Protocol description of motorola type II Control channel

ronenp

Member
Joined
May 8, 2002
Messages
527
Hi there
Can anyone point me to document or any kind of detail of the data that the control channel of motorola type II or Smartnet or SmartZone transmit ?
mainly im intrested in the Modulation ? (FSK ? PSK ? ETC? ) Bitrate and encoding ? NRZ ? etc ? and if possible data bit structure inside
Any Info is Welcome
Thanks Forward
R
 

boatbod

Member
Joined
Mar 3, 2007
Messages
2,721
Location
Talbot Co, MD
Hi there
Can anyone point me to document or any kind of detail of the data that the control channel of motorola type II or Smartnet or SmartZone transmit ?
mainly im intrested in the Modulation ? (FSK ? PSK ? ETC? ) Bitrate and encoding ? NRZ ? etc ? and if possible data bit structure inside
Any Info is Welcome
Thanks Forward
R
It's a proprietary format and I'm not aware of any official documentation released by Motorola.

The control channel is 3600 baud with binary fsk modulation. There's at least two variations of frequency spectrum that you'll see in the field (simulcast vs standalone) but essentially they can be decoded using the same demodulator.

If you want to learn about how the bitstream is coded, I suggest you peruse wtrunk (trunk88), trunk-recorder and op25 (boatbod repo) sources as all of these are capable of decoding smartzone. There's a stand-alone port of the old gr-smartnet gnuradio block in my github repo (boatbod/gr-smartnet).
 
Last edited:

SuitSat

Newbie
Joined
Mar 12, 2021
Messages
1
As stated by boatbod, it's a proprietary format; but as this protocol is nowadays obsolescent and no longer supported, I think it's fair game to write some of its aspects I still have on memory and some scattered docs... Mods may agree or disagree (if the later, please delete this post)...

I assume you are familiar with the very notion of trunking, and the notion of ISW, OSW, LSHS...
I don't recall the lowermost layer aspect (PHY) but here's some infos you may or may not find useful...


Let's start by the beginning shall we ?
First of all, the System Status Word (SSW) is transmitted by the central controller through the control channel. The SSW is received by all the radios listening to the control channel and is transmitted in a format called a Word Frame (WF).
This Word Frame carrying the SSW occupies a 23.3 ms time frame and is sent continuously at 3600 baud. It is transmitted only when the system is idle and is used to synchronize the subscribers to the control channel. This WF is used for bit synchronization only and provides no useful information to the user.
The System ID OSW (Outbound Signal Word) is inserted serially after an SSW at least once every three seconds and contains system identification and control channel information.

That's for the basic (step1); now when an user presses the PTT on this radio, the radio sends an Inbound Signal Word (ISW) (sometimes called a Channel Request) to the central controller via the control channel.
This ISW is sent to the central controller at 3600 baud in 23.3 ms word frames and is transmitted in synchronization with the central controller's SSW. (ISW transmission is synchronized to the central controller's SSW).


There's several ISW type, I will explain the Single-Word one :
The information bits in the ISW contains the Unit ID, call type, and other parameters. If the radio is already affiliated with the central controller, the radio transmits a Single Word ISW containing 78 bits sent at 3600 bps (21.67 ms) with 21 information bits and 57 error correction bits.
[If the radio is not yet affiliated with the central controller, it transmits a Dual Word ISW.]
Ok, we just described step2, let's go to step3...


In step 3, the central controller transmits the Channel Grant or Busy OSW.
The Channel Grant OSW contains announcement group, talkgroup, Unit ID, and voice channel assignment or status information.
The channel grant signal contains 84 bits sent at 3600 baud (23.3 milliseconds) with 27 information bits, 8 sync bits, and 49 error correction bits. The 27 information bits consist of 16 address bits, one call-type bit, and 10 status or channel bits.
If the channel is in the 0 - 759 block, then the status bits contain the channel number, but if the channel is in the 760 - 1024 block, then the status word is sent in hexadecimal code.
This OSW is used to send the voice channel assignments. It consists of two consecutive words sent four times in succession.
Each word contains 84 bits and is sent at 3600 bps (23.3 ms). The information bits are split into 27 information bits, 8 synchronization bits, and 49 error correction bits.
If a channel is not available (the entire system is busy) the initiating radio displays a busy light and/or produces a Busy tone.
The Channel Busy OSW has the same format as the Channel Grant except that the information causes the radios to generate a busy tone to indicate to the radio user that all repeaters are busy.


OK, now step4 :
The central controller transmits a Low Speed HandShake (LSHS) signal (also called a Connect Word).
The LSHS unmutes received audio and holds receiving radios on the assigned voice channel.
The LSHS is sent through the voice channel at 150 Baud. The signal consists of the first 11 bits of the talkgroup identification.
If a radios does not receive or decode the LSHS, it returns to the control channel.
[BTW, The central controller continues to send the LSHS on the assigned voice channel for the duration of the transmission. This is used to keep the receiving radios unsquelched.]

Step4b:
When the microphone is unmuted and voice transmission begins, the radio transmits a Connect tone, which causes the central controller to keep the channel connected.
The Connect tone is a sub audible tone sent by the radio on the voice channel along with voice information. The central controller checks its presence to verify that the radio is still using the voice channel.
If the tone is not there, the central controller takes control of the repeater and makes it available for reassignment as a voice channel. The default frequency for the Connect Tone is 105.88 Hz. (Other Connect tone frequencies can be used).


Ok, now our user has finished talking, he releases the PTT, that's step5:
When the PTT button is released the radio does not dekey. Instead, it sends 200 milliseconds of Disconnect tone.
The Disconnect tone is used to notify the central controller that the user has finished a transmission. The Disconnect tone is a 163.64 Hz signal that is transmitted over the voice channel for 200 milliseconds.
[In message trunking, the central controller detects the Disconnect tone and begins a message timeout timer (max. 6 seconds, factory default set for 1 second)].

Once a radio transmits the Disconnect Tone, the radio switches to receive mode and unmutes after detecting the LSHS.
If any talkgroup member decides to respond to the message prior to the expiration of the message timer, the conversation will continue with the new radio providing the Connect Tone.

That would be Step6 and 7 [Call continuation, and Disconnect tone again] (in message trunking) but for clarity and brevity sake, let's ignore that and just refers to step4 & 5 again...

Last step, step8, the conversation has ended for good :
In Step 8, the final step in this sequence, the central controller transmits.
If the central controller does not receive a Connect word before the message timeout timer expires, the central controller transmits a 125 ms Disconnect word at 300 baud via the voice channel.
When a radio receives the Disconnect word, the radio mutes and returns to control channel. The central controller then makes the voice channel available for reassignment.

And Voilà, the basic of Motorola trunking !

Sorry for the wall of text and my bad writting, hope somebody will find that useful !
 

boatbod

Member
Joined
Mar 3, 2007
Messages
2,721
Location
Talbot Co, MD
Very interesting reading, thank you!
Can you tell me more about the low speed data, in particular method of coding and if there are any error correction/parity bits? I'm assuming it's binary FSK.
 

davidgcet

Member
Premium Subscriber
Joined
Aug 17, 2010
Messages
1,288
good explanation, I worked on both type I and II systems for years and knew how the signal flow all worked but honestly never knew timing of them specifically. honestly never had a problem that required me to dig that deep into it.
 

ronenp

Member
Joined
May 8, 2002
Messages
527
Thank You
I had a site long ago that described exectly what you wrote there but it was gone long ago and I lost the info i will take this and save it ...
i have few more questions wonder if you can answer
i know it is FSK what is the coding system NRZ ? other ?
in case of failsoft evey repeater dont transmit the regular high speed data it transmit low speed data ... what is thransmitted in this data ? what is the baudrate ? and coding system ? pure fsk ? nrz ? etc ?
Thank you again
R
 

RFI-EMI-GUY

Member
Joined
Dec 22, 2013
Messages
4,604
The failsoft word is low speed data outbound from the repeater along with a periodic warning tone. The failsoft word is common. It is the same for all systems, repeaters, channels.
 

K2NEC

Member
Joined
Oct 23, 2017
Messages
1,628
As stated by boatbod, it's a proprietary format; but as this protocol is nowadays obsolescent and no longer supported, I think it's fair game to write some of its aspects I still have on memory and some scattered docs... Mods may agree or disagree (if the later, please delete this post)...

I assume you are familiar with the very notion of trunking, and the notion of ISW, OSW, LSHS...
I don't recall the lowermost layer aspect (PHY) but here's some infos you may or may not find useful...


Let's start by the beginning shall we ?
First of all, the System Status Word (SSW) is transmitted by the central controller through the control channel. The SSW is received by all the radios listening to the control channel and is transmitted in a format called a Word Frame (WF).
This Word Frame carrying the SSW occupies a 23.3 ms time frame and is sent continuously at 3600 baud. It is transmitted only when the system is idle and is used to synchronize the subscribers to the control channel. This WF is used for bit synchronization only and provides no useful information to the user.
The System ID OSW (Outbound Signal Word) is inserted serially after an SSW at least once every three seconds and contains system identification and control channel information.

That's for the basic (step1); now when an user presses the PTT on this radio, the radio sends an Inbound Signal Word (ISW) (sometimes called a Channel Request) to the central controller via the control channel.
This ISW is sent to the central controller at 3600 baud in 23.3 ms word frames and is transmitted in synchronization with the central controller's SSW. (ISW transmission is synchronized to the central controller's SSW).


There's several ISW type, I will explain the Single-Word one :
The information bits in the ISW contains the Unit ID, call type, and other parameters. If the radio is already affiliated with the central controller, the radio transmits a Single Word ISW containing 78 bits sent at 3600 bps (21.67 ms) with 21 information bits and 57 error correction bits.
[If the radio is not yet affiliated with the central controller, it transmits a Dual Word ISW.]
Ok, we just described step2, let's go to step3...


In step 3, the central controller transmits the Channel Grant or Busy OSW.
The Channel Grant OSW contains announcement group, talkgroup, Unit ID, and voice channel assignment or status information.
The channel grant signal contains 84 bits sent at 3600 baud (23.3 milliseconds) with 27 information bits, 8 sync bits, and 49 error correction bits. The 27 information bits consist of 16 address bits, one call-type bit, and 10 status or channel bits.
If the channel is in the 0 - 759 block, then the status bits contain the channel number, but if the channel is in the 760 - 1024 block, then the status word is sent in hexadecimal code.
This OSW is used to send the voice channel assignments. It consists of two consecutive words sent four times in succession.
Each word contains 84 bits and is sent at 3600 bps (23.3 ms). The information bits are split into 27 information bits, 8 synchronization bits, and 49 error correction bits.
If a channel is not available (the entire system is busy) the initiating radio displays a busy light and/or produces a Busy tone.
The Channel Busy OSW has the same format as the Channel Grant except that the information causes the radios to generate a busy tone to indicate to the radio user that all repeaters are busy.


OK, now step4 :
The central controller transmits a Low Speed HandShake (LSHS) signal (also called a Connect Word).
The LSHS unmutes received audio and holds receiving radios on the assigned voice channel.
The LSHS is sent through the voice channel at 150 Baud. The signal consists of the first 11 bits of the talkgroup identification.
If a radios does not receive or decode the LSHS, it returns to the control channel.
[BTW, The central controller continues to send the LSHS on the assigned voice channel for the duration of the transmission. This is used to keep the receiving radios unsquelched.]

Step4b:
When the microphone is unmuted and voice transmission begins, the radio transmits a Connect tone, which causes the central controller to keep the channel connected.
The Connect tone is a sub audible tone sent by the radio on the voice channel along with voice information. The central controller checks its presence to verify that the radio is still using the voice channel.
If the tone is not there, the central controller takes control of the repeater and makes it available for reassignment as a voice channel. The default frequency for the Connect Tone is 105.88 Hz. (Other Connect tone frequencies can be used).


Ok, now our user has finished talking, he releases the PTT, that's step5:
When the PTT button is released the radio does not dekey. Instead, it sends 200 milliseconds of Disconnect tone.
The Disconnect tone is used to notify the central controller that the user has finished a transmission. The Disconnect tone is a 163.64 Hz signal that is transmitted over the voice channel for 200 milliseconds.
[In message trunking, the central controller detects the Disconnect tone and begins a message timeout timer (max. 6 seconds, factory default set for 1 second)].

Once a radio transmits the Disconnect Tone, the radio switches to receive mode and unmutes after detecting the LSHS.
If any talkgroup member decides to respond to the message prior to the expiration of the message timer, the conversation will continue with the new radio providing the Connect Tone.

That would be Step6 and 7 [Call continuation, and Disconnect tone again] (in message trunking) but for clarity and brevity sake, let's ignore that and just refers to step4 & 5 again...

Last step, step8, the conversation has ended for good :
In Step 8, the final step in this sequence, the central controller transmits.
If the central controller does not receive a Connect word before the message timeout timer expires, the central controller transmits a 125 ms Disconnect word at 300 baud via the voice channel.
When a radio receives the Disconnect word, the radio mutes and returns to control channel. The central controller then makes the voice channel available for reassignment.

And Voilà, the basic of Motorola trunking !

Sorry for the wall of text and my bad writting, hope somebody will find that useful !
That was a really awesome read. Thanks for that.
Any idea how that differs from P25T?
 
Top