Loudoun Co VA Phase II System

Status
Not open for further replies.

freqhopping

Member
Joined
Jan 5, 2004
Messages
5,215
Location
Lo Co VA/ FM19
From UT
Sysid: 373
Site: 001-001
WACN: BEE00
Callsign: WPQZ390
Modulation: CQPSK
NAC: 372
Profile: has ranged from 13.68 to 14.68
Signal: Normal

LCN
00-2487 866.5000
00-2571 867.0750
00-2611 867.3250
00-2727 868.0500 Control
00-2825 868.6625
00-2843 868.7750
00-2865 868.9125
02-2486
02-2487
02-2570
02-2571
02-2610
02-2864
02-2865

Band plan: 851.00625 Lo 00-0000 Hi 00-4095 Spacing 6.25 / 762.00625 Lo 01-0000 Hi 01-4095 Spacing 6.25

Talkgroups logged start at 2801 and go up to 2905, plus 4094 and 65536 for a total of 83 so far. Many only show a single hit.

Two talkgroups have been heard, the activity is on the 00-xxxx LCNs. There is other activity seen but not heard on the 02-xxxx LCNs.

Pro96Com shows the same with the addition of showing PvtData for Type. Bandwidth= 6.25

The old system 6B1D is still in use for the fire department which will change over next week. Some of the same frequencies are in use on both systems.

Attached is a data dump.
 
Last edited:

bluefox2163

Member
Joined
Feb 19, 2005
Messages
458
able to monitor

are you able to monitor a p25 phase II system with a pro 96 digital?I thought it was inaccessiblle at this time
 
N

N_Jay

Guest
1) As said it is not P25 Phase 2
2) The control channel is still Phase 1 compatible with a few added messages
Decoding it should be no problem. Channel assignments now need channel and slot information
3) As of now you are not going to receive voice on any current scanner
It will be interesting to see if when Phase 2 TDMA scanners become available if they will also receive Motorola's pre-phase 2 format.
4) If you are hearing voice channels, it is because those talkgroups are operating in Phase 1 mode.
 
N

N_Jay

Guest
Phase 2 (and Moto's pre-phase 2) allow dual mode (almost by default) for backwards compatibility, to allow use of the existing field radios, and for interoperability.

If any radio involved in the call is Phase 1 only, the entire call will default to phase 1.
 

greenthumb

Colorado DB Administrator
Database Admin
Joined
Feb 29, 2004
Messages
1,935
You may have already said this, but I had heard that they weren't doing ddm until a later release and that for now either a talk group will do only phase 1 or only phase 2.

But again, all the more reason for me to stay away from buying any more phase 1 only scanners....
 
N

N_Jay

Guest
I would have to check on the exact release of DDM.

I have a feeling these systems are a little off the release path anyhow.

You can still dedicate channels and get what looks to the users as ddm just with out as much flexibility and channel efficiency.
 

KA1RBI

Member
Joined
Aug 15, 2008
Messages
486
Hey Freqhopping

Can you do me a fav - please capture a sample of the signal(s) as WAV files (at min. sample rate = 48000) - fed at the disciminator tap, of course. I would be very interested to see a copy, ideally both the trunk cc as well as voice channels.
 

KA1RBI

Member
Joined
Aug 15, 2008
Messages
486
OK unitrunker and pro96com should have no trouble receiving that.

It's 4800 CQPSK with sufficient LSM style distortion to cause some Trellis errors.

It's a trunk CC although IMBE voice frames (LDU1 only) also appear at regular intervals.

Max
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Frame Sync: 0x5575f5ff77ff
NID codeword: 0x37258af0f9b29f8c
Network Access Code: 0x372, Data Unit ID: 0x5
Raw IMBE frame: 0x2922b5eeabc05f22c3222ad0e622e522179e
Raw IMBE frame: 0x1a22ffcca32c42e2ee5525ec85f2222c2222
Raw IMBE frame: 0x1c9272cc44e47eff152142b5ab24e4224623
Raw IMBE frame: 0x251793742262ffa32605575f5ff77ff37278
Raw IMBE frame: 0xc2d2b222222239272e222222f81e12222222
Raw IMBE frame: 0x22b62925e525e51e2222f2c2f2c412215131
Raw IMBE frame: 0x54c45791d222222222359722222222f8ce22
Raw IMBE frame: 0x22222222035575f5ff77ff37278af0f9b29f
Raw IMBE frame: 0x99e1762f221bf21cada8229e517e999b2f12
Found a Logical Link Data Unit 1 (LDU1)
Link Control: 0xd6221c29c628acfb1f
Link Control Format: 0xd6
Low Speed Data: 0x8c25
Status Symbols: 0x2 0x2 0x2 0x3 0x2 0x2 0x2 0x2 0x2 0x3 0x2 0x2 0x2 0x2 0x2 0x3 0x2 0x2 0x2 0x2 0x2 0x3 0x2 0x2
Frame Sync: 0x5575f5ff77ff
NID codeword: 0x37278af0f9b29f8c
Network Access Code: 0x372, Data Unit ID: 0x7
Found a trunking control channel packet in single block format
Found a Trunking Signaling Block
TSBK: 0x3a 0x3a0000137301010aa760514b
tsbk3a rfss status: syid: 373 rfid 1 stid 1 ch1 aa7
Found a Trunking Signaling Block
TSBK: 0x39 0x390001010b09040b3104af26
tsbk39 secondary cc: rfid 1 stid 1 ch1 b09 ch2 b31
Found a Trunking Signaling Block
TSBK: 0x3b 0xbb0000bee003730aa7601ee5
tsbk3b net stat: wacn bee00 syid 373 ch1 aa7
Status Symbols: 0x2 0x2 0x2 0x3 0x2 0x2 0x2 0x2 0x2 0x3
Frame Sync: 0x5575f5ff77ff
NID codeword: 0x37278af0f9b29f8c
Network Access Code: 0x372, Data Unit ID: 0x7
Found a trunking control channel packet in single block format
Found a Trunking Signaling Block
TSBK: 0x39 0x390001010b31040b1b0448c8
tsbk39 secondary cc: rfid 1 stid 1 ch1 b31 ch2 b1b
 

js_scan888

Member
Joined
Jul 1, 2008
Messages
56
Freqhopping, thank you for uploading the CQPSK Control Channel WAV file. Would you be able to do the exact same thing, (sample 48000 bps) with a Voice Channel too ?

KA1RBI, I think you are getting some false positives with the BCH word. It's thinking that the Data Unit Id is 5, when it should be Data Unit Id 7. The WAV file contains at least 384 Data Units, all with Id 7, for trunking control. If you are not seeing that many, perhaps that's the problem. Try forcing the Data Unit Id's to be only 7, and I think you will see the data turn into valid Status Broadcast messages, Channel Grants, etc, instead of voice traffic.
 

freqhopping

Member
Joined
Jan 5, 2004
Messages
5,215
Location
Lo Co VA/ FM19

KA1RBI

Member
Joined
Aug 15, 2008
Messages
486
KA1RBI, I think you are getting some false positives with the BCH word.
Entirely possible! That particular program has the best decoders but the worst error correction in it. [which is to say, no error correction]. Another utility would have caught that, but not extracted the TSBK's.

Thanx freqhopping for those files

73

Max
 

js_scan888

Member
Joined
Jul 1, 2008
Messages
56
Based on the WAV files, here's a general description of the TDMA P25 voice channels.

Normal P25 dibit sync: 111113113311333313133333 which is $5575F5FF77FF
TDMA P25 dibit sync: 331313111113131113331133 which is $F77557757F5F

The TDMA P25 signal has the following record types:

Record type A has total of 288 bits (48 bit sync followed by 240 bits of data)
0-47 ( 48 sync bits)
48-179 (misc 132 bits)
180-251 (misc or voice frame 72 bits)
252-287 (misc 36 bits)

Record type B has total of 576 bits (48 bit sync followed by 528 bits of data)
0-47 ( 48 sync bits)
48-179 (misc 132 bits)
180-251 (voice frame 72 bits)
252-371 (misc 120 bits)
372-443 (voice frame 72 bits)
444-575 (misc 132 bits)

The TDMA P25 signal is using the Half Rate Vocoder. It is AMBE+2, which is the same one used in MOTOTRBO and NXDN.
 
N

N_Jay

Guest
EXCEPT!!!!!!!!!!!!!!

It is NOT P25 Phase 2 TDMA.

It is Motorola's proprietary Pre-Phase 2 TDMA.

Yes, it uses the hale rate AMBE vocoder (as will Phase 2).

It uses 4800 baud C4FM/CQPSK (9600 bits per second), whereas P25 Phase 2 will use 12 KBPS with different modulation.
 
Last edited:

greenthumb

Colorado DB Administrator
Database Admin
Joined
Feb 29, 2004
Messages
1,935
freqhopping - is it the case that the traffic channels are continuously keyed? It sounds that way in the recordings...
 

freqhopping

Member
Joined
Jan 5, 2004
Messages
5,215
Location
Lo Co VA/ FM19
freqhopping - is it the case that the traffic channels are continuously keyed? It sounds that way in the recordings...
I don't know whats up. Last night on 867.075 on my 996 (which I've used to get the recordings) it would sound like a control channel when there was no traffic. I don't hear that tonight, but I have my 396XT and PRO-106 on that freq now and I do hear it. I don't get that on 867.325, I only have noise when there is un-decodable voice traffic.
 

greenthumb

Colorado DB Administrator
Database Admin
Joined
Feb 29, 2004
Messages
1,935
Only two chs are continuously keyed. That's the two control chs, 868.775 (00-2843) and 868.050 (00-2727).
Neither sounded like a typical motorola P25 control channel (LSM or not) and I believe that the OP of those files said they were traffic channels. There is a file with the control channel and it has the typical LSM sound to it. And looking at the capture from Unitrunker he has, neither of them are the primary or an alternate control channel.

Listening to what seem to be traffic channels, they sound different when voice is being carried, and you can definitely hear when they're not active. Maybe they just have a really long hang timer for some reason if they're not continuously keyed.
 
Status
Not open for further replies.
Top