SDR# TETRA Demodulator Trunk Tracking Demonstration

[Ubbe]

Moreover, this morning, while taking the bus, I observed well on the bus stops there are small antennas.
At first I thought, ok it's to update the display panels of the next bus passages, but I noticed that there are also these small antennas on bus stops that do not have display panels.

The antennas probably also works as transponders to calibrate the buses route positions. When a bus are close enough to one of those antennas it gets a response back from it with its ID number and the computer in the bus then calibrate the buses map positions to be more exact. I know that the buses where I live have sensors on the wheel that measures the distance the bus travel and when the bus open its door the position are calibrated to that bus stop on the map.

/Ubbe

 

[fhebr]

Hello,

in the city (Czech Republic) where I study and am interested in public transport, there is an urban radio network (mainly used by the transport company and the city police) with the Tetra protocol. I would like to ask if any of you have any idea to what extent it is realistic to listen to this radio network, for example with this software, if it has the following specifications:

Mobile radios: Motorola MTP3550 or MTP3250
Frequency: about 410-430 Mhz
Protocol (air interface): EN 300 392-2 (TETRA)
Broadcast type (?): 18K0F7WWT
System software: Dimetra IP Compact R8.2 (ETSI TS 100392-15)
Crypting firmware: TEA1 for BTS TETRA, type MTS
Authentication Center (AuC)
Provisioning Center (PrC)
Key Variable Loader KVL 4000 from Motorola Solutions
Auth function


These specifications come from various contracts and documents, albeit more complicated, available publicly. I also asked a colleague from another city about this question, and he told me that he thought it was not realistic, but on the contrary, supposedly an employee of the transport company himself, who understands the situation, mentioned that in some way listening should be easy, so I don't know what to think about it.
Once there was an analogue network with the MPT 1327 protocol and it was the best possible source of information about extraordinary things, but that is over for a few years now.

Thank you very much in advance for your answers.

 

[Ubbe]

The firmware in tetra radios are usually not able to be modified, it's encrypted and can also have a safety function that is senses when you open up the radio and erases the whole firmware.

Al tetra radios start up by trying to find a control channel and then it announces itself on that channel by transmitting its ID and what TG you have selected and its TMEI number and those credentials needs to be confimed by the user database in the system. If your radio are not in that database it will be refused to continue to monitor anything in the system. I haven't seen any modified firmware for any model of tetra radio that allows you to monitor without first being approved by the system database.

Instead you have to use a $20 SDR dongle as a receiver and tetra decoding software where the easiest to use and best functioning are Tetra Trunk Tracker for Windows that can be found here on RR.

/Ubbe

 

[hamradionl]

Ubbe: My country use tetraradio for HAM even have there own repeater, they flash or modify the original firmware.
i send you the link some very long time ago, you remember or forgot?
Or buy a new AOR DV10, i use for last 8 weeks

 

[Ubbe]

You can use any tetra radio programmed with the frequency and system ID to be used on tetra HAM repeaters as they are running in stand alone site trunking or fail soft mode without any database or control over who uses the repeater.

/Ubbe

 

[hamradionl]

You can use any tetra radio programmed with the frequency and system ID to be used on tetra HAM repeaters as they are running in stand alone site trunking or fail soft mode without any database or control over who uses the repeater.

/Ubbe

You wrote "firmware in tetra radios are usually not able to be modified" thats why i responded. For RX only on "open" network you not need a database, its like using a DV10 but better. Even have scanning function. In very long time in the past, send you a link to the FW.

 

[Ubbe]

I've gone thru all your messages and find no link to firmware hacks or remember seeing it. The closest it gets are a standard codeplug editor. Please send again as it probably never arrived to my inbox. Having worked 20 years with tetra radios I can probably tell if it's legit or not. All tetra radios have scanning function, both on trunked TG's and conventional simplex frequencies.

/Ubbe

 

[Zeifer69]

I have a little problem, I want to monitor some groups that only transmit on LA 5 but when the calls end it does not return to the LA 5 control channel, it changes to the LA 18 channel. It only happens to me in LA 5, in other LAs I can leave it without holding a group and it always returns to its control channel. LA 5 carrier is 815 and LA 18 is 805
In addition, the information window shows manual D-release instead of the normal D-release, at that moment the control channel is changed
What can be causing it?

 

[thewraith2008]

I don't know why from what I can see.

From the last two images, it's only showing the LA:18/5 switch after been on carrier 897 and around the same time of day.
Can you confirm that this is the only carrier that this switching is occurring on or does it occur on other carriers and does it occur at other times of the day. If it's only carrier 897, can you check what the carrier reports the LA as.

There could be a bad decode occurring which switches to LA:18, but if there is no signal at that frequency, then it will switch back to last good LA used which was LA:5 in this case.



Latest version (v1.8.6.0) can be found here: MEGA - Download
Release post here

 

[Zeifer69]

I don't know why from what I can see.

From the last two images, it's only showing the LA:18/5 switch after been on carrier 897 and around the same time of day.
Can you confirm that this is the only carrier that this switching is occurring on or does it occur on other carriers and does it occur at other times of the day. If it's only carrier 897, can you check what the carrier reports the LA as.

There could be a bad decode occurring which switches to LA:18, but if there is no signal at that frequency, then it will switch back to last good LA used which was LA:5 in this case.



Latest version (v1.8.6.0) can be found here: MEGA - Download

I recorded the problem so you can see it, it happened to me 4 times, it seems to be random, there is no exact moment.

It happens at min 0:17 / 3:40 / 5:17 and 8:0

I also leave you some screenshots.

There is also a sign that the Sync diagram marks it as if it were inverted, it is only a carrier, the issue has already been mentioned before but I wanted to ask what you think, it could be a reception error Or is the carrier signal really like that?

 

[Zeifer69]

I don't know why from what I can see.

From the last two images, it's only showing the LA:18/5 switch after been on carrier 897 and around the same time of day.
Can you confirm that this is the only carrier that this switching is occurring on or does it occur on other carriers and does it occur at other times of the day. If it's only carrier 897, can you check what the carrier reports the LA as.

There could be a bad decode occurring which switches to LA:18, but if there is no signal at that frequency, then it will switch back to last good LA used which was LA:5 in this case.



Latest version (v1.8.6.0) can be found here: MEGA - Download
Release post here

The groups that start with 700 only transmit in LA 5, I have never heard them outside of it, there are other groups and the same thing happens but they jump between several LAs so I think it's normal, and the problem only occurs in LA 5 the other LAs work good.
With Netmonitor I can monitor it without problem since the carrier remains fixed.

 

[hamradionl]

I've gone thru all your messages and find no link to firmware hacks or remember seeing it. The closest it gets are a standard codeplug editor. Please send again as it probably never arrived to my inbox. Having worked 20 years with tetra radios I can probably tell if it's legit or not. All tetra radios have scanning function, both on trunked TG's and conventional simplex frequencies.

/Ubbe

Motorola serie MT7xx or 8xx and sipura, its long ago. It whas a link to a page (germany or NL) with differ plugs differ radio's +/- 2014 - 2016 Workflow looked like the AOR DV10 who also do trunk fallow. But actual you answer already in message 146.

 

[thewraith2008]

@Zeifer69

In your video @ 3.40, a call (Call ID: 35) is setup on carrier: 897.
There does not appear to be any call taking place on this carrier and is why the 'Manual D_Release' is seen.
This occurs every time the carrier 897 is used.

If you note the information for this carrier 897 after the switch. (Shown in SDR# TETRA demodulator side panel)
This is showing that the LA is now 18 (was 5) and and the main carrier is now on 805 (was 815).
When the call ends (via 'Manual D_Release'), it returns to the reported main carrier, which is 805 in this case.

Issue is, why is a call been setup on a different LAs BS.
Is this intentional (by the TETRA system) or is it a bug of TTT or the TETRA Demodulator.
Since other calls are setup OK, I would think the TTT carrier frequency translation is OK.

What do the PDU logs show at time of call setup on carrier 897.
Maybe a IF IQ recording would help.

Also it may help to identify all the carriers for LA:5 and try and determine what carrier it should be going too.

 

[oz1jua]

thewraith2008 Could be greate if the TETRA_MM-Registrations_2023-XX-XX.txt also has what LA it came from. !​

 

[signal4567]

Has anyone ever been able to get correct audio out from the demodulator? Always seems to have problems with certain calls, there is something in the audio on some calls that triggers this loss of audio frames if thats the correct explanation. On some calls there is a very dramatic difference causing it to drop out a lot.
Of course this is not present on actual tetra radios so is there something wrong with the codec or something?
I have verified that there is no problem with reception, been using this for several years now all the way from sq5bpf-tetra telive and still have the same issues.

 

[Zeifer69]

Has anyone ever been able to get correct audio out from the demodulator? Always seems to have problems with certain calls, there is something in the audio on some calls that triggers this loss of audio frames if thats the correct explanation. On some calls there is a very dramatic difference causing it to drop out a lot.
Of course this is not present on actual tetra radios so is there something wrong with the codec or something?
I have verified that there is no problem with reception, been using this for several years now all the way from sq5bpf-tetra telive and still have the same issues.

It happens to me especially in the 800 mhz band, on the same frequency some groups are heard perfectly and others are cut off a lot. But I don't know if it's just me or it also happens on radios. With NetMonitor it is heard a little better but in the absence of the gain control the audio is very low compared to trunktracker

 

[Ubbe]

Always seems to have problems with certain calls, there is something in the audio on some calls that triggers this loss of audio frames if thats the correct explanation. On some calls there is a very dramatic difference causing it to drop out a lot.

Look at the frame buffer counter. If it increases in number then your PC could be struggling to keep up with the decode process. I have mine go between 1 up to 4 so it seems to process all in a timely manner.

Check if it's always on a certain frequency that you have the drop outs. Look at the spectrum when it happens, does the signal strength jump up or down or other indications that you might have RF overload/interference issues?

/Ubbe

 

[LA6FRA]

I don't know why from what I can see.

From the last two images, it's only showing the LA:18/5 switch after been on carrier 897 and around the same time of day.
Can you confirm that this is the only carrier that this switching is occurring on or does it occur on other carriers and does it occur at other times of the day. If it's only carrier 897, can you check what the carrier reports the LA as.

There could be a bad decode occurring which switches to LA:18, but if there is no signal at that frequency, then it will switch back to last good LA used which was LA:5 in this case.



Latest version (v1.8.6.0) can be found here: MEGA - Download
Release post here

Hi. For some reason, I notice today that TTT v1.8.6.0, after more that a year working continuously without any error , sudenly changes the frequency of SDR, to 100 MHz and reset all radio settings. I has happend in two different pc's, no windows or other update has been made. I was using LRRP and I think this is it. Clicking the map a few times makes somehow change TTT, I think.

 

[Ubbe]

TTT are dumping LRRP data in a folder and the LRRP plotting program are reading that dumped data. It shouldn't have anything to do with TTT and probably not SDR# as well, as all filtering and selections are within the standalone LRRP program.

/Ubbe

 

[kondote]

Can someone tell me why the tetra demodulator that comes with Tetra trunk tracker does not show the location messages with the speed and direction, when with other versions of the tetra demodulator it does show them?