wonder how they'll network all 50 sites together.

Here is the coverage map.

 

[wa6yvx]

Site Locations

If I get time this weekend I'll see if I can find my UHF Yagi and attempt to DF each Fisher freq with site locations.

I'm in South Bay, so I should be getting Otay and Miguel fairly well. Until then I won't be much help with the data decoding on this system.

 

[inigo88]

To test my theory I programmed all the frequencies sharing the same SLCO format with the control channel into a common bank on my disc tapped scanner. I let it sit on one of the voice frequencies with DMRDecode running until there was activity, had to quickly write down the group ID and which timeslot it was on, then quickly change back to the control channel, let DMRDecode catch up decoding the control channel and then PAUSE the screen.

Convert the decimal group ID to binary and then pour through each CSBKO=3 line squinting at the binary code and counting 1s and 0s to see if they matched up. Sometimes I was too late and got nothing, but if I was able to match the group ID I took note of the 5 bits to the right and converted them to decimal to find the LCN. Here's what I was able to come up with on the TeamTalk Connect system:

463.6875 (Slot 1) = LCN 03 (00011)
463.6875 (Slot 2) = LCN 07 (00111)
454.5250 (Slot 2) = LCN 09 (01001) - Slot 1 is always the control channel.

The last three bits of the CSBKO=3 OSW were always "010" no matter which time slot it was on, so I have no idea what they do. There is also an LCN 02 (00010) but results were inconclusive on the frequency. Also at that point I was giving myself a headache so I gave up.

This will get much easier with two scanners/computers, and if Ian gets the chance to add support for the new OSWs with a new build of DMRDecode.

 

[Forts]

I'm now starting to see activity on my local system so hopefully I can contribute to this as well. Like you mentioned I think I'm going to start with a 2 scanner 2 laptop setup and go from there.

 

[wa6yvx]

Another Fisher Frequency

Looks like another Fisher Frequency with CC3 is 461.275
454.525 and 461.300 appear to be on Mt. Otay.

 

[Forts]

Turns out the system I'm keeping an eye on is a very wide area system, covering Southwestern Ontario basically from Detroit/Windsor to almost half way to Toronto. And I agree that the CSBKO=1 + FID=6 messages would most likely carry the System and Site identifiers. I was thinking the last 4 bits for the Site ID, but the fact that it was posted earlier that those bits changed on one frequency doesn't jive. I'm going to try and get a little more data from the other sites and see if anything clicks.

 

[inigo88]

Good deal glad to have you on board! Let us know what you think of the CSBKO=3 format when you finally start seeing them.

 

[Forts]

So far the only voice activity I have seen has been on the 2nd timeslot of the control channel frequency. Hopefully more frequencies are added soon so I can try to make sense of the LCN stuff.

 

[Forts]

Anyone have any guesses why I see activity like this:

Slot Type : Colour Code 1 CSBK
Unknown CSBK : CSBKO=1 + FID=6 0000010100000100000000110000000000000000000000000000000000000110
9:19:18 PM DMR Voice Frame with Embedded Signalling
EMB : Colour Code 13 : PI=1 : First fragment of LC 
9:19:40 PM DMR Voice Frame with Embedded Signalling
EMB : Colour Code 13 : PI=1 : First fragment of LC 
9:20:26 PM DMR Data Frame with Embedded Signalling
Slot Type : Colour Code 1 CSBK
Unknown CSBK : CSBKO=1 + FID=6 0000010100000100000000110000000000000000000000000000000000000110
9:20:36 PM DMR Data Frame
Slot Type : Colour Code 1 CSBK
Unknown CSBK : CSBKO=1 + FID=6 0000010100000100000000110000000000000000000000000000000000000110
9:20:36 PM DMR Voice Frame with Embedded Signalling
EMB : Colour Code 14 : PI=1 : First fragment of LC 
9:20:38 PM DMR Data Frame
Slot Type : Colour Code 1 CSBK
Unknown CSBK : CSBKO=1 + FID=6 0000010100000100000000110000000000000000000000000000000000000110

I'm puzzled by why the Colour Code changes from 13 to 14 then to 1. Just poor decode from weak signal perhaps??

 

[racingfan360]

>I'm puzzled by why the Colour Code changes from 13 to 14 then to 1. Just poor decode from weak signal perhaps??

I think so...I too have had experience of what I thought were random colour codes when decoding a weak Connect Plus signal.

 

[Forts]

I've been trying to wrap my head around this Connect Plus stuff and I wanted to compare some of my findings with you guys. In my travels I've been able to do some logging from a half dozen different sites on the same network. Here is what I see:

[b]CSBKO=1 + FID=6                                                                SLCO=10[/b]
0000010100000100000000110000000000000000000000000000000000000110         000010011110000001100000
0000010000000000000000000000000000000000000000000000000000001111         000010011110000001010000
0000001100000010000000000000000000000000000000000000000000001101         000010011110000001000000
0000000100000010000001000000000000000000000000000000000000000101         000010011110000000110000
0000001000000011000000000000000000000000000000000000000000000101         000010011110000000010000
0000000100000011000000000000000000000000000000000000000000001011         000010011110000000100000

Now according to the Connect Plus system planner, the System ID and Site ID are broadcast using CSBKO messages. Going by that, I don't see any similarities in the CSBKO=1 + FID=6 messages. I was also thinking the last handful of bits may be the Site ID, but as you can see above I have two sites that both end with 0101.

However, looking at the SLCO=10 messages there are definite patterns. In my situation I would hazard a guess that 00001001111 (or some portion thereof) could be the System ID, with the remainder being the Site ID. Just not sure how many bits belong to each. The system planner also states that a Connect Plus system can have a maximum of 15 repeaters (so a max of 30 LCN's, with the control channel always being LCN=1), so from the above SLCO=10 examples, the first 16 bits could contain the system ID, the next 4 the Site ID (1111 = 15), then 4 remaining for whatever.

Does anyone else have any logs from the same system that they can compare to and see if this is consistent?

 

[IanWraith]

Hello All

My thanks to Forts for this excellent analysis. Sadly I can't help much as I have yet to hear of any Connect Plus systems here in Britain.

One question though is the System ID dictated to the company setting up the system by Moto making it unique ? If not you will get the position we have in Britain with MPT1327 system IDs where the companies setting up the systems used the same system ID for every system they sold or just made it be 0 or 1. This makes identifying the field containing the system ID more difficult than it could otherwise be.

Regards

Ian

 

[Forts]

All little more info I've found... as mentioned earlier the Site ID can be a value of 1 to 6, and the System ID (Motorola calls it the Network ID) can be 0 - 4095 (I find it odd that 0 is a valid value but whatever....). 4095 in binary being 111111111111 (12 bits)..

So again looking at one of my SCLO=10 examples from above...

0000 100111100000 011 00000
????  Network ID  Site ?????

I don't know if they would make the Site ID a 3 bit field or not though, seeing as the max value is 6 (111). So if the above happened to be correct, this would be Network ID 4576 and Site #3.

 

[Forts]

One question though is the System ID dictated to the company setting up the system by Moto making it unique ? If not you will get the position we have in Britain with MPT1327 system IDs where the companies setting up the systems used the same system ID for every system they sold or just made it be 0 or 1. This makes identifying the field containing the system ID more difficult than it could otherwise be.

The Network ID is an editable field in the Connect Plus CPS, so I'm assuming it's assigned by the installer.

 

[inigo88]

Forts, brilliant work!

I came to similar conclusions a while back, since the SLCO messages seem to be the only ones showing patterns that could be consistent enough to be a network or site ID... but I had been doubting myself because like Ian said, it can be very ambiguous (especially looking at an idle control channel with no observable cause and effect). You'll notice on active voice frequencies the SLCO format remains exactly the same but with voice frequencies it's SLCO=9, where as control channel is SLCO=10. I got a little frustrated when my local systems abruptly lost most of their voice traffic (maybe customer trial run didn't go so well?) so I've been taking a break from playing with Connect Plus, but you've reeled me back into it.

The following is a comparison of the four Connect Plus control channels I can receive from the City of San Diego, belonging to the Fisher Wireless "TeamTalk Connect" trunking system:

[B]CC Freq:     CSBKO=1 FID=6:                                                       SLCO=10:[/B]

454.0375     0000001100000101000000100000000100000110000000000000000000000101     000001110111000001000000
454.0500     0000001100000100000001010000011000000000000000000000000000001011     000001110111000000010000
454.5250     0000000100000010000001000000010100000110000000000000000000000101     000001110111000000110000
461.3000     0000000100000011000001000000010100000110000000000000000000001110     000001110111000000100000

Brilliant!!!

CSBKO=1 FID=6 is still unintelligible, but taking the SLCO format to be Network ID, then Site ID, I come up with the following:

454.0375 - Network: 119 - Site: 4
454.0500 - Network: 119 - Site: 1
454.5250 - Network: 119 - Site: 3
461.3000 - Network: 119 - Site: 2

To those familiar with the San Diego area, I believe 461.30 to be Palomar Mtn or Mt Otay, 454.525 to be Mt Otay, and 454.05 to be Mt San Miguel. I'm not sure about 454.0375 as it comes in the scratchiest of all.

This is a very exciting result, because it will help us match potential voice frequencies to their control channel. Back in June I was very uncertain about a guess I made grouping the voice frequencies and control channels together based on their SLCO=9/10 format, when I tried the following:

454.525cc: SLCO=10 000001110111000000110000
464.8250v:  SLCO=9  000001110111000000110000
463.6875v:  SLCO=9  000001110111000000110000
463.6125v:  SLCO=9  000001110111000000110000

Where as in light of the latest evidence this becomes:

[B]Network:[/B] 119 - [B]Site:[/B] 3

454.5250 - Control Channel
464.8250 - Voice
463.6875 - Voice
463.6125 - Voice

I guess I was on the right track!

Forts: I tried making the Network ID cutoff in a different place, since you ended up with a higher than possible Network ID (0 to 4095). Here's my guess on the format:

From my example:

[B]000001110111[/B] 00000 [B]100[/B] 0000

[B]Network:[/B] 119  - [B]Site:[/B] 4

From your example:

[B]000010011110[/B] 00000 [B]110[/B] 0000

[B]Network:[/B] 158 - [B]Site:[/B] 6

If this holds true I would propose the following with your data:

000010011110 00000 110 0000   - Network: 158 - Site: 6
000010011110 00000 101 0000   - Network: 158 - Site: 5
000010011110 00000 100 0000   - Network: 158 - Site: 4
000010011110 00000 011 0000   - Network: 158 - Site: 3
000010011110 00000 001 0000   - Network: 158 - Site: 1
000010011110 00000 010 0000   - Network: 158 - Site: 2

What do you think? I am really starting to believe this is the right format as everything is just falling into place.

 

[Forts]

Ah! Good stuff! I'm glad what you are seeing falls in line with what's around me. I've yet to find voice frequencies for the sites I'm monitoring (the system is still fairly new and doesn't have a whole lot of voice traffic on it at any given time).

 

[Forts]

Hmmm.... Using your example of:

454.525cc: SLCO=10 000001110111000000110000

and assuming the Network ID is 1110 1110 0000.... do we read that left to right or right to left? You came up with a value of 119 whereas I would have said it was 3808 (making the assumption the LSB is on the right hand end of the string).

Hmmmm......

 

[inigo88]

Hmmm.... Using your example of:

454.525cc: SLCO=10 000001110111000000110000

and assuming the Network ID is 1110 1110 0000.... do we read that left to right or right to left? You came up with a value of 119 whereas I would have said it was 3808 (making the assumption the LSB is on the right hand end of the string).

Hmmmm......

It's not a reading left or right issue, I chose to put the breaks in different places. You're doing:

0000 100111100000 011 00000

Which yields Network ID: 2528 (Not network 4576 which you said in the post). I tried putting the breaks in different places because I thought that since the max network ID was 4095, 4576 wouldn't work... So this was all based on a typo. Thus I tried:

000010011110 00000 110 0000

Notice how now the Network ID=158 and Site ID=6.

The reason I broke it up differently was if you look at my data and try and break it up the way you did originally, you'll separate the site field... so that's wrong. (Notice if you look at all the SLCO=10 frames in a stack and start on the right hand side there HAS to be four 0s, not 5, before the Site ID field.)

Maybe we could hybridize our methods?

454.525cc: SLCO=10 000001110111000000110000

0000 [B]0111011100000[/B] [B]011[/B] 0000

Now I get Network: 3808 - Site: 3. Is that what you meant?

If this is right, then your original example would be:

0000 1001111000000 110 0000

Now the problem is that in order to keep it as Site=6 (which we know is a given by looking at them all in a stack) and to leave the extra 4 0s on the left and right sides, we are forced to conclude that the Network ID=5056, and this can't be since it can't be higher than 4095.

Thus I'm forced to go back to my original conclusion, that the SLCO=9/SLCO=10 format is the following (from the left):

First 12 bits - Network ID.
Next 5 bits - Omitted (Always 0).
Next 3 bits - Site ID.
Next 4 bits - Omitted (Always 0).

000001110111 00000 011 0000

That forces me to conclude Network ID=119, and not 3808 (in order to keep it as site 3, which is a given). I think my format still checks out.

 

[Forts]

Haha.. Duh... I didn't even realize the value I had in my own example was greater than the allowed value of 4095 (smacks head).