Ok to the protocol. If you have a clean capture of the 4-level fm signal the
one thing you will see often is a frame synchronization pattern. According to
the documents its 48bits in length and is hexidecimal (0x55, 0x75, 0xf5,
0xff, 0x77, 0xff). Those frame sync's seperate the frames of data. This is a
key element since if you have detected that pattern it means your 4-level FM
recovery routines are functioning properly.
- each APCO-25 voice call is composed of a series of data units: 1 Header
unit followed by Logical Data Unit 1 and Logical Data Unit 2. Those LDU's
repeat until the end of the voice call. At the end of the voice call there is
something called a terminator data unit.
- what distinguishes a voice frame from a data frame or a terminator frame is
something called a network ID. This network id is 64 bits in length and is the
very first piece of data after frame sync. It basically tells you what type of
packet it is (Header, LDU1, LDU2, Terminator, Data).
- within each LDU packet is the actual IMBE voice data, link control data
(source ID, destination ID, manufacture ID, talkgroup ID, ..), Low speed data
(dont know what this is for), and encryption sync(key ID, algorithm ID). I can
basically get all this data with my parsing routine. I can tell what radio is
keyed up, who they are talking to, and the various signalling messages sent
(emergency, pages, messages,...). I have the raw IMBE voice data but dont know
how to turn the IMBE packets into audio.
- Each LDU contains 9 IMBE packets, each IMBE packet is 144 bits in length,
88 of those bits are raw IMBE voice data. Each IMBE frame represents 20ms of
audio. It seems like during the beginning and end of a call the IMBE frame is
fixed.
- There is only one header packet during the beginning of any APCO25 voice
call. This header unit contains a encryption synchronization pattern,
manufacture ID, encryption algorithm ID, Encryption Key ID, and Trunking
talkgroup ID. It seems like the encryption related data is fixed where the
call is not encrypted (the encryption sync pattern appears fixed and does not
look random).
- Data frames are trellis encoded, I have a TIA APCO-25 document that saids
something about future trunking control packet being based on Data frames. I
guess they encapsulate trunking signalling into data frames. There are
basically 2 types of data frames 1/2 rate and 1/3 rate trellis encoded
packets. The first data frame and all standalone data frames are always 1/2
rate trellis encoded. Subsequent data frames can be 1/2 or 1/3 rate trellis
encoded depending on what type of data call it is. The types are confirmed
(acknowledged) or unconfirmed (unacknowledged). You see with 1/2 rate
encoding 1/2 or your data is forward error correction data. With 1/3 rate 2/3
is data and 1/3 is forward error correction. You loose alot of efficiency
with 1/2 rate, but it is more reliable.