Understanding Connect Plus trunking

[IanWraith]

Hello All

I agree on the need for a separate thread to discuss this subject hence this post. I shall help as best I can but there don't seem to be any Connect Plus systems in my local area but I will add your discoveries to DMRDecode.

Regards

Ian

 

[Forts]

I've got at least a couple Connect Plus systems in my area so I will try to gather any info that I can. I believe they are both fairly new systems so I don't think there is a lot of traffic on them yet.

 

[Forts]

Here is a sample log file of a system near me if anyone is interested.... pretty much looks like the same few commands repeating over and over.

 

[inigo88]

I've come across a huge 450-470 MHz MotoTRBO Connect Plus system run by Fisher Wireless here in San Diego county. So far what I'm seeing is similar to your log file.

The following message types seem to be associated with Connect Plus control channels:

CSBKO=1 + FID=6
CSBKO=3 + FID=6
SLCO=10

Unlike your log file, all the Connect Plus frequencies I've come across alternate between CSBKO=1 and CSBKO=3.

Edit: I'm noticing the same group IDs on other frequencies besides the continuous control channels. I believe these are voice channel LCNs on the Connect Plus systems . I am noticing a consistent pattern that all these suspected voice channels broadcast "Short LC: Unknown SLCO=9" messages. Keep an eye out for those (as well as common group IDs) and it will help you determine which frequencies belong to the same Connect Plus system.

 

[inigo88]

Well here's some progress. This is an excerpt of Connect Plus control channel data on 454.525 MHz during a voice call assignment:

Group Voice Channel User LC
Service Options : Non-emergency/No priority
Group Address : 50013 Source Address : 60047
3:51:40 AM DMR Data Frame
CACH : TACT  AT=1 Ch 1 Continuation fragment of LC 
Slot Type : Colour Code 3 CSBK
Unknown CSBK : CSBKO=3 + FID=6 0000000011101010100011110000000011000011010111010100100000000010
3:51:40 AM DMR Voice Frame
CACH : TACT  AT=1 Ch 2 Continuation fragment of LC 
3:51:40 AM DMR Data Frame
CACH : TACT  AT=1 Ch 1 Last fragment of LC 
Slot Type : Colour Code 3 CSBK
Unknown CSBK : CSBKO=1 + FID=6 0000000100000010000001000000010100000110000000000000000000000100
3:51:40 AM Short LC : Unknown SLCO=10 000001110111000000110000
3:51:40 AM DMR Voice Frame with Embedded Signalling

Group ID: 50013, Source ID: 60047.

CSBKO=3 + FID=6 00000000 1110101010001111 00000000 1100001101011101 0100100000000010
                                                 
                               |                         |                       |
                               |                         |                       |
   			       |         Group ID: 1100001101011101 (dec 50013)  |
			       |                                                 |
                               |                                             Unknown
          Radio ID: 1110101010001111 (dec 60047)

It's a good thing these trbo trunking protocols seem to redundantly copy DMR group and source info into the proprietary CSBK frames, because otherwise I'd have no idea where to start.

Does anyone have the Connect Plus CPS? Without knowing how LCNs are assigned (are the frequencies pre-programmed like LTR and Capacity Plus or are they directly assigned using LCNs and custom tables like Motorola systems) I don't really know what to look for.

Edit: Is it possible the group and source decodes are false? It didn't seem to make much sense to put them on the control channel. If they're not good decodes I could be going about this wrong.

 

[Forts]

I haven't seen any activity yet on the Connect Plus system near me. They look like valid decodes though... hopefully I will have something to compare to soon.

 

[inigo88]

I forgot that the group and radio IDs are 24 bit frames (only with Capacity & Connect Plus they leave the first 8 most significant bits 0). So it should look like this:

CSBKO=3 + FID=6 000000001110101010001111 000000001100001101011101 0100100000000010
                                                 
                               |                         |                  |
                               |                         |                  |
   			       |             Group ID:  50013               |
			       |                                            |
                               |                                       Unknown
                   Radio ID:  60047

So the format is:

Radio ID: 24 bits.
Group ID: 24 bits.
Unknown: 16 bits.

I think CSBKO=3 + FID=6 messages are Connect Plus Channel Grant OSWs. This hypothesis is supported by absence of them on idle Connect Plus control channels. If it is a channel grant then the last 16 bits could contain the destination LCN (but I don't yet understand how that's assigned). If LCNs are directly assigned and not pre-programmed, it's worth mentioning that some documentation I've come across says Connect Plus only supports UHF, so there may only be one custom bandplan (and thus less stuff for the control channel to announce).

That leads me to believe that CSBKO=1 + FID=6 are Connect Plus Idle Msg OSWs. Presumably these would contain idle system parameters that wouldn't change from call to call - hypothetically things like a system ID, network ID, site ID, neighboring site LCN (for RSSI), etc. I did an experiment and grabbed one from the beginning of the log file, one from the end and a couple from the middle:

CSBKO=1 + FID=6 0000000100000011000001000000010100000110000000000000000000001101
CSBKO=1 + FID=6 0000000100000011000001000000010100000110000000000000000000001101
CSBKO=1 + FID=6 0000000100000011000001000000010100000110000000000000000000001101
CSBKO=1 + FID=6 0000000100000011000001000000010100000110000000000000000000001101

As you can see they're the same, even though during the course of several minutes the CSBKO=3 channel grants changed to different values.

On the same frequency 461.3 MHz, I compared today's log with last night's:

CSBKO=1 + FID=6 0000000100000011000001000000010100000110000000000000000000001101 (Today)
CSBKO=1 + FID=6 0000000100000011000001000000010100000110000000000000000000001011 (Yesterday)

The last four bits changed, from decimal 13 yesterday to 11 today.

This is a multi-site system and I've been able to find which control channels are related by observing common group and radio IDs on them, so I was also able to compare two control channel's idle frames from yesterdays logs:

CC 461.300 MHz: CSBKO=1 + FID=6 0000000100000011000001000000010100000110000000000000000000001011
CC 454.525 MHz: CSBKO=1 + FID=6 0000000100000010000001000000010100000110000000000000000000000100

Notice the last 4 bits on the second control channel are now "4" in decimal. Because I'm sure these control channels belong to two sites on the same Connect Plus system, I was looking for commonalities that could indicate a field for a value common to the whole system, like a system ID. There are definitely some similarities!

What do you guys think?

 

[inigo88]

Another interesting note using DSD: The control channel CSBK data alternates between both TDMA time slots, but voice calls can be placed on the 2nd time slot of the control channel (while the control channel continues to occupy the first).

I've had great luck with DSD on conventional TRBO and Capacity Plus, but it has been really temperamental with Connect Plus (getting a lot of voice frames but no decoded audio). The signal is inverted and TRBO only with -xr -fr, so I am guessing I'm just slightly out of range and not getting the best decodes.

 

[Forts]

Good work so far.... I'm going to start logging the system near my full time to see what activity there may be. As you mentioned the control channel is dedicated to TS1 of the frequency it's on, and seemingly never changes (like a regular trunked system where the control channel may hop around). It would seem that there is some sort of SysID and SiteID in there as well (which could be very useful). I was also reading that Privacy is NOT an option on Connect Plus at this time, so that's a bit of a bonus if DSD will work with it. I also read that once equipped with the option board, and flashed for Connect Plus, the radios can be updated with frequency info over the air. Pretty slick!

Looks like CSBK frames are used for channel grants, radio affiliation/de-affiliation, radio disable/enable etc etc.

 

[Forts]

A little more reading tells me Connect Plus systems broadcast a Site ID and a 'Network ID'... so this is basically the System ID. Minimum value of 1, max 4096. Default is 50. Radio IDs are 1 to 16776351. Connect Plus radios also have a Multigroup ID (0 to 16776351... a value of 0 indicated Multigroup is not available) as well as regular group calls, all call's and private calls.

 

[wa6yvx]

Fisher San Diego

Inigo,

I have also been looking at this system. I found 11 freqs that all have colour code 3, must be the same system. Looking at signal strengths, they must be at different locations. I am not able to decode
audio with DSD though. Or does the TS1 Control CH data jam out the TS2 audio?

452.3625, 454.1750, 454.5250, 454.5875, 461.2500, 461.3000,
461.6125, 463.6875, 463.7875, 463.8250, 464.6250

Any other freqs related to this system?

 

[inigo88]

Actually the slot 2 audio tended to come through great on DSD while parked on the control channel. I've noticed the signal strength has to be REALLY good though, and even then half the time I'd get "VOICE:==" frames with no audio.

The system belongs to Fisher Wireless, with licenses to Mt Woodson, Mt San Miguel, Mt Otay and Mt Soledad. I have looked up a lot of Fisher licenses before and noticed they do a lot of mixing and matching frequencies, so the location on the license isn't necessarily the site that frequency actually belongs to... unfortunately.

Here is what I'm guessing is the closest site to me. Given my location I am guessing Mt San Miguel, though it could be Soledad if they have a site there.


454.0500 - voice (maybe different site?)
461.3000 - control channel
461.4250 - voice
461.6125 - voice
463.6875 - voice
463.7875 - voice
463.8250 - voice
464.6250 - voice
464.7125 - voice (probably different site)

Other control channels belonging to the same system:

452.3625 - cc for nearby site
454.0375 - cc for nearby site
454.5250 - cc (further away)
463.4375 - cc (really far away - and it gets covered by an idle burst from a PassPort system!)

Group IDs:

50001
50012
50013
50014
50015

Radio IDs:

60041
60042
60045
60046
60048
60049
60050
60051
60052
60054
60055
60056
70021

From the crappy audio I was able to get from DSD I caught some mention of "Site 2" (and possibly site 3 and 4) from techs doing radio checks. There were also some security companies using 10-codes and some construction type users.

From what I've been able to find there can be up to 6 sites per network, and each site can contain up to 15 repeater frequencies including the control channel. The repeater frequencies are not assigned directly like I originally thought, they're pre-programmed in the radio memory. I'm not sure how the radios are told which time slot to go to, and I wonder if they do it the same way as Capacity Plus (where one frequency is split into two LCNs) or whether they specify time slot in a different part of the OSW.

The problem I'm running into is that with so many short data fields with site and LCN only being 4 or 5 bits a piece, it's hard to arbitrarily guess how to split the OSW up, especially since we don't know any of the real values. Network ID should be around 13 bits, but with so many 0s and so many identical CSBKO=1 messages it's hard to tell where to divide it up.

I'm glad to have someone to compare this system with!

 

[inigo88]

Also, IF each time slot is given its own channel number (like Capacity Plus) I'd be willing to venture the following guess... however that's a big if.

Channel Grants on 461.30 MHz control channel:

CSBKO=3 + FID=6 000000010001000110000101 000000001100001101010001 00011 00000000 010

Radio ID: 70021
Group ID: 50001
LCN: 3 (?)
Site: 2 (?)

CSBKO=3 + FID=6 000000010001000110000101 000000001100001101010001 00101 00000000 010

Radio ID: 70021
Group ID: 50001
LCN: 5
Site: 2

Different day same control channel:

CSBKO=3 + FID=6 000000001110101010001100 000000001100001101011100 00011 00000000 010

Radio ID: 60044
Group ID: 50012
LCN: 3
Site: 2

Channel Grants on 454.525 MHz control channel:

CSBKO=3 + FID=6 000000001110101010010101 000000001100001101011111 00010 00000000 010

Radio ID: 60053
Group ID: 50015
LCN: 2
Site: 2??? Oops that probably isn't the site after all then, unless it's a Home Site ID (originating site the group call took place on) like PassPort uses.

CSBKO=3 + FID=6 000000001110101010001011 000000001100001101011101 00111 00000000 010

Radio ID: 60043
Group ID: 50013
LCN: 7
Last 3 bits: 2

Is this plausible?

 

[mam1081]

Apparently I have a very active Capacity Plus system a few miles from my location - Hobby Lobby's Worldwide Distribution warehouse! It seems to be a 4 or 5 frequency single site system (licensed for more). What I've found so far:

Capacity Plus CSBK : CSBKO=62

463.7375 Slot 1 = LCN 1
463.7375 Slot 2 = LCN 2
463.8875 Slot 1 = LCN 3
463.8875 Slot 2 = LCN 4
464.0625 Slot 1 = LCN 5
464.0625 Slot 2 = LCN 6
464.0625 Slot 1 = LCN 7 or 8
464.0625 Slot 2 = LCN 7 or 8
463.4625 unid LCNs

All channels use the same color code (1)

Groups in use:
11
12
13
14
15 - Security
16
19 - Loading

I'd seen about 50 active radios on this system


There is another local system that looks like it doesn't have much activity. It's licensed to a local radio service that currently has a few networked LTR systems.

461.975 Slot 1 = LCN 1 Color 1
461.975 Slot 2 = LCN 2 Color 1
461.875 Slot 1 = LCN 3 Color 2
Its interesting that different colors can be used in the same system...or can they?

Has anyone tried submitting this new type of TRS to the database? If any data dumps would be useful to add features in DMRdecode, please let me know!

 

[inigo88]

This is the "Connect Plus" thread (the version with the dedicated control channel), there is also a two page Capacity Plus thread. But your system looks really good! As far as submitting it to the database, we don't yet have the option of choosing any TRBO trunking variants (or adding color code or group IDs to the conventional repeaters). However I encourage you to bring this issue up in the database sub-forum to let them know that interest exists in adding database support for these systems!

 

[Forts]

Its interesting that different colors can be used in the same system...or can they?

Yes they can.

 

[inigo88]

Well it's looking very likely CSBKO=3 + FID=6 are "Connect Plus Channel Grants."

Format:

24 bits: Source ID
24 bits: Group ID
5 bits: LCN (I have never seen it go above 15, the maximum allowed LCN)

After the LCN field, the remaining bits are always "00000000010." I was originally thinking the last two could be the time slot (01 for 1 and 10 for 2?), but I have never seen it end in 1 so the way the trunking system assigns the time slot per LCN is still a mystery.

Here's more food for thought: Some of the SLCO=10 frames (only seen on the control channel) and SLCO=9 frames (only seen on voice frequencies) are identical with one another.

The control channel on 461.300 announces: SLCO=10 000001110111000000010000.
The control channel on 454.525 announces: SLCO=10 000001110111000000110000

The voice frequencies have SLCO=9 frames that repeat one of the two possibilities above.

Using the presumption that these frames relate the control channel to the voice frequencies associated with it (could be network ID + site ID perhaps?) I grouped the following together. This could potentially be the Fisher Wireless Connect Plus Mt San Miguel site:

454.525cc: SLCO=10 000001110111000000110000
464.8250v: SLCO=9 000001110111000000110000
463.6875v: SLCO=9 000001110111000000110000
463.6125v: SLCO=9 000001110111000000110000

More testing will be required to see if they actually are related, but as you can see that pattern is hard to ignore.

 

[Forts]

Is there any activity on the voice channels while they are idle? ie and idle burst or anything like that? I haven't come across any voice channels for my systems yet.

 

[inigo88]

No sorry. Your only warning will be CSBKO=3 on the control channel when one of the voice channels becomes active.

 

[Forts]

That's what I suspected, thanks!