diff --git a/README.md b/README.md index 65dfa1f..252ef93 100644 --- a/README.md +++ b/README.md @@ -18,6 +18,11 @@ - ✅ **Прошивка разложена на запчасти:** два процессора + внешний SPI = три независимых канала внедрения. Карта — [`docs/firmware-parts.md`](docs/firmware-parts.md). - ✅ **Найден штатный загрузчик ресурсов** (`Unicode Download.exe`, внутри `FontVoicePicture`) — официальный путь замены **шрифтов, голосовых подсказок и картинок** (в т.ч. загрузочного логотипа) без патча MCU. - ✅ **Разобран спектроанализатор REFV DualTachyon** — та самая реализация, которую хвалят пользователи. См. [`docs/refw-spectrum.md`](docs/refw-spectrum.md). +- 🎯 **DMR-чип опознан: FM100B = Sicomm SCT3258TD** — документированный baseband. Датащит и Packet Interface (126 стр) в [`docs/SCT3258_packet_interface.txt`](docs/SCT3258_packet_interface.txt). Открывает калибровку/AMBE/вокодер по спеке. Родня: UV-4R, китайские клоны (та же связка SCT3258+AT32). +- ✅ **Приём Talker Alias** — позывной вызывающего крупно на экране (cmd `0x60`). Сборка [`tools/build_ta.py`](tools/build_ta.py). +- ✅ **Интерактивный агент** — управление FM100B через COM без перешивки ([`tools/build_agent.py`](tools/build_agent.py) + [`tools/agent.py`](tools/agent.py)); снят полный [список команд FM100B](docs/fm100b-commands.md). +- ✅ **Работа с SPI** — чтение/запись/восстановление codeplug и калибровки из дампа ([`tools/spi_read.py`](tools/spi_read.py), [`tools/spi_wr.py`](tools/spi_wr.py), [`tools/spi_restore.py`](tools/spi_restore.py)). +- ⚠️ **DMR TX-калибровка** — сбита в экспериментах, восстановление документировано в [`docs/dmr-tx-recovery.md`](docs/dmr-tx-recovery.md) (offset-компенсация / .updat Radtel / калибровка по прибору). --- @@ -91,6 +96,9 @@ python flasher/build_exe.py # -> пересобрать .exe (PyInsta - **[docs/baseband-and-audio.md](docs/baseband-and-audio.md)** — управление DMR-баузбендом и аудио-трактом (PA2 — питание УНЧ, PA14 — гейт звука от модуля). - **[docs/refw-spectrum.md](docs/refw-spectrum.md)** — разбор спектроанализатора кастомной прошивки REFV DualTachyon: как вызывается, из каких функций состоит, что переносимо. - **[docs/refw-analysis.md](docs/refw-analysis.md)**, **[docs/refw-strings.md](docs/refw-strings.md)** — анализ образа REFV DualTachyon и полная выгрузка его строк/меню. +- **[docs/SCT3258_packet_interface.txt](docs/SCT3258_packet_interface.txt)** — документация DMR-чипа Sicomm SCT3258 (= FM100B): формат пакетов, команды, калибровка, вокодер/AMBE. +- **[docs/fm100b-commands.md](docs/fm100b-commands.md)** — карта команд FM100B, снятая агентом с живой рации. +- **[docs/dmr-tx-recovery.md](docs/dmr-tx-recovery.md)** — диагноз и пути восстановления DMR-передачи (частотная калибровка). - **[research/re/](research/re/)** — рабочие заметки по подсистемам (в т.ч. `dmr.md` — таблицы команд FM100B в обе стороны). ## История извлечения прошивки diff --git a/docs/SCT3258_packet_interface.pdf b/docs/SCT3258_packet_interface.pdf new file mode 100644 index 0000000..33f57ed Binary files /dev/null and b/docs/SCT3258_packet_interface.pdf differ diff --git a/docs/SCT3258_packet_interface.txt b/docs/SCT3258_packet_interface.txt new file mode 100644 index 0000000..49b1356 --- /dev/null +++ b/docs/SCT3258_packet_interface.txt @@ -0,0 +1,8827 @@ +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc + + +Packet Interface of CT3258 + + + + + + + + + + +Version:1.0 + + Date: 2015/01/14 + + + + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +2 +Change History + +Version +Date +Change Descriptions +Author +1.0 +2015/01/14 +Initial version +Hao Ye + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +3 +Contents: +Packet Interface of CT3258 +1  +Change History +2  +1  +Packet Interface Descriptions +7  +1.1  +Packet Format +7  +1.1.1  +START_BYTES +7  +1.1.2  +LENGTH +7  +1.1.3  +TYPE +7  +1.1.4  +Packet Fields +9  +1.1.5  +Parity Field +9  +1.1.6  +Time Out +10  +1.2  +Field Formats +10  +1.2.1  +CHAN_D +14  +1.2.2  +VOCODER_CMODE +14  +1.2.3  +AFC_CONFIG +15  +1.2.4  +COMPANDER_CONFIG +16  +1.2.5  +VOCODE_TONE +17  +1.2.6  +ANALOG_FEATURE +19  +1.2.7  +VOCOER_SEL +19  +1.2.8  +VOCODER_INI +20  +1.2.9  +CHIP_RESET +20  +1.2.10  +CHIP_LOWPWR +20  +1.2.11  +PARITY_ENABLE +21  +1.2.12  +ACK_MESSAGE +21  +1.2.13  +WORK_MODE +22  +1.2.14  +CARRIER_READY +23  +1.2.15  +PROCESS_MODE +24  +1.2.16  +NEW_EVENT +25  +1.2.17  +DEMOD_GAIN +26  +1.2.18  +REPORT_FIELD +26  +1.2.19  +BER_REPORT +27  +1.2.20  +ANALOG_TONE +27  +1.2.21  +CALL_START +28  +1.2.22  +CALL_STOP +30  +1.2.23  +CONNECT +30  +1.2.24  +DISCONNECT +30  +1.2.25  +DPMR_ACK +31  +1.2.26  +SYSTEM_INFO +31  +1.2.27  +ANALOG_SUBAUDIO +32  +1.2.28  +CALL_MATCH +41  +1.2.29  +ADDRESSING_MODE +41  +1.2.30  +GROUP_ID +42  +1.2.31  +SCRAMBLER_SEED +43  +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +4 +1.2.32  +MOD_GAIN +43  +1.2.33  +CODEC_SELECT +44  +1.2.34  +SET_I2C_ADDRESS +44  +1.2.35  +SYNC_MISS_COUNT +44  +1.2.36  +Q_PRO_STR +45  +1.2.37  +Q_HW_VER +45  +1.2.38  +Q_SW_VER +45  +1.2.39  +Q_CID_SN +46  +1.2.40  +DMR_GROUP_ID +46  +1.2.41  +DC_OFFSET +47  +1.2.42  +ANALOG_CONFIG +48  +1.2.43  +CTC_PARAM +50  +1.2.44  +VOCOER_IO_SET +52  +1.2.45  +MODOUT_CONFIG +53  +1.2.46  +IQCOMP_COEF +53  +1.2.47  +DIGC_DATA_FRAME +55  +1.2.48  +DPMR_PREAMBLE_LENGTH +61  +1.2.49  +DPMR_CALL_OPTION +61  +1.2.50  +DPMR_END_UE +62  +1.2.51  +DIGC_FS1 +63  +1.2.52  +DIGC_CALLED_ID_BIN +63  +1.2.53  +DIGC_OWN_ID_BIN +63  +1.2.54  +DPMR_CALLED_ID_BCD +64  +1.2.55  +DPMR_OWN_ID_BCD +64  +1.2.56  +DPMR_M_V_F_E +64  +1.2.57  +DPMR_PROTOCOL_OPTION +65  +1.2.58  +DPMR_SLD +65  +1.2.59  +DPMR_HT_CI_PM +66  +1.2.60  +DPMR_CI +71  +1.2.61  +DPMR_CC +71  +1.2.62  +DPMR_SEND_SF +72  +1.2.63  +DPMR_SEND_HEADER +72  +1.2.64  +DPMR_SEND_END +72  +1.2.65  +DPMR_SEND_AD +72  +1.2.66  +DIGI_MIC_GAIN +73  +1.2.67  +DIGI_SPEAKER_GAIN +73  +1.2.68  +I2C_OPERATION +73  +1.2.69  +MISC_GAIN +74  +1.2.70  +SQ_LEVEL +75  +1.2.71  +SPI_OPERATION +78  +1.2.72  +DMR_SLC +78  +1.2.73  +DMR_CALL_SLOT +79  +1.2.74  +EQULIZER_FILTER +79  +1.2.75  +DMR_FLC +80  +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +5 +1.2.76  +DMR_CC +81  +1.2.77  +DMR_CALL_START +81  +1.2.78  +DMR_CALL_OPTION +82  +1.2.79  +DMR_OFFSET +83  +1.2.80  +DMR_SLOT_TYPE +84  +1.2.81  +DMR_EMB +84  +1.2.82  +DMR_CALLED_ID_BCD +85  +1.2.83  +DMR_OWN_ID_BCD +85  +1.2.84  +DMR_SLOT_FOUND +85  +2  +Application Guides +87  +2.1  +Code Downloading +87  +2.1.1  +Boot loader Downloading +87  +2.1.2  +Application Downloading +87  +2.2  +DPMR Call Processing +87  +2.2.1  +Easy Mode +88  +2.2.2  +DPMR Layer 2 Mode +90  +2.3  +DMR Call Processing +92  +2.3.1  +DMR Easy Mode +92  +2.3.2  +DMR Layer 2 Mode +92  +2.3.3  +DMR MS Call Flow +93  +2.3.4  +Base Station Activation +94  +2.3.5  +Listen Before Transmitting +94  +2.4  +Typical Call Sessions with CT3258 in DPMR Mode +96  +2.4.1  +Digital Voice Call +96  +2.4.2  +Voice Call with Slow Data +97  +2.4.3  +Voice Call Recording +97  +2.4.4  +Voice Call Play Back +98  +2.4.5  +Data Call with Type 1 or Type 2 Data +99  +2.4.6  +Voice Call with Appended Data +99  +2.4.7  +Data Call Type 3 (for future release) +100  +2.4.8  +Short Appended Data (TS 102 658 Only) +102  +2.4.9  +Analog Voice Call in DPMR Mode +102  +2.4.10  +Handling of Maintenance Message (TS 102 658 Only) +103  +2.4.11  +Automatic Analog and DPMR Call Detection +103  +2.4.12  +Audio Muting for Un-matched Calls +104  +2.5  +Typical Call Sessions with CT3258 in DMR Mode +104  +2.5.1  +DMR Voice Call in DMR Easy Mode +104  +2.5.2  +DMR Voice Call in DMR Layer 2 Mode +107  +2.5.3  +Analog Voice Call in DMR Mode +110  +2.6  +Gain Calibration +111  +2.7  +DC and IQ Calibration +112  +2.8  +Error Handling +118  +2.9  +DPMR Standard User Interface +118  +2.9.1  +Message Used for Standard User Interface +119  +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +6 +2.10  +DMR Number and Dialing Plan +121  +2.10.1  +Message Used for DMR Dialing Plan +122  +2.11  +Power Saving Mode +123  +2.12  +Codec Selection +124  +2.13  +Codec Configurations +124  +2.14  +Debug Mode +125  +2.14.1  +Setting Up Two Point Modulation +125  +2.14.2  +BER Test +125  +2.14.3  +Loop Back +125  +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +7 +1 Packet Interface Descriptions +Packet interface is defined above the physical interface (HPI, Serial Port) for communications +between CT3258 and the host MCU. The packet format is identical regardless of physical +interfaces. + +As HPI in CT3258 is preconfigured to use 16 bit format, the total number of bytes in a packet +should be even. If the total number of byte is odd, a zero is appended at the end. This appended +zero will not be counted in the LENGTH field. +1.1 Packet Format +The packet format is as shown in the table below. A packet consists of a packet header and number +of packet fields and optional parity bytes. A packet header starts with 3 bytes of START_BYTES. +The next two bytes contain the packet LENGTH and the next byte contains the TYPE. Each +packet contains one or more fields which are shown as FIELD (0) through FILELD (N-1). +Optionally, at the end of the packet, there are two parity bytes. + +Packet Header +Field +Parity +START_BYTES +LENGTH TYPE +FIELD(0) +... +FIELD(N-1) +FBYTE PARITY_BYTE +3 byte +2 byte +1 byte +Variable + +Variable +1 byte +1 byte +Table 1-1 General Packet Format + +Packet details are described in the sections below. +1.1.1 START_BYTES +The three bytes of START_BYTES always have fixed values of 0x84, 0xA9, 0x61. +1.1.2 LENGTH +The PACKET LENGTH occupies two bytes of the packet. The MS byte of the packet length is the +fourth byte of the packet and the LS byte of the packet length is the fifth byte of the packet. The +PACKET LENGTH is the sum of each FIELD. Note that PACKET LENGTH excludes the first 6 +bytes taken up by the Packet Header. If parity check is enabled, the length field includes the parity +byte as well. + +As HPI in CT3258 is preconfigured to use 16 bit format, the total number of bytes in a packet +should be even. If the total number of byte is odd, a zero is appended at the end. This appended +zero will not be counted in the LENGTH field. +1.1.3 TYPE +TYPE field specifies the destination, read/write property and the types of the packet. It includes +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +8 +multiple fields, described in the table below: + +Bit +Position +Field +Descriptions +7 +AMBE +bypass +External Vocoder message bypass +0: CT3258 Control +1: AMBE control +6 +Codec bypass +Codec message bypass +0: CT3258 Control +1: Codec control, any bytes after packet type are send to codec +directly +5 +Read/Write +Read Write Control +0: Write. The MCU write fields to CT3258 +1: Read. CT3258 report fields to the MCU. Not all parameters are +readable. +4 +Near/Far +Near end / Far end control +0: Near end +1: Far End +3-0 +Packet Type +See Table Below +Table 1-2 Fields in TYPE Byte + +Internally, the call related information is stored in registers in CT3258. External MCU can write to +and read from these registers through packet interface. The write/read control is through bit 5 of +TYPE field. Not all registers are readable. Column 6 of Table 1-5 describes whether a register is +readable or not. + +Some fields, such as Own ID, Called ID, have two sets of internal registers, for far end and near +end of calls. When writing a packet field, the content is always stored in the near end registers. +When reading field information, the MCU can request the near end information or the far end +information. The near end information is the information that is to be sent or already sent to the far +end. The far end information is the information that is received from the far end. The near/far end +control is through bit 4 of the TYPE byte. + +For example, station A has an Own ID 1234567, station B has an Own ID of 1234563. The user +(MCU) can set the Own ID for the two stations with field DPMR_OWN_ID_BCD, and with write +flag. The user can then read back the Own ID of each station with read flag, and near end flag at +the two stations. After a call is made from A to B, the user can read the Own ID of station A by +issuing read command to station B with far end flag. Column 6 of Table 1-5 also describes +whether far end register is available for reading. + +The details of Packet Type are described in Table 1-3 below. + + + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +9 +Type +Value +Packet +Name +Descriptions +0 +Control +Packets +Used to set up chip operation mode, configure hardware, set up or end a +call. When a control packet is received, the chip returns a control packet +with response fields that contain response data or indication of errors in +the control packet. +3 +DPMR +Packet +Used for DPMR protocol specific information. User can use these +messages to change the elements of DPMR protocol. +4 +Program +packet +Used for host MCU to program CT3258. +5 +DMR +Used for DMR protocol specific information. User can use these messages +to change the elements of DMR protocol. +Others +Reserved +Reserved +Table 1-3 Packet Types + +Note that the boot loader for DPMR mode and DMR mode is different. Depending on the boot +loader types, CT3258 enters DPMR mode or DMR mode. In DPMR mode, commands for DMR +only (type 5) are not recognized. In DMR mode, command for DPMR only (type 3) are not +recognized. + +Also note that for program packet only (type 4), the packet header and parity bytes can be omitted. +In that case, the boot loader searches for a match of the field and command code. +1.1.4 Packet Fields +The packet fields contain useful packet information. Various different packet fields each with their +own format are defined in the next section, however, the general format of a field is shown in the +table below. + +A field consists of a field identifier followed by field data. The length of field data is dependent +upon the field identifier. Many fields have fixed lengths. Some fields are variable in length; and in +such cases the length of the field data is embedded inside field data explicitly or implicitly. + +Field Identifier +Field Data +1 byte +L(n)-1 bytes +Table 1-4 General Field Format +1.1.5 Parity Field +The parity field is a 2-byte field at the end of a packet. The first byte of the parity field is the parity +field identifier and is always equal to 0x2f. The second byte of the parity field is the parity byte. It +is obtained by “Exclusive-oring” every byte in the packet, except for the START_BYTES and the +parity byte (last byte), together. CT3258 checks the parity byte for all received packets, informs +the MCU of any parity error, and discards any packet that has an incorrect parity byte. When +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +10 +parity check fails, the receiver replies with a packet (with field 0x17) indicating parity failure. +Parity check is disabled at reset. It can be enabled when CT3258 receives a control packet with +PARITY_ENABLE field. +1.1.6 Time Out +If a valid message is received, CT3258 responds to MCU in 40 milliseconds (except some especial +commands in the table ). If a response packet is not received within 40 milliseconds, the MCU can +consider the message lost and resend the packet if necessary. +When a response packet is received, the MCU or CT3258 does not send an ACK to the response +packet. + +Commands +Response time +CHAN_D +80ms +VOCOER_SEL +1-3s +CODEC_SELECT +1 s +DIGC_DATA_FRAME +80ms. +The response time of the first data is header frame(80ms) ++ Preamble + Silence +ACK_MESSAGE +The response time of receiving 17 0A after finishing +sending is about 400ms. We have to wait the 17 0A to do +the subsequent operation. +1.2 Field Formats +A packet must contain one or more fields. The field formats are different for different types of +packets. Each packet requires a response packet. + +Control packets can be used to configure the chip prior to operation and also to query for +information from the chip. The response packet for must fields just echoes back the control field +identifier followed by a 0x00 byte to indicate the control field was received successfully. If +multiple fields are present in the packets, the response packet only needs to echo the last field of +the packet. + +DPMR / DMR packets contain the call information. They can be originated either from host or +from CT3258. The response packets to DPMR / DMR packet echoes back the control field +identifier followed by a 0x00 byte to indicate the field was received successfully. If multiple fields +are present in the packets, the response packet only needs to echo the last field of the packet. + +The Program Packet is used by the host to down load application program to CT3258. The +response packet to Program Packet echoes back the control field identifier followed by a 0x00 +byte to indicate the field was received successfully. + +Either the MCU or CT3258 can initiate a packet exchange. The packet can be used to write +information to the other end (CT3258 or MCU), or it can be used to request information from the +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +11 +other end. The Read/Write control is by bit 5 of the TYPE byte. + +When requesting field information, the MCU can request near the end information or the far end +information. The near end information is the information that is to be sent or already sent to the far +end. The far end information is the information that is received from the far end. The near/far end +control is through bit 4 of the TYPE byte. + +The table below summarizes various fields used in CT3258. + +Field Name +Field +Identifie +r +Pac +ket +Typ +e +Contro +l Field +Length +(Bytes) +Respon +se Field +Length +(Bytes) +Note +Descriptions +CHAN_D +0x01 +0 +Varies +2 +YP +Encoded voice data +VOCODER_CMODE +0x02 +0 +2 +2 +N +Vocoder mode flags for current +vocoder +AFC_CONFIG +0x05 +0 +3 +2 +YR + +COMPANDER_CONFI +G +0x06 +0 +8 +2 +N +Compander Configuration +VOCODE_TONE +0x08 +0 +Varies +2 +Y +Force current encoder/decoder +to generate tone frames +ANALOG_FEATURE +0x0A +0 +3 +2 +N +Analog Feature configuration +VOCOER_SEL +0x10 +0 +2 +2 +N +Vocoder Selection +VOCODER_INI +0x12 +0 +2 +2 +N +Vocoder initialization +CHIP_RESET +0x14 +0 +1 +2 +N +Chip reset +CHIP_LOWPWR +0x15 +0 +2 +2 +N +Set chip to low power mode +PARITY_ENABLE +0x16 +0 +2 +2 +N +Enable parity check +ACK_MESSAGE +0x17 +0 +None +2 +N +Message error report +WORK_MODE +0x18 +0 +4 +2 +Y +Set up CT3258 work mode +CARRIER_READY +0x19 +0 +2 +2 +N +Carrier Ready Message +PROCESS_MODE +0x1A +0 +2 +2 +N +Process Mode +NEW_EVENT +0x1B +0 +None +2 +YX +New event indication +DEMOD_GAIN +0x1C +0 +3 +2 +Y +Demodulator Gain +REPORT_FIELD +0x1D +0 +2 +2 +NX +Fields to report when receiving +calls. +BER_REPORT +0x1E +0 +2 +10 +Y +Bit error rate test report +ANALOG_TONE +0x1F +0 +18 +2 +N +Generate Local Tone +CALL_START +0x20 +0 +2 +2 +N +Start call send +CALL_STOP +0x21 +0 +1 +2 +N +Stop call send +CONNECT +0x22 +0 +2 +2 +NP +Send connection +DISCONNECT +0x23 +0 +2 +2 +NP +Send disconnection +DPMR_ACK +0x24 +0 +2 +2 +NP +Send ack +SYSTEM_INFO +0x25 +0 +2 +2 +NP +Send +system +or +status +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +12 +information +ANALOG_SUBAUDI +O +0x26 + +0 +Varies +2 +N +analog subaudio +CALL_MATCH +0x27 +0 +None +2 +N +Call match report +ADDRESSING_MODE +0x28 +3 +2 +2 +NP +Dialing mask length +GROUP_ID +0x29 +3 +5 +2 +YP +Group ID number +SCRAMBLER_SEED +0x2A +0 +Varies +2 +NP +Scrambler seed +MOD_GAIN +0x2C +0 +3 +2 +N +Modulator Gain +CODEC_SELECT +0x2D +0 +2 +2 +N +Codec Selection +SET_I2C_ADDRESS +0x2E +0 +2 +2 +N +Set the I2C address for the +codec +SYNC_MISS_CNT +0x2F +0 +2 +2 +N +Set the number of Sync miss +before reporting +Q_PRO_STR +0x30 +0 +1 +Varies +Y +Query for product code +Q_HW_VER +0x31 +0 +1 +Varies +Y +Query for hardware version +Q_SW_VER +0x32 +0 +1 +Varies +Y +Query for software version +Q_CID_SN +0x33 +0 +1 +9 +Y +Query for customer ID +DMR_GROUP_ID +0x36 +5 +6 +2 +YD +Group ID number +DC_OFFSET +0x39 +0 +13 +2 +N +DC Offset +ANALOG_CONFIG +0x3c +0 +12 +2 +N +Analog Configuration +VOCODER_IO_SET +0x3e +0 +2 +2 +NP +Vocoder IO settings +CTC_PARAM +0x3d +0 +23 +2 +N +CTC detection parameters +MODOUT_CONFIG +0x41 +0 +6 +2 +N +Two point modulation delay +IQCOMP_COEF +0x42 +0 +10 +2 +YR +IQ compensation configuration +DIGC_DATA_FRAME +0x43 +0,3, +5 +Varies +2 +YFX +Data frames +DPMR_PREAMBLE_L +ENGTH +0x46 +0,3 +3 +N +N +Preamble and silence length +DPMR_CALL_OPTIO +N +0x47 +3 +6 +2 +N +DPMR Call Option +DPMR_END_UE +0x4B +3 +4 +2 +YF +17-bit un-encoded END +DIGC_FS1 +0x4C +3 +7 +2 +YF +48-bit of FS1 +DIGC_CALLED_ID +_BIN +0x50 +3, 5 +4 +2 +YF +24-bit called ID in binary +DIGC_OWN_ID_BIN +0x51 +3, 5 +4 +2 +YF +24-bit own ID in binary +DPMR_CALLED_ID +_BCD +0x52 + +3 +5 +2 +YFP +7 digit called ID in BCD +DPMR_OWN_ID +_BCD +0x53 +3 +5 +2 +YFP +7 digit own ID in BCD +DPMR_M_V_F_E +0x54 +3 +2 +2 +YFP +3-bit communication mode and +4-bit communication format +DPMR_PROTOCOL_O +PTION +0x55 +3 +2 +2 +NP +DPMR protocol option +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +13 +DPMR_SLD +0x56 +3 +4 +2 +YFP +18-bit slow data +DPMR_HT_CI_PM +0x57 +3 +3 +2 +YFP +4-bit header type and 11-bit +call information +DPMR_CI +0x5A +3 +3 +2 +FP +11-bit call information +DPMR_CC +0x5C +3 +4 +2 +YFP +24-bit of color code (Di-bit) +DPMR_SEND_SF +0x5F +3 +1 +2 +NP +Send super frame command. +Upon receiving this command, +CT3258 assemble a super +frame and send to the far end +DPMR_SEND_HEAD +ER +0x60 +3 +1 +2 +NP +Send header frame command. +Upon receiving this command, +CT3258 assemble a header +frame and send to the far end +DPMR_SEND_END +0x61 +3 +1 +2 +NP +Send end frame command. +Upon receiving this command, +CT3258 assemble a end frame +and send to the far end +DPMR_SEND_AD +0x62 +3 +1 +2 +NP +Send appended data +DIGI_MIC_GAIN +0x68 +0 +3 +2 +N +Digital Microphone Gain +DIGI_SPEAKER_GAI +N +0x69 +0 +3 +2 +N +Digital Speaker Gain +I2C_OPERATION +0x6A +0 +Varies +5 +Y +I2C Read and Write +MISC_GAIN +0x6B +0 +13 +2 +N +Misc. Gains +SQ_LEVEL +0x6C +0 +13 +2 +YR +RSSI and OOBE levels +SPI_OPERATION +0x6D +0 +3 +2 +YR +SPI Write Operation +DMR_SLC +0x6E +5 +5 +2 +ND +DMR SLC report +DMR_CALL_SLOT +0x6F +5 +2 +2 +ND +DMR call slot information +EQUALIZER_FILTER +0x70 +0 +12 +2 +N +Set +coefficients +for +audio +equalizer +DMR_FLC +0x76 +5 +4 +2 +YD +DMR Full LC +DMR_CC +0x77 +5 +2 +2 +YD +DMR Color Code +DMR_CALL_START +0x78 +5 +4 +2 +ND +DMR Call Start +DMR_CALL_OPTION +0x79 +5 +6 +2 +ND +DMR Call option +DMR_OFFSET +0x7A +5 +9 +2 +ND +DMR Slot Timing Offset +DMR_SLOT_TYPE +0x7B +5 +2 +2 +ND +DMR slot type +DMR_EMB +0x7C +5 +2 +2 +ND +DMR EMB field +DMR_CALLED_ID_B +CD +0x7D +5 +5 +2 +YFD +8 digit called ID in BCD +DMR_OWN_ID_BCD +0x7E +5 +5 +2 +YFD +8 digit called ID in BCD +DMR_SLOT_FOUND +0x7F +5 +2 +2 +ND +DMR_slot found +Table 1-5 Overview of Packet Fields + +In the note field in the above table, Y means the command can be used as both WRITE and READ +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +14 +command; N means the command can only be used as a WRITE command. F means the command +can be used to read both Far End information and Near End information. R means the command is +used only when paired with SCT3700. D means command can be used for DMR only. P means +command can be used for DPMR only. X means command is interpreted differently for DMR and +DPMR. + +As most fields are used as commands to CT3258 for controlling and configuration purposes, we +sometimes call field as command. As a result we use the terms field and command +in-discriminatively throughout the document. + +The detailed descriptions of each filed is described in the following sections. Only field format in +Write Packet is shown. Read Packets usually only have the field ID byte. +1.2.1 CHAN_D +This field can be used to pass encoded voice data between the MCU and CT3258. This command +is only used in DPMR mode. + +Field Identifier +Data Length + Vocoder Configuration field +1 Byte +1 Byte +1 Bytes +0x01 +The length of the +data in bytes +Encoded voice data. 36 bytes per +80 milliseconds. +Default: +36 + +Table 1-6 CHAN_D Field Format +1.2.2 VOCODER_CMODE +This field can be used to change the mode of the vocoder. + +Field Identifier + Vocoder Configuration field +1 Byte +1 Bytes +0x02 +{ AMBE_COMP, 0, 0, 0, NS, 0, TD, AGC} +Default: +0x08 +Table 1-7 VOCODER_CMODE Field Format + +The meaning of each bit is given below: + +Bit Name Descriptions +Default +AMBE_ +COMP +AMBE +vocoder +compatibility bit +0 +NS +Noise Suppression Enable +0: disable +1 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +15 +1: enable +Reserved +Reserved +0 +TD +Tone Detection Enable +0: disable +1: enable +0 +AGC +AGC Enable +0: disable +1: enable +0 +Table 1-8 VOCODER_CMODE Field Options +1.2.3 AFC_CONFIG +This command is used to configure AFC (automatic frequency control), when used with SCT3700. + +If the receiver carrier frequency is not matched to the transmitter carrier frequency, the +performance degrade. + +The use the AFC, the user first use this command to read the frequency offset between the +transmitter and the receiver. To compensate for the frequency offset, the user has two options: + +1. Change SCT3700 receiver LO, using SCT3700 frequency configuration command. +2. Change the internal mixer inside CT3258, using this command. + +The AFC_CONFIG write command has the following format: + +Field Identifier + Internal frequency offset +1 Byte +1 Bytes +0x05 +Internal frequency offset applied at the CT3258 mixer. The unit is Hz +Default: +0 +Table 1-9 AFC_CONFIG Field Format + +AFC_CONFIG command is also used to read the frequency offset between the receiver and the +transmitter. + +To read the frequency offset, AFC_CONFIG command should be sent with “Read/Write” bit in +the TYPE field set to 1. The AFC_CONFIG command used in “read” mode has the following +format: + +Field Identifier +DC Time Constant +1 Byte +1 Byte +0x05 +Time constant for averaging AFC frequency offset +Default +3 + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +16 +Time constant of 0 corresponds to average time of 31.25 ms, which is the time it takes to reach +within 10% of the steady state energy value. If the constant is n, the average time is given by the +following formula: + +T = 31.25 * 2^n. + +The Response to the read AFC_CONFIG command has the following format: + +Field Identifier +Frequency offset +Reserved +1 Byte +1 Byte +1 Bytes +0x05 +Frequency +offset +between +the +transmitter +and the +receiver, in Hz +Reserved +Default +- +- +1.2.4 COMPANDER_CONFIG + +This command is used to configure the compander in analog call mode. The configurable +parameters include compander reference level for the transmitter and the receiver, the energy +estimation timing constant, and the compander gain update interval. + + +The compander energy level is calculated as the running average of the absolute values of received +audio signal, given by the equation below: + +E(n) = (1-alpha) * E(n-1) + alpha * |x(n)|, + +where |x(n)| is the absolute value of the received audio signal, alpha is the time constant. The +smaller is the alpha, the larger is the time constant. Roughly, T = 4 / alpha, where T is the time it +takes to reach within 10% of the steady state energy value. For example, with the default alpha = +68, the time constant is T = 4 / 68 = 60 ms. + +The TX and RX compander reference levels are the signal levels that the input signal are +compared against. At the TX side, if the input signal energy level is greater than the TX +compander reference level, the input signal are reduced; if it is less than the TX compander +reference level, it is enlarged. At the RX side, if the input signal energy level is greater than the +RX compander reference level, the input signal are enlarged; if it is less than the RX compander +reference level, it is reduced. + +The compander gain update interval is the interval that the compander gains are re-calculated. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +17 +Within the interval, the compander gain is unchanged. The compander gain update interval is in +terms of 24 kHz samples. + + +Field +Identifier +Compander +Update +interval +Compander +TX reference +Comander +RX reference +Compander +Energy +Constant +1 Byte +1 Byte +2 Bytes +2 Bytes +2 Bytes +0x06 +Compander +update +interveral +in +terms of 24 +samples +Compander +TX reference, +0-32768 +Compander +RX reference, +0-32768 +Compander +Energy update +constant, +0-16384 +Default +60 +2048 +2048 +68 + +Table 1-10 COMPANDER_CONFIG Field Format + +1.2.5 VOCODE_TONE +This field is used to force the encoder to transmit a tone frame. The frequency (or frequencies) and +amplitude of the tone are specified by this field. It is also used to report the detected DTMF tone +or single tone to the MCU. + +Field +Identifier +Tone +Configuration +Tone Data +Amplitude Data +16 bit Frequency +1 Byte +1 Byte +1 Byte +1 Byte +2 Bytes (Optional) +0x08 +See Table 1-10 +for details +See Table 1-12 +for details +Amplitude +scale +in dB ++3dB to -90 dB +Single +tone +Frequency in 16 bit +decimal +Default +0 +0x80 +-10 dB (0xF6) +0 +Table 1-11 VOCODE_TONE Field Format + +The details of Tone Configuration byte is as follows: + +Bit Position Descriptions +Default +Bit 7-3 +Reserved +0 +2 +Optional 16 bit frequency field flag +0: No 16 bit frequency field +1: 16 bit frequency field present +0 +1 +Tone Direction +0: Send or detect near end Vocoder tone +1: Send or detect far end Vocoder tone +0 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +18 +0 +Tone on / off flag +0: Tone Off +1: Tone On +0 +Table 1-12 Tone Configuration Details + +DTMF Tone Data Tone Type +Frequency 1 (Hz) +Frequency 2 (Hz) +0-4 +Invalid Tone +NA +NA +0x05-0x7A +Single Tone +Tone Data * 31.25 Hz +NA +0x7B-0x7F +Invalid tone +NA +NA +0x80 +DTMF “0” +1336 +941 +0x81 +DTMF “1” +1209 +697 +0x82 +DTMF “2” +1336 +697 +0x83 +DTMF “3” +1477 +697 +0x84 +DTMF “4” +1209 +770 +0x85 +DTMF “5” +1336 +770 +0x86 +DTMF “6” +1477 +770 +0x87 +DTMF “7” +1209 +852 +0x88 +DTMF “8” +1336 +852 +0x89 +DTMF “9” +1477 +852 +0x8a +DTMF “A” +1633 +697 +0x8b +DTMF “B” +1633 +770 +0x8c +DTMF “C” +1633 +852 +0x8d +DTMF “D” +1633 +951 +0x8e +DTMF “*” +1209 +941 +0x8f +DTMF “#” +1477 +941 +0x90 +KNOX “0” +1162 +820 +0x91 +KNOX “1” +1052 +606 +0x92 +KNOX “2” +1162 +606 +0x93 +KNOX “3” +1279 +606 +0x94 +KNOX “4” +1052 +672 +0x95 +KNOX “5” +1162 +672 +0x96 +KNOX “6” +1279 +672 +0x97 +KNOX “7” +1052 +743 +0x98 +KNOX “8” +1162 +743 +0x99 +KNOX “9” +1279 +743 +0x9a +KNOX “A” +1430 +606 +0x9b +KNOX “B” +1430 +672 +0x9c +KNOX “C” +1430 +743 +0x9d +KNOX “D” +1430 +820 +0x9e +KNOX “*” +1052 +820 +0x9f +KNOX “#” +1279 +820 +0xa0 +Dial Tone +440 +350 +0xa1 +Ring tone +480 +440 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +19 +0xa2 +Busy Tone +620 +480 +0xa3 +Call Progress Tone +490 +350 +0xa4-0xff +Inactive +NA +NA +Table 1-13 VOCODE_TONE Field Options + +Note that the bytes for 16 bit Frequency is optional. It is present only if bit 2 of Tone +Configuration Byte is 1. + +1.2.6 ANALOG_FEATURE +This field configures for special feature. Note that these special feature can only be used when the +analog vocoder (ID = 16) is loaded. + +Field Identifier +ANALOG_FEATURE +1 Byte + +2 Bytes +0x010 +Bit 0: DTMF enable flag +0: DTMF detection is disabled +1: DTMF detection is enabled +Bit 1: DTMF detection position +0: DTMF detection is done before the +de-emphasis filter +1: DTMF detection is done after the +de-emphasis filter +Bit 2: MSK enable flag +0: MSK transmission and detection +disabled +1: MSK transmission and detection is +enabled. +Bit 3: Compander enable flag +0: Compander is disabled +1: Compander is enabled. +Bit 4-15: reserved. +Default +3 +Table 1-14 ANALOG_FEATURE Field Format + +1.2.7 VOCOER_SEL +This field forces vocoder type. + +CT3258 supports AMBE+2 vocoder from DVSI. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +20 +Field Identifier +Vocoder Type +1 Byte +1 Byte +0x010 +4: AMBE+2 +16: Analog calls +Others, reserved +Default +4 +Table 1-15 VOCODER_SEL Field Format + +1.2.8 VOCODER_INI +This command initializes the vocoder. + +Field Identifier +Initialization type +1 Byte +1 Byte +0x012 +N/A +Default +0 +Table 1-16 VOCODER_INI Field Format +1.2.9 CHIP_RESET +This command resets CT3258. This command has the effect as NMI signal (non-maskable +interrupt), which restarting the firmware in CT3258 without reloading the firmware. +Field Identifier +1 Byte +0x14 +Table 1-17 CHIP_RESET Field Format +1.2.10 CHIP_LOWPWR +This command puts CT3258 in low power mode. + +Field Identifier +Low Power Mode +1 Byte +1 byte +0x015 +Bit 7:6, Reserved +Bit 5: Power down external vocoder +Bit 4: Power down external codec +Bit 3:0: Power mode of CT3258 +0: Normal +1: Stop TX and RX processing +2: Reserved +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +21 +Table 1-18 CHIP_LOWPWR Field Format +1.2.11 PARITY_ENABLE +This command enables parity checks on all packets: + +Field Identifier +Parity Enable/Disable +1 Byte +1 Byte +0x016 +0: Disable parity checks +1: Enable parity checks +Default +0 +Table 1-19 PARITY_ENABLE Field Format + +Note that unlike other fields, PARITY_ENABLE field can only be the only field in a packet. +1.2.12 ACK_MESSAGE +This is a response packet to a received packet, when packet is not received correctly, and the +packet field is not recognizable or unreliable. + +Note that when received field is recognizable reliably even though there is error in the packet, +CT3258 respond with the command field instead of ACK_MESSAGE field. + +Note that 0x17 0x0A does not indicate an error condition. This is sent when CT3258 has +completely sent the message to be sent to the far end. +3: Power down certain peripheral of CT3258 including serial port, DMA and +timers. +4: CT3258 enters IDLE mode +5: CT3258 enters Sleep mode +6: CT3258 enters Halt mode + +Default +0 +Field Identifier +Failure Code +1 Byte +1 Byte +0x017 +0: No error +1: Response to system reset. CT3258 is ready to receive command from the +host. +2: Field length exceeds maximum allowed +3: Parity error +4: Unknown command error +5: Packet length does not match with field Length +6: Error in processing field +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +22 +Table 1-20 PACKET_FAILURE Field Format +1.2.13 WORK_MODE +This command set the work mode for CT3258. + +Table 1-21 WORK MODE Field Format + +Bit Position Descriptions +7 +Two Point Modulation Disable Flag +0: Enable two point modulation in TX mode +1: Disable two point modulation in TX mode +6 +Special SCT3700 calibration loop enable +0: Normal mode +1: Enable the special SCT3700 calibration +loop +5-4 +Reserved +3-0 +Work Mode +7: I2C write error +8: SLD request time out error +9: TCH request time out error +10. Message to far end completion indication +11. Error in processing called ID or own ID +12. Chip not activated +13. Unsupported feature +14. Function not loaded +15. Odd byte error + +Others: reserved +Default +0 +Field +Identifier +Work +Mode +Modem Loop Mode +Audio Loop Back +Debug Mode +1 Byte +1 Byte +1/2 Byte [7:4] +1/2 Byte [3:0] +1 Byte +0x018 +See Table +1-19 +for +details. +0: No Loop +1: Codec Loop back +2: 4 FSK Loop back +3: Packet Loop back +4: FEC Loop back +5: Vocoder Loop back +6: Decimator Loop +back +Others: reserved +0: No Loop +1: Codec Loop back +2: +Decimator +Loop +back +3: Vocoder Loop back +4: FEC Loop back +5: Packet Loop back +6: 4 FSK Loop back +Others: reserved +See Table 1-20 for +details +Default +0 +0 +0 +0 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +23 +0: Idle +1: RX +2: TX +3: Full Duplex +Table 1-22 Details of Work Mode Byte + +Byte Value Descriptions +0 +No debug +1 +Mod port send fixed sine wave of 1000 Hz +2 +Mod port send 4 FSK signal with FS1 pattern +3 +Reserved +4 +Reserved +5 +BER Test mode +6 +Reserved +7 +Reserved +8 +Reserved +9 +TX sends 1031 Hz test Tone instead Voice from microphone +10 +TX sends silence instead Voice from microphone +11 +DMR BER test mode (STD ID 511) +14 +DPMR/DMR BER test mode (STD IB CALL), see note 1 +Table 1-23 Details of Debug Mode Byte + +Note 1: The STD IB CAL pattern changes the STB IB 511 pattern with every 100th bit inverted. This +gives this pattern a 1% bit error rate + +1.2.14 CARRIER_READY +This command informs CT3258 that carrier is detected on the RX side. Upon receiving this +message, CT3258 start to look for preamble and frame SYNCs. This command is also used to +inform CT3258 whether to mute the audio if the called ID (for DPMR calls) or CTCSS/DCS code +does match. + +If carrier detection (SQ) is to be done by CT3258 (enabled by CALLL_OPTION command), this +command starts the carrier detection on CT3258. + +Field Identifier +Carrier Ready Indication +1 Byte +1 Byte +0x019 +Bit 7:3, Reserved +Bit 2: Mute Flag for muting audio if called ID or CTCSS/DCS code does not +match. + 0: Un-mute the audio even if the called ID (for DPMR calls) or +CTCSS/DCS code (for a analog calls) does not match +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +24 + 1: Mute the audio if the called ID (for DPMR call) or CTCSS/DCS code +(for analog calls) does not match, un-mute other wise. +Bit 1:0, Carrier ready flag +0: Carrier Lost +1: Carrier Ready +2: Carrier Ready, but the phase of the demodulated signal is reversed. +Others: reserved +Note： The reverse of demodulated signal polarity does not work in analog +mode. Please configure the polarity with ANALOG_SUBAUDIO. + +Default +0 +Table 1-24 CARRIER_READY Field Format +1.2.15 PROCESS_MODE +This command set the process mode of CT3258. The process mode includes DPMR / DMR +physical layer only (1), physical layer plus data link layer (2) and physical layer plus data link +layer plus call control layer (3). This command is also used to enable automatic detection of +analog or digital calls. + +Field Identifier +Process Mode +1 Byte +1 Byte +0x01A +2: Layer 2, DPMR / DMR Layer 2 Mode +3: Layer 3, Easy Mode +128: Analog Mode +131: Automatic detection of analog call or DPMR calls (layer +3) +Others: Reserved +Default +2 +Table 1-25 PROCESS_MOD Field Format + +With layer two processing mode, CT3258 is responsible to perform layer one and layer two +processing of the DPMR / DMR protocol, including the FEC, interleaving and message +interpretation. + +Layer 2 processing complies with ETSI TS 102 490 or TS 102 658 in DPMR mode, and ETSI TS +102 361 in DMR mode, + +With layer three processing mode, in addition to layer two processing, the CT3258 also performs +call control of the DPMR / DMR processing. ANNEX A Standard User Interface for CSF radio in +DPMR mode, and ANNEX C DMR Numbering and Dialing plan are implemented in CT3258. At +the transmitter, CT3258 supports wild character dialing for group and all calls for DPMR and +DMR, abbreviated dialing and masked dialing for DPMR. At the receiver, when a call is received, +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +25 +CT3258 does matching of individual call number and group number and informs the MCU of +matching results. +1.2.16 NEW_EVENT +This message is sent when a new event occurs and requires MCU attention. Note that some of the +fields different in DPMR and DMR mode. + +Field Identifier +Event +1 Byte +1 Byte +0x01B +0: No event +1: DPMR: New Header frame received, with FEC error + DMR: Data Sync received with FEC error +2: DPMR: New End frame received +3: DPMR: New CCH received +4: DPMR New Header frame received with no FEC error + DMR: Data SYNC received +5: DPMR: Super Frame received, with no FEC error + DMR: Voice SYNC received +6: DPMR: FS3 received +7: DPMR: FS4 received +8: Lost synchronization +9. DPMR: FS1 found pre-alert +10. DPMR: FS2 found pre-alert +11. Reserved +12. Carrier detected +13. Carrier lost +14. Unsupported call received +15. Wrong vocoder +16-255 reserved +Default +0 +Table 1-26 NEW_EVENT Field Format + +If a digital call is received and correctly decoded, CT3258 reports NEW_EVENT 4 OR 5. If a +digital call is received but has FEC error, CT3258 reports NEW_EVENT 1. These event reports +can also be disabled with REPORT_FIELD command. + +In DPMR mode, if mixed call detection is enabled, and a digital call is received, NEW_EVENT 9 +or 10 will be reported first, before complete FEC checking process, to alert MCU that a digital call +is received. These events can be used to terminate analog call detection. + +If CT3258 is to do carrier detection (SQ), NEW_EVENT 12 and 13 are used to report carrier +status. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +26 +During the course of a digital call, if synchronization pattern is not detected for a period of time +(configured through command SYNC_MISS_COUNT), CT3258 reports NEW_EVENT 8. +1.2.17 DEMOD_GAIN +This message set the demodulation gain for the demodulator. If the value is zero, auto calibration +is used. + +Table 1-27 DEMOD_GAIN Field Format +1.2.18 REPORT_FIELD +This message informs CT3258 what field to report when receiving a call. + +Field Identifier +Mask Byte +1 Byte +1 Byte +0x01D +Mask to indicate the field to report when receiving a new call. Each individual +bit select one field. Multiple fields can be selected. +Default +0x70 +Table 1-28 REPORT_FIELD Field Format + +The details of the bits are different depending on DPMR or DMR mode. + +Bit Position +Field to report +7 +NEW_EVENT (FS1 or FS2) +6 +DPMR_M_V_F_E +5 +DPMR_HT_CI_PM +4 +DIGC_CALLED_ID_BIN +3 +DPMR_CALLED_ID_BCD +2 +DIGC_OWN_ID_BIN +1 +DPMR_OWN_ID_BCD +0 +DPMR_CC +Table 1-29 Bit definition for Mask Byte in DPMR Mode + + +Field Identifier +Event +1 Byte +2 Byte +0x01C +0: Auto calibration +Others: linear gain values in Q16.11 (16 bits total, 11 bits fraction, MSB first), +with 2048 as 0 dB + +Default +0 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +27 +Bit Position +Field to report +7 +NEW_EVENT (FS1 or FS2) +6 +DMR_FLC +5 +DMR_CSBK +4-1 +Reserved +0 +DMR SLOTTYPE OR EMB +Table 1-30 Bit definition for Mask Byte in DMR Mode + +1.2.19 BER_REPORT +This command enquires for the BER test report. The BER includes test success flag, test duration, +total number of errors, and error rate in ppm (pieces per million). A duration parameter in the +command control the duration used in ppm calculation + +Field Identifier +BER Duration +1 Byte +1 Byte +0x01E +BER statistics duration +0: All errors in the test are used in BER ppm calculation +1-30, number of seconds used for ppm calculation. Error beyond the duration +are discarded in BER ppm calculation +Default +0 +Table 1-31 BER_REPORT Field Format + +The response packet returns the BER results. +Table 1-32 BER_REPORT response Field Format +1.2.20 ANALOG_TONE +This command enables the CT3258 to generate or stop a tone signals to be played out from the +line out port or the MOD port. The tone signal is a repetition of a two-tone pattern, in the form as +Tone1-Tone2-Tone1-Tone2….-Tone1-Tone2. Each tone is made up of two frequencies. The +Field +Identifier + Valid +Indication +Test length +Errors +Error in PPM +1 Byte +1 Byte +2 Bytes +4 Bytes +4 Bytes +0x01E +1: BER test +successful +0: BER test +unsuccessful. +Result is not +meaningful +Word (MSB first) to +indicate the number +of seconds in BER +test +Long +word +(MSB +first) to indicate the +number +of +errors +found. +Long word (MSB +first) to indicate the +error percentage (in +ppm) +Default +0 +0 +0 +0 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +28 +frequencies and amplitudes are programmable. If silence is desired for the second tone, the user +should set the two frequencies or the two amplitudes of the second tone to zero. + + +Table 1-33 LOCAL_TONE Field Format + + + +Bit Position +Field to report +7 +Remote Tone Flag +0: Local Tone to the line out port +1: Remote Tone to the MOD port +6-0 +Repeat Number +0: Stop Tone +127: Infinite +Others: Repetition Number +Table 1-34 Definition for TONE_CTRL +1.2.21 CALL_START +Call Start command. Upon receiving this command, CT3258 begins to send call to the far end. +Field +Identifier +TONE_CTRL +Frequency 11 +Frequency 12 +Frequency 21 +Frequency 22 +1 Byte +1 Byte +2 Bytes +2 Bytes +2 Bytes +2 Bytes +0x01F +See +Table +1-32 +for +Details +First +frequency +of +the first tone, +in Hz +If Bit 7 of the +MSB +is +1, +siren +is +generated +Second +frequency +of +the first tone, in +Hz +First frequency +of the Second +tone, in Hz +Second +frequency +of +the +second +tone, in Hz +Default +0 +NA +NA +NA +NA +Amplitude11 +Amplitude 12 +Amplitude 21 +Amplitude 22 +Length 1 +Length 2 +1 Byte +1 Byte +1 Bytes +1 Bytes +2 Bytes +2 Bytes +Amplitude of +the first +frequency of +the first tone, in +8 bit linear +scale with 6 bit +fractions +Amplitude +of +the +second +frequency of the +first tone, in 8 +bit linear scale +with +6 +bit +fractions +Amplitude +of +the +first +frequency of the +second tone, in +8 bit linear scale +with +6 +bit +fractions +Amplitude +of +the +second +frequency of the +second tone, in +8 bit linear scale +with +6 +bit +fractions +Length of +the +first +tone +in +milliseco +nds. +Length +of +the +second +tone +in +milliseco +nds. +NA +NA +NA +NA +NA +NA +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +29 + + +Field Identifier +Call Details +1 Byte +1 Byte +0x20 +DATA[0]={M[2:0], V[1:0], F[1:0], EP} +Call Mode, Version, Call Format, +Emergency Call flag +Default +0 +Table 1-35 CALL_START Field Format + +With CALL_START command, the header type, HT is set to 0x0. + +The M, F, and P fields are described in the following tables + +M +Communication Modes +000 +Voice communication (no user data in SLD field) +001 +Voice + slow data (user data in SLD field) +010 +Data communication type 1 (Payload is user data without FEC) +011 +Data communication type 2 (Payload is user data with FEC) +100 +Data communication type 3 (Packet data, ARQ method) +101 +Voice and appended data (type 2) +110 +Appended data +Others Reserved +Table 1-36 Communication Mode Field Details + +V +Version number +00 +DPMR standard traffic +01 +Reserved +10 +Reserved +11 +Manufacturer specific +Table 1-37 Version Field Details + +F +Communication Format +00 Call ALL (Broadcast) +01 Peer-to-peer communication +10 BS uplink +11 +BS downlink +Table 1-38 Communication Format Field Details + +EP +Emergency Priority Flag +0 +Normal call +1 +Emergency call +Table 1-39 Emergency Priority Flag Field Details +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +30 +1.2.22 CALL_STOP +Call Stop command. Upon receiving this command, CT3258 sends an END frame to the far end +and then stop the call to the far end. + +Field Identifier +1 Byte +0x21 +Table 1-40 CALL_STOP Field Format + +This command is also used to end an analog call. +1.2.23 CONNECT +Call Connect command. Upon receiving this command, CT3258 send connection command to the +far end. It is also used send a call alert to the far end in the case of voice calls. + +Field Identifier +Call Details +1 Byte +1 Byte +0x22 +DATA[0]={M[2:0], V[1:0], F[1:0], EP} +Call Mode, Version, Call Format, +Emergency Call flag +Default +0 +Table 1-41 CONNECT Field Format + +With CONNECT command, the header type, HT is set to 0x01. + +The meaning of M, V, F and EP fields are described in Table 1-32 to Table 1-35. + +If there is no frame after sending this command, we must wait CT3258 report 17 0A then make the +subsequent operation (The response time is 150ms+Preamble +Silence+PowerSaveHeader). +1.2.24 DISCONNECT +Call Disconnection command. Upon receiving this command, CT3258 sends disconnect command +to the far end. + +Field Identifier +Call Details +1 Byte +1 Byte +0x23 +DATA[0]={M[2:0], V[1:0], F[1:0], EP} +Call Mode, Version, Call Format, +Emergency Call flag +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +31 +Default +0 +Table 1-42 DISCONNECT Field Format + +With DISCONNECT command, the header type, HT is set to 0x02. + +The meaning of M, V, F and EP fields are described in section CALL_START. + +If there is no frame after sending this command, we must wait CT3258 report 17 0A then make the +subsequent operation (The response time is 300ms+Preamble +Silence +PowerSaveHeader). +1.2.25 DPMR_ACK +ACK command: Upon receiving this command, CT3258 send acknowledgment to the far end. + +Field Identifier +Call Details +1 Byte +1 Byte +0x24 +DATA[0]={M[2:0], V[1:0], F[1:0], EP} +Call Mode, Version, Call Format, +Emergency Call flag +Default +0 +Table 1-43 DPMR_ACK field Format + + +With DPMR_ACK command, the header type, HT is set to 0x03. + +The meaning of M, V, F and EP fields are described in section CALL_START. + +If there is no frame after sending this command, we must wait CT3258 report 17 0A then make the +subsequent operation (The response time is 100ms+Preamble +Silence+PowerSaveHeader). +1.2.26 SYSTEM_INFO +System Info command, upon receiving this command, CT3258 sends system or status request or +response to the far end. + +Field Identifier +Call Details +1 Byte +1 Byte +0x25 +DATA[0]={M[2:0], F[3:0], EP} +Call Mode, Version, Call Format, +Emergency Call flag +Default +0 +Table 1-44 SYSTEM_INFO field Format + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +32 +SYSTEM_INFO command does not set header type, HT, field. The header type can be set with +DPMR_HT_CI_PM or DPMR_HT command before sending SYSTEM_INFO. + +The meaning of M, V, F and EP fields are described in in section CALL_START. + +If there is no frame after sending this command, we must wait CT3258 report 17 0A then make the +subsequent operation (The response time is 150ms+Preamble +Silence+PowerSaveHeader). +1.2.27 ANALOG_SUBAUDIO +This field contains analog sub_audio message. Upon receiving this message, CT3258 configure +the sub-audio generation and detection setting of CT3258 in analog mode. It is also used to report +detection of specific CTCSS/DCS tones and tail detection results. + +The number of bytes for this field varies depending on the whether arbitrary CTCSS/DCS +generation and detection is required. If no arbitrary CTCSS/DCS is required, the field length is 3. +If arbitrary DCS code is required, the field length is 5. The added two bytes are for the arbitrary +DCS code in hex form. If arbitrary CTCSS code is required, the field length is 9. Two of the added +six bytes are for the CTCSS frequencies, another four bytes are for the two coefficients for the +narrow band filter for that particular frequency. + +The CTCSS coefficients are calculated from the arbitrary CTCSS frequency to be detected. The +formula is: + +a1 = round (2048 * sqrt (1.9990 * (1-cos(2*w0)))) + +a2 = round (-2047*2^9 * cos (w0)) + 2^20 + +where w0 is calculated from the desired arbitrary CTCSS frequency, f0, by + +w0 = f0/1909.9 + +For example for CTCSS frequency 67 Hz, the coefficients are calculated as follows: + +a1 = round (2048*sqrt (1.9990 * (1-cos (2*67/1909.9)))) = 144 +a2 = round ((-2047*2^9 * cos (67/1909.9))) + 2^20 = 1157 + +The MCU is responsible to calculate the coefficients and pass them to CT3258. + +Field +Identifier +Sub-audio +Configuration / +Status +CTCSS/DCS +number +Arbitrary +CTCSS +frequency or +DCS code +Coefficient +A1 +Coefficient +a2 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +33 +1 Byte +1 Byte +1 Byte +2 Bytes +2 Bytes +2 Bytes +0x26 +See Table 1-44 +for details +0: No CTCSS +/DCS +1-108: +CTCSS/DCS +code +255: Arbitrary +CTCSS/DCS +code +Others: +reserved +For +CTCSS: +CTCSS +frequency +in +steps of 0.1 Hz +(MSB first) + +For +DCS, +0-0x1ff, +corresponding +to +the +DCS +code, in HEX +format , MSB +first +Narrow +band +filter +coefficient +a1 +for +arbitrary +CTCSS +frequency +Narrow +band +filter +coefficient +a1 +for +arbitrary +CTCSS +frequency +Default +0x40 +0 +NA + NA +NA +Table 1-45 SUBAUDIO Field Format + +Bit Position +Bit Name +Descriptions +7 +CD_SEL +DCS and CTCSS select +0: CTCSS +1: DCS +6 +EXP_SEL +Expanded CTCSS / DCS code Select +0: Standard CTCSS/DCS set (38 for CTCSS, 83 for +DCS) +1: Expanded CTCSS DCS Set (51 for CTCSS, 107 +for DCS) +5 +Polarity +DCS polarity +0: Positive DCS polarity +1: Negative DCS polarity +4 +Blind +Blind sub-audio detection enable +0: No blind sub-audio detection +1: Blind sub-audio detection enabled. +3 +Auto Polarity Detection +DCS Auto polarity detection enable +0: DCS Auto polarity detection disabled +1: DCS Audio polarity detection enable +2-1 +Tail Detection +Configuration or Report +In a configuration packet, it is used to enabling tail +generation and detection: +00: No Tail detection +01: 120 degree tail +10: 180 degree tail for CTCSS. Enable tail detection +for DCS. +11: 240 degree tail + +In a report packet, it is used to report tail detection +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +34 +results: +00: No Tail found +01: 120 degree tail found +10: 180 degree tail found +11: 240 degree tail found + +0 +FOUND +Sub audio find flag +0: No CTCSS/DCS found +1: CTCSS/DCS found +Table 1-46 Sub-Audio Configuration Details + +Serial Number： +DCS code in Octal format +DCS code in Hex format +1 +017 +00F +2 +023 +013 +3 +025 +015 +4 +026 +016 +5 +031 +019 +6 +032 +01A +7 +036 +01E +8 +043 +023 +9 +047 +027 +10 +050 +028 +11 +051 +029 +12 +053 +02B +13 +054 +02C +14 +065 +035 +15 +071 +039 +16 +072 +03A +17 +073 +03B +18 +074 +03C +19 +114 +04C +20 +115 +04D +21 +116 +04E +22 +122 +052 +23 +125 +055 +24 +131 +059 +25 +132 +05A +26 +134 +05C +27 +143 +063 +28 +145 +065 +29 +152 +06A +30 +155 +06D +31 +156 +06E +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +35 +32 +162 +072 +33 +165 +075 +34 +172 +07A +35 +174 +07C +36 +205 +085 +37 +212 +08A +38 +223 +093 +39 +225 +095 +40 +226 +096 +41 +243 +0A3 +42 +244 +0A4 +43 +245 +0A5 +44 +246 +0A6 +45 +251 +0A9 +46 +252 +0AA +47 +255 +0AD +48 +261 +0B1 +49 +263 +0B3 +50 +265 +0B5 +51 +266 +0B6 +52 +271 +0B9 +53 +274 +0BC +54 +306 +0C6 +55 +311 +0C9 +56 +315 +0CD +57 +325 +0D5 +58 +331 +0D9 +59 +332 +0DA +60 +343 +0E3 +61 +346 +0E6 +62 +351 +0E9 +63 +356 +0EE +64 +364 +0F4 +65 +365 +0F5 +66 +371 +0F9 +67 +411 +109 +68 +412 +10A +69 +413 +10B +70 +423 +113 +71 +431 +119 +72 +432 +11A +73 +445 +125 +74 +446 +126 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +36 +75 +452 +12A +76 +454 +12C +77 +455 +12D +78 +462 +132 +79 +464 +134 +80 +465 +135 +81 +466 +136 +82 +503 +143 +83 +506 +146 +84 +516 +14E +85 +523 +153 +86 +526 +156 +87 +532 +15A +88 +546 +166 +89 +565 +175 +90 +606 +186 +91 +612 +18A +92 +624 +194 +93 +627 +197 +94 +631 +199 +95 +632 +19A +96 +646 +1A6 +97 +654 +1AC +98 +662 +1B2 +99 +664 +1B4 +100 +703 +1C3 +101 +712 +1CA +102 +723 +1D3 +103 +731 +1D9 +104 +732 +1DA +105 +734 +1DC +106 +743 +1E3 +107 +754 +1EC +108 +0 +000 +Table 1-47 DCS Extend Table +Serial Number： +DCS code in Octal format +DCS code in Hex Format +1 +023 +013 +2 +025 +015 +3 +026 +016 +4 +031 +019 +5 +032 +01A +6 +043 +023 +7 +047 +027 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +37 +8 +051 +029 +9 +054 +02C +10 +065 +035 +11 +071 +039 +12 +072 +03A +13 +073 +03B +14 +074 +03C +15 +114 +04C +16 +115 +04D +17 +116 +04E +18 +125 +055 +19 +131 +059 +20 +132 +05A +21 +134 +05C +22 +143 +063 +23 +152 +06A +24 +155 +06D +25 +156 +06E +26 +162 +072 +27 +165 +075 +28 +172 +07A +29 +174 +07C +30 +205 +085 +31 +223 +093 +32 +226 +096 +33 +243 +0A3 +34 +244 +0A4 +35 +245 +0A5 +36 +251 +0A9 +37 +261 +0B1 +38 +263 +0B3 +39 +265 +0B5 +40 +271 +0B9 +41 +306 +0C6 +42 +311 +0C9 +43 +315 +0CD +44 +331 +0D9 +45 +343 +0E3 +46 +346 +0E6 +47 +351 +0E9 +48 +364 +0F4 +49 +365 +0F5 +50 +371 +0F9 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +38 +51 +411 +109 +52 +412 +10A +53 +413 +10B +54 +423 +113 +55 +431 +119 +56 +432 +11A +57 +445 +125 +58 +464 +134 +59 +465 +135 +60 +466 +136 +61 +503 +143 +62 +506 +146 +63 +516 +14E +64 +532 +15A +65 +546 +166 +66 +565 +175 +67 +606 +186 +68 +612 +18A +69 +624 +194 +70 +627 +197 +71 +631 +199 +72 +632 +19A +73 +654 +1AC +74 +662 +1B2 +75 +664 +1B4 +76 +703 +1C3 +77 +712 +1CA +78 +723 +1D3 +79 +731 +1D9 +80 +732 +1DA +81 +734 +1DC +82 +743 +1E3 +83 +754 +1EC +84 +0 +000 + +Table 1-48 DCS Standard Table + +Serial Number： +CTCSS frequency +1 +67 +2 +71.9 +3 +74.4 +4 +77 +5 +79.7 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +39 +6 +82.5 +7 +85.4 +8 +88.5 +9 +91.5 +10 +94.8 +11 +97.4 +12 +100 +13 +103.5 +14 +107.2 +15 +110.9 +16 +114.8 +17 +118.8 +18 +123 +19 +127.3 +20 +131.8 +21 +136.5 +22 +141.3 +23 +146.2 +24 +151.4 +25 +156.7 +26 +162.2 +27 +167.9 +28 +173.8 +29 +179.9 +30 +186.2 +31 +192.8 +32 +203.5 +33 +210.7 +34 +218.1 +35 +225.7 +36 +233.6 +37 +241.8 +38 +250.3 +39 +134.4 +Table 1-49 CTCSS Standard Table + + +Serial Number： +ctcss 52 digit decimal +1 +63 +2 +67 +3 +69.3 +4 +71.9 +5 +74.4 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +40 +6 +77 +7 +79.7 +8 +82.5 +9 +85.4 +10 +88.5 +11 +91.5 +12 +94.8 +13 +97.4 +14 +100 +15 +103.5 +16 +107.2 +17 +110.9 +18 +114.8 +19 +118.8 +20 +123 +21 +127.3 +22 +131.8 +23 +136.5 +24 +141.3 +25 +146.2 +26 +151.4 +27 +156.7 +28 +159.8 +29 +162.2 +30 +165.5 +31 +167.9 +32 +171.3 +33 +173.8 +34 +177.3 +35 +179.9 +36 +183.5 +37 +186.2 +38 +189.9 +39 +192.8 +40 +196.6 +41 +199.5 +42 +203.5 +43 +206.5 +44 +210.7 +45 +218.1 +46 +225.7 +47 +229.1 +48 +233.6 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +41 +49 +241.8 +50 +250.3 +51 +254.1 +52 +134.4 +Table 1-50 CTCSS Extend Table +1.2.28 CALL_MATCH +This field is used in a CT3258 generated report message when a call is received, as a result from a +CARRIER_READY command from the MCU. It is generated if a DPMR or a DMR call is +received and that the receiver can start to SYNC with the transmitter. + +Field Identifier +Call Details +1 Byte +1 Byte +0x27 +See Table 1-48 for details +Default +0 +Table 1-51 CALL_MATCH Field Format + +Table 1-52 Call Match Details +1.2.29 ADDRESSING_MODE +This field is used to configure the addressing mode of CT3258 for DPMR. As described in the +DPMR spec (TS 102 490 or 658).), with initial addressing mode, the user uses 254 binary ID’s. +With configured addressing mode, the user can use a dial pad to dial 7 digital numbers. + +Bit Position +Bit Name +Descriptions +7-4 +Group ID +For group calls, the matched group ID +3 +CC Match +Color code match status +0: Color code matched +1: Color code not matched +2 +Un-match Reason The reason for call not matching +0: Valid Called ID not received +1: Called ID not matched +Others: reserved +1 +Group Call +Group or individual call flag when a call is matched +0: Individual call +1: Group call +0 +Called ID Match +Flag +Called ID Match Flag +0: Called ID matched with receiver Own ID, or one of the +receiver group ID +1: Called ID is not matched +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +42 +The field format is described below. + +Field Identifier +Addressing Mode Details +1 Byte +1 Byte +0x28 +See Table 1-50 for details +Default +0 +Table 1-53 ADDRESSING_MODE Field Format + +Bit Position +Bit Name +Descriptions +7-4 +Reserved +Reserved +3-1 +Dial mask Length +0-6: The length of the Dial mask for Configured Addressing mode +Others: invalid. +0 +Mode Select +Address mode select +0: Initial Addressing mode +1: Configured Address mode (Standard User Interface) +Table 1-54 Addressing Mode Details + +The number of digital the user is allowed to dial is (7- Dial_Mask_Length). For example, 3 mean +that 3 numbers are masked. The user is able to dial a maximum of 4 numbers. By default, +Dial_Mask_Length = 0, meaning no mask is used and the user is allowed to dial all 7 digits. +1.2.30 GROUP_ID +The command is for DPMR mode only. A separate command DMR_GROUP_ID is used for DMR +mode. + +Each DPMR terminal can be assigned an individual ID (own ID) and one or several group ID’s. +When an incoming called ID matched with the receiver’s individual ID or group ID, the receiver +responds. The GROUP_ID field is used to pass the group ID to CT3258. + +This field contains the group ID in 7 BCD codes and one group number. + +Field Identifier + Group ID and group number +1 Byte +4 Bytes +0x29 +DATA[0]= {K1, K2} +DATA[1]= {K3, K4} +DATA[2]= {K5, K6} +DATA[3]= {K7, Group Number}, +where group number can be 1-15 +Default +0,0,0,0 +Table 1-55 GROUP_ID Field Format + +K1, … , K7 are 0-9 for BCD numbers, or 10 for ‘*’. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +43 + +The command fields support up to 15 group numbers. +1.2.31 SCRAMBLER_SEED +This command enables/disables the voice scrambler for encryptions and selects the 32 bit +scrambler seed. + + +Field Identifier +Scrambler Type +Scrambler seeds +1 Byte +1 Bytes +0/4 bytes +0x2A +0: Disable the Scrambler +1: Enable 32 bit scrambler +(DPMR Mode only) +4: Enabled 16 bit scrambler +0 byte if scrambler type = 0; +4 bytes if scrambler type = 1; +DATA[0] = SEED[31:24] +DATA[1] = SEED[24:16] +DATA[2] = SEED[15:8] +DATA[3] = SEED[7:0] +2 bytes if scrambler type = 4; +DATA[0] = SEED[15:8] +DATA[1] = SEED[7:0] +Default +0 +0,0,0,0 +Table 1-56 SCRAMBLER_SEED Field Format + +Note: The 32 bit scrambler is indeed a 16 bit scrambler. The first 16-bit is used as scrambler seed +which the end user can program. The second 16-bit is an XOR mask, which can be used by radio +manufacturers to purposely make their radio to be incompatible with radio made by other +manufactures. The second 16-bit should have at least 5 “1” to be effective. + +For the 16 bit scrambler, when this command is set in TX, please set the PM in HT_CI_PM +command to enable the encryption function. +1.2.32 MOD_GAIN +This message set the modulation gain for the modulator. +Field Identifier +Event +1 Byte +2 Byte +0x02C +Linear gain applied to the modulator in Q16.11 (16 bits total, 11 bits fraction, +MSB first), with 2048 as 0 dB +Table 1-57 MOD_GAIN Field Format +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +44 +1.2.33 CODEC_SELECT +This command selects the codec that works with CT3258. Current supported codecs include +TLC320AIC3204 from TI and WM8758B from Wolfson. + +Field Identifier +Codec Selection +1 Byte +1 Bytes +0x02D +1: TLC320AIC3204 +2: WM8758B +3: ES8338 + +Others: reserved. +Default +2 +Table 1-58 CODEC_SELECT Field Format +1.2.34 SET_I2C_ADDRESS +CT3258 also supports other types of codecs, as long as it has an I2C interface for control and a +serial interface for data transfer which conforms with CT3258 format and timing. The I2C address +of the codec can be set the command SET_I2C_ADDRESS +Field Identifier +I2C Address +1 Byte +1 Bytes +0x02E +I2C address to pass to codec +Default +0x34 +Table 1-59 SET_I2C_ADDRESS Field Format +1.2.35 SYNC_MISS_COUNT +Once a call is set up, CT3258 monitor the link conditions and continuously check the presence of +synchronization word, (FS2 in the case DPMR and Voice SYNC pattern in DMR). It reports +SYNC miss if the number of sync miss is greater than a threshold. This command set the +threshold. + +Table 1-60 SYNC_MISS_COUNT Field Format + +Field Identifier +Sync Miss Count +1 Byte +1 Bytes +0x02F +Threshold for sync miss counter before reporting to MCU. +0-254: threshold of sync miss to exceed (greater than) before report sync miss +255: never report sync miss +Default +255 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +45 +The message to report Sync miss is NEW_EVENT with field value of 0x08. +1.2.36 Q_PRO_STR +This command enquires for product code. +Field Identifier +1 Byte +0x030 +Table 1-61 Q_PRO_STR Field Format + +The response packet returns a string: “CT3258” or other product code. +Field Identifier Number of Bytes +Data +1 Byte +1 Byte +Variable Number of bytes +0x30 +Number of bytes +“CT3258F” +Table 1-62 Q_PRO_STR Field Options +1.2.37 Q_HW_VER +This command enquires for hardware version. + +Field Identifier +1 Byte +0x031 +Table 1-63 Q_HW_VER Field Format + +The response packet returns a string: “V0.01.01” or other hardware version. + +Field Identifier Number of Bytes +Data +1 Byte +1 Byte +Variable Number of bytes +0x31 +Number of Bytes +“V0.02.02” +Table 1-64 Q_HW_VER Field Options +1.2.38 Q_SW_VER +This command enquires for software version: + +Field Identifier +1 Byte +0x032 +Table 1-65 Q_SW_VER Field Format + +The response packet returns a string: “V0.01.01” or other software version. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +46 + +Field Identifier Number of Bytes +Data +1 Byte +1 Byte +Variable Number of bytes +0x32 +Number of Bytes +“V1.00.04” +Table 1-66 Q_SW_VER Field Options +1.2.39 Q_CID_SN +This command enquires for customer ID and serial number. +Field Identifier +1 Byte +0x033 +Table 1-67 Q_CID_SN Field Format + +The response packet returns customer ID in 6 BCD numbers and serial number in 10 BCD +numbers. + +Field Identifier +Customer ID +Serial Number +1 Byte +3 Bytes +5 Bytes +0x33 +Customer ID in 6 BCD +numbers +Serial Number in 10 BCD +numbers +Table 1-68 Q_CIN_SN Field Options + +1.2.40 DMR_GROUP_ID +Each DMR terminal can be assigned an individual ID (own ID) and one or several group ID’s. +When an incoming called ID matched with the receiver’s individual ID or group ID, the receiver +responds. The DMR_GROUP_ID field is used to pass the group ID to CT3258. + +This field contains the group ID in 8 BCD codes and one group number. + +Field Identifier + Group ID and group number +1 Byte +5 Bytes +0x29 +DATA[0]= {K1, K2} +DATA[1]= {K3, K4} +DATA[2]= {K5, K6} +DATA[3]= {K7, K8} +DATA[4] = Group Number +where group number can be 1-15 +Default +0,0,0,0 +Table 1-69 GROUP_ID Field Format +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +47 + +K1, … , K8 are 0-9 for BCD numbers. + +The command fields support up to 15 group numbers. + + +1.2.41 DC_OFFSET +This command applies a DC offset to the input signals from the ADC and to the output signal to +the DAC. It also applies a digital gain to the signals to the DAC before DC offset is added. + +The value of the DC offset is in 2’s complements, with 0x7fff corresponds to the maximum +positive DC offset, and 0x8000 corresponds to the maximum negative DC offsets. The electrical +voltage of the DC offset depends on the codec types and the analog gain that is applied to the +codec. + +With zero analog gain, the maximum offset is capped by the supply voltage of the codec, and the +minimum is capped by zero. + +In the case of DAC output, a gain is applied to the output signal before DC offset is added. The +gain is in linear scale, with 0x0800 corresponding to zero gain. + +Field +Identifier +DC +offset +for +ADC +Left +Channel +DC offset +for ADC +Right +Channel +DC offset +for DAC +Left +Channel +DC offset +for DAC +right +Channel +Digital +Gain for +DAC left +channel +Digital +Gain for +DAC right +Chanel +1 Byte +2 Byte +2 Bytes +2 Bytes +2 Bytes +2 Bytes +2 Bytes +0x039 +DC +offset +Value, +MSB +followed by +LSB, +0x8000-0x7 +fff +DC +offset +Value, +MSB +followed by +LSB, +0x8000-0x7 +fff +DC +offset +Value, +MSB +followed by +LSB, +0x8000-0x7 +fff +DC +offset +Value, +MSB +followed by +LSB, +0x8000-0x7 +fff +Digital +Gain +Value, +MSB +followed by +LSB, +In +linear +Scale, +Q16.11 +Digital +Gain +Value, +MSB +followed by +LSB, +In +linear +Scale, +Q16.11 +Default +0 +0 +0 +0 +2048 +2048 +Table 1-70 DC_OFFSET Field Format + +When paired with SCT3700, DC_OFFSET command is also used to read the DC levels and +amplitudes of the signal in the RX path. In addtion, the DC levels and amplitudes of TX signal can +be read by looping the TX to the RX and then read the RX DC levels and amplitudes. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +48 +To read DC levels and amplitudes, DC_OFFSET command should be sent with “Read/Write” bit +in the TYPE field set to 1. The DC_OFFSET command used in “read” mode has the following +format: + +Field Identifier +DC Time Constant +1 Byte +1 Byte +0x39 +Time constant for averaging DC and amplitude. +Default +0 + +Default time constant of 0 corresponds to average time of 31.25 ms, which is the time it takes to +reach within 10% of the steady state energy value. If the constant is n, the average time is given by +the following formula: + +T = 31.25 * 2^n. + +The Response to the read DC_OFFSET read command has the following format: + +Field +Identifier +DC offset for +the Left +Channel +DC offset for +the Right +Channel +Amplitude for +the Left +Channel +Amplitude for +the Right +Channel +Total energy +of IQ channel +Division out +of +AMP_I/AMP +_Q +1 Byte +2 Byte +2 Bytes +2 Bytes +2 Bytes +4 Bytes +1 Byte +0x039 +DC +offset +Value, +MSB +followed +by +LSB, +in +Q16.15, +0x8000-0x7fff +DC +offset +Value, +MSB +followed +by +LSB, + +in +Q16.15, +0x8000-0x7fff +Amplitude +Value, +MSB +followed +by +LSB, +in +Q16.15 +0x0-0x7fff +Amplitude +Value, +MSB +followed +by +LSB, +in +Q16.15 +0x0-0x7fff +I^2 ++Q^2, +used to do TX +DC +calibration, +only +for +SCT3700, +Used for IQ +calibration +only +for +SCT3700 +Default +- +- +- + + +- + +1.2.42 ANALOG_CONFIG +This command changes the CT3258 configuration in analog mode. The parameter that can be +configured in analog mode include LPF selection for 12.5 kHz or 25 kHz channel spacing, +pre-emphasis and de-emphasis filter settings, and various gain values at different stages in the +signal chain. All gain values are linear gain with 16 bit resolution. + +Field +Identifier +Mode +Configure +TX gain +Before +Limiter +TX Gain +after Limiter +CTCSS +Gain +DCS Gain +RX Volume +Gain +1 Byte +1 Byte +2 Bytes +2 Bytes +2 Bytes +2 bytes +2 Bytes +0x03C +See Table +16 bit linear +16 bit linear +16 bit linear +16 bit +16 bit linear +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +49 +Table 1-71 ANALOG_CONFIG Field Format + +Bit +Position +Bit Name +Descriptions +7 +ALT_LPF +Additional attenuation at 3 kHz when BB_CH_SEL = 1 +6 +DCS_HPF +DCS high pass filter enable flag, for removing DC +0: DCS high pass filter is disabled +1: DCS high pass filter is enabled +5 +COMPANDER +Compander enable +0: Compander is disabled +1: Compander is enabled. +4 +ANA_TONE_CFG Analog Tone configure +0: No CTCSS or DCS when sending analog tones +1: Send CTCSS or DCS when sending analog tones +3 +IF_CH_SEL +IF Channel Select +0: 12.5 kHz channel +1: 25 kHz channel +2 +SKIP_EMP +Skip pre-emphasis and de-emphasis filters +0: No skip pre-emphasis and de-emphasis filters +1: Skip pre-emphasis and de-emphasis filters +1 +BB_CH_SEL +Base band channel filter select +0: LPF corner at 2.55k Hz +1: LPF corner at 3 kHz +0 +FILTER_BYPASS +Filter by pass. All analog signal processing in the TX path and the +RX path are bypassed if this bit is set. +Table 1-72 Mode Configure Details + + +Note that IF_CH_SEL and BB_CH_SEL can be different. IF_CH_SEL selects 12.5KHz narrow +band channel selection filter or 25 kHz wide band channel selection filter. BB_CH_SEL selects +the base band filter LPF corner. The following table gives a guide line for IF_CH_SEL or +BB_CH_SEL settings. + +IF_CH_SEL BB_CH_SEL Standard +0 +0 +12.5kHz narrow band channel, compliant with Europe CE +standards (ETSI EN 300 296) +0 +1 +12.5kHz narrow band channel, compliant with US FCC standards +(TIA 603) +1 +0 +N/A +1 +1 +25 kHz wide band channel, compliant with Europe CE standards +1-67 for +details +gain, MSB +first, in +Q16.11 +gain, MSB +first, in +Q16.12 +gain, MSB +first, in +Q16.12 +linear gain, +MSB first, +in Q16.12 +gain, MSB +first, in +Q16.11 +Default +2 +2048 +4096 +4096 +4096 +2048 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +50 +(ETSI EN 300 296) and US FCC standards (TIA 603). + +When BB_CH_SEL = 1, the user can configure ALT_LPF, to add an 1.5 dB attenuation at 3kHz. +This is useful for two point modulation when the VCO boosts the frequency response at 3kHz, +which may result in the total frequency response out of the spec. +1.2.43 CTC_PARAM +This command is used to configure CTCSS detection parameters. The CTCSS detection is done +with two conditions, frequency and energy. The frequency has to be close to the designated +CTCSS frequency, and the CTCSS energy has to above a certain threshold. To reduce the +probability of false detection, both conditions have to be satisfied for a number of times before a +CTCSS detection is declared. If one of the conditions is not satisfied for a number of times, +CTCSS lost is declared. This command sets those thresholds. + +Instead of using the standard phase reversal as CTCSS tail, SCT3258 can also send 55 Hz tone at +the end of call as an indication for call end. “55 Hz” is used here as a general term for the special +tone for call end indication. Its frequency is a programmable. CTC_PARAM command is also +used to configure the mode and frequency of the 55 Hz tone. Also, as in the CTCSS tone case, a +narrow band filter (NBF) is used to capture the 55 Hz tone. The coefficients for the NBF need to +be set in this command if the 55 Hz tone detection is enabled. + + +Freq_Tough +Eng_Tough +Tail_180 +Tail_120 +CTC_Tail_DI +55 +Hz +Tail +Configuration +1 Byte +1 Bytes +1 Bytes +1 Bytes +1 Bytes +1 Byte +Number of +times +Number of +times energy +180 degree +CTCSS tail +120 degree +CTCSS tail +CTCSS tail +detection +55 Hz Tail +Configuration, +Field +Identifier +Energy_Hi +Energy_Lo +Freq_Miss +Eng_Miss +Freq_norm +Eng_Norm +1 Byte +2 Byte +2 Bytes +1 Bytes +1 Bytes +1 bytes +1 Bytes +0x3D +Energy high +threshold +for CTCSS +found +detection +Energy low +Threshold +for CTCSS +lost +detection +Number of +times +frequency +conditions +missed +before +declaring +CTCSS lost +Number of +times +energy +conditions +missed +before +declaring +CTCSS lost +Number of +times +frequency +conditions +satisfied +before +declaring +CTCSS +found under +good +condition +Number of +times +energy +conditions +satisfied +before +declaring +CTCSS +found under +good +condition +Default +0x0384 +0x0258 +6 +4 +2 +1 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +51 +frequency +conditions +satisfied +before +declaring +CTCSS +found under +tough +condition +conditions +satisfied +before +declaring +CTCSS +found under +tough +condition +detection +threshold. +Higher +threshold +make it +more +difficult to +detect tail. +detection +threshold. +Higher +threshold +make it +more +difficult to +detect tail. +index, larger +index value +makes +detection +easier. A value +of 0 is the +hardest. +See Table +below for +details +7 +6 +0x80 +0xd0 +0 +0 + + + +Tail Frequency +Tail +NBF +Coefficients +Signal to Total Energy +Ratio +Reserved +2 Bytes +4 Bytes +1 Byte +2 bytes +Special +Tail +frequency, + +in +steps of 0.1 Hz +(MSB first). 55 Hz +as default. + +Narrow band filter +coefficients for the +special tail +frequency. See +Section 1.2.27 +for details of the +coefficients +Signal to Total Energy +Ratio Threshold for +CTCSS detection. The +larger the threshold, the +more difficult to detect + +2, 38 +0, 118, 3, 179 +0xb0 +0 + + +Table 1-73 CTC_PARAM Field Format + +Bit Position +Bit Name +Descriptions +7 +ANA_END_SEND +Flag for sending end of transmission +0: No 17 0A sent after CTCSS/DCS tail is sent +1: 17 0A sent after CTCSS/DCS tail is sent +6 +CTCSS_TOL +CTCSS detection tolerance +0: No tolerance if received CTCSS frequency is off +spec +1: More tolerance if received CTCSS frequency is +off spec. +5 +TAIL_LENGTH +Flag for analog tail length for CTCSS and DCS +0: tail length 180 ms +1: tail length 250 ms +4 +HPF_CORNER +Flag for analog High pass filter corner +0: HPF corner at 300 Hz +1: HPF corner at 450 Hz +3 +CTC_TAIL_RX +55 Hz tail detection enable in CTCSS call: +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +52 +0: 55 Hz Tone detection enabled +1: 55 Hz Tone detection enabled +2 +VOICE_TAIL_RX +55 Hz tail detection enable in call with no sub-audio: +0: 55 Hz Tone detection enabled +1: 55 Hz Tone detection enabled +1 +CTC_TAIL_TX +55 Hz tail enable in CTCSS call: +0: No 55 Hz Tone are sent at the end of call +1: 55 Hz Tone are sent at the end of call +0 +VOICE_TAIL_TX +55 Hz tail enable in voice call with no sub-audio: +0: No 55 Hz Tone are sent at the end of call +1: 55 Hz Tone are sent at the end of call +Table 1-74 55 Hz Tail Configuration Details + +1.2.44 VOCOER_IO_SET +This field selects the input and output settings for vocoders. It is most used for voice recording and +play back. Currently, this command is only used in DPMR mode only. + +Field Identifier Recording/Play Back Setting +1 Byte +1 Byte +0x03e +Vocoder IO configuration, See table below +Default +0 +Table 1-75 VOCODER_IO_SET Field Format + +Bit Position +Bit Name +Descriptions +7 +Reserved +Reserved +6 +MOD_IN +Modulator input select: +0: from vocoder +1: from MCU (through CHAN_D commanad) +5:4 +ENC_OUT +Voice encoder output select: +00: Voice encoder output to modem +01: Voice encoder output to MCU +10: Voice encoder output to modem and MCU +3 +DEC_IN +Voice decoder input select: +0: from demodulator +1: from MCU (through CHAN_D commanad) +2 +DEMOD_OUT +Demodulator output select +0: to voice decoder +1: to MCU (through CHAN_D commanad) and to voice decoder +1 +Reserved +Reserved +0 +Reserved +Reserved +Table 1-76 Vocoder IO Configuration Details +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +53 + +With VOCODER_IO_SET command, the user can implement functions like local/remote +recording and local/remote play back. The following table gives example of the settings. + +Function +Vocoder IO Settings +Local Recording +0x20 +Remote Recording +0x04 +Local Play back +0x08 +Remote Play back +0x40 +Table 1-77 Vocoder IO Settings for Different Functions +1.2.45 MODOUT_CONFIG +This command is used to configure the phase delay between the two channels in a two point +modulation scheme. Adding a phase delay between the channels is useful to achieve a flat +frequency response in two point modulation. The minimum step size is 10.4 us. And maximum +delay is plus or minus 416 us. For example, if the phase delay time is set to 0x08,the signal at +LOR is 83.2 us after the signal at LOL .If phase delay time is set to 0xf8, then the signal at LOR is +83.2 us a head of with the signal at LOL. + +Field Identifier +Phase delay time configure +Reserved +1 Byte +1 Byte +4 Bytes +0x041 +Minimum to -40 max to 40, with a +step size of 10.4 us +Reserved +Default +0 +0,0,0,0 +Table 1-78 MODOUT_CONFIG Field Format +1.2.46 IQCOMP_COEF +This command is used when paired with SCT700 only. + +This command is used to configure the IQ compensation filter of for the RX path and the TX path. +If CT3258 works in IQ input or IQ output mode, the I path and the Q path of the RF front en +should be perfectly matched, or the performance suffers. However, the I path and the Q path are +never perfectly matched in the analog world. IQ compensation filter are used to re-aligned the IQ +signals so that they are matched. The figure below shows the control data and control signals of IQ +compensation filter. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +54 +External +Codec +I +Q +coef_amp +coef_phi +IQ_Mode +I_Out +Q_out + +Figure 1-1 IQ Compensation Filter + +The IQ compensation filter has two operation modes: the normal mode and the calibration mode. +In normal mode (IQ_Mode = 0), the IQ compensation filter is enabled. In calibration mode +(IQ_Mode = 1), the IQ compensation filter is disabled, allowing the algorithm to evaluate the +amount of IQ imbalance, and calculate the filter coefficients coef_amp and coef_phase +accordingly. + +The default values of coef_amp and coef_phi are 0, which should be the value if I and Q path are +perfect aligned and need to compensation. + +In calibration mode, the value coef_phase has no effect, while coef_amp has an effect to the +output. To complete disable IQ compensation filter, coef_amp should be set to zero, while +IQ_Mode is set to 1. + +CT3258 has internal algorithm to aid the calculation of the IQ compensation filter coefficients. +The user can use the DC_OFFSET read command to see the effect of the calibration. + +The structure of the TX IQ compensation filter and the RX IQ compensation filter are identical. +Both compensation filters are configured with IQCOMP_COEF command. + +The contents of the IQCOMP_COEF command are described in the table below. + +Field +Identifier +Mode +Configure +rx_coef_amp +rx_coef_phi +tx_coef_amp +tx_coef_phi +1 Byte +1 Byte +2 Bytes +2 Bytes +2 Bytes +2 bytes +0x042 +See Table +1-80 for +details +RX +amplitude +coefficient, +16 bit linear +value, MSB +first, in +Q16.14 +RX phase +coefficient, +16 bit linear +value, MSB +first, in +Q16.14 +TX +amplitude +coefficient, +16 bit linear +value, MSB +first, in +Q16.14 +TX phase +coefficient, +16 bit linear +value, MSB +first, in +Q16.14 +Default +2 +0 +0 +0 +0 +Table 1-79 IQCOMP_COEF Field Format +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +55 +Bit Position +Bit Name +Descriptions +7 +Reserved +Reserved +6 +RX_IQ_MODE +RX IQ compensation Filter work mode +0: Enable RX IQ compensation Filter, with coefficients described +in the subsequent field parameters +1: RX IQ compensation Filter in calibration mode (only +rx_coef_amp is effective) +5-3 +Reserved +Reserved +2 +TX_IQ_MODE +TX IQ compensation Filter work mode +0: Enable TX IQ compensation Filter, with coefficients described +in the subsequent field parameters +1: TX IQ compensation Filter in calibration mode (only +tx_coef_amp is effective) +1-0 +Reserved +Reserved +Table 1-80Mode Configure Details + +If Bit 6 (RX_IQ_MODE) is set to 1, the RX phase coefficients in the command do not take effect. +Likewise, the TX phase coefficients in the command does not take effect unless Bit 2 +(TX_IQ_MODE) of the mode byte is 0. + +IQCOMP_COEF command is also used to read the IQ compensation filter coefficients currently +used by CT3258, either calculated by CT3258 or set previously by the MCU. The response packet +to the read command is identical to configuration packet. + +1.2.47 DIGC_DATA_FRAME +This field contains type 1, 2, 3 data, voice and appended data, transparent data and short appended +data. + +Field Identifier +Frame Property +Data Length +Data Bytes +1 Byte +1 Byte +1 Byte +Up to 180 bytes +0x43 +See the following tables for +detail +0-180: Indicate +the length of the +Data +Others: reserved +DATA[0] +DATA[1] +… +DATA[DataLength-1] + +Contain +data, +start +from DATA[0], MSB +first +Default +NA +NA +NA +Table 1-81 DIGC_DATA_FRAME Field Format + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +56 +The frame property field for DPMR and for DMR are different. + +Bit Position +Bit Name +Descriptions +7 +DATA_VALID +Flag to indicate whether current frame has valid data +0: Current frame has no valid data. Far end can discard current +frame +1: Current frame has valid data. +6 +CONT_FLAG +Continuation flag +0: Data Continues after this frame +1: Data finish at this frame +CT3258 does not process this field. It just passes this bit to the far +end MCU. The MCU should not send more DIGC_DATA_FRAME +commands after CONT_FLAG is set to one. +5 +FEC_ERROR +FEC error flag +0: No FEC error in the received frame +1: FEC error in the received frame +4 +Reserved +Reserved +3-0 +Frame Type +Frame types: +0: Type 1 Data, Valid Data Length is 0 to 36 +1: Type 2 Data, Valid Data Length is 0 to 20 +2: Type 3 Data, Not implemented yet +3: Voice and Appended Data, Valid Data Length is 0 to 20 +4: Transparent Data, Valid Data Length is 0 to 48 +5. Short Appended Data, Valid Data Length is 9, 18, 27, 36 +depending on the number of appended data frames. +Others, reserved + +Table 1-82 Frame Property Details in DPMR Mode + +Bit Position +Bit Name +Descriptions +7-5 +Reserved + +4 +Data/Voice Burst +Data or voice burst selection +0: Data Burst +1: Voice Burst +3-0 +Data Type +DMR data type (for data burst only) +0: PI header +1: Voice LC header +2: Terminator with LC +3: CSBK +4: MBC Header +5: MBC Continuation +6: Data Header +7: Rate 1/2 Data +8: Rate 3/4 Data +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +57 +9: Idle +10: Rate 1 Data +11-15: Reserved + +Table 1-83 Frame Property Details in DMR Mode + +At the transmitter, the MCU passes the contents of data burst to CT3258 through this field. +CT3258 adds FEC according to the data type and puts into a TDMA burst. At the receiver, +CT3258 applies FEC decoding to the received data burst and reports the contents to the MCU +using the same field. + +The content and the length of the frame is different according to the data type in +DMR_DATA_FRAME. The details is describe in the below text. + +When Data Type is PI header , Voice LC Header ,Terminator with LC, or the bit 4 is Voice Burst, +the content of the frame is FULL LC PDU(without CRC). The length is 9 bytes. +Table 1-84 FULL LC PDU + +When Data Type is CSBK or MBC Header, the content of the frame is Control Signalling Block +(CSBK) PDU (without CRC ). The length is 10 bytes. + +Information element +Length +Remark +Last Block +1 +This bit shall be set to 1 +Protect Flag +1 + +CSBK Opcode(CSBKO) +6 + +FID +8 +The FID shall be either SFID or MFID +CSBK Data +64 + +NOTE : The data information element is defined by TS 102 361-2[5] +Table 1-85 CSBK PDU + +When Data Type is MBC Continuation, the content of the frame can be MBC Continuation Block +or MBC Last Block.The length is 12 bytes. +Information element +Length +Remark +Last Block +1 + +Information element +Length +Remark + Protect Flag (PF) +1 + +Reserved +1 + +Full Link Control Opcode +(FLCO) +6 + +Feature set ID (FID) +8 +The FID shall be either SFID or MFID +Error Full LC Data +56 +(see note 1) +NOTE 1: The data information element is defined by the feature protocol document TS 102 +361-2 [5]. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +58 +MBC data +95 + +Table 1-86 MBC Continuation Block + +Information element +Length +Remark +Last Block +1 + +MBC Data +79 + +MBC CRC +16 +Filled with 0, calculated by the chip automatically +Table 1-87 MBC Last Block + +When Data Type is DATA_HEADER, the content of the frame is DATA_HEAD_PDU. We +introduce the C_HEAD_PDU only (without CRC, the other HEAD_PDU is in the TS 102 361-1 +Protocol ). The length is 10 bytes. +Information element +Length +Remark +Group or Individual +1 +This bit is set to indicate that the destination LLID is +for a group +Response Requested (A) +1 + +Header +Compression +(HC) +1 + +Pad Octet Count (POC) +1 + +Format +4 +Data packet identification +SAP Identifier +4 + +Pad Octet Count (POC) +4 + +Logical Link ID (LLID) +24 +Destination +Logical Link ID (LLID) +24 +Source +Full +Message +Flag +(FMF) +1 + +Blocks to Follow (BF) +7 + +Re-Synchronize flag (S) +1 + +Send sequence Number +(N(S)) +3 + +Fragment +Sequence +Number (FSN) +4 + +Table 1-88 C_HEADER_PDU + +When +Data +Type +is +Rate +1/2 +Data, +the +contents +of +the +frame +can +be +Confirm_R_1_2_DATA_CONTINU_PDU, +UNConfirm_R_1_2_DATA_CONTINU_PDU, +Confirm_R_1_2_DATA_LAST_PDU or UNConfirm_R_1_2_DATA_LAST_PDU.The length is +12 bytes. See details from table 1-65 to 1-68. + +Information element +Length +Remark +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +59 + Data Block Serial Number +(DBSN) +7 + + C-DATA CRC +9 + Filled with 0, calculated by the chip automatically + User Data +80 + The user data field may contain pad octets +Table 1-89 Confirm_R_1_2_DATA_CONTINU_PDU + +Information element +Length +Remark +User Data +96 +The user data field may contain pad octets +Table 1-90 UNConfirm_R_1_2_DATA_CONTINU_PDU + +Information element +Length +Remark +Data Block Serial +Number (DBSN) +7 + +C-DATA CRC +9 +Filled with 0, calculated by the chip automatically +User Data +48 +The user data field may contain up to 6 pad octets +Message CRC +32 +Filled with 0, calculated by the chip automatically +Table 1-91 Confirm_R_1_2_DATA_LAST_PDU + +Information element +Length +Remark +User Data +64 +(see note) +Message CRC +32 +Filled +with +0, +calculated +by +the +chip +automatically +NOTE:The user data field may contain up to 8 pad octets. +Table 1-92 UNConfirm_R_1_2_DATA_LAST_PDU + +When +Data +Type +is +Rate +3/4 +Data, +the +contents +of +the +frame +can +be +Confirm_R_3_4_DATA_CONTINU_PDU, +UNConfirm_R_3_4_DATA_CONTINU_PDU, +Confirm_R_3_4_DATA_LAST_PDU or UNConfirm_R_3_4_DATA_LAST_PDU.The length is +12 bytes. See details from table 1-69 to 1-72. + +Information element +Length +Remark +Data Block Serial +Number (DBSN) +7 + +C-DATA CRC +9 +Filled with 0, calculated by the chip automatically +User Data +128 +The user data field may contain pad octets +Table 1-93 Confirm_R_3_4_DATA_CONTINU_PDU + +Information element +Length +Remark +User Data +144 +The user data field may contain pad octets +Table 1-94 UNConfirm_R_3_4_DATA_CONTINU_PDU + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +60 +Information element +Length +Remark +Data Block Serial +Number (DBSN) +7 + +C-DATA CRC +9 +Filled with 0, calculated by the chip automatically +User Data +96 +The user data field may contain up to 12 pad octets +Message CRC +32 +Filled with 0, calculated by the chip automatically +Table 1-95 Confirm_R_3_4_DATA_LAST_PDU + +Information element +Length +Remark +User Data +112 +The user data field may contain up to 14 pad octets +Message CRC +32 +Filled with 0, calculated by the chip automatically +Table 1-96 UNConfirm_R_3_4_DATA_LAST_PDU +When Data Type is IDLE, the content of the frame is IDLE_PDU. The length is 12 bytes.See +details in table 1-73. +Information element +Length +Remark +User Data +96 + +Table 1-97 IDLE_PDU + +When +Data +Type +is +Rate +1 +Data, +the +contents +of +the +frame +can +be +Confirm_R_1_DATA_CONTINU_PDU, +UNConfirm_R_1_DATA_CONTINU_PDU, +Confirm_R_1_DATA_LAST_PDU or UNConfirm_R_1_DATA_LAST_PDU.The length is 24 +bytes. See details from table 1-74 to 1-77. + +Information element +Length +Remark +Data Block Serial +Number (DBSN) +7 + +C-DATA CRC +9 +Filled with 0, calculated by the chip automatically +User Data +176 +The user data field may contain pad octets +Table 1-98 Confirm_R_1_DATA__CONTINU_PDU + +Information element +Length +Remark +User Data +192 +The user data field may contain pad octets +Table 1-99 UNConfirm_R_1_DATA__CONTINU_PDU + +Information element +Length +Remark +Data Block Serial +Number (DBSN) +7 + +C-DATA CRC +9 +Filled with 0, calculated by the chip automatically +User Data +144 +The user data field may contain up to 18 pad octets +Message CRC +32 +Filled with 0, calculated by the chip automatically +Table 1-100 Confirm_R_1_DATA__LAST_PDU +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +61 + +Information element +Length +Remark +User Data +160 +(see note) +Message CRC +32 +Filled with 0, calculated by the chip automatically +NOTE:The user data field may contain up to 20 pad octets. +Table 1-101 UNConfirm_R_1_DATA__LAST_PDU +1.2.48 DPMR_PREAMBLE_LENGTH +DPMR standard allows the length of the preamble to be more than the default 72 bits (15 +milliseconds). This command sets the length of additional preambles and length of silence (before +preamble) in increment of 20 milliseconds + +Field Identifier +Preamble Length +Silence Length +1 Byte +1 Bytes +1 Byte +0x046 +Length additional Preambles in 20 +millisecond unit +Silence length before preamble in 20 +millisecond unit +Default +0 +0 +Table 1-102 DPMR_PREAMBLE_LENGTH Field Format +1.2.49 DPMR_CALL_OPTION +This field is used to set the DPMR specific call options + +Field Identifier + DPMR Call Options +1 Byte +5 Bytes +0x47 +Data[0]: +Bit 7: Slot timing flag +0: The message sent to far end can be sent freely +1: The message sent to far end has to be sent at slot +boundary. The first bit of the preamble will be sent 30 +milliseconds from the last bit of the last received +message +Bit 6: SQ detection enable + 0: SQ detection is not done by CT3258 + 1: SQ detection is done by CT3258 +Bit 5: IQ receive enable + 0: CT3258 in IF IQ mode + 1: CT3258 in base band mode +Bit 4: RF control enable + 0: CT3258 does not control RF chip (SCT3700) + 1: CT3258 controls RF chip. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +62 +Bit 3-0: Number of the power saving headers to precede +the next message. Zero to disable power saving headers + +Data[1]: voice delay constant and transmit control +Bit 7: IQ transmit enable +0: CT3258 transmitting in IQ mode +1: CT3258 transmitting in base band mode +Bit 6: Enable Wrong Vocoder report +Bit 5:0: voice delay constant +0-40: voice delay constant in steps of 40 +milliseconds +Data[2]: Report options +Bit 7: 1B 09, 1B 0A report +0: No report of 1B 09 and 1B 0A +1: Report 1B 09 and 1B 0A + Others: reserved +Default +0 + +Table 1-103 DPMR_CALL_OPTION Field Format +Note: In order to send extended power saving headers, DPMR_CALL_OPTION must be called +each time when a communication is to start +1.2.50 DPMR_END_UE +This field contains the 17 bits of unencoded END data. + +Field Identifier + 17 bit of unencoded END +1 Byte +3 Bytes +0x4B +DATA[0]={ET[1:0], ARQ[1:0], TX_WAIT[3:0]} +DATA[1]={STATUS[4:0], 3b000} +DATA[2]=0 +Default +0,0,0 +Table 1-104 DPMR_END_UE Field Format +The details of ET, ARQ, TX_WAIT and status are given in the following tables. + +00 Normal end frame +01 End frame with status message +10 Reserved +11 Reserved +Table 1-105 Details ET Field + +00 No ACK request to called station +01 ACK request to called station +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +63 +10 Reserved +11 Reserved +Table 1-106 ARQ Field Details + +0000 +No specified time +0001 +40 ms (half a frame) +0010 +80 ms (one frame) +0011 +160 ms (two frames) +0100 +320 ms (one superframe) +Other +Other Reserved +Table 1-107 Details of Tx WAIT Field +1.2.51 DIGC_FS1 +This field contains the 48 bits of FS1 data for DPMR. It is also used to generate a fixed 48 bit test +pattern for both DPMR and DMR mode. + +Field Identifier + 48 bit of encoded FS1 +1 Byte +6 Bytes +0x4C +DATA[0]=FS1[47:40] +DATA[1]=FS1[39:32] +… +DATA[5]=FS1[7:0] +Default +0x57,0xff,0x5f,0x75,0xd5,0x77 +Table 1-108 DIGC_FS1 Field Format +1.2.52 DIGC_CALLED_ID_BIN +This field contains the called ID in 24 bit binary form. + +Field Identifier + 24 bit binary called ID +1 Byte +3 Bytes +0x50 +DATA[0]=CALL_ID_BIN[23:16] +DATA[1]= CALL_ID_BIN [15:8] +DATA[2]= CALL_ID_BIN [7:0] +Default +0,0,0 +Table 1-109 DIGC_CALLED_ID_BIN Field Format +1.2.53 DIGC_OWN_ID_BIN +This field contains the own ID in 24 bit binary form. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +64 +Field Identifier + 24 bit binary own ID +1 Byte +3 Bytes +0x51 +DATA[0]=OWN_ID_BIN[23:16] +DATA[1]= OWN_ID_BIN [15:8] +DATA[2]= OWN_ID_BIN [7:0] +Default +0,0,0 +Table 1-110 DIGC_OWN_ID_BIN Field Format +1.2.54 DPMR_CALLED_ID_BCD +This field contains the called ID in 7 BCD codes. +Field Identifier + Called ID in 7 BCD codes +1 Byte +4 Bytes +0x52 +DATA[0]= {K1, K2} +DATA[1]= {K3, K4} +DATA[2]= {K5, K6} +DATA[3]= {K7, 0x4b0000} +Default +0xaa,0xaa,0xaa,0xa0 +Table 1-111 DPMR_CALLED_ID_BCD Field Format + +If the user dials less than 7 digits, the user should use 0x0F to fill the place for un-dialed digits. +Upon receiving the message with less than 7 digits, CT3258 will fill the rest of the digits to +complete 7 digits if layer 3 process mode is enabled. +1.2.55 DPMR_OWN_ID_BCD +This field contains the own ID in 7 BCD codes. +Field Identifier + Own ID in 7 BCD codes +1 Byte +4 Bytes +0x53 +DATA[0]= {K1, K2} +DATA[1]= {K3, K4} +DATA[2]= {K5, K6} +DATA[3]= {K7, 0x4b0000} +Default +0x00,0x00,0x00,0x00 +Table 1-112 DPMR_OWN_ID_BCD Field Format +1.2.56 DPMR_M_V_F_E +This field contains communication mode (M), version (V), and communication format (F) fields. + +Field Identifier + M and F fields +1 Byte +1 Byte +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +65 +0x54 +DATA[0]={M[2:0], V[1:0], F[1:0], EP} +Default +0 +Table 1-113 DPMR_M_V_F Field Format + +The meaning of M, V, F and EP are described in section CALL_START. +1.2.57 DPMR_PROTOCOL_OPTION +This field is used to set the DPMR specific protocol options + +Field Identifier + DPMR Protocol Options +1 Byte +1 Byte +0x55 +Bit 7: Protocol Support + 0: Support TS 102 490 + 1: Support TS 102 490 and TS 102 658 +Bit 6: NDR Support + 0: No Support for NDR + 1: Support for NDR +Bit 5 : TS 102 658 Mode 3 Support + 0: No Support for Mode 3 + 1: Support for Mode 3 +Bit 4: Maintenance Message Report + 0: Repeated Maintenance Message only reported only once. +1: Every reported messages are reported +Bit 3: Reserve (Should set to zero) +Bit 2: Reserve +Bit 1 : All call mapping + 0: Old way of all call mapping: TS 102 658 (V2.1.1 or +earlier) + 1: New way of all call mapping +Bit 0 : 12.5 kHz DPMR support. + 0: 6.25 kHz DPMR + 1: 12.5 kHz DPMR +Default +0 +Table 1-114 DPMR_PROTOCOL_OPTION Field Format +1.2.58 DPMR_SLD +This field contains 18 bits of slow data. + +Field Identifier + M and F fields +1 Byte +4 Bytes +0x56 +DATA[0]=SLD[17:10] +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +66 +DATA[1]=SLD[9:2] +DATA[2]={SLD[1:0], 0x000000} +Default +0x80,0x40,0x00 +Table 1-115 DPMR_SLD Field Format + +The meaning of SLD field is defined in the TS 102 658 or TS 102 490: + +Bit position + Meaning +17 +Continuation Flag 1 +0: User data continuous after the following byte +1: User data is terminated by the following byte +16-9 +User data byte 1 +8 +Continuation Flag 2 +0: User data continuous after the following byte +1: User data is terminated by the following byte +7-0 +User data byte 2 +Table 1-116 Details SLD Field + +Note that SLD filed can also be modified by WORK_MODE command. Upon receiving command +WORK_MODE with the mode set to TX or duplex, the SLD field is reset to default 0x80, 0x40, +0x00. In a typical voice call with slow data, the MCU always send WORK_MODE command +before sending the first DPMR_SLD command. +1.2.59 DPMR_HT_CI_PM +This field contains header type (HT) and call information (CI) fields. + +Field Identifier + HT and CI fields +1 Byte +2 Bytes +0x57 +DATA[0]={HT[3:0], CI[10:7]} +DATA[1]={CI[6:0], PM} +Default +0,0 +Table 1-117 DPMR_HT_CI_PM Field Format + +Details of HT, CI and PM can be found in the following tables. + +HT indicates header type. + +0000 +Communication start header (a superframe follows) +0001 +Connection request header (an END frame follows) +0010 +Unconnect request header (an END frame follows) +0011 +ACK (this a single frame, ACK or NACK is differentiated by the CI bits setting) +0100 +System request header (an END frame follows) or Maintenance Message header +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +67 +0101 +ACK header reply to a system request (a superframe follows) +0110 +System delivery header (a superframe follows) +0111 +Status response header (an END frame follows) +1000 +Status request header +Other +Reserved +Table 1-118 Header Type Details + +PM is the channel preservation flag used for base station to send out channel preservation +messages. When sending a voice call, this bit is used to enable the encryption. + +PM Channel Preservation Flag +0 +Channel is not preserved +1 +Channel is preserved +Table 1-119 Channel Preservation Flag Field Details + +CI contains 3 bits of CI type and 8 bits of CI information. + +CI Type +CI Information +3 bits +8 bits +Table 1-120 CI Format + +The meaning of CI depends on the header types. + +Use +Purpose +Power save +Indicate normal or extended header type +T1 or T2 Data +Indicate the type of data (supplementary service) +T3 Data (Packet) +Indicate data frame size and number of frames +Acknowledgements Indicate ACK or NACK and reason +System request +System response +Delivery Header +CI Type defines the purpose +CI Information is not used and set to 0000 0000 +Table 1-121 CI Usuage + +The details of CI for different header types are described in the following sub-sections, +1.2.59.1 Call Information for Power Save +CI Type (3 bits): +CI Type +Definition +111 +Extended wake-up Header +Other value +Normal Header type +Table 1-122 CI Type for Power Save + +If the extended wake-up Header is used then the last 4 information bits will show how many +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +68 +Headers frames follow the current one (i.e. counting down to zero). + +0000 0000 +Normal Header frame +0000 0001 +-------------- +0000 1111 + +Ext Header frame 1 +------------------------------------------------------- +Ext Header frame 15 + +Other +Reserved +Table 1-123 CI Information for Power Save +1.2.59.2 Call Information for Types 1 and 2 data +Data communications (types 1 and 2): + +CI Type +CI Information +001 +Format +Reserved +4 bits +4 bits +Table 1-124 CI Type for Type 1 and Type 2 Data + +Reserved bits are set to 0000. +Format: +0000 +Status message +0001 +Precoded message +0010 +Free text message (radio generated data) +0011 +Short file transfer +0100 +User defined data 1 +0101 +User defined data 2 +0110 +User defined data 3 +0111 +User defined data 4 +Other Reserved +Table 1-125 CI Information for Type 1 and Type 2 Data +1.2.59.3 Call Information for Type 3 (packet) data +Information bits for Packet data format (Type 3): + +CI Type +CI Information +011 +pdS Frame Size +pdM Data Size +4 bits +4 bits +Table 1-126 CI for Type 3 Data + +Details of pdS (packet data size) and pdM (number of transmitted frames) are details by the tables +below. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +69 +pdS +Frame time (ms) +Data size bits +0 +80 +288 +1 +160 +672 +2 +240 +1056 +3 +320 +1440 +Other Reserved +Reserved +Table 1-127 Packet Data Frame Sizes (pdS) + +pdM +Number of Data frames +0 +1 frame +1 +2 frames +2 +3 frames +3 +4 frames +4 +5 frames +5 +6 frames +6 +7 frames +7 +8 frames +Other +Reserved +Table 1-128 Number of Transmitted Frames (pdM) +1.2.59.4 Call Information for System Transactions +System request/answer/delivery header: + +CI Type Definition +000 Reserved +001 Dynamic group request/answer/delivery +010 Reserved +011 Reserved +100 ESN request/reply +101 MFID request/reply +110 Contact station address(via Interconnect, IP) +111 Reserved +Table 1-129 CI Type for System Transactions + +CI Info +Definition +0000 0000 All bits set to zero (the data size is +indicated in the CCH SLD field) +Table 1-130 CI Information for System Transactions +1.2.59.5 Call Information for Acknowledgments +Acknowledgment: +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +70 +CI Type Definition +000 +Reserved +001 +ACK (Rx OK) +010 +NACK (data error, resend request) +011 +NACK (request denied) +Other +Reserved +Table 1-131 CI Type for Acknowledgements + +CI Info +Definition +0 + +1 to 255 ACK/NACK status (rejection reason defined by user) +Table 1-132 CI Information for Acknowledgements +1.2.59.6 Call Information for appended data +CI type: + +CI +Type Definition +Meaning +000 +Short Data +Service Requested is Short Data +011 +Call Diversion +Call Diversion Service +Table 1-133 CI type for Appended data + +Short data CI Info: + +CI Info +length +Meaning +UAD(0 - 3) +[7:6],2 bits +Appended Short Data Number of appended UDTs +required to transport short data +SYMB +[5:0],6 bits +Number of symbols in the short data , +Table 1-134 CI Information for Short data + +Call Diversion CI Info: + +CI Info +Length +Meaning +UAD(00) [7:6],2 bits +Number of Appended Data = 1 +SYMB +[5:0],6 bits +N/A for call diversion +Table 1-135 CI Information for Call Diversion +1.2.59.7 Call Information for Maintenance Message +CI type +Type Definition +CI Info +000 +IDLE Message +N/A +001 +Guard Message +See table below + +Preservation message +See note +Table 1-136 Call Information for Maintenance Message +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +71 +CI Info +length +Meaning +Reserved +[7:4],4bits +Reserved +Guard Kind +[3:0],4 bits +0000 +Reserved +0001 +DIS_PTT +Disable Target MS or +Talkgroup PTT +0010 +EN_PTT +Enable Target MS or +Talkgroup PTT + + +0011 + +ILLEGALLY +PARKED +Clear down from the +payload channel MS +whose address does not +match,Source or Target +Address +0100 to 1111 +Reserved +Table 1-137 Call Information for Guard Message + +Note: Preservation message is not identified by CI. It is identified with PM as 1. In preservation +message, CI keeps value of previous traffic channel down link messages, along with CALLED ID, +OWN ID, M, V, F, and EP fields. +1.2.60 DPMR_CI +This field contains 11 bits call information. It is used for reporting CI information by CT3258 to +the MCU upon receiving an extended header. + +Field Identifier + CI field +1 Byte +2 Byte +0x5A +DATA[0]={CI[10:3]} +DATA[1]={CI[2:0], 0x5b00000} +Default +0,0 +Table 1-138 DPMR_CI Field Format +1.2.61 DPMR_CC +This field contains the 24 bits of CC data for the transmitter and the receiver. + +Field Identifier + 24 bit of encoded CC +1 Byte +3 Bytes +0x5C +DATA[0]=CC[23:16] +DATA[1]=CC[15:8] +DATA[2]=CC[7:0] +Default +0x57, 0x75,0x77 +Table 1-139 DPMR_CC Field Format +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +72 +1.2.62 DPMR_SEND_SF +Send super frame command. Upon receiving this command, CT3258 assemble a super frame and +send to the far end. + +Field Identifier +1 Byte +0x5F +Table 1-140 DPMR_SEND_SF Field Format +1.2.63 DPMR_SEND_HEADER +Send header frame command. Upon receiving this command, CT3258 assemble a header frame +and send to the far end. + +Field Identifier +1 Byte +0x60 +Table 1-141 DPMR_SEND_HEADER Field Format +1.2.64 DPMR_SEND_END +Send end frame command. Upon receiving this command, CT3258 assemble an end frame and +send to the far end. + +Field Identifier +1 Byte +0x61 +Table 1-142 DPMR_SEND_END Field Format +1.2.65 DPMR_SEND_AD +Send DPMR_SEND_AD command. Upon receiving this command,CT3258 assemble a series of +appended data frmae，include HEADER FRAME ,APPENDED DATA FRAME (according as +appended data number),END FRAME. + +Field Identifier +Call Details +1 Byte +1 Byte +0x62 +DATA[0]={M[2:0], V[1:0], F[1:0], EP} +Call Mode, Version, Call Format, +Emergency Priority +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +73 +Default +0 +Table 1-143 DPMR_SEND_AD Field Format + +DPMR_SEND_AD can only be used in TS 102 658 PROTOCOL. + +The meaning of M, V, F and EP fields are described in the section CALL_START. + +Note: Please set the content of appended data frame with DIGC_DATA_FRAME command before +sending appended data frame with this command. +1.2.66 DIGI_MIC_GAIN +This message set the modulation gain for the microphone used in the digital mode only. + +Table 1-144 DIGI_MIC_GAIN Field Format +1.2.67 DIGI_SPEAKER_GAIN +This message set the modulation gain for the speaker used in the digital mode only. + +Table 1-145 DIGI_SPEAKER_GAIN Field Format +1.2.68 I2C_OPERATION +This command is used to read and write raw I2C command to the I2C devices that are connected +to CT3258. Examples of the connected devices include codec, security keys and RF transceiver. + +This command differs from the codec bypass packet described in 1.1.3 in that codec bypass packet +can only be used for certain codecs, while I2C_OPERATION can be used for any connected I2C +devices. + + +Field Identifier +Event +1 Byte +2 Byte +0x068 +Linear gain applied to the microphone in Q16.11 (16 bits total, 11 bits fraction, +MSB first), with 2048 as 0 dB. This gain is used in digital mode only + +Field Identifier +Event +1 Byte +2 Byte +0x069 +Linear gain applied to the speaker in Q16.11 (16 bits total, 11 bits fraction, +MSB first), with 2048 as 0 dB. This gain is used in digital mode only +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +74 +Table 1-146 I2C_OPERATION Write Field Format + +To read from I2C device, the user should set TYPE field to 0x20, and the I2C_OPERATION +syntax is as follows: + +Field Identifier +I2C device Address +Device register address +I2C Data Length +1 Byte +1 Byte +1 Byte +1 Byte +0x06A +I2C device address +Device register address +Number of Bytes to +Read +Default +0 +0 +0 +Table 1-147 I2C_OPERATION Read Field Format + +The response packet returns the I2C data + +Field Identifier +Data read from I2C +1 Byte +I2C Data Length +0x6A +Data[0] +Data[1] +… +Data[I2C Data Length-1] +Default +0 +Table 1-148 I2C_OPERATION Read Response Field Format +1.2.69 MISC_GAIN +This command set the various gain levels, including the input and output gain for IQ signal, and +CTCSS/DCS receive gains, and frequency of the signal used for calibration, and DC filter settings. + +Field +Identifier +IQ TX Gain +IQ RX Gain +CTCSS/DCS +Receive +Gain +Calibration +Signal +Frequency +DC Filter +Configuration +Reserved +1 Byte +2 Bytes +2 Bytes +2 Bytes +2 Bytes +1 Byte +3 Bytes +0x06B +16 bit linear +16 bit linear +16 bit linear +16 bit linear +See table + +Field +Identifier + I2C +device +Address +Device register +address +I2C Data Length +I2C data +1 Byte +1 Byte +1 Byte +1 Byte +I2C Data Length +0x06A +I2C +device +address +Device +register +address +Number of Bytes to +Write. +Data[0] +Data[1] +… +Data[I2C Data Length] +Default +0 +0 +0 +N/A +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +75 +gain, MSB +first, in +Q16.11 +gain, MSB +first, in +Q16.11 +gain, MSB +first, in +Q16.11 +gain, MSB +first, in +Q16.11 +below for +detail. +Default +2048 +2048 +2048 +2048 +0 + +Table 1-149 MISC_GAINS Field Format + +Bit Position +Bit Name +Descriptions +7-2 +Reserved + +1 +DC Filter enable +0: DC filter is disabled +1: DC filter is enabled. +0 +Manual DC +Mode +0: Auto DC Mode, DC filter is +enabled at low input level and +disabled at high input level for digital +calls, and always enabled for analog +call. +1: Manual DC Mode. See bit 1 for +details. +Table 1-150 DC Configuration Detail + + +The IQ RX gain is applied to the input IQ signals (when IQ receive is enabled) after it is received +by CT3258. The IQ TX gain is applied to the output IQ signals (when IQ transmit is enabled) +before it is sent to the codec. + +The CTCSS/DCS receive gain is used in analog mode, and is applied to the CTCSS/DCS signals +after the 300 HF LPF. It is used to adjust the level of DCS subaudio signals without affecting the +level of audio signals. + +The calibration signals are I / Q sinusoidal signals generated by CT3258 TX path, which can be +looped back by SCT3700 to CT3258 RX for I Q calibration. The frequency of the signals can be +programmable with this command. A default value of 2048 corresponds to a frequency of 350 Hz. + +1.2.70 SQ_LEVEL +This command is used for calibration of SQ detection. It is also used to read the RSSI and OOBE +levels. + + +Field +Identifi +er +GAIN_ +ADJUS +T +EXT +LNA_ +GAINL +Forced +RF +Gain +OOBE_ +INTV +OOBE +_HI_D +OOBE +_LO_D +OOBE +_HI_A +OOBE +_LO_A +1 Byte +1 Byte +1Byte +1 Byte +1 Byte +2 Bytes +2 Bytes +2 Bytes +2 Bytes +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +76 +0x06C +Gain +Adjust +ment, +from +-128 dB +to +127 +dB +Externa +l LNA +value. +Refer to +table +below. +Forced +RF +Gain +Setting. +See +table +below +for +Details +OOBE +detectio +n +interval +in units +of +1.333 +ms. +Digital +OOBE +high +thresh +old, +16 bit +linear +value +Digital +OOBE +low +thresh +old, +16 bit +linear +value +Analog +OOBE +high +thresh +old, +16 bit +linear +value +Analog +OOBE +low +thresh +old, +16 bit +linear +value +Default +0 +0 +0 +90 +0x4000 +0x0400 +0x4000 +0x0400 +Table 1-151 SQ_LEVEL Field Format + +Bit Position +Bit Name +Descriptions +7 +Forced +RF +Gain +Enabled +0: Forced RF Gain Disable. RF gain controlled by AGC +algorithm +1: Forced RF Gain Enabled. RF gain are setting by bit 6-0. +6-0 +Gain Details +RF Gain Details: It is different for RDA1847 or SCT3700 +For RDA1847, +0-15, Gain Index +Others, reserved + +For SCT3700 +Bit 6-4: LNA gain setting + 001: highest gain + 010: highest gain -6 dB + 011: highest gain -12 dB + 100: highest gain -24 dB + 101: highest gain -36 dB + 110: highest gain -48 dB + Others: reserved + +Bit 3-0: PGA settings: + 0000: lowest gain + 0001-1100, 2-24 dB, 2 dB a step + Others, reserved +Table 1-152 Force RF Gain Details + +Bit Position +Bit Name +Descriptions +7:0 +External +LNA +gain +Setting +Only For SCT3700 +Bit 7:6: Reduction of AGC target level. +00: Maximum AGC target level used +01: Maximum AGC target level – 6 dB +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +77 +10: Maximum AGC target level – 12 dB +11: Maximum AGC target level – 18 dB + +Bit 5:0: External LNA gain in db if it is used. +If the external LNA is not used, the value is always zero. If +the external LNA is used, it is the difference of external +gain value when external LNA is enabled and when it is +disabled. Please refer to Chapter 2.6 for its usage. + +Table 1-153 External LNA setting Details + +GAIN ADJUST is used to account for all unspecified gains in the analog path. It may be different +with different analog implementations. It may be even different from radio to radio. The RSSI is +correct only if the value is set correctly. If external LNA is used, it need to be disabled when +calibrating GAIN_ADJUST. + +If external LNA is not used, “EXT LNA GAIN” should be assigned to its default value of zero. + +If external LNA is used, the user should set EXT LNA GAIN appropriately to reflect the +characteristic of the external LNA. It involves two part. Bit 5-0 is used to set the value of LNA +gain in dB. It reflect the receive gain increase when the external LNA is enabled from when it is +disabled. Also, if the external LNA is used, the user should lower the maximum SCT3700 AGC +gain to avoid saturating the RX signals. The amount of maximum AGC target level decrease are +set by bit 7-6 of “EXT LNA GAIN” fields. The following is a guide line: + +00: if the external LNA gain is less than 6 dB. +01: if the external LNA gain range in 6-12db +10: if the external LNA gain range in 12-18db +11: if the external LNA gain range in 18-24db + +OOBE indicates the energy of FM demodulated signals at frequency band above 3 kHz. OOBE +value is small when RF carrier signal exists, and large when no carrier signals present. It is a good +indication for SQ (or carrier) detection. Typically, when carrier signals present, OOBE level is +below 8. + +OOBE level has a high threshold and a low threshold for SQ detection, with the high threshold +larger than the low threshold. To detect the presence of carrier, the OOBE level is compared with +the low threshold. Carrier detection is reported if the OOBE level is above the low threshold. Once +carrier is found, the OOBE level is compared with the high threshold. If the OOBE level is lower +than the high threshold, carrier lost is reported. + +The OOBE levels for analog and digital calls are different. As a result, CT3258 has two sets of +high and low OOBE threshold for digital and analog separately. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +78 +SQ_LEVEL command is also used to read narrow, wide band RSSI and OOBE levels. The +response packet has the following format. + +Field Identifier +NB_RSSI +WB_RSSI +OOBE Level +Inband Level +1 Byte +1 Byte +1 Byte +2 Byte +2 Byte +0x06C +Narrow band +RSSI + 137 +Wide band RSSI + +137 +OOBE level +Inband signal +energy level +Default + + + + + +There are two RSSI estimators in the CT3258. One of them is narrow band RSSI, used to estimate +the energy of signals in the channel of interests. The other is wide band RSSI, used to estimate the +energy of the signal in the channel of interests and surrounding channels. All RSSI values in this +command are of dB scale. + +All RSSI values are expressed as unsigned 8 bit integer. The real RSSI is this value minus 137. +For example, for WB_RSSI value of 17, the real wide band RSSI is 17 – 137 = -120 dBm. +1.2.71 SPI_OPERATION +This command is used to write raw SPI command to the SPI devices that are connected to CT3258. +Examples of the connected devices include SCT3700. + +Field Identifier + SPI Register Address +SPI register Contents +1 Byte +1 Byte +1 Byte +0x06D + SPI Register Address +SPI register Contents +Default +0 +0 +Table 1-154 SPI_OPERATION Write Field Format + +The SPI register table for SCT3700 can be found in SCT3700 data sheet. + +1.2.72 DMR_SLC +This command is used to report the short LC data from the base station. + +Field Identifier +Offset +1 Byte +4 Bytes +0x06E +Contains 28 bit of SLC data +Default +0 +Table 1-155 DMR_SLC Field Format +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +79 +1.2.73 DMR_CALL_SLOT +This field is used to set the slot number for the transmitting or receiving calls. +DMR_CALL_ +SLOT +Call +Timing +Update +Direct TDMA +Rev +Slot mode +1 BYTE +BIT[7] +BIT[6] +BIT[3] +BIT[4] +BIT[3:0] +0x6F +0:Receive Call +1:Transmit Call +0: +keep +current +TX timng +1: Update +TX timing +according +RX timing +0: Direct TDMA +Mode disabled +1: Direct TDMA +mode enabled +Reserved +0:random +1:slot1 +2:slot2 +3:both(only Rx) + +Table 1-156 DMR_CALL_SLOT Field Format + +Note that the slot number is in terms of mobile station slot number, or downlink slot number. +1.2.74 EQULIZER_FILTER +This command configures the coefficients for the audio equalizer filters. A total of up to three +equalizer filters can be enabled. Each filter is a second order IIR filter implemented in straight +form. The transfer function of the filters are shown in the following equation: + +H(z) = (b0 + b1 * z^(-1) + b2*z^(-2)) / (1 + a1 * z^(-1) + a2 * z^(-2)) +The sampling rate of the filter is 24 kHz. + +This command gives the filter coefficients. All coefficients are in Q16.14 format (16 bit total, with +14 bit fraction), with MSB first + +By default, no equalizer filter is enabled. + +Field Identifier Filter Selection Byte +a1 +a2 +b0 +b1 +b2 +1 Byte +1 Byte +2 Bytes +2 Bytes +2 Bytes +2 Bytes 2 Bytes +0x70 +Bit 7-6: reserved +Bit 5: TX or RX selection +0: Filter at RX side +1: Filter at TX side +Bit 4: Enable flag + 1: Selected filter enabled + 0: Selected filter not enabled +Bit 3-0: Filter selection +a1 in +Q16.14 +MSB +first +a2 in +Q16.14 +MSB +First +b0 in +Q16.14 +MSB +First +b1 in +Q16.14 +MSB +first +b2 in +Q16.14 +MSB +First +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +80 + 1: Filter 1 selected + 2: Filter 2 selected + 3: Filter 3 selected + Others: reserved +Default +0 +- +- +- +- +- +Table 1-157 EQUALIZER FILTER Field Format +1.2.75 DMR_FLC +This message set the information for the FLC in a DMR control packet. + +Field Identifier +FLC +1 Byte +3 Byte +0x076 +Data[0] = {PF, REV, FLCO[5:0]} +Data[1] = {FID[7:0]} +Data[2] = {SeversOption[7:0]} + +Table 1-158 DMR_FLC Field Format + +Details of the elements are defined in the DMR standard (TS 102 361) + +PF field is defined by： + +PF +Protect Flag +0 +Reserved +Table 1-159 PF Settings + +FLCO field is defined by: + +FLCO +Full Link Control Opcode +000000 +Group Voice Call（Grp_V_Ch_Usr） +000011 +Unit to Unit Voice Call（UU_V_Ch_Usr） +Table 1-160 FLCO Settings + +FID field is defined by: + +FID +Feature set ID +0000 0000 +Standardized feature set ID for the services +0000 0001 +Reserved for future standardization +0000 0010 +Reserved for future standardization +0000 0011 +Reserved for future standardization +0000 0100 +Manufacture’s specific feature set ID(MFID) +Etc. +Etc +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +81 +0111 1111 +Manufacture’s specific feature set ID(MFID) +1xxx xxxx +Reserved for future MFID’s allocation(MFID) +Table 1-161 FID Settings + +Service Option field is defined by: +Service option element +Bit position +Value remark +Emergency +Bit[7] +0:Non-Emergency service +1:Emergency service +Privacy +Bit[6] +0:privacy is not defined +Reserved +Bit[5:4] +00:Reserved for future +Broadcast +Bit[3] +0:Non-broadcast service +Open voice call mode(OVCM) +Bit[2] +0:Non_OVCM call +1:OVCM call +Priority level +Bit[1:0] +00: NO Priority +01: Priority 1 +10: Priority 2 +11: Priority 3 +Note: Priority 3 is the highest Priority +Table 1-162 Service Option Settings +1.2.76 DMR_CC +This message set the color code index for DMR calls + +Field Identifier +CC +1 Byte +1 Byte +0x077 +0: CC0 is used +1: CC1 is used +… +15: CC15 is used + +Table 1-163 DMR_CC Field Format +1.2.77 DMR_CALL_START +This command is used to start a call. Upon receiving this command, CT3258 begins to send call to +the far end. + +Field Identifier +1 Byte +0x078 +Table 1-164 DMR_CALL_START Field Format +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +82 +1.2.78 DMR_CALL_OPTION +This field is used to set the DMR specific call options + +Field Identifier + DMR Call Options +1 Byte +5 Bytes +0x79 +Data[0]: +Bit 7: unused slot fill pattern +0: unused slot filled with 0 +1: unused slot filled with random bits. +Bit 6: SQ detection enable + 0: SQ detection is not done by CT3258 + 1: SQ detection is done by CT3258 +Bit 5: IQ receive enable + 1: CT3258 in IF IQ mode + 0: CT3258 in base band mode +Bit 4: RF control enable + 0: CT3258 does not control RF chip (SCT3700 or +RDA 1847) + 1: CT3258 controls RF chip. +Bit 3: RF slot timing control (SCT3700 Only) + 0: No control of SCT3700 TX signal during +transmission + 1: Turn on and off SCT3700 TX signal aligned with +the base band slot timing. +Bit 2: RF_TIMING RX mode enable +0: RF_TIMING port outputs slot timing information in +TX mode only +1: RF_TIMING port outputs slot timing information in +TX mode and RX mode +Bit 1-0: Traffic mode + 0: DMR continuous transmission mode + 1: DMR direct mode with no reverse channel + 2: DMR direct mode with reverse channel + +Data[1]: voice delay constant and IQ transmit mode +Bit 7: IQ transmit enable +1: CT3258 transmitting in IQ mode +0: CT3258 transmitting in base band mode +Bit 6: Reserved +Bit 5:0: voice delay constant +0-40: voice delay constant in steps of 40 milliseconds + Others: reserved +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +83 + +Data[2]: +Bit 7-4: Number of good CACH received before +reporting DMR_SLOT_FOUND with the slot verified +flag set. +Bit 3-0: Number of repeated LC header + +Data[3]: +Bit 7-6: Reserved +Bit 5-0: Bit mask for reporting repeated identical +messages. + Bit 4: 0, report identical SLC once + 1, report every SLC + Bit 3: 0: Report identical IDLE data frames once + 1: Report all IDLE data frames + Bit 2: 0: Report identical CSBK data frames once + 1: Report all CSBK data frames + Bit 1: 0: Report identical LC headers once + 1: Report all LC headers +Bit 0: 0: Report identical LC terminators once + 1: Report all LC terminators +Data[4]: Reserved + +Default +0 + +Table 1-165 DMR_CALL_OPTION Field Format +1.2.79 DMR_OFFSET +This command set the timing offset of the RF_TIMING signal to the internal slot timing signal, +which is aligned with base station timing. With default parameters, the RF_TIMING signal is +identical to the internal slot timing signal, which has a 60 millisecond period and 50% duty cycle, +with the rising edge aligned with the end of a BS slot. With DMR_OFFSET command, the +RF_TIMING signal can be ahead or lag of the internal slot timing signals. + +Field Identifier +Offset +Length +1 Byte +2 Bytes +2 Bytes +0x07A +16 bit signed integer, +MSB first. The unit is +41.7 microseconds. +The range is -720 to +720, or -30 +milliseconds to +30 +16 bit unsigned +integer, MSB first. +The unit is 41.7 +microseconds. The +range is 240 to +1200, or 10 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +84 +milliseconds +milliseconds to 50 +milliseconds +Default +0 +720 +Table 1-166 DMR_OFFSET Field Format + +1.2.80 DMR_SLOT_TYPE +This field is used report the slot type when a call is received. +Slot Type +Colour Code +Data Type +1 BYTE +BIT[7:4] +BIT[3:0] +0x7B +Value:0-15 +0000:PI header +0001:Voice LC header +0010:Terminatior with LC +0011:CSBK +0100:MBC header +0101:MBC continuation +0110:data header +0111:rate 1/2 data +1000:rate 3/4 data +1001:idle +1010:Rate1 Data +Others:Reserved for future use +Table 1-167 DMR_SLOT_TYPE Field Format + +1.2.81 DMR_EMB +This field is used report the EMB field when a call is received. + +DMR_EMB +Colour Code +PI +LCSS +Rev +1 BYTE +BIT[7:4] +BIT[3] +BIT[2:1] +BIT[0] +0x7C +Value:0-15 +Reserved +00:Single fragment LC or first fragment +CSBK signalling +01:First fragment of LC signalling +10:Last fragment of LC or CSBK +signaling +11:Continuation fragment of LC or +CSBK +Reserved +Table 1-168 DMR_EMB Field Format +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +85 +1.2.82 DMR_CALLED_ID_BCD +This field contains the called ID in 8 BCD codes. + +Field Identifier + Called ID in 7 BCD codes +1 Byte +4 Bytes +0x7D +DATA[0]= {K1, K2} +DATA[1]= {K3, K4} +DATA[2]= {K5, K6} +DATA[3]= {K7, K8} +Default +0xaa,0xaa,0xaa,0xaa +Table 1-169 DMR_CALLED_ID_BCD Field Format + +K1 should be either 0 or 1. An 8 digit BCD should not exceed “16777016”. If the user wishes to +dial a 7 digit BCD number “1234567”, he/she should fill the K1-K8 as “01234567”. +1.2.83 DMR_OWN_ID_BCD +This field contains the own ID in 8 BCD codes. + +Field Identifier + Own ID in 7 BCD codes +1 Byte +4 Bytes +0x7E +DATA[0]= {K1, K2} +DATA[1]= {K3, K4} +DATA[2]= {K5, K6} +DATA[3]= {K7, K8} +Default +0x00,0x00,0x00,0x00 +Table 1-170 DMR_OWN_ID_BCD Field Format + +1.2.84 DMR_SLOT_FOUND +This field is used by CT3258 to inform the MCU that synchronization with the far end BS or MS +is achieved and CACH is decoded. + +DMR_SLOT FOUND +Slot Found Details +1 BYTE +1 Byte +0x7F +Details in the table below +Table 1-171 DMR_SLOT_FOUND Field Format + +Bit Position +Bit Name +Bit Descriptions +7 +Sync Type +MS Sync or BS Sync +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +86 +0: MS Sync +1: BS Sync +6 +Slot Verify +Slot verify flag +0: Slot not verified +1: Slot Verified +5 +Slot invert +Slot invert flag +0: slot not inverted from last report +1: slot inverted from last report +4 +Reserved +Reversed +3 +AT +Access Type +0:inbound channel is idle +1:inbound channel is busy +note:in continuous transmission mode, for +both voice and data,the AT bit is set to 1; +2 +TC +TDMA Channel selection +0:Following outbound burst is channel 1 +1:Following outbound burst is channel 2 +1:0 +LCSS/TD +MA SLOT +When BS SYNC is found (bit 7 = 1), +These two bits indicate LCSS +00:Single fragment LC or first fragment +CSBK signalling see note +01:First fragment of LC signalling +10:Last fragment of LC or CSBK signaling +11:Continuation fragment of LC or CSBK +Signaling +When MS SYNC is found (bit 7 = 0), this two +bit indicates the types of MS SYNC found +0: no TDMA direct SYNC +1: TDMA SYNC 1 found +2: TDMA SYNC 2 found +Table 1-172 Slot Found Details + +This field is used only by CT3258 to report the CACH information when BS SYNC is found, or +types of MS SYNC if MS SYNC is found. Identical CACH are not reported to reduce the traffic +between CT3258 and the MCU (after CACH is verified). A CACH verify scheme is used in +reporting DMR_SLOT_FOUND. Bit 7-4 of Byte 2 of DMR_CALL_OPTION command +specifies the number of good CACH received before reporting DMR_SLOT_FOUND with the +slot verified flag set. Before the number of good CACH has reached the specified limit, CT3258 +reports every CACH that is found, without setting the slot verified flag. When the specified limit +is reached, CT3258 reports the last CACH with the slot verified flag set. If the slot number of the +last reported CACH matches the previously reported CACH, it indicates that no slot inversion is +needed. If the slot number of the last reported CACH does not match the previously reported +CACH, it indicates that slot inversion is needed. In this case, the user should treat all previous +report CACH as if the slot number is inverted (1 as 2, and 2 as 1). +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +87 + +2 Application Guides +2.1 Code Downloading +After CT3258 reset, it first down loads a boot loader from the MCU through the HPI and then +execute the boot loader. The boot loader then loads the rest of the application from the embedded +flash and start execution. +2.1.1 Boot loader Downloading +The boot loader is a program with fixed 1024 words. It is downloaded to CT3258 after CT3258 +reset. + +After the initial reset, CT3258 enters into boot loading mode. In boot loading mode, CT3258 is +automatically configured after reset to load a 1024-word block of instructions from the HPI port. +CT3258 then begins executing that instruction block immediately. + + +The HPI port is configured as 16-bit mode, low-byte first, and either Intel mode or Motorola mode. +PIO1 is sampled and used to select either Intel (LOW input) or Motorola (HIGH input). + +The host must download exact 1024 words for this boot process to work. + +Note that the boot loader for DPMR mode and DMR mode is different. Depending on the boot +loader types, CT3258 enters DPMR mode or DMR mode. In DPMR mode, commands for DMR +only (type 5) are not recognized. In DMR mode, command for DPMR only (type 3) are not +recognized. +2.1.2 Application Downloading +After the boot loader is downloaded to CT3258 and executed, CT3258 reads the application +firmware in the embedded flash and start execution. +2.2 DPMR Call Processing +CT3258 support two ways of processing digital calls: Easy Mode (layer 3), DPMR Layer 2 Mode +(layer 2). +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +88 +2.2.1 Easy Mode +The Easy Mode is for users who don’t have the in-depth understanding the DPMR protocol. MCU +uses simple CALL_START, CALL_STOP, CONNECT, DISCONNECT messages to start, stop a +voice calls, or initiate or disconnect a data calls. Internally, CT3258 handles all call processing +according the DPMR Protocol . + +With Easy Mode, in addition to layer two processing, the CT3258 also performs call control of the +DPMR processing. “ANNEX A” Standard User Interface for CSF radio are implemented in +CT3258. At the transmitter, CT3258 supports wild character dialing, abbreviated dialing and +masked dialing. At the receiver, when a call is received, CT3258 matches incoming called number +with its own individual call number and group number and informs the MCU of matching results. + +With Easy Mode, CT3258 strictly complies with the DPMR protocol (ETSI TS 102 490 or 658). +The ability to change any aspect of the protocol is disabled. + +The process mode can be set or changed with PROCESS_MODE command. For Easy Mode, +Mode 3 is selected with PROCESS_MODE command. +2.2.1.1 Transmitting +In Easy Mode, the MCU passes called ID and own ID to CT3258. CT3258 saves this information +in the internal registers. Upon receiving a CALL_START packet, it formatted the information +according to the DPMR protocol and send to the far end. + +For example, a voice can be started with the following packet. + +Packet Header +START_BYTES +LENGTH +TYPE +Fields +DPMR_CALLED_ID +DPMR_OWN_ID +CALL_START +Parity +FBYTE +PARITY_BYTE +Table 2-1 Example Packet For Starting a Voice Call in Easy Mode + +If a field has been sent from the MCU to CT3258 before, and does not change in the next packet, +this field can be omitted from the packet. For example, to redial a previous dial number, the MCU +only needs to send the following packet to CT3258 + + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +89 +Packet Header +START_BYTES +LENGTH +TYPE +Fields +CALL_START +Parity +FBYTE +PARITY_BYTE +Table 2-2 Example of Redial Packet + +The call can be ended with a packet with CALL_STOP field. + +Packet Header +START_BYTES +LENGTH +TYPE +Fields +CALL_STOP +Parity +FBYTE +PARITY_BYTE +Table 2-3 Example of Call Stop Packet +2.2.1.2 Receiving +Upon receiving a call from the far end, CT3258 extracts useful information according to the +DPMR protocol and reports to the MCU. + +The example below shows the packet sent to the MCU after receiving a new header frame. + +Packet Header +START_BYTES +LENGTH +TYPE +Fields +CALL_HT_CI +DPMR_CALLED_ID +DPMR_OWN_ID +DPMR_M_V_F_E +DPMR_CC +CALL_MATCH +Parity +FBYTE +PARITY_BYTE +Table 2-4 Example of Packet from DSP after Receiving a Call + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +90 +The type of FIELD to report can be changed with REPORT_FIELD command. + +The fields can be sent in one packet or in multiple packets. + +2.2.2 DPMR Layer 2 Mode +With DPMR Layer 2 Mode, CT3258 support DPMR up to layer 2 the does not handle the call +processing layer of the DPMR protocol. All call processing supports are provided by external +MCU. In this case, CT3258 just performs the tasks of transporting DPMR related messages +between the MCU’s of the two terminals. As a result, the following process will be performed by +the MCU: + +Air Interface Call Control Layer (Layer 3) + +1. Establishing, maintaining and termination of calls +2. Individual or group call transmission and receptions +3. Destination addressing +4. Automatic matching of Called ID of incoming call to own ID and group ID + +As comparison, these processes are completed by CT3258 with Easy Mode. + +With DPMR Layer 2 Mode, the MCU can access primitive elements of the DPMR architecture. +For example, to start a call, the MCU send individual elements in the protocol to CT3258, with +DPMR_SEND_HEADER and DPMR_SEND_SF, whereas in easy mode, the user sends a simple +CALL_START to CT3258. + +With easy mode, the user also has the ability to change synchronization pattern with DPMR_FS1, +DPMR_FS2, DPMR_FS3 and DPMR_FS4. +2.2.2.1 Transmitting + +In DPMR Layer 2 Mode, the MCU pass un-encoded HT, END and CCH frames, or individual +information elements such as Called_ID or Own_ID to CT3258. CT3258 saves this information in +the internal registers. Upon receiving a DPMR Packet with DPMR_SEND_HEADER, +DPMR_SEND_END or DPMR_SEND_SF, the MCU performs channel coding and interleaving, +forms the complete HI, END and Super Frame structure, and send to the far end. + +For example, upon receiving the DPMR Packet below, CT3258 builds a CCH0 to CCH3 structure. + + + + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +91 +Packet Header +START_BYTES +LENGTH +TYPE +Fields +DPMR_CCH_UE (0) +DPMR_CCH_UE (1) +DPMR_CCH_UE (2) +DPMR_CCH_UE (3) +Parity +FBYTE +PARITY_BYTE +Table 2-5 Example 1 of a Packet from MCU in DPMR Layer 2 Mode + + +Then if the MCU send a packet with DPMR_SEND_SF, it forms a super frame with the saved +information, and sends it to the far end. + +Similarly the host message to build a HI frame and END frame can be like the one below: + +Packet Header +START_BYTES +LENGTH +TYPE +Fields +DPMR_HI_UE +Parity +FBYTE +PARITY_BYTE +Table 2-6 Example of a HI Packet from MCU + +Packet Header +START_BYTES +LENGTH +TYPE +Fields +DPMR_END_UE +Parity +FBYTE +PARITY_BYTE +Table 2-7 Example of END Packet from MCU +2.2.2.2 Receiving +Upon receiving a Super Frame, Header Frame or an End Frame, CT3258 extracts the CCH0 – +CCH3, HI or END fields, performs de-interleaving and channel decoding on the frames. CT3258 +extracts individual elements to the MCU. + +The example below shows the packet sent to the MCU after receiving a new header frame. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +92 +Packet Header +START_BYTES +LENGTH +TYPE +Fields +DPMR_CALLED_ID +DPMR_OWN_ID +DPMR_M_F +DPMR_HT_CI_PM +Parity +FBYTE +PARITY_BYTE +Table 2-8 Example of Packet from DSP after Receiving a Header Frame +2.3 DMR Call Processing +CT3258 support two ways of processing digital calls: Easy Mode (Layer 3 Mode), DMR Layer 2 +Mode. + +In Easy Mode (Layer 3 Mode), CT3258 digital mode support layer 1-3 processing of the DMR +protocol complied with ETSI TS 102 361. The MCU uses simple DMR_CALL_START, +CALL_STOP messages to start, stop a voice calls. + +In Layer 2 Mode, CT3258 implements Layer 1 and Layer 2 of the DMR protocol, complied with +ETSI TS 102 361. Layer 3 and above are implemented on the MCU. The interface between +CT3258 and the MCU are based on Layer 2 and Layer 3 interface. + +Note that if SCT3700 supported is enabled, only Layer 2 Mode is supported. +2.3.1 DMR Easy Mode +In Easy Mode (Layer 3 Mode), the MCU uses simple DMR_CALL_START, CALL_STOP +messages to start, stop a voice calls. Internally, CT3258 handles all call processing according the +DMR Protocol. “ANNEX C of TS 102 361” numbering plan is implemented in CT3258. At the +transmitter, CT3258 supports individual call and group call dialing. At the receiver, when a call is +received, CT3258 matches incoming called number with its own individual call number and group +number and informs the MCU of matching results. +2.3.2 DMR Layer 2 Mode +In DMR Layer 2 Mode, CT3258 interacts with the control processor (the MCU) to complete the +DMR voice and data calls. The layer 1 and layer 2 of the DMR are implemented in CT3258, while +layer 3 and above are implemented in the MCU. The information exchange between the MCU and +CT3258 is through DIGC_DATA_FRAME commands or indications. The MCU passes the data +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +93 +types and the payload information the CT3258 through DIGC_DATA_FRAME to CT3258. +CT3258 performs FEC according to the data types, CT3258 adds FEC, formulates them into 30 +ms data burst and adds 4FSK modulation before sending to the far end. At the receiver, CT3258 +decode the received data burst, and report to the MCU through DIGC_DATA_FRAME +indications. + +In DMR Layer 2 mode, care must be taken to make sure that the DIGC_DATA_FRAME messages +are sent no more and no less than 60 millisecond at a time. Examples of layer 2-3 message +exchange are described in the example session below. + +Two types of commands are used by the MCU to control CT3258. The first type is hardware +related for configuring CT3258 in certain mode ready for communication. The second type is +protocol related, where commands are used to pass layer 2 and layer 3 information. In particular +DIGC_DATA_FRAME command is used to start or stop a voice or data call. + +2.3.3 DMR MS Call Flow +The diagram below shows at typical DMR voice call from one mobile station to another mobile +station without a repeater. + +MCU +MS1 Transmiter +MS2 Receiver +3928 +3928 +MCU +call up +data frame +(LC Header) +response +data frame +(LC Header) +data frame +(surperframe) +response +Voice call +data frame +(surperframe) +LC header +Super Frame +next +..... +call Down +data frame +(LC Terminal) +response +data frame +(LC Terminal) +LC Terminal + Figure 2-1 DMR MS Call Flow +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +94 + +The MCU informs CT3258 the types of data frame to send through command +DMR_DATA_FRAME and then waits for response from CT3258. CT3258 put the data frame for +transmission and sends a response in the form of (0x17 0x0a). The next DMR_DATA_FRAME +won’t be sent unless a response (0x17 0x0A) is received. The interval between two +DMR_DATA_FRMAE is around 60 milliseconds. + +Only one DMR_DATA_FRAME command with LC contents is needed to start the voice +communication at the TX side. The subsequent super frames use the same LC contents. Similarly, +DMR_DATA_FRAME is only reported once upon receiving super frames at the RX side. The +MCU knows the call end condition from either by receiving a terminal frame, or by receiving +CT3258 response of 1B 08. +2.3.4 Base Station Activation +In order to place voice or data calls through the base station or repeater, the mobile station should +first acquire synchronization by monitor signals from the base station. If the base station is in idle +state, the mobile station should first send a base station activation message to activate the base +station. This is done by MCU sending a DMR_DATE_FRAME with CSBK contents. The diagram +below shows the base station activation procedure. + +MCU +MS Transmiter +BS UpLink +3928 +call up +data frame +(CSBK) +response +CSBK +BS Down link Actived +MS Receiver + +Figure 2-2 Base Station Activation +2.3.5 Listen Before Transmitting +If the base station is activated, it constantly broadcasts base station signals. The mobile station +should first acquire timing synchronization from the base station before it can start or receive a +call. Timing synchronization is done by monitoring the SYNC pattern and the CACH signals from +the base station. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +95 +The MCU on the mobile station first sends command DMR_CALL_SLOT to inform CT3258 +which slot to monitor, and waits CT3258 for DMR_SLOT_FOUND response. As soon as CT3258 +acquire synchronization, it sends DMR_SLOT_FOUND response, first with slot verified flag +unset, then after the preset number of CACH is received, with the slot verified flag set. At this +point, the mobile station is aligned with the base station. CT3258 can report any data frames from +the +far +end +through +DMR_DATA_FRAME +message. +The +MCU +can +also +issue +DMR_DATA_FRAME command to CT3258 to send to the far end. + +The diagram below shows a timing acquisition process. +slot 2 +slot 1 +c +a +c +h +BS Down Link +MS Receive +c +a +c +h +slot 2 +slot 1 +c +a +c +h +c +a +c +h +slot 2 +slot 1 +c +a +c +h +SLOT FOUND +c +a +c +h +Receive +Transmit +Receive +Receive +RF_TIMING +PORT +RF Ttransmit Control +(MCU Generate) +Close +Open +Close +Open +Close +Open +MS Ttransmit +slot 1 +(Invalid) +slot 2 +(valid) +slot 1 +(Invalid) +slot 2 +(valid) +slot 1 +(Invalid) +slot 2 +(valid) +Offset +Transmit +Transmit +SLOT_TIMING +(SCT3928 Internal) +Slot 1 +Slot 2 +Slot 1 +Slot 2 +Slot 1 +Slot 2 +SLOT FOUND +Done + Figure 2-3 Signal Timing Relationship + +After CT3258 acquires synchronization from the base station, it generates an internal 60 +millisecond cyclic timing signal, SLOT_TIMING. In the TX mode, CT3258 controls the timing on +the modulation output port so that it is in synchronization with the base station timing. In the +meantime, it also outputs a SLOT_TIMING signal through the RF_TIMING port to control the +RF circuit. The RF_TIMING signal can be identical to the SLOT_TIMNG. It can also be ahead or +lag the SLOT_TIMING signal. The offset are programmable through command DMR_OFFSET. +The MCU can then generate necessary timing signals to control the RF transceiver and the power +amplifier. In the case of SCT3700, the switching of RF transceiver and controlled by the CT3258. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +96 + +2.4 Typical Call Sessions with CT3258 in DPMR Mode +2.4.1 Digital Voice Call +A voice call involves the transmitter and the receiver. In both side, the MCU is the main controller, +controlling the RF circuit, the MMI and CT3258. Before the call, the MCU should set the RF +circuit in TX mode for the transmitter and in RX mode for the receiver. The sub-section below +only describes the interaction between the MCU and CT3258. +2.4.1.1 Initial Setting for both the Transmitter and the Receiver +1. Set Vocoder type with VOCODER_SEL +2. Set CT3258 to Easy mode with PROCESS_MODE command +3. Set Color Code corresponding to the RF Channel with DPMR_CC command +4. Set addressing mode to either “Initial Address Mode” or “Configured Addressing Mode” with +ADDRESS_MODE command +5. Set Own ID with DIGC_OWN_ID_BIN or DPMR_OWN_ID_BCD (“Configured Addressing +Mode” only) +2.4.1.2 Initial Setting for the Receiver +1. Set the demodulator gain with DEMOD_GAIN command +2. Set the types of field to report when receiving a call with REPORT_FIELD command +2.4.1.3 Initial Setting for the Transmitter +1. Set the modulator gain with MOD_GAIN command +2.4.1.4 Transmitter Side, Start a Call +1. Set CT3258 in TX or DUPLEX with WORK_MODE command +2. Set called ID and own ID with DPMR_CALLED_ID and DPMR_OWN_ID +3. Start the call with CALL_START, for peer-to-peer voice call +2.4.1.5 Receiver Side, Start a Call +1. Set CT3258 in RX or DUPLEX with WORK_MODE command +2. When detecting carrier, inform CT3258 that carrier is ready with CARRIER_READY +command + +After the call from transmitter arrives, CT3258 reports useful information. The MCU decides +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +97 +whether to accept or discard the call. +2.4.1.6 Transmitter Side, End a Call +1. Drop the call with CALL_STOP command +2. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) +2.4.1.7 Receiver Side, End a Call +1. Drop the carrier with CARRIER_READY command +2.4.2 Voice Call with Slow Data +1. Start the call the same way as voice only call described in the previous section except that +the communication mode(the M in M_V_F_EP) is set to Call with Slow Data +2. After the calls start, the MCU first send a packet with DPMR_SLD field. +3. When CT3258 begin transmitting, it fills slow data in the super frame and transmits slow data +along with the voice frames. As soon as the slow data is being transmitted, it sends a +DPMR_SLD response packet to the MCU, at 80 millisecond interval. + +Packet Header +START_BYTES +LENGTH +TYPE (Read Near End) +Fields +DPMR_SLD +Parity +FBYTE +PARITY_BYTE +Table 2-9 Example Packet for Request Near End Slow Data + +4. Upon receiving DPMR_SLD response, the MCU write DPMR_SLD to CT3258, also at 80 +millisecond interval. +5. At the receiver, upon receiving super frame with SLOW data, CT3258 extract slow data and +report to the MCU with DPMR_SLD packet at 80 millisecond interval. +6. When all data has been transmitted, the MCU has to wait the response packet of the last frame +DPMR_SLD. +7. Drop the call with CALL_STOP command +8. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) +2.4.3 Voice Call Recording +1. Enable voice recording function with command VOCODER_IO_SET at the transmitter for +near end voice call recording (IO_SET = 0x20), or at the receiver for far end voice call +recording (IO_SET = 0x04) +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +98 +2. Start the call the same way as voice only call described in the previous section. +3. When the call starts, CT3258 start to send encoded voice data with CHAN_D field, at 80 +millisecond interval. + +Packet Header +START_BYTES +LENGTH +TYPE (Read Near End) +Fields +CHAN_D +Parity +FBYTE +PARITY_BYTE +Table 2-10 Example Packet for Voice Recoding +4. Upon receiving CHAN_D, the MCU should process the message and save its contents. The +MCU does not send a response to CHAN_D. +5. The process repeats at 80 millisecond interval. +6. Drop the call with CALL_STOP command +7. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) +8. Disable the voice recording by setting IO_SET = 0x00 +2.4.4 Voice Call Play Back +1. Enable voice play back function with command VOCODER_IO_SET at the transmitter for far +end voice play back (IO_SET = 0x40), or at the receiver for near end voice play back +(IO_SET = 0x08) +2. Start the call the same way as voice only call described in the previous section. +3. When the call starts, MCU starts to send encoded voice data with CHAN_D field, at 80 +millisecond interval. + +Packet Header +START_BYTES +LENGTH +TYPE (Read Near End) +Fields +CHAN_D +Parity +FBYTE +PARITY_BYTE +Table 2-11 Example Packet for Play Back + +4. Upon receiving CHAN_D, CT3258 send back the response to CHAN_D. +5. The process repeats at 80 millisecond interval. +6. Drop the call with CALL_STOP command +7. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) +8. Disable the voice recording by setting IO_SET = 0x00 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +99 +2.4.5 Data Call with Type 1 or Type 2 Data + +1. Start the call the same way as voice only call described in the previous section except that +the communication mode (the M in M_V_F_EP) is set to Type 1 or Type 2 data call. The +DPMR_HT_CI has to be configured as section 1.2.53. +2. After the calls start, the MCU first send a packet with DIGC_DATA_FRAME field, which +includes up to 36 bytes (in 80 ms) of data. In the DIGC_DATA_FRAME fields, user should +also indicate whether valid data are present and the length of the valid data. The user should +also indicate whether this is the last data frame. +3. When CT3258 begin transmitting, it fills data in the TCH frame and starts transmitting data. +As soon as data is being transmitted, it sends a DIGC_DATA_FRAME response packet to the +MCU, at 80 millisecond interval. + +Packet Header +START_BYTES +LENGTH +TYPE (Read Near End) +Fields +DIGC_DATA_FRAME +Parity +FBYTE +PARITY_BYTE +Table 2-12 Example Packet for Request Near End Type 1 and Type 2 Data + +4. Upon receiving DPMR_DTAT_FRAME response, the MCU write DIGC_DATA_FRAME +with more data to CT3258, also at 80 millisecond interval. +5. At the receiver, upon receiving DPMR pay load, CT3258 extracts data from TCH frames and +report to the MCU with DIGC_DATA_FRAME packet at 80 millisecond interval. +6. When all data has been transmitted, the MCU responds to data query with +DIGC_DATA_FRAME with indication that no more data is to transmit. +7. Drop the call with CALL_STOP command +8. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) +2.4.6 Voice Call with Appended Data +The Voice Call with Appended Data starts as voice call and ends as a Type 2 Data Call. +1. Start the call the same way as voice only call described in the previous sections except that +the communication mode(the M in M_V_F_EP) is set to Voice Call with Appended Data. The +DPMR_HT_CI has to be configured as section 1.2.53. +2. Proceed to voice communication as a normal voice call +3. When the user releases the PTT, the MCU first send a packet with DIGC_DATA_FRAME +field, which includes up to 36 bytes (in 80 ms) of data. In the DIGC_DATA_FRAME fields, +user should also indicate whether valid data are present and the length of the valid data. The +user should also indicate whether this is the last data frame. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +100 +4. When CT3258 begin transmitting, it fills data in the TCH frame and starts transmitting data. +As soon as data is being transmitted, it sends a DIGC_DATA_FRAME response packet to the +MCU, at 80 millisecond interval. + +5. Upon receiving DPMR_DTAT_FRAME response the MCU write DIGC_DATA_FRAME +with more data to CT3258, also at 80 millisecond interval. +6. At the receiver, upon receiving DPMR pay load, CT3258 extracts data from TCH frames and +report to the MCU with DIGC_DATA_FRAME packet at 80 millisecond interval. +7. When all data has been transmitted, the MCU responds to data query with +DIGC_DATA_FRAME with indication that no more data is to transmit. +8. Drop the call with CALL_STOP command +9. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) +2.4.7 Data Call Type 3 (for future release) +Type 3 Data calls involve a call set up and disconnect procedure as described below: + +1. Station A: Send connection request +2. Station B: Send ACK +3. Station A: Send data frames +4. Station B: Send ACK +5. Station A: Send more data frames +6. Station B: Send ACK + +… +7. Station A: Send Disconnect request + +The interactions of MCU and CT3258 to complete a data call are described below. +2.4.7.1 Initialization of Data Call Type 3 +The initialization of Type3 data call is the same as voice calls. +2.4.7.2 Connection Request +1. Set Station A in TX mode and Station B in RX mode with WORK_MODE command +2. Set call information (CI) for appropriate data format with DPMR_CI_PM command +3. Send CONNECT command in station A +4. Set Carrier Ready in station B +5. CT3258 in station B report HT_CI to station B MCU +6. Station B MCU becomes aware of a data call request, and get ready to send an ACK +7. When the CONNECT message is sent out in station A, CT3258 responds with +ACK_MESSAGE (10) +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +101 +2.4.7.3 Connection Acknowledge +1. Set Station B in TX mode and Station A in RX mode with WORK_MODE command +2. Set CI to indicate ACK or NACK (with NACK reason) with DPMR_CI_PM. +3. Send DPMR_ACK command in station B +4. Set Carrier Ready in station A +5. CT3258 in station A report HT_CI to the MCU +6. Station A MCU becomes aware of the acknowledgement from station B, and get ready to send +data. +7. When the Connect Acknowledgement message is sent out in station B, CT3258 responds with +ACK_MESSAGE (10) +2.4.7.4 Sending Type 3 Data Frames +1. Set Station A in TX mode and Station B in RX mode with WORK_MODE command +2. Set CI for appropriate data format with DPMR_CI_PM command +3. Start the call with CALL_START +4. After the calls start, the MCU first send a packet with DIGC_DATA_FRAME field with Type +3 data indication, which includes up to 48 bytes (in 80 ms) of data. In the +DIGC_DATA_FRAME fields, user should also indicate whether valid data are present and the +length of the valid data. The user should also indicate whether this is the last data frame. +5. CT3258 fills data in the data frame and start transmission. As soon as data is being transmitted, +it sends a DIGC_DATA_FRAME query packet to the MCU to request for more data. This +process continues at 80 milli-second interval. +6. Upon receiving DIGC_DATA_FRAME query, the MCU write DIGC_DATA_FRAME to +CT3258, also at 80 millisecond interval. +7. At station B, upon receiving data frames, CT3258 extract data and report to the MCU with +DIGC_DATA_FRAME packet at 80 millisecond interval. +8. Station B MCU assembles the data frames from the DIGC_DATA_FRAME fields. +9. When all data in current data frame has been transmitted, the MCU responds to data query +with DIGC_DATA_FRAME with indication that no more data is to transmit. +10. Drop the call with CALL_STOP command +11. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) +2.4.7.5 Data Acknowledgement +1. Set Station B in TX mode and Station A in RX mode with WORK_MODE command +2. Set CI to indicate ACK or NACK (with NACK reason) with DPMR_CI_PM. +3. Send DPMR_ACK command in station B +4. Set Carrier Ready in station A +5. CT3258 in station A report HT_CI to the MCU +6. Station A MCU becomes aware of the acknowledgement from station B, and get ready to send +more data packet. +7. When the Data Acknowledgement message is sent out in station B, CT3258 responds with +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +102 +ACK_MESSAGE (0x17 0x0A) to MCU B. +2.4.7.6 Disconnect +1. Set Station A in TX mode and Station B in RX mode with WORK_MODE command +2. Send DISCONNECT command in station A. +3. Set Carrier Ready in station B +4. CT3258 in station B report HT_CI to the MCU +5. Station B MCU becomes aware of the Disconnect request from station A, and start disconnect +procedure +6. Station B disconnect the cal +7. When the DISCONNECT message is sent out in station A, CT3258 responds with +ACK_MESSAGE (0x17 0x0A) +2.4.8 Short Appended Data (TS 102 658 Only) +ETSI TS 102 658 defines a special message for transmitting short data. It is constructed by a +connection request HEADER frame, one to four appended data frames, and an END frame. To +send Short Appended Data, the MCU can follow the procedure below. +2.4.8.1 Send Short Appended Data +Set Station A in TX mode with WORK_MODE command +1. Set call information (CI) for appropriate data format with DPMR_CI_PM command +2. Send the contents of the short appended data with DIGC_DATA_FRAME command with type +set to Short Appended Data. +3. Send SEND_AD command in station A +4. When the CONNECT message is sent out in station A, CT3258 responds with +ACK_MESSAGE (10) +5. The MCU set Station A in RX mode to get ready to receive an ACK. +2.4.8.2 Receive Short Appended Data +1. Set Station B in RX mode with WORK_MODE command +2. Set Carrier Ready in station B +3. CT3258 in station B receives short appended data and report to station B MCU with +DIGC_DATA_FRAME +4. Set Station B in TX mode to get ready to send an ACK. +2.4.9 Analog Voice Call in DPMR Mode +CT3258 support dual mode operation with digital and analog calls. For analog call, CT3258 +supports CTCSS/DCS sub-audio signals. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +103 +2.4.9.1 Receiver Side, Start a Call +1. Set CT3258 to analog call mode with PROCESS_MODE command +2. Set CT3258 in RX or DUPLEX with WORK_MODE command +3. Set CTCSS/DCS settings with SUB_AUDIO command +4. When detecting carrier, inform CT3258 that carrier is ready with CARRIER_READY + +After the call from transmitter arrives, CT3258 reports whether CTCSS/DCS is matched or not +with SUB_AUDIO command. +2.4.9.2 Transmitter Side, Start a Call +1. Set CT3258 to analog call mode with PROCESS_MODE command +2. Set CT3258 in TX or DUPLEX with WORK_MODE command +3. Set CTCSS/DCS settings with SUB_AUDIO command +4. Start the call with CALL_START command +2.4.9.3 Receiver Side, End a Call +1. Drop the carrier with CARRIER_READY command +2.4.9.4 Transmitter Side, End a Call +1. Drop the call with CALL_STOP command +2.4.10 Handling of Maintenance Message (TS 102 658 Only) +With ETSI TS 102 658, the BS may send multiple maintenance messages such as preservation +messages, Idle messages or Guard messages. CT3258 may report each occurrence of these +messages, or elect to only report the same message once to save traffic between CT3258 and the +MCU. The election is controlled by command DPMR_PROTOCOL_OPTION. +2.4.11 Automatic Analog and DPMR Call Detection +To set up for automatic analog and DPMR call detection, the receiver is set up the same ways as a +digital calls, with the following exceptions: + +1. Set CT3258 to Easy mode with PROCESS_MODE command, with mixed call bit enabled: i. +e., the process mode as 131. +2. Set CTCSS/DCS settings with SUB_AUDIO command + +The transmitter side is set up exactly as normal analog or DPMR call. + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +104 +With automatic analog and DPMR call detection, CT3258 monitors the RF channel, and +simultaneously detects FS1/FS2 pattern for DPMR calls, and CTCSS/DCS signaling for analog +calls. If DPMR call is found, it sends CALL_MATCH message (even if the called ID or CC code +does not match). If CTCSSS/DCS signaling is found, it send SUB_AUDIO message. +2.4.12 Audio Muting for Un-matched Calls +By defaults, CT3258 enables audio as soon as a DPMR or an analog call is received, even if called +ID or CTCSS/DCS code does not match. It is up to the MCU to decide whether to take the call or +not. If the MCU decides to take to call, it enables audio PA. If not, it turns off the audio PA, and +send carrier lost to CT3258. + +Optionally, the CT3258 can mute the audio until a correct call match is achieved. This can be done +by setting Mute Flag when sending the Carrier Ready command at the receiver. When Mute Flag +is set, CT3258 sends zeros to its audio out line until a called ID of the incoming call matches the +own ID of itself, or the CTCSS/DCS code of the transmitter and receiver match. +2.5 Typical Call Sessions with CT3258 in DMR Mode +2.5.1 DMR Voice Call in DMR Easy Mode +A voice call involves the transmitter and the receiver. In both side, the MCU is the main controller, +controlling the RF circuit, the MMI and CT3258. Before the call, the MCU should set the RF +circuit in TX mode for the transmitter, and in RX mode for the receiver. The sections below only +describe the interaction between the MCU and CT3258. + +Note that if SCT3700 support is enabled, DMR Easy mode is not supported. +2.5.1.1 Initial Setting for both the Transmitter and the Receiver +1.Set Vocoder type with VOCODER_SEL, 4 for AMBE+2 +Command ID: +VOCODER_SEL +Send Command: 84 A9 61 00 02 00 10 04 +Receive +Data:84 A9 61 00 02 00 10 00 + +2.Set CT3258 to digital mode with PROCESS_MODE command +Command ID: +PROCESS_MODE +Send Command: 84 A9 61 00 02 00 1A 03 +Receive +Data:84 A9 61 00 02 00 1A 00 + +3.Set Color Code corresponding to the RF Channel with DMR_CC command +Send Command: 84 A9 61 00 02 08 77 01 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +105 +Receive +Data:84 A9 61 00 02 08 77 00 + +4.Configure the call option with DMR_CALL_OPTION +Command ID: +DMR_CALL_OPTION +Send Command: 84 A9 61 00 06 08 79 41 00 00 00 00 +Receive +Data:84 A9 61 00 02 08 79 00 +(In this particular command, CT3258 is set to do SQ detection; slotted mode is used, with unused +slot filled with zeros; SLOT verified number is 1). + +5.Set Own ID with DIGC_OWN_ID_BIN or DMR_OWN_ID_BCD +Command ID: DIGC_OWN_ID_BIN +Send Command: 84 A9 61 00 04 08 50 XX XX XX +Receive +Data:84 A9 61 00 02 08 50 00 + +2.5.1.2 Initial Setting for the Receiver +1. Set the demodulator gain with DEMOD_GAIN command +2. Set the types of field to report when receiving a call with REPORT_FIELD command +Command ID: REPORT_FIELD +Send command: 84 A9 61 00 02 00 1D XX +Receive Data: 84 A9 61 00 02 00 1D 00 +2.5.1.3 Initial Setting for the Transmitter +1. Set the modulator gain with MOD_GAIN command +2.5.1.4 Transmitter Side, Start a Call +1.Set CT3258 in TX with WORK_MODE command +Command ID: +WORK_MODE +Send Command: 84 A9 61 00 04 00 18 02 00 00 +Receive +Data: 84 A9 61 00 02 00 18 00 + +2.Set called ID and own ID with DIGC_CALLED_ID and DIGC_OWN_ID +Command ID: DIGC_OWN_ID_BIN +Send Command: 84 A9 61 00 04 08 50 XX XX XX +Receive +Data: 84 A9 61 00 02 08 50 00 + +Command ID: +DMR_CALLED_ID_BIN +Send Command: 84 A9 61 00 04 08 51 XX XX XX +Receive +Data: 84 A9 61 00 02 08 51 00 + +3.Set FLC information +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +106 +Command ID: +DMR_FLC +Send Command: 84 A9 61 00 04 08 76 00 00 00 +Receive +Data:84 A9 61 00 02 08 76 00 + +(In this particular command, FLCO as group call, FID is standard) + +4.Start the call with DMR_CALL_START, for peer-to-peer voice call +Command ID: +DMR_CALL_START +Send Command: 84 A9 61 00 01 08 78 +receive command: 84 a9 61 00 02 08 78 00 +2.5.1.5 Receiver Side, Start a Call +1.Set CT3258 in RX or DUPLEX with WORK_MODE command +Command ID: +WORK_MODE +Send Command: 84 A9 61 00 04 00 18 01 00 00 +Receive +Data:84 A9 61 00 02 00 18 00 + +2.When detecting carrier, inform CT3258 that carrier is ready with CARRIER_READY command + +Send Command: 84 A9 61 00 02 00 19 {0x01 or 0x02} +Receive +Data:84 A9 61 00 02 00 19 00 + +After the call from transmitter arrives, CT3258 reports useful information. The MCU decides +whether to accept or discard the call. +2.5.1.6 Receiver Side, after a Call is Received +Receive Data:84 A9 61 00 02 30 7F 87 + +DMR_SLOT_FOUND message. The content is TACT in the CACH, BS call, SLOT +verify not completed + +Receive Data:84 A9 61 00 02 30 1B 04 + +Indicate voice SYNC is received + +Receive Data:84 A9 61 00 02 30 7B 11 + DMR_SLOT_TYPE message. CC is 1. Data type is Voice LC Header + +Receive Data:84 A9 61 00 04 30 76 00 00 00 + DMR_FLC message + +Receive Data:84 A9 61 00 04 30 50 xx xx xx + DIGC_CALLED_ID_BIN + +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +107 +Receive Data:84 A9 61 00 04 30 51 xx xx xx + DIGC_OWN_ID_BIN + +Receive Data:84 A9 61 00 05 30 7D xx xx xx xx + DIGC_CALLED_ID_BCD + +Receive Data:84 A9 61 00 05 30 7E xx xx xx xx + DIGC_OWN_ID_BCD + +Receive Data:84 A9 61 00 02 30 27 00 + CALL_MATCH message, indicating a valid DMR call is received, and called ID and CC +are matched. +2.5.1.7 Transmitter Side, End a Call +1. Drop the call with CALL_STOP command +Command ID: DMR_CALL_STOP +Send Command: 84 A9 61 00 01 03 21 +receive command: 84 A9 61 00 02 03 21 00 + +2. When the END message is sent out, CT3258 responds with ACK_MESSAGE (0x17 0x0A) + +2.5.1.8 Receiver Side, End a Call +When the transmitter stops the call, CT3258 receives LC terminator from the far end, and report it +with DMR_SLOT_TYPE to the MCU. + +Receive Data:84 A9 61 00 02 30 7B 11 + DMR_SLOT_TYPE message. CC is 1. Data type is Voice LC Terminator. + +2. After receiving DMR_SLOT_TYPE, the receiver can then drop the carrier with +CARRIER_READY command +Command ID: +DMR_CARRIER_READY +Send +Command: 84 A9 61 00 02 00 19 00 +Receive +Data:84 A9 61 00 02 00 19 00 +2.5.2 DMR Voice Call in DMR Layer 2 Mode +A voice call involves the transmitter and the receiver. In both side, the MCU is the main controller, +controlling the RF circuit, the MMI and CT3258. Before the call, the MCU should set the RF +circuit in TX mode for the transmitter and in RX mode for the receiver. The sub-section below +only describes the interaction between the MCU and CT3258. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +108 +2.5.2.1 Initial Setting for both the Transmitter and the Receiver +1. Set Vocoder type with VOCODER_SEL. An up to 2-3 seconds delay is required to down load +the vocoder from the flash. +Command ID: +VOCODER_SEL +Send Command: 84 A9 61 00 02 00 10 04 +Receive +Data:84 A9 61 00 02 00 10 00 + +2. Set CT3258 to layer 2 mode with PROCESS_MODE command +Command ID: +PROCESS_MODE +Send Command: 84 A9 61 00 02 00 1A 02 +Receive +Data:84 A9 61 00 02 00 1A 00 + +3. Set Color Code corresponding to the RF Channel with DMR_CC command +Command ID: +DMR_CC +Send Command: 84 A9 61 00 02 08 77 01 +Receive +Data:84 A9 61 00 02 08 77 00 + +4. Set DMR call options with DMR_CALL_OPTION command +Command ID: +DMR_CALL_OPTION +Send Command: 84 A9 61 00 06 08 79 41 00 10 00 00 +Receive +Data:84 A9 61 00 02 08 79 00 + +(In this particular command, CT3258 is set to do SQ detection; slotted mode, with unused slot +filled with zeros; SLOT verified number is 1). +2.5.2.2 Initial Setting for the Receiver + Set the demodulator gain with DEMOD_GAIN command + Set the types of field to report when receiving a call with REPORT_FIELD command +2.5.2.3 Initial Setting for the Transmitter +1. Set the modulator gain with MOD_GAIN command + +2.5.2.4 Receiver Side, Start a Call +1. +Set CT3258 in RX or DUPLEX with WORK_MODE command +Command ID: +WORK_MODE_RX +Send Command: 84 A9 61 00 04 00 18 01 00 00 +Receive +Data:84 A9 61 00 02 00 18 00 +2. +Set which slot to receive with DMR_CALL_SLOT command +Send Command: 84 A9 61 00 02 08 6F 01 +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +109 +Receive +Data:84 A9 61 00 02 08 6F 00 +(For mobile to mobile call, the slot number is 0) + +3. +When detecting carrier, inform CT3258 that carrier is ready with CARRIER_READY +command +Command ID: +DMR_CARRIER_READY +Send Command: 84 A9 61 00 02 00 19 {0x01 or 0x02} +Receive +Data:84 A9 61 00 02 00 19 00 + +After the call from transmitter arrives, CT3258 reports useful information. The MCU decides +whether to accept or discard the call. +2.5.2.5 Transmitter Side, Start a Call +1. Set which slot to transmit with DMR_CALL_SLOT command. If MS call is to be placed, the +slot number is 0. Otherwise, slot 1 or slot 2 is selected +Command ID: +DMR_CALL_SLOT +Send Command: 84 A9 61 00 02 08 6F 81 +Receive +Data: 84 A9 61 00 02 08 6F 00 + +2. Set CT3258 in TX mode with WORK_MODE command +Command ID: +WORK_MODE_TX +Send Command: 84 A9 61 00 04 00 18 02 00 00 +Receive +Data: 84 A9 61 00 02 00 18 00 + +3. Send LC with DIGC_DATA_FRAME (CC can be sent in the same packet) +Command ID: +DIGC_DATA_FRAME +Send Command: 84 A9 61 00 0E 08 77 01 43 01 09 00 00 00 00 00 01 00 00 01 +Receive +Command: 84 A9 61 00 01 20 43 + +4. Start the call by sending super frame with DIGC_DATA_FRAME +Command ID: +PROTOCOL_DATA_FRAME +Send Command: 84 A9 61 00 0E 08 77 01 43 11 09 00 00 00 00 00 01 00 00 01 +Receive +Command: 84 A9 61 00 01 20 43 +2.5.2.6 Receiver Side, after a Call is Received +Receive Data: 84 A9 61 00 02 30 7F 87 + DMR_SLOT_FOUND message. The content is TACT in the CACH, BS call, SLOT +verify not completed + +Receive Data:84 A9 61 00 02 30 7F A9 + DMR_SLOT_FOUND message. The content is TACT in the CACH, BS call, SLOT +verify completed, with no need to invert slot numbers in previous DMR_SLOT_FOUND +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +110 +message. At this point, the mobile station is synchronized with the base station. If the +mobile station wishes to start a call, it needs to check the AT bit in the TACT of CACH, +and proceed if it is not busy. + +Receive Data: 84 A9 61 00 0E 30 77 01 43 01 09 00 00 00 00 00 01 00 00 01 + This message contains two fields, DMR_CC and DIGC_DATA_FRAME. CC is 0x01. +The content in the data frame is data burst at SLOT1, length of 9, and Voice LC header. + +Receive Data: 84 A9 61 00 0E 30 77 01 43 11 09 00 00 00 00 00 01 00 00 01 + This message contains two fields, DMR_CC and DIGC_DATA_FRAME. CC is 0x01. +The content in the data frame is voice super frame at SLOT1, length of 9, and Voice LC +header. Once CT3258 receives and reports one voice super frame, it won’t report +subsequent voice super frame. But it continues to track the synchronization of the base +station, and report 0x1B 0x08 if the synchronization is lost, which the MCU can use as +an indication of call lost. +2.5.2.7 Transmitter Side, End a Call +1. Stop the call by sending Terminator LC. Once CT3258 has sent all message to the far end, it +reports 17 0A to the MCU +Command ID: +PROTOCOL_DATA_FRAME +Send Command: 84 A9 61 00 0c 08 43 02 09 00 00 00 00 00 01 00 00 01 +Receive +Command: 84 A9 61 00 01 20 43 +Receive +Command: 84 A9 61 00 02 20 17 0A +2.5.2.8 Receiver Side, End a Call +When the transmitter stops the call, CT3258 receives LC terminator from the far end, and report it +with DIGC_DATA_FRAME to the MCU + +Receive Data:84 A9 61 00 0E 30 77 01 43 02 09 00 00 00 00 00 01 00 00 01 + This message contains two fields, DMR_CC and DIGC_DATA_FRAME. CC is 0x01. +The content in the data frame is data burst at SLOT1, length of 9, and Voice LC +Terminator. + +1. Drop the carrier with CARRIER_READY command +Command ID: +DMR_CARRIER_READY +Send Command: 84 A9 61 00 02 00 19 00 +Receive +Data:84 A9 61 00 02 00 19 00 +2.5.3 Analog Voice Call in DMR Mode +CT3258 support dual mode operation with digital and analog calls. For analog call, CT3258 +supports CTCSS/DCS sub-audio signals. +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +111 +2.5.3.1 Receiver Side, Start a Call +1. Set CT3258 to analog call mode with PROCESS_MODE command +2. Set CT3258 in RX or DUPLEX with WORK_MODE command +3. Set CTCSS/DCS settings with SUB_AUDIO command +4. When detecting carrier, inform CT3258 that carrier is ready with CARRIER_READY + +After the call from transmitter arrives, CT3258 reports whether CTCSS/DCS is matched or not +with SUB_AUDIO command. +2.5.3.2 Transmitter Side, Start a Call +1. Set CT3258 to analog call mode with PROCESS_MODE command +2. Set CT3258 in TX or DUPLEX with WORK_MODE command +3. Set CTCSS/DCS settings with SUB_AUDIO command +4. Start the call with DMR_CALL_START command +2.5.3.3 Receiver Side, End a Call +1. Drop the carrier with CARRIER_READY command +2.5.3.4 Transmitter Side, End a Call +1. Drop the call with CALL_STOP command + +2.6 Gain Calibration +This is the first step of calibration. It calibrates the receiver path to calculate SQ_LEVEL correctly +without being affected by gains variation in the analog path.. + +For SCT3700, follow these steps: +1. +Feed -60dbm FM signal (eg. by HP8920) to receiver and make chip run in receiver mode +2. +Adjust “GAIN_ADJUST” till WB_RSSI equals to -60dbm + +Note that if external LNA is used, it needs to be disable when doing GAIN calibration. + +Command ID: READ_RSSI +Send Command: 84 A9 61 00 01 20 6C 00 +Receive +Data: 84 A9 61 00 07 23 6C 00 3B 00 37 00 00 + +For example, 0x3B-137 = -78dbm, which means there is -18db mismatch. So we set +GAIN_ADJUST to 0xee, and send +Command ID: WRITE_RSSI +Packet Interface of CT3258 +Copy Rights © 2015, Wuxi Sicomm Communication Technologies, Inc & Celetra, Inc +112 +Send Command: 84 A9 61 00 0D 00 6C EE 00 00 30 10 00 04 00 10 00 04 00 +Receive +Data:84 A9 61 00 02 00 6C 00 + +After that when we read again, it results, +Command ID: READ_RSSI +Send Command: 84 A9 61 00 01 20 6C 00 +Receive +Data: 84 A9 61 00 07 23 6C 00 4C 00 36 00 00 + +This time 0x4c-137 = -61dbm is almost correct, +/-1db is ignorable. + +3. +Enable external LNA if it is used +Command ID: 3700CONFIG +Send Command: 84 A9 61 00 03 00 6D 0F 00 00 +Receive +Data:84 A9 61 00 02 00 6D 00 + +4. +Adjust “EXT LNA_GAIN” till WB_RSSI equals to -60dbm +Command ID: readrssi +Send Command: 84 A9 61 00 01 20 6C 00 +Receive +Data: 84 A9 61 00 07 23 6C 00 6D 00 18 00 00 + +0x6D-137 = -28dbm, which means 32db mismatch. So we set EXTLNA_VAL[5:0]=0x20, +EXTLNA_VAL[7:6]=3 which is determined by 0x20-(0x4C-0x3B)=15dB +Bit7-Bit6 + Value + 11 + 12 ±0.2 кГц** от номинала. По Q&A Radtel даже ±0.2 кГц не даёт +хотспоту синхронизироваться с передачей. Приём работает, т.к. RX-смещение в допуске. + +Причина смещения: заводская частотная калибровка была сброшена/затёрта, а **Radio Tuning +Software «Write» залил ДЕФОЛТНЫЕ** значения смещения — неточные для конкретного экземпляра. + +### Где что лежит +- **Калибровка ОСНОВНОГО тракта рации** — SPI region 0x40 (0x000000, 4 КБ). Восстановлена + из `radio-spi-dump.bin` → **приём заработал**. Весь codeplug тоже восстановлен из дампа. +- **Частотная калибровка / DMR-девиация** — в NVRAM модуля FM100B. Команды модуля: + `SPCali_FreqOpt`, `SPCali_DigMod` (цифр. модуляция), `SPCali_PowerOpt`, `ATC_RfDeviation_SetReq`. + Перепрошивка кода модуля их НЕ трогает; сток при старте их НЕ шлёт → сброшенное значение держится. + +### Radio Tuning Software — как устроена (reverse .NET) +- Работает через **прозрачный мост** (режим МЕНЮ), маркер кадров `0xAAAA`, + команды `CmdConnect / CmdOpenCal / CmdWriteAll / CmdEnd`. +- Калибровка = **15 частотных смещений** `nOffset_1..15` + `num_U/V_DigFreq` (DMR-частота UHF/VHF). +- Кнопки: `Read` (с рации в UI), `Write/WriteAll` (в рацию), `Save`→`.updat` файл. +- **ВАЖНО:** по Q&A Radtel после калибровки жать «Finish» (сохранение). Возможно Write без + этого не фиксирует. И для точной калибровки нужен **прибор** (SDR/частотомер) — крутить + offset до ±0.2 кГц. + +## Пути восстановления (по приоритету) + +1. **Компенсация на хотспоте (RXOffset)** — БЕЗ прибора. Если TX рации смещена на постоянный + X Гц, выставить на хотспоте `RXOffset` так, чтобы приёмник поймал смещённую передачу. + Перебор RXOffset в MMDVM.ini (±1000 Гц шагом ~100), рестарт MMDVMHost, при передаче рации + (PTT) искать «received RF» в логе. Требует, чтобы владелец жал PTT в момент перебора. + Инструмент: `tools/hotspot_rxoffset_sweep.py` (готовится). + +2. **Точная калибровка частоты по прибору** — Radio Tuning Software + SDR/частотомер: + Read → крутить `num_U_DigFreq`/`nOffset` до ±0.2 кГц по прибору → **Finish/Save + WriteAll**. + +3. **Заводской `.updat`** — запросить у Radtel техподдержки файл калибровки для серийника, + либо debug-софт. Тогда Radio Tuning: Open `.updat` → WriteAll. + +## Что уже сделано +- ✅ SPI-калибровка рации (region 0x40) восстановлена из эталона → приём работает. +- ✅ Весь codeplug (каналы/зоны/контакты/группы/ключи/лог/SMS/FM) восстановлен из `radio-spi-dump.bin`. +- ✅ Диагноз локализован: TX-частотное смещение модуля. +- ⏳ Осталось: вернуть точное TX-смещение (пути 1–3 выше). + +## Инструменты +- `tools/spi_read.py` / `tools/spi_wr.py` — чтение/запись SPI через CPS (WSL powershell). +- `tools/fm100b.py` — команды модулю через мост (режим МЕНЮ). +- `tools/agent.py` — интерактивный агент (обычный режим). diff --git a/docs/fm100b-commands.md b/docs/fm100b-commands.md new file mode 100644 index 0000000..217fe3b --- /dev/null +++ b/docs/fm100b-commands.md @@ -0,0 +1,57 @@ +# FM100B — карта команд (снята интерактивным агентом) + +Снято `tools/agent.py` на прошивке `rt4d_agent.bin` — запрос каждой команды пустым +payload (`68 cmd 01 01 CK CK 00 00 10`), ответ модуля через снифер. Рация V1.2.0.32. + +`status` (байт [3] ответа): **0x00** = OK/есть данные, **0x01** = не поддержано или нужен payload. + +## Отвечают данными (status 0x00, len>0) + +| cmd | len | ответ | смысл | +|---|---|---|---| +| `0x04` | 1 | `03` | параметр | +| `0x24` | 4 | `01 00 40 01` | возможности/идентификатор модуля | +| `0x25` | 4 | `01 02 00 32` | **версия прошивки = V1.2.0.32** | +| `0x27` | 1 | `00` | статус | +| `0x28` | 1 | `00` | статус | +| `0x34` | 2 | `00 00` | параметр (2 байта) | +| **`0x35`** | 35 | `10 02 21 6a df 62 e1 4f 53 90 38 …` | **таблица** (записи с сигнатурой `e1 4f 53 90`) | +| `0x36` | 1 | `00` | статус | +| `0x3B` | 1 | `01` | флаг | +| **`0x43`** | 33 | `10 01 01 70 65 57 5b e1 4f 53 90 31 … 32 …` | **таблица**: две записи `…e1 4f 53 90` + индекс 1/2 (контакты/RX-группы?) | +| `0x46` | 1 | `00` | статус | +| `0x85` | 1 | `00` | статус | + +## Приняты без данных (status 0x00, len 0) — действия/OK + +`0x01 0x03 0x1A 0x40 0x4B 0x65 0x66` +(`0x66` = девиация ш/у полосы по changelog; `0x65` рядом — вероятно связанное) + +## Не поддержано / нужен payload (status 0x01) + +`0x0D 0x0E 0x10-0x19 0x22 0x2B 0x2C 0x2D 0x30 0x37 0x3A 0x3C 0x3D 0x3F 0x41 0x44 0x45 +0x47 0x4A 0x4E 0x4F 0x50 0x51 0x52 0x54 0x56 0x58 0x5C 0x5D 0x5E 0x60 0x61 0x63 0x64 +0x67 0x83 0x84 0x86 0x87` +(это SET/enable-команды — на пустой запрос отвечают отказом; проверять с payload) + +## Не опрошены (опасные SET — меняют состояние) + +`0x05` конфиг канала · `0x06` вызов · `0x07` данные канала · `0x0A` PTT · +`0x49` свой DMR ID · `0x62` параметры вызова · `0x81/0x82` SMS · `0x2A 0x42 0x48 +0x4C 0x4D 0x55 0x57` · **`0x3E` прошивка модуля — НЕ СЛАТЬ** + +## Известны из снифера входящего вызова (FM100B → MCU) + +| cmd | смысл | +|---|---| +| `0x62` | параметры вызова (src/dst/TG) | +| `0x06` | setup (sub 0x60) / end (sub 0x6f) | +| `0x60` | **Talker Alias (позывной)** — см. docs/talker-alias | +| `0x59` | активность приёма (гейт звука PA14) | +| `0x05` | конфигурация канала | + +## Открыто + +- **AMBE-выдача** (для модема): по умолчанию нет. Кандидаты — SET-команды со `status 0x01`, + проверять с payload `enable` + активный вызов + наблюдение потока через агента. +- Таблицы `0x35`/`0x43`: расшифровать формат записи (сигнатура `e1 4f 53 90`). diff --git a/tools/agent.py b/tools/agent.py new file mode 100644 index 0000000..7df8bc0 --- /dev/null +++ b/tools/agent.py @@ -0,0 +1,120 @@ +#!/usr/bin/env python3 +"""Клиент интерактивного агента RT-4D (прошивка rt4d_agent.bin). + +Шлёт рации `0xAA <сырой FM100B-кадр>`, агент блитит кадр модулю, ответы +модуля возвращаются в порт как `F1 F2 <кадр>`. Работает через powershell.exe (WSL). + + python3 tools/agent.py send 25 01 01 # cmd=25 b=01 sub=01, payload пуст -> версия + python3 tools/agent.py send 25 01 01 --data 00 + python3 tools/agent.py raw 68 25 01 01 00 00 00 00 10 # готовый кадр целиком + python3 tools/agent.py listen 10 # просто слушать порт N секунд +""" +import argparse, subprocess, sys, struct + + +def cksum(frame: bytes) -> int: + s = 0; i = 0 + while len(frame) - i > 1: + s += (frame[i] << 8) | frame[i + 1]; i += 2 + if len(frame) - i: + s += frame[i] << 8 + while s >> 16: + s = (s & 0xFFFF) + (s >> 16) + return (~s) & 0xFFFF + + +def build_frame(cmd, b, sub, payload: bytes) -> bytes: + f = bytearray([0x68, cmd, b, sub, 0xFF, 0xFF, + (len(payload) >> 8) & 0xFF, len(payload) & 0xFF]) + f += payload; f.append(0x10) + ck = cksum(bytes(f)); f[4], f[5] = (ck >> 8) & 0xFF, ck & 0xFF + return bytes(f) + + +def find_port(): + out = subprocess.run(["powershell.exe", "-NoProfile", "-Command", + "[System.IO.Ports.SerialPort]::GetPortNames() -join ','"], + capture_output=True, text=True).stdout + ports = [p for p in out.strip().replace("\r", "").split(",") if p] + if not ports: sys.exit("нет COM-порта") + return ports[0] + + +PS = r''' +$p = New-Object System.IO.Ports.SerialPort "{port}",115200,"None",8,"one" +$p.ReadTimeout = 200 +try {{ $p.Open() }} catch {{ Write-Output "ERR"; exit 1 }} +$p.DiscardInBuffer() +$tx = [byte[]]@({txlist}) +if ($tx.Length -gt 0) {{ $p.Write($tx,0,$tx.Length) }} +$sb = New-Object System.Text.StringBuilder +$sw = [Diagnostics.Stopwatch]::StartNew() +$last = 0 +while ($sw.Elapsed.TotalSeconds -lt {secs}) {{ + try {{ [void]$sb.Append("{{0:x2}}" -f $p.ReadByte()); $last=$sw.ElapsedMilliseconds }} catch {{}} + if ($sb.Length -gt 0 -and ($sw.ElapsedMilliseconds - $last) -gt {idle}) {{ break }} +}} +$p.Close() +Write-Output $sb.ToString() +''' + + +def xfer(port, tx: bytes, secs=3, idle=400): + txlist = ",".join(str(x) for x in tx) + r = subprocess.run(["powershell.exe", "-NoProfile", "-Command", + PS.format(port=port, txlist=txlist, secs=secs, idle=idle)], + capture_output=True, text=True, encoding="utf-8", errors="replace") + hexs = "".join(l.strip() for l in r.stdout.splitlines() if l.strip() and l.strip() != "ERR") + return bytes.fromhex(hexs) if hexs else b"" + + +def parse_frames(raw: bytes): + out, i = [], 0 + while i < len(raw) - 2: + if raw[i] == 0xF1 and raw[i + 1] == 0xF2: + n = raw[i + 2] + if 9 <= n <= 220 and i + 3 + n <= len(raw): + out.append(raw[i + 3:i + 3 + n]); i += 3 + n; continue + i += 1 + return out + + +def show(raw): + print(f"принято {len(raw)} байт") + frames = parse_frames(raw) + if not frames: + if raw: print("сырые байты:", raw.hex(' ')) + else: print("(тишина)") + return + for f in frames: + pl = f[8:-1] if len(f) > 9 else b"" + txt = "".join(chr(c) if 32 <= c < 127 else "." for c in pl) + print(f" cmd 0x{f[1]:02X} len={len(pl)} {f.hex(' ')}" + (f" «{txt}»" if pl else "")) + + +def main(): + ap = argparse.ArgumentParser() + sub = ap.add_subparsers(dest="op", required=True) + s = sub.add_parser("send"); s.add_argument("cmd"); s.add_argument("b"); s.add_argument("sub") + s.add_argument("--data", default=""); s.add_argument("--secs", type=float, default=3) + r = sub.add_parser("raw"); r.add_argument("bytes", nargs="+"); r.add_argument("--secs", type=float, default=3) + l = sub.add_parser("listen"); l.add_argument("secs", type=float, nargs="?", default=10) + ap.add_argument("--port") + a = ap.parse_args() + port = a.port or find_port() + + if a.op == "listen": + show(xfer(port, b"", secs=a.secs, idle=99999)) + return + if a.op == "raw": + frame = bytes(int(x, 16) for x in a.bytes) + else: + payload = bytes.fromhex(a.data) if a.data else b"" + frame = build_frame(int(a.cmd, 16), int(a.b, 16), int(a.sub, 16), payload) + tx = bytes([0xAA, len(frame)]) + frame + print(f"TX кадр модулю: {frame.hex(' ')}") + show(xfer(port, tx, secs=a.secs)) + + +if __name__ == "__main__": + main() diff --git a/tools/apply_patch.py b/tools/apply_patch.py new file mode 100644 index 0000000..c250fce --- /dev/null +++ b/tools/apply_patch.py @@ -0,0 +1,87 @@ +#!/usr/bin/env python3 +"""Применить патч из редактора прошивки к образу. + + python3 apply_patch.py patch.json [--src stock-fw/rt4d_ru_batt.bin] + [--out stock-fw/rt4d_custom.bin] + +Формат патча (его выдаёт кнопка «Скопировать патч»): + {"texts":[{"va":134370285,"txt":"ОСН. НАСТР"}, ...], + "logo":{"va":134500045,"b64":"..."}} + +Текст пишется в CP1251 и добивается пробелами ровно до исходной ширины поля — +записи в прошивке фиксированной длины, сдвигать их нельзя. +""" +import argparse, base64, json, sys + +BASE = 0x08002800 +# доступные глифы: ASCII + 33 заглавные кириллические буквы, дописанные при русификации +CYR = "АБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯЁ" + + +def widths(src_len): + """допустимые ширины полей — берём из таблиц редактора""" + return None + + +def main(): + ap = argparse.ArgumentParser() + ap.add_argument("patch") + ap.add_argument("--src", default="stock-fw/rt4d_ru_batt.bin") + ap.add_argument("--out", default="stock-fw/rt4d_custom.bin") + ap.add_argument("--meta", default="tools/display-editor/field-widths.json", + help="ширины полей (va -> max), пишется при сборке редактора") + a = ap.parse_args() + + patch = json.load(open(a.patch, encoding="utf-8")) + img = bytearray(open(a.src, "rb").read()) + try: + W = {int(k): v for k, v in json.load(open(a.meta, encoding="utf-8")).items()} + except Exception: + sys.exit(f"нет файла ширин полей {a.meta} — пересоберите редактор") + + bad = [] + n = 0 + for t in patch.get("texts", []): + va, txt = t["va"], t["txt"] + if va not in W: + bad.append(f"неизвестный адрес 0x{va:08X}") + continue + w = W[va] + for ch in txt: + if ch not in CYR and not (0x20 <= ord(ch) <= 0x7E): + bad.append(f"0x{va:08X}: нет глифа для «{ch}»") + if len(txt) > w: + bad.append(f"0x{va:08X}: «{txt}» длиннее поля ({len(txt)} > {w})") + continue + try: + enc = txt.encode("cp1251") + except UnicodeEncodeError as e: + bad.append(f"0x{va:08X}: не кодируется в CP1251 ({e})") + continue + img[va - BASE: va - BASE + w] = enc.ljust(w, b" ") + n += 1 + + lg = patch.get("logo") + if lg: + raw = base64.b64decode(lg["b64"]) + if len(raw) != 288: + bad.append(f"логотип: ожидалось 288 байт, пришло {len(raw)}") + else: + va = lg["va"] + img[va - BASE: va - BASE + 288] = raw + print("логотип обновлён (288 Б)") + + if bad: + print("ОШИБКИ:") + for b in bad: + print(" " + b) + if not n: + sys.exit(1) + + open(a.out, "wb").write(bytes(img)) + print(f"применено текстов: {n}") + print(f"готово: {a.out}, {len(img)} Б") + + +if __name__ == "__main__": + main() diff --git a/tools/build_agent.py b/tools/build_agent.py new file mode 100644 index 0000000..221d936 --- /dev/null +++ b/tools/build_agent.py @@ -0,0 +1,249 @@ +#!/usr/bin/env python3 +"""Интерактивный агент в прошивке: управление FM100B через COM-порт с ПК, без перешивки. + +Протокол (ПК -> рация по USART6): + 0xAA +агент блитит эти len байт в USART3 (модулю). Ответы модуля идут обратно в порт +через снифер-хук on_frame (кадр: F1 F2 <кадр>). Так я с ПК шлю любой кадр +и сразу вижу реакцию — перебор команд (AMBE, record и пр.) вживую. + +Приём с порта — по байту за тик в главном цикле (не блокирует UI, в отличие от зонда). +CPS одновременно не подключать. Основа rt4d_ru_batt.bin, откат — она же. + + python3 build_agent.py + python3 tools/agent.py send 25 01 01 # спросить версию модуля + python3 tools/agent.py raw 68 25 01 01 00 00 00 00 10 +""" +import struct +from keystone import Ks, KS_ARCH_ARM, KS_MODE_THUMB + +BASE = 0x08002800 +SRC = "stock-fw/rt4d_ru_batt.bin" +OUT = "stock-fw/rt4d_agent.bin" + +ON_FRAME = 0x08006348 +FRAME_CALL = 0x08018DD8 +UI_HOOK = 0x08020806 +TICK_FUNC = 0x0801DFD0 +TX_BYTE = 0x08018BFC # usart6_tx_byte(u8) +USART3_TXBUF = 0x08006C9C # usart3_tx_buf(buf,len) +# приём CPS идёт через USART6-ISR, который складывает байты в это кольцо. +# Читаем кольцо по своему указателю — порт/ISR не трогаем, CPS не ломаем. +RING_BUF = 0x200082EF # 4K кольцо RX (маска 0xFFF) +RING_HEAD = 0x20000C60 # u32, растущий индекс записи (из ISR) + +MAGIC_ADDR = 0x2000B000 +MAGIC_VAL = 0x41474E54 # 'AGNT' +ST_STATE = 0x2000B040 # 0=ждём AA, 1=ждём len, 2=собираем +ST_LEN = 0x2000B041 +ST_IDX = 0x2000B042 +ST_BUF = 0x2000B044 # до 64 байт -> 0x2000B084 +MY_TAIL = 0x2000B088 # u32, наш указатель чтения кольца + +EQ, NE, HS, LS, LO = 0, 1, 2, 9, 3 + + +def thumb_bl(src, dst): + off = (dst - (src + 4)) >> 1 + s=(off>>23)&1; i1=(off>>22)&1; i2=(off>>21)&1 + imm10=(off>>11)&0x3FF; imm11=off&0x7FF + j1=(~i1^s)&1; j2=(~i2^s)&1 + return struct.pack(">1)&0x7FF)) if cond is None \ + else struct.pack(">1)&0xFF)) + off+=self._sz(it) + return bytes(out) + + +def main(): + img=bytearray(open(SRC,"rb").read()) + end=BASE+len(img); code_at=(end+3)&~3 + img+=b"\xff"*(code_at-end) + ks=Ks(KS_ARCH_ARM,KS_MODE_THUMB) + def lo(a): return a&0xFFFF + def hi(a): return (a>>16)&0xFFFF + + # ---- agent_poll: читать кольцо RX по своему указателю ---- + # r7 = my_tail (u32). Пока my_tail != head — брать ring[my_tail & 0xFFF]. + poll_at=code_at + a=Asm(ks,poll_at) + a.asm(f""" + push {{r4, r5, r6, r7, lr}} + movw r7, #{lo(MY_TAIL)} + movt r7, #{hi(MY_TAIL)} + ldr r7, [r7] + """) + a.label("ploop") + # head? + a.asm(f""" + movw r0, #{lo(RING_HEAD)} + movt r0, #{hi(RING_HEAD)} + ldr r0, [r0] + cmp r7, r0 + """) + a.b("pret", EQ) + # byte = ring[my_tail & 0xFFF]; my_tail++ + a.asm(f""" + movw r0, #{lo(RING_BUF)} + movt r0, #{hi(RING_BUF)} + ubfx r1, r7, #0, #12 + ldrb r6, [r0, r1] + adds r7, #1 + movw r4, #{lo(ST_STATE)} + movt r4, #{hi(ST_STATE)} + ldrb r5, [r4] + cmp r5, #0 + """) + a.b("s_wait_aa", EQ) + a.asm("cmp r5, #1") + a.b("s_len", EQ) + # state 2: собираем в буфер + a.asm(f""" + movw r0, #{lo(ST_IDX)} + movt r0, #{hi(ST_IDX)} + ldrb r1, [r0] + movw r2, #{lo(ST_BUF)} + movt r2, #{hi(ST_BUF)} + strb r6, [r2, r1] + adds r1, #1 + strb r1, [r0] + movw r0, #{lo(ST_LEN)} + movt r0, #{hi(ST_LEN)} + ldrb r0, [r0] + cmp r1, r0 + """) + a.b("ploop", LO) # idx отправить в USART3 + a.asm(f""" + movw r0, #{lo(ST_BUF)} + movt r0, #{hi(ST_BUF)} + movw r1, #{lo(ST_LEN)} + movt r1, #{hi(ST_LEN)} + ldrb r1, [r1] + bl #{USART3_TXBUF} + movs r0, #0 + strb r0, [r4] + """) + a.b("ploop") + # state 0: ждём 0xAA + a.label("s_wait_aa") + a.asm("cmp r6, #0xAA") + a.b("ploop", NE) + a.asm("movs r0, #1\nstrb r0, [r4]") + a.b("ploop") + # state 1: принять len + a.label("s_len") + a.asm(f""" + movw r0, #{lo(ST_LEN)} + movt r0, #{hi(ST_LEN)} + strb r6, [r0] + movw r0, #{lo(ST_IDX)} + movt r0, #{hi(ST_IDX)} + movs r1, #0 + strb r1, [r0] + movs r0, #2 + strb r0, [r4] + """) + a.b("ploop") + a.label("pret") + a.asm(f""" + movw r0, #{lo(MY_TAIL)} + movt r0, #{hi(MY_TAIL)} + str r7, [r0] + pop {{r4, r5, r6, r7, pc}} + """) + poll=a.build() + + # ---- tick_router: init магии один раз + agent_poll каждый тик ---- + tick_at=poll_at+len(poll) + r=Asm(ks,tick_at) + r.asm(f""" + push {{lr}} + bl #{TICK_FUNC} + movw r0, #{lo(MAGIC_ADDR)} + movt r0, #{hi(MAGIC_ADDR)} + ldr r1, [r0] + movw r2, #{lo(MAGIC_VAL)} + movt r2, #{hi(MAGIC_VAL)} + cmp r1, r2 + """) + r.b("inited", EQ) + r.asm(f""" + str r2, [r0] + movw r0, #{lo(ST_STATE)} + movt r0, #{hi(ST_STATE)} + movs r1, #0 + strb r1, [r0] + movw r0, #{lo(RING_HEAD)} + movt r0, #{hi(RING_HEAD)} + ldr r1, [r0] + movw r0, #{lo(MY_TAIL)} + movt r0, #{hi(MY_TAIL)} + str r1, [r0] + """) + r.label("inited") + r.asm(f"bl #{poll_at | 1}\npop {{pc}}") + tick=r.build() + + # ---- снифер on_frame ---- + hook_at=tick_at+len(tick) + h=Asm(ks,hook_at) + h.asm(f""" + push {{r4, r5, r6, lr}} + mov r4, r0 + ldrb r5, [r4, #6] + ldrb r6, [r4, #7] + orr.w r5, r6, r5, lsl #8 + adds r5, #9 + uxtb r5, r5 + movs r0, #0xF1 + bl #{TX_BYTE} + movs r0, #0xF2 + bl #{TX_BYTE} + mov r0, r5 + bl #{TX_BYTE} + movs r6, #0 + """) + h.label("sloop") + h.asm("cmp r6, r5") + h.b("sdone", HS) + h.asm(f"ldrb r0, [r4, r6]\nbl #{TX_BYTE}\nadds r6, #1") + h.b("sloop") + h.label("sdone") + h.asm(f"mov r0, r4\nbl #{ON_FRAME}\npop {{r4, r5, r6, pc}}") + hook=h.build() + + code=poll+tick+hook + img+=code + while len(img)%4: img.append(0xFF) + print(f"poll 0x{poll_at:08X} ({len(poll)}Б), tick 0x{tick_at:08X}, hook 0x{hook_at:08X}") + + img[UI_HOOK-BASE:UI_HOOK-BASE+4]=thumb_bl(UI_HOOK,tick_at) + img[FRAME_CALL-BASE:FRAME_CALL-BASE+4]=thumb_bl(FRAME_CALL,hook_at) + open(OUT,"wb").write(bytes(img)) + print(f"готово: {OUT}, {len(img)} Б") + + +if __name__=="__main__": + main() diff --git a/tools/build_batt.py b/tools/build_batt.py new file mode 100644 index 0000000..894bda7 --- /dev/null +++ b/tools/build_batt.py @@ -0,0 +1,161 @@ +#!/usr/bin/env python3 +"""Напряжение батареи вместо штатной иконки + уборка полосы у всплывающего окна. + +Патчи: + 1. Свой код в свободном месте после конца образа (0x08029000): + stub — пустышка `bx lr` + batt_draw — рисует "8.4V" мелким шрифтом 5x8 на странице 0 + tick_router — вызывает оригинал, затем batt_draw (только на главном экране) + 2. `bl 0x08008300` @0x080148E2 — отрисовка штатной шкалы -> stub (иконки больше нет). + 3. `bl 0x08010A00` @0x0801E2A4 — «напряжение -> индекс 0..3» убрано (2 x nop), + чтобы флаг перерисовки взводился на каждые 0.1 В, а не только на порогах. + 4. `bl 0x0800842C` @0x080085DE — верхняя полоса рамки всплывающего окна убрана. + 5. `bl 0x0801DFD0` @0x08020806 — последний вызов цепочки отрисовки в ui_tick_normal + перенаправлен на tick_router. + +Почему через конец цикла: раньше мы рисовали из середины кадра (из цепочки обновления +батареи), и любой более поздний вывод затирал цифры — при входящем вызове «7» теряла +перекладину и читалась как «1». Теперь наш текст ложится последним и перекрывает всё. +""" +import struct +from keystone import Ks, KS_ARCH_ARM, KS_MODE_THUMB + +BASE = 0x08002800 +SRC = "stock-fw/rt4d_ru_full.bin" +OUT = "stock-fw/rt4d_ru_batt.bin" + +SMALL_CHAR = 0x080089AC # void small_char(u8 page, u8 x, u8 ch, u8 dim) +BATT_VOLT = 0x200008B0 # u16, напряжение * 10 +G_SCREEN = 0x200008B3 # u8, текущий экран (0 = главный) + +GAUGE_CALL = 0x080148E2 # bl 0x08008300 — штатная шкала батареи +GAUGE_FUNC = 0x08008300 +LEVEL_CALL = 0x0801E2A4 # bl 0x08010A00 — напряжение -> индекс +LEVEL_FUNC = 0x08010A00 +TOPBAR_CALL = 0x080085DE # bl fill_col_run(page=1) — верхняя полоса рамки +FILL_RUN = 0x0800842C +TICK_CALL = 0x08020806 # bl 0x0801DFD0 — последний вызов отрисовки за кадр +TICK_FUNC = 0x0801DFD0 + +MYCODE = 0x08029000 +X0, X1, X2, X3 = 108, 113, 118, 123 # позиции четырёх символов + + +def thumb_bl(src: int, dst: int) -> bytes: + off = dst - (src + 4) + assert -(1 << 24) <= off < (1 << 24), "цель BL слишком далеко" + off >>= 1 + s = (off >> 23) & 1 + i1 = (off >> 22) & 1 + i2 = (off >> 21) & 1 + imm10 = (off >> 11) & 0x3FF + imm11 = off & 0x7FF + j1 = (~i1 ^ s) & 1 + j2 = (~i2 ^ s) & 1 + return struct.pack("индекс") + o_bar = check(TOPBAR_CALL, FILL_RUN, "верхняя полоса рамки") + o_tick = check(TICK_CALL, TICK_FUNC, "хвост отрисовки") + print("все четыре точки патча подтверждены") + + # ---- раскладка своего кода ---- + stub_addr = MYCODE + stub = bytes(ks.asm("bx lr", stub_addr)[0]) + + batt_addr = stub_addr + len(stub) + batt_asm = f""" + push {{r4, r5, r6, lr}} + movw r4, #{BATT_VOLT & 0xFFFF} + movt r4, #{(BATT_VOLT >> 16) & 0xFFFF} + ldrh r4, [r4] + uxtb r4, r4 + movs r1, #205 + muls r1, r4, r1 + lsrs r5, r1, #11 + movs r1, #10 + muls r1, r5, r1 + subs r4, r4, r1 + movs r0, #0 + movs r1, #{X0} + mov r2, r5 + add r2, #0x30 + movs r3, #0 + bl #{SMALL_CHAR} + movs r0, #0 + movs r1, #{X1} + movs r2, #0x2E + movs r3, #0 + bl #{SMALL_CHAR} + movs r0, #0 + movs r1, #{X2} + mov r2, r4 + add r2, #0x30 + movs r3, #0 + bl #{SMALL_CHAR} + movs r0, #0 + movs r1, #{X3} + movs r2, #0x56 + movs r3, #0 + bl #{SMALL_CHAR} + pop {{r4, r5, r6, pc}} + """ + batt = bytes(ks.asm(batt_asm, batt_addr)[0]) + + # tick_router: оригинал -> проверка экрана -> batt_draw. + # keystone не умеет метки, поэтому условный переход кодируем вручную. + tick_addr = batt_addr + len(batt) + partA = bytes(ks.asm(f""" + push {{r4, lr}} + bl #{TICK_FUNC} + movw r4, #{G_SCREEN & 0xFFFF} + movt r4, #{(G_SCREEN >> 16) & 0xFFFF} + ldrb r4, [r4] + cmp r4, #0 + """, tick_addr)[0]) + bne_addr = tick_addr + len(partA) + partB = bytes(ks.asm(f"bl #{batt_addr}", bne_addr + 2)[0]) + bne = struct.pack(" за partB + partC = bytes(ks.asm("pop {r4, pc}", bne_addr + 2 + len(partB))[0]) + tick = partA + bne + partB + partC + + code = stub + batt + tick + print(f"свой код: {len(code)} Б (stub 0x{stub_addr:08X}, " + f"batt_draw 0x{batt_addr:08X}, tick_router 0x{tick_addr:08X})") + + img += code + while len(img) % 4: + img.append(0xFF) + + # ---- патчи ---- + img[o_gauge:o_gauge + 4] = thumb_bl(GAUGE_CALL, stub_addr) + print("штатная шкала батареи отключена") + img[o_level:o_level + 4] = b"\x00\xbf\x00\xbf" + print("преобразование в индекс убрано — перерисовка на каждые 0.1 В") + img[o_bar:o_bar + 4] = b"\x00\xbf\x00\xbf" + print("верхняя полоса рамки убрана") + img[o_tick:o_tick + 4] = thumb_bl(TICK_CALL, tick_addr) + print("вывод напряжения перевешен на конец кадра") + + open(OUT, "wb").write(bytes(img)) + print(f"готово: {OUT}, {len(img)} Б") + + +if __name__ == "__main__": + main() diff --git a/tools/build_probe.py b/tools/build_probe.py new file mode 100644 index 0000000..26ca6d5 --- /dev/null +++ b/tools/build_probe.py @@ -0,0 +1,213 @@ +#!/usr/bin/env python3 +"""Зонд достижимости AMBE: при старте шлёт FM100B «enable» по диапазону команд, +затем работает обычной рацией + снифер логирует всё, что модуль отдаёт. + +Идея: если какая-то из перебираемых команд включает выдачу голосового AMBE +(модемный примитив ATC_RecordEn/RecvAmbe), то при входящем вызове в порт пойдёт +поток ~27-байтовых кадров, которых в стоке нет. Диапазон сужаем бинарно, меняя LIST. + + python3 build_probe.py "0x40-0x6F" # первый прогон — весь диапазон + python3 build_probe.py "0x50-0x5F" # сузить + python3 tools/sniff.py 30 --raw # смотреть поток при вызове + +Безопасность: исключены 0x3E (прошивка модуля) и уже используемые команды. +Основа rt4d_ru_batt.bin; откат — она же. +""" +import struct, sys +from keystone import Ks, KS_ARCH_ARM, KS_MODE_THUMB + +BASE = 0x08002800 +SRC = "stock-fw/rt4d_ru_batt.bin" +OUT = "stock-fw/rt4d_probe.bin" + +ON_FRAME = 0x08006348 +FRAME_CALL = 0x08018DD8 +UI_HOOK = 0x08020806 +TICK_FUNC = 0x0801DFD0 +FM_SEND1 = 0x0801B044 # void fm100b_send1(cmd,b,sub,data, respbuf, timeout) +TX_BYTE = 0x08018BFC # порт к ПК +MAGIC_ADDR = 0x2000B000 +MAGIC_VAL = 0x50524F42 # 'PROB' +RESP_BUF = 0x2000B020 # scratch для respbuf fm100b_send1 + +USED = {0x3E, 0x42, 0x48, 0x49, 0x4C, 0x4D, 0x55, 0x57, 0x62, + 0x05, 0x06, 0x07, 0x09, 0x0A, 0x25, 0x59, 0x60} +EQ, NE, HS, LS = 0, 1, 2, 9 + + +def parse_range(s): + a, b = s.split("-") + lo, hi = int(a, 16), int(b, 16) + return [c for c in range(lo, hi + 1) if c not in USED] + + +def thumb_bl(src, dst): + off = (dst - (src + 4)) >> 1 + s = (off >> 23) & 1; i1 = (off >> 22) & 1; i2 = (off >> 21) & 1 + imm10 = (off >> 11) & 0x3FF; imm11 = off & 0x7FF + j1 = (~i1 ^ s) & 1; j2 = (~i2 ^ s) & 1 + return struct.pack(">1)&0x7FF)) + else: out+=struct.pack(">1)&0xFF)) + off+=self._sz(it) + return bytes(out) + + +def main(): + rng = sys.argv[1] if len(sys.argv) > 1 else "0x40-0x6F" + cand = parse_range(rng) + print(f"диапазон {rng} -> {len(cand)} кандидатов: {' '.join('%02X'%c for c in cand)}") + + img = bytearray(open(SRC, "rb").read()) + end = BASE + len(img); code_at = (end+3)&~3 + img += b"\xff"*(code_at-end) + ks = Ks(KS_ARCH_ARM, KS_MODE_THUMB) + def lo(a): return a & 0xFFFF + def hi(a): return (a>>16)&0xFFFF + + # таблица кандидатов (байты) + завершающий 0x00 + tbl = bytes(cand) + b"\x00" + + # ---- probe_once: разослать enable всем кандидатам ---- + # табличка лежит сразу после кода; адрес вычислим после сборки — двухпроходно: + # проще положить таблицу ПЕРЕД функцией и адресовать movw. + tbl_at = code_at + probe_at = tbl_at + len(tbl) + if probe_at & 1: probe_at += 1 # выравнивание для кода + pad = probe_at - (tbl_at + len(tbl)) + + p = Asm(ks, probe_at) + p.asm(f""" + push {{r4, r5, lr}} + movw r4, #{lo(tbl_at)} + movt r4, #{hi(tbl_at)} + """) + p.label("ploop") + p.asm("ldrb r5, [r4]\ncmp r5, #0") + p.b("pdone", EQ) + # маркер в порт: F3 F3 cmd + p.asm(f""" + movs r0, #0xF3 + bl #{TX_BYTE} + movs r0, #0xF3 + bl #{TX_BYTE} + mov r0, r5 + bl #{TX_BYTE} + """) + # fm100b_send1(cmd=r5, b=1, sub=1, data=1, respbuf, timeout=0x64) + p.asm(f""" + sub sp, #8 + movw r0, #{lo(RESP_BUF)} + movt r0, #{hi(RESP_BUF)} + str r0, [sp] + movs r0, #0x64 + str r0, [sp, #4] + mov r0, r5 + movs r1, #1 + movs r2, #1 + movs r3, #1 + bl #{FM_SEND1} + add sp, #8 + adds r4, #1 + """) + p.b("ploop") + p.label("pdone") + p.asm("pop {r4, r5, pc}") + probe = p.build() + + # ---- tick_router: один раз вызвать probe_once ---- + tick_at = probe_at + len(probe) + r = Asm(ks, tick_at) + r.asm(f""" + push {{lr}} + bl #{TICK_FUNC} + movw r0, #{lo(MAGIC_ADDR)} + movt r0, #{hi(MAGIC_ADDR)} + ldr r1, [r0] + movw r2, #{lo(MAGIC_VAL)} + movt r2, #{hi(MAGIC_VAL)} + cmp r1, r2 + """) + r.b("done", EQ) + r.asm(f""" + str r2, [r0] + bl #{probe_at | 1} + """) + r.label("done") + r.asm("pop {pc}") + tick = r.build() + + # ---- ta_hook = снифер: F1 F2 len + кадр + passthrough ---- + hook_at = tick_at + len(tick) + h = Asm(ks, hook_at) + h.asm(f""" + push {{r4, r5, r6, lr}} + mov r4, r0 + ldrb r5, [r4, #6] + ldrb r6, [r4, #7] + orr.w r5, r6, r5, lsl #8 + adds r5, #9 + uxtb r5, r5 + movs r0, #0xF1 + bl #{TX_BYTE} + movs r0, #0xF2 + bl #{TX_BYTE} + mov r0, r5 + bl #{TX_BYTE} + movs r6, #0 + """) + h.label("sloop") + h.asm("cmp r6, r5") + h.b("sdone", HS) + h.asm(f""" + ldrb r0, [r4, r6] + bl #{TX_BYTE} + adds r6, #1 + """) + h.b("sloop") + h.label("sdone") + h.asm(f""" + mov r0, r4 + bl #{ON_FRAME} + pop {{r4, r5, r6, pc}} + """) + hook = h.build() + + code = tbl + b"\x00"*pad + probe + tick + hook + img += code + while len(img) % 4: img.append(0xFF) + print(f"таблица 0x{tbl_at:08X}, probe 0x{probe_at:08X}, tick 0x{tick_at:08X}, hook 0x{hook_at:08X}") + + img[UI_HOOK-BASE:UI_HOOK-BASE+4] = thumb_bl(UI_HOOK, tick_at) + img[FRAME_CALL-BASE:FRAME_CALL-BASE+4] = thumb_bl(FRAME_CALL, hook_at) + open(OUT,"wb").write(bytes(img)) + print(f"готово: {OUT}, {len(img)} Б") + + +if __name__ == "__main__": + main() diff --git a/tools/build_sniffer.py b/tools/build_sniffer.py new file mode 100644 index 0000000..9f2f16a --- /dev/null +++ b/tools/build_sniffer.py @@ -0,0 +1,99 @@ +#!/usr/bin/env python3 +"""Диагностическая сборка: зеркалит все кадры от DMR-модуля в USB-порт. + +Перехватывается единственный вызов `fm100b_on_frame` (0x08006348) из разборщика +кадров. Наша функция выдаёт в компьютерный порт маркер F1 F2, длину и сам кадр, +после чего передаёт управление штатному обработчику — логика радио не меняется. + + python3 build_sniffer.py # -> stock-fw/rt4d_sniffer.bin + python3 tools/flash_ps.py stock-fw/rt4d_sniffer.bin + python3 tools/sniff.py 60 # слушать 60 секунд + +Сборка временная: для обычной работы вернуть stock-fw/rt4d_ru_batt.bin. +""" +import struct +from keystone import Ks, KS_ARCH_ARM, KS_MODE_THUMB + +BASE = 0x08002800 +SRC = "stock-fw/rt4d_ru_batt.bin" +OUT = "stock-fw/rt4d_sniffer.bin" + +ON_FRAME = 0x08006348 # void fm100b_on_frame(u8 *frame) +CALL_SITE = 0x08018DD8 # единственный bl на него +TX_BYTE = 0x08018BFC # void usart6_tx_byte(u8) — порт к компьютеру + + +def thumb_bl(src, dst): + off = (dst - (src + 4)) >> 1 + s = (off >> 23) & 1; i1 = (off >> 22) & 1; i2 = (off >> 21) & 1 + imm10 = (off >> 11) & 0x3FF; imm11 = off & 0x7FF + j1 = (~i1 ^ s) & 1; j2 = (~i2 ^ s) & 1 + return struct.pack("> 1 + blt = struct.pack(" 00.. 10 + Сток payload этой команды выбрасывает (обработчик = nop; b default). + +Наши патчи (поверх rt4d_ru_batt.bin — там уже вольтметр и роутер отрисовки): + • ta_hook перехватывает fm100b_on_frame: на 0x60 копирует позывной в буфер RAM + и ставит ta_valid; на 0x59 payload=0 (конец приёма) сбрасывает ta_valid; + затем всегда вызывает штатный обработчик. + • new_tick_router (последним за кадр): самоинициализация настроек по «магии», + затем на главном экране рисует вольтметр и — если включено и есть свежий + позывной — сам позывной внизу экрана. + +Буфер RAM 0x2000C7FC..: [magic4][en][valid][len][txt16] (свободный зазор SRAM). +Настройка ta_en инициализируется в 1 при каждом включении (постоянное хранение — +шаг 2, вместе с меню). Откат — rt4d_ru_batt.bin. +""" +import struct +from keystone import Ks, KS_ARCH_ARM, KS_MODE_THUMB + +BASE = 0x08002800 +SRC = "stock-fw/rt4d_ru_batt.bin" +OUT = "stock-fw/rt4d_ta.bin" + +DRAW_STRING = 0x08008A50 # void draw_string(page,x,s,len, mode@[sp]) +BIG_CHAR = 0x08008100 # void big_char(page,x,ch,mode) — крупный шрифт 11x24 частоты +ON_FRAME = 0x08006348 # void fm100b_on_frame(u8 *frame) +FRAME_CALL = 0x08018DD8 # единственный bl on_frame +UI_HOOK = 0x08020806 # последний вызов отрисовки в ui_tick_normal +TICK_FUNC = 0x0801DFD0 # оригинал этого вызова +BATT_DRAW = 0x08029002 # уже в rt4d_ru_batt.bin +G_SCREEN = 0x200008B3 + +# Буфер в окне [0x2000AE48 .. 0x2000B108): выше вершины стека (SP=0x2000AE48, +# растёт вниз), ниже первого глобала (0x2000B108). Ничья 192-байтовая зона — +# в отличие от прошлого 0x2000C7FC, который оказался внутри чужого буфера. +MAGIC_ADDR = 0x2000B000 +MAGIC_VAL = 0x52543444 # 'RT4D' +TA_EN = 0x2000B004 +TA_VAL = 0x2000B005 +TA_LEN = 0x2000B006 +TA_TXT = 0x2000B007 # 16 байт -> до 0x2000B017 +TA_PAGE = 3 # ниже ID, крупный шрифт 24px (страницы 3-5) + +EQ, NE, HS, LS, GE = 0, 1, 2, 9, 10 + + +def thumb_bl(src, dst): + off = (dst - (src + 4)) >> 1 + s = (off >> 23) & 1; i1 = (off >> 22) & 1; i2 = (off >> 21) & 1 + imm10 = (off >> 11) & 0x3FF; imm11 = off & 0x7FF + j1 = (~i1 ^ s) & 1; j2 = (~i2 ^ s) & 1 + return struct.pack("> 1) & 0xFF + if cond is None: + out += struct.pack("> 1) & 0x7FF)) + else: + out += struct.pack("> 16) & 0xFFFF + + # ---- ta_draw: позывной крупным шрифтом (11x24) по центру экрана ---- + # ширина символа 12px, высота 24px (страницы 2-4 = вертикальный центр). + # x0 = (128 - len*12)/2 = 64 - len*6. Длину зажимаем к 10 (10*12=120<=128). + ta_draw_at = code_at + a = Asm(ks, ta_draw_at) + a.asm(f""" + push {{r4, r5, r6, r7, lr}} + movw r4, #{hexlo(TA_LEN)} + movt r4, #{hexhi(TA_LEN)} + ldrb r4, [r4] + cmp r4, #10 + """) + a.b("len_ok", LS) + a.asm("movs r4, #10") + a.label("len_ok") + a.asm(f""" + movs r0, #6 + muls r0, r4, r0 + movs r5, #64 + subs r5, r5, r0 + movw r6, #{hexlo(TA_TXT)} + movt r6, #{hexhi(TA_TXT)} + movs r7, #0 + """) + a.label("cloop") + a.asm("cmp r7, r4") + a.b("cdone", HS) + a.asm(f""" + ldrb r2, [r6, r7] + mov r1, r5 + movs r0, #{TA_PAGE} + movs r3, #0 + bl #{BIG_CHAR} + adds r5, #12 + adds r7, #1 + """) + a.b("cloop") + a.label("cdone") + a.asm("pop {r4, r5, r6, r7, pc}") + ta_draw = a.build() + + # ---- new_tick_router ---- + tick_at = ta_draw_at + len(ta_draw) + r = Asm(ks, tick_at) + r.asm(f""" + push {{r4, lr}} + bl #{TICK_FUNC} + movw r0, #{hexlo(MAGIC_ADDR)} + movt r0, #{hexhi(MAGIC_ADDR)} + ldr r1, [r0] + movw r2, #{hexlo(MAGIC_VAL)} + movt r2, #{hexhi(MAGIC_VAL)} + cmp r1, r2 + """) + r.b("skipinit", EQ) + r.asm(f""" + str r2, [r0] + movw r0, #{hexlo(TA_EN)} + movt r0, #{hexhi(TA_EN)} + movs r3, #1 + strb r3, [r0] + movw r0, #{hexlo(TA_VAL)} + movt r0, #{hexhi(TA_VAL)} + movs r3, #0 + strb r3, [r0] + """) + r.label("skipinit") + # вольтметр — только на главном экране (screen==0) + r.asm(f""" + movw r4, #{hexlo(G_SCREEN)} + movt r4, #{hexhi(G_SCREEN)} + ldrb r4, [r4] + cmp r4, #0 + """) + r.b("no_batt", NE) + r.asm(f"bl #{BATT_DRAW}") + r.label("no_batt") + # ДИАГНОСТИКА: позывной рисуем на ЛЮБОМ экране, если есть свежий TA + # (условие en временно убрано — сначала убедимся, что приём работает) + r.asm(f""" + movw r0, #{hexlo(TA_VAL)} + movt r0, #{hexhi(TA_VAL)} + ldrb r0, [r0] + cmp r0, #0 + """) + r.b("end", EQ) + r.asm(f"bl #{ta_draw_at | 1}") + r.label("end") + r.asm("pop {r4, pc}") + tick = r.build() + + # ---- ta_hook ---- + hook_at = tick_at + len(tick) + h = Asm(ks, hook_at) + h.asm(""" + push {r4, r5, r6, lr} + mov r4, r0 + ldrb r5, [r4, #1] + cmp r5, #0x60 + """) + h.b("check59", NE) + # handle 0x60: len = frame[10], clamp 16 + h.asm(""" + ldrb r5, [r4, #10] + cmp r5, #16 + """) + h.b("len_ok", LS) + h.asm("movs r5, #16") + h.label("len_ok") + h.asm("movs r6, #0") + h.label("loop") + h.asm(""" + cmp r6, r5 + """) + h.b("afterloop", HS) + h.asm(f""" + adds r0, r4, #11 + ldrb r0, [r0, r6] + movw r1, #{hexlo(TA_TXT)} + movt r1, #{hexhi(TA_TXT)} + strb r0, [r1, r6] + adds r6, #1 + """) + h.b("loop") + h.label("afterloop") + h.asm(f""" + movw r1, #{hexlo(TA_LEN)} + movt r1, #{hexhi(TA_LEN)} + strb r5, [r1] + movw r1, #{hexlo(TA_VAL)} + movt r1, #{hexhi(TA_VAL)} + movs r0, #1 + strb r0, [r1] + """) + h.b("pass") + h.label("check59") + # кадр 0x06 = начало (sub 0x60) или конец (sub 0x6f) вызова -> сброс позывного. + # На начало сброс срабатывает ДО прихода 0x60 (TA), поэтому не мешает показу. + h.asm("cmp r5, #0x06") + h.b("pass", NE) + h.asm(f""" + movw r1, #{hexlo(TA_VAL)} + movt r1, #{hexhi(TA_VAL)} + movs r0, #0 + strb r0, [r1] + """) + h.label("pass") + h.asm(f""" + mov r0, r4 + bl #{ON_FRAME} + pop {{r4, r5, r6, pc}} + """) + hook = h.build() + + code = ta_draw + tick + hook + img += code + while len(img) % 4: + img.append(0xFF) + print(f"код: ta_draw 0x{ta_draw_at:08X} ({len(ta_draw)}Б), " + f"tick 0x{tick_at:08X} ({len(tick)}Б), hook 0x{hook_at:08X} ({len(hook)}Б)") + + # репоинты + img[UI_HOOK - BASE: UI_HOOK - BASE + 4] = thumb_bl(UI_HOOK, tick_at) + img[FRAME_CALL - BASE: FRAME_CALL - BASE + 4] = thumb_bl(FRAME_CALL, hook_at) + print("UI-хук -> new_tick_router; on_frame -> ta_hook") + + open(OUT, "wb").write(bytes(img)) + print(f"готово: {OUT}, {len(img)} Б") + + +if __name__ == "__main__": + main() diff --git a/tools/display-editor/firmware-editor.html b/tools/display-editor/firmware-editor.html new file mode 100644 index 0000000..8e03ab4 --- /dev/null +++ b/tools/display-editor/firmware-editor.html @@ -0,0 +1,360 @@ + + + + + +RT-4D — редактор прошивки + + + + + +
+
+

Редактор прошивки RT-4D

+ содержимое взято из текущей прошивки рации +
+ + + +
+
+

Разделы

    +

    —

    +
    +

    Ширина пункта — 14 символов. Показ справа — как это нарисует рация + тем же шрифтом, что в прошивке. Строчных русских букв в шрифте нет, поэтому + ввод переводится в заглавные; неизвестные символы подсвечиваются красной рамкой.

    +
    + +
    +
    +
    +
    +
    +

    Варианты выбора в меню (Вкл/Выкл, списки шагов, режимов). Ширина 16 символов.

    +
    + +
    +
    +
    +
    +
    +

    Служебные надписи и сообщения. Ширина у каждой своя — она задана + местом в прошивке и увеличить её нельзя.

    +
    + + +
    + +
    + изменений: 0 + правьте текст — я соберу патч и залью в рацию + + + +
    + + + + + diff --git a/tools/display-editor/index.html b/tools/display-editor/index.html new file mode 100644 index 0000000..1e2702f --- /dev/null +++ b/tools/display-editor/index.html @@ -0,0 +1,462 @@ + + + + + +RT-4D — конструктор дисплея + + + + + +
    +
    +

    Конструктор дисплея RT-4D

    + шрифты и координаты — из самой прошивки + 128 × 64 · 8 страниц по 8 строк +
    + +
    +
    +
    +
    + + + + + + + + +
    +
    +
    +
    + курсор — + страница — + элементов 0 +
    +
    +
    + +
    +

    Вызовы отрисовки

    +
    коллизий нет
    + 
    
+    
    
+  
    
+
+  
    
+    
    
+      
    Элементы
    
+      
      
+    
      
+
+    
      
+      
      Свойства
      
+      
      Выберите элемент на дисплее.
      
+    
      
+
+    
      
+      
      Макет
      
+      
      
+        
      
+          
+          
+          
+        
      
+        
      Стрелками — сдвиг на 1 пиксель, с Shift — на 8. Текст по вертикали
+        встаёт только на границу страницы: вывод адресуется страницами, а не строками.
      
+      
      
+    
      
+  
      
+
      
+
      
+
+
+
+
+
diff --git a/tools/flash_ps.py b/tools/flash_ps.py
new file mode 100644
index 0000000..64077ef
--- /dev/null
+++ b/tools/flash_ps.py
@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""Прошивка RT-4D из WSL через powershell.exe (WSL2 не отдаёт COM напрямую).
+
+    python3 tools/flash_ps.py stock-fw/rt4d_ru_batt.bin [--port COM4]
+
+Рация должна быть в режиме прошивки: выключить -> включить, удерживая тангенту PTT.
+
+Протокол бутлоадера (тот же, что в flash_rt4d.py):
+    рукопожатие : слать 0xFF, пока не придёт 0xFF
+    стирание    : [39 33 05 10]+CK, затем [39 33 05 55]+CK  -> ACK 0x06
+    запись      : [57 hi lo] + 1024 Б + CK                  -> ACK 0x06
+    CK = (0x48 + сумма) & 0xFF
+"""
+import argparse, os, shutil, subprocess, sys
+
+WIN_TMP_WSL = "/mnt/c/Users/vikto/AppData/Local/Temp"
+WIN_TMP_WIN = r"C:\Users\vikto\AppData\Local\Temp"
+
+PS = r'''
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$fw = [System.IO.File]::ReadAllBytes("{fwpath}")
+$p = New-Object System.IO.Ports.SerialPort "{port}",115200,"None",8,"one"
+$p.ReadTimeout = 250
+$p.WriteTimeout = 5000
+try {{ $p.Open() }} catch {{ Write-Output "ERR: порт занят или недоступен: $($_.Exception.Message)"; exit 1 }}
+
+Write-Output "INFO: прошивка $($fw.Length) байт, порт {port}"
+
+# --- рукопожатие ---
+$p.DiscardInBuffer()
+$ready = $false
+$sw = [Diagnostics.Stopwatch]::StartNew()
+while ($sw.ElapsedMilliseconds -lt 8000) {{
+  try {{ if ($p.ReadByte() -eq 0xFF) {{ $ready = $true; break }} }}
+  catch {{ $p.Write([byte[]]@(0xFF), 0, 1) }}
+}}
+if (-not $ready) {{
+  Write-Output "ERR: бутлоадер не отвечает. Выключите рацию и включите с зажатой тангентой PTT."
+  $p.Close(); exit 1
+}}
+Write-Output "INFO: бутлоадер найден"
+
+# --- стирание ---
+foreach ($trig in 0x10, 0x55) {{
+  $pl = [byte[]]@(0x39, 0x33, 0x05, $trig, 0)
+  $s = 0x48; for ($i = 0; $i -lt 4; $i++) {{ $s = ($s + $pl[$i]) -band 0xFF }}
+  $pl[4] = [byte]$s
+  $p.DiscardInBuffer(); $p.Write($pl, 0, 5)
+  $ok = $false; $sw2 = [Diagnostics.Stopwatch]::StartNew()
+  while ($sw2.ElapsedMilliseconds -lt 6000) {{ try {{ if ($p.ReadByte() -eq 6) {{ $ok = $true; break }} }} catch {{}} }}
+  if (-not $ok) {{ Write-Output "ERR: ошибка стирания"; $p.Close(); exit 1 }}
+}}
+Write-Output "INFO: область приложения стёрта"
+
+# --- дополнение до кратности 1024 ---
+$pad = (1024 - ($fw.Length % 1024)) % 1024
+if ($pad -gt 0) {{
+  $t = New-Object byte[] ($fw.Length + $pad)
+  [Array]::Copy($fw, $t, $fw.Length)
+  for ($i = $fw.Length; $i -lt $t.Length; $i++) {{ $t[$i] = 0xFF }}
+  $fw = $t
+}}
+$total = $fw.Length
+$blocks = $total / 1024
+
+# --- запись ---
+$pl = New-Object byte[] 1028
+for ($off = 0; $off -lt $total; $off += 1024) {{
+  $pl[0] = 0x57
+  $pl[1] = [byte](($off -shr 8) -band 0xFF)
+  $pl[2] = [byte]($off -band 0xFF)
+  [Array]::Copy($fw, $off, $pl, 3, 1024)
+  $s = 0x48
+  for ($i = 0; $i -lt 1027; $i++) {{ $s = ($s + $pl[$i]) -band 0xFF }}
+  $pl[1027] = [byte]$s
+  $p.DiscardInBuffer(); $p.Write($pl, 0, 1028)
+  $ok = $false; $sw3 = [Diagnostics.Stopwatch]::StartNew()
+  while ($sw3.ElapsedMilliseconds -lt 4000) {{ try {{ if ($p.ReadByte() -eq 6) {{ $ok = $true; break }} }} catch {{}} }}
+  if (-not $ok) {{ Write-Output ("ERR: нет ACK на блоке 0x{{0:X5}}" -f $off); $p.Close(); exit 1 }}
+  $n = ($off / 1024) + 1
+  if (($n % 16) -eq 0 -or $n -eq $blocks) {{ Write-Output ("PROG: {{0}}/{{1}} блоков" -f $n, $blocks) }}
+}}
+$p.Close()
+Write-Output "OK: записано. Выключите и включите рацию обычным образом."
+'''
+
+
+def find_port() -> str:
+    out = subprocess.run(["powershell.exe", "-NoProfile", "-Command",
+                          "[System.IO.Ports.SerialPort]::GetPortNames() -join ','"],
+                         capture_output=True, text=True).stdout
+    ports = [p for p in out.strip().replace("\r", "").split(",") if p]
+    if not ports:
+        sys.exit("COM-порт не найден — подключите рацию.")
+    return ports[0]
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("firmware")
+    ap.add_argument("--port")
+    a = ap.parse_args()
+
+    fw = os.path.abspath(a.firmware)
+    if not os.path.exists(fw):
+        sys.exit(f"нет файла: {fw}")
+    name = "rt4d_flash_tmp.bin"
+    shutil.copy(fw, os.path.join(WIN_TMP_WSL, name))
+    win_fw = os.path.join(WIN_TMP_WIN, name)
+
+    port = a.port or find_port()
+    script = PS.format(fwpath=win_fw.replace("\\", "\\\\"), port=port)
+
+    proc = subprocess.Popen(["powershell.exe", "-NoProfile", "-Command", script],
+                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                            text=True, encoding='utf-8', errors='replace')
+    rc = 0
+    for line in proc.stdout:
+        line = line.rstrip("\r\n")
+        if line:
+            print(line, flush=True)
+            if line.startswith("ERR:"):
+                rc = 1
+    proc.wait()
+    sys.exit(rc or proc.returncode)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/hotspot_rxoffset_sweep.py b/tools/hotspot_rxoffset_sweep.py
new file mode 100644
index 0000000..1b72bf4
--- /dev/null
+++ b/tools/hotspot_rxoffset_sweep.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Подбор RXOffset хотспота под смещённую TX-частоту рации (без прибора).
+
+Идея: TX рации смещена на постоянный X Гц (дефолтная калибровка). Двигаем приёмное
+смещение хотспота (RXOffset) и при передаче рации (PTT) ищем в логе MMDVMHost
+«received RF» — значит offset поймал передачу. По BER выбираем лучший.
+
+Запуск на самом хотспоте (или по SSH). Владелец УДЕРЖИВАЕТ PTT на DMR-канале во время
+каждого шага (окно ~6 с). Меняет RXOffset в MMDVM.ini, рестартит MMDVMHost, читает лог.
+
+    python3 hotspot_rxoffset_sweep.py --range 1000 --step 100 --dwell 7
+
+Требует sudo (запись MMDVM.ini + restart). Значения offset в Гц.
+"""
+import argparse, subprocess, re, time, sys
+
+INI = "/opt/MMDVMHost/MMDVM.ini"
+SVC = "radiostar-mmdvmhost"
+
+
+def set_rxoffset(val):
+    # заменить RXOffset= в секции [Modem], сохранив регистр
+    sub = subprocess.run(
+        ["sudo","sed","-i",f"s/^RXOffset=.*/RXOffset={val}/",INI],
+        capture_output=True, text=True)
+    return sub.returncode == 0
+
+
+def restart():
+    subprocess.run(["sudo","systemctl","restart",SVC],capture_output=True)
+
+
+def watch_rf(dwell):
+    """слушать журнал dwell секунд, вернуть (got_rf, ber)"""
+    t0 = time.time()
+    got = False; ber = None
+    proc = subprocess.Popen(
+        ["sudo","journalctl","-u",SVC,"-f","--since","now","-o","cat"],
+        stdout=subprocess.PIPE, text=True)
+    try:
+        while time.time() - t0 < dwell:
+            line = proc.stdout.readline()
+            if not line: continue
+            if "received RF" in line or "RF voice" in line or "RF late entry" in line:
+                got = True
+                m = re.search(r"BER:\s*([\d.]+)", line)
+                if m: ber = float(m.group(1))
+            if "BER:" in line and "RF" in line:
+                m = re.search(r"BER:\s*([\d.]+)", line)
+                if m: ber = float(m.group(1))
+    finally:
+        proc.terminate()
+    return got, ber
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--range", type=int, default=1000, help="± Гц")
+    ap.add_argument("--step", type=int, default=100)
+    ap.add_argument("--dwell", type=int, default=7)
+    a = ap.parse_args()
+
+    offsets = list(range(-a.range, a.range+1, a.step))
+    # порядок: от центра наружу
+    offsets.sort(key=lambda x: abs(x))
+    print(f"перебор RXOffset {offsets[0]}..{offsets[-1]} Гц, шаг {a.step}, окно {a.dwell}с")
+    print("УДЕРЖИВАЙ PTT на DMR-канале рации во время КАЖДОГО шага!\n")
+    best = None
+    for off in offsets:
+        set_rxoffset(off); restart(); time.sleep(2)
+        print(f"  RXOffset={off:+5d} Гц … жми PTT", flush=True)
+        got, ber = watch_rf(a.dwell)
+        if got:
+            print(f"    ✅ ПОЙМАНО RF! BER={ber}")
+            if best is None or (ber is not None and ber < best[1]):
+                best = (off, ber if ber is not None else 99)
+            if ber is not None and ber < 3:
+                print(f"    отличный BER — offset {off} рабочий, стоп")
+                break
+    if best:
+        set_rxoffset(best[0]); restart()
+        print(f"\nЛУЧШИЙ RXOffset={best[0]} Гц (BER {best[1]}) — записан и применён")
+    else:
+        print("\nне поймано — TX смещена сильнее диапазона или проблема в девиации, не частоте")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/sniff.py b/tools/sniff.py
new file mode 100644
index 0000000..3fe652f
--- /dev/null
+++ b/tools/sniff.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Захват кадров DMR-модуля с рации, прошитой снифером.
+
+    python3 tools/sniff.py [секунды] [--port COM4] [--raw]
+
+Рация должна быть прошита stock-fw/rt4d_sniffer.bin и включена обычным образом.
+Формат потока: F1 F2  <кадр len байт>, кадр — обычный `68 cmd b sub CK CK len len … 10`.
+
+Под WSL порт открывается через powershell.exe.
+"""
+import argparse, subprocess, sys
+from collections import Counter
+
+# что уже известно про команды модуля (из re/dmr.md и разбора образа FM100B)
+KNOWN = {
+    0x05: "конфигурация канала", 0x06: "установка вызова", 0x07: "данные канала",
+    0x09: "разное", 0x0A: "передача/PTT", 0x25: "версия модуля",
+    0x3E: "обновление прошивки модуля", 0x42: "параметр", 0x49: "свой DMR ID",
+    0x51: "вокодер", 0x59: "активность приёма", 0x62: "параметр",
+    0x66: "девиация", 0x67: "компандер", 0x81: "блок SMS", 0x82: "отправка SMS",
+    0x84: "запрос контакта",
+}
+
+PS = r'''
+$p = New-Object System.IO.Ports.SerialPort "{port}",115200,"None",8,"one"
+$p.ReadTimeout = 100
+try {{ $p.Open() }} catch {{ Write-Output "ERR:$($_.Exception.Message)"; exit 1 }}
+$sw = [Diagnostics.Stopwatch]::StartNew()
+$sb = New-Object System.Text.StringBuilder
+while ($sw.Elapsed.TotalSeconds -lt {secs}) {{
+  try {{
+    $b = $p.ReadByte()
+    [void]$sb.Append("{{0:x2}}" -f $b)
+    if ($sb.Length -ge 512) {{ Write-Output $sb.ToString(); [void]$sb.Clear() }}
+  }} catch {{
+    if ($sb.Length -gt 0) {{ Write-Output $sb.ToString(); [void]$sb.Clear() }}
+  }}
+}}
+if ($sb.Length -gt 0) {{ Write-Output $sb.ToString() }}
+$p.Close()
+'''
+
+
+def find_port():
+    out = subprocess.run(["powershell.exe", "-NoProfile", "-Command",
+                          "[System.IO.Ports.SerialPort]::GetPortNames() -join ','"],
+                         capture_output=True, text=True).stdout
+    ports = [p for p in out.strip().replace("\r", "").split(",") if p]
+    if not ports:
+        sys.exit("COM-порт не найден — подключите рацию.")
+    return ports[0]
+
+
+def parse(stream: bytes):
+    """выделить кадры по маркеру F1 F2 """
+    out, i = [], 0
+    while i < len(stream) - 3:
+        if stream[i] == 0xF1 and stream[i + 1] == 0xF2:
+            n = stream[i + 2]
+            if 9 <= n <= 220 and i + 3 + n <= len(stream):
+                out.append(stream[i + 3:i + 3 + n])
+                i += 3 + n
+                continue
+        i += 1
+    return out
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("secs", nargs="?", type=int, default=30)
+    ap.add_argument("--port")
+    ap.add_argument("--raw", action="store_true", help="печатать каждый кадр")
+    a = ap.parse_args()
+    port = a.port or find_port()
+    print(f"[слушаю {port} {a.secs} с — начинайте передачу]", flush=True)
+
+    r = subprocess.run(["powershell.exe", "-NoProfile", "-Command",
+                        PS.format(port=port, secs=a.secs)],
+                       capture_output=True, text=True, encoding="utf-8", errors="replace")
+    hexs = "".join(l.strip() for l in r.stdout.splitlines()
+                   if l.strip() and not l.startswith("ERR:"))
+    if "ERR:" in r.stdout:
+        sys.exit(r.stdout.strip())
+    raw = bytes.fromhex(hexs) if hexs else b""
+    frames = parse(raw)
+    print(f"принято {len(raw)} байт, кадров {len(frames)}\n")
+
+    cnt = Counter(f[1] for f in frames if len(f) > 1)
+    print("команды (код — сколько раз — что известно):")
+    for cmd, n in cnt.most_common():
+        print(f"  0x{cmd:02X}  x{n:<5d} {KNOWN.get(cmd,'— НЕИЗВЕСТНО —')}")
+
+    print("\nпервые кадры каждого кода:")
+    seen = set()
+    for f in frames:
+        if len(f) < 2 or f[1] in seen:
+            continue
+        seen.add(f[1])
+        pl = f[8:-1] if len(f) > 9 else b""
+        txt = "".join(chr(c) if 32 <= c < 127 else "." for c in pl)
+        print(f"  0x{f[1]:02X}: {f.hex(' ')}")
+        if pl:
+            print(f"        payload {len(pl)} Б  «{txt}»")
+    if a.raw:
+        print("\nвсе кадры:")
+        for f in frames:
+            print("  " + f.hex(" "))
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/spi_read.py b/tools/spi_read.py
new file mode 100644
index 0000000..a160357
--- /dev/null
+++ b/tools/spi_read.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Чтение SPI-флеша рации через CPS-протокол (USART6) из WSL по powershell.exe.
+
+Рация — в ОБЫЧНОМ режиме (не мост, не прошивка), кабель в COM. CPS-протокол:
+  notify : 34 00 00 10 44                 -> ACK 06
+  read   : 52      -> 1028 Б (3 hdr + 1024 data + 1 cksum), offset в КБ
+  cksum  : (sum) & 0xFF, seed 0
+
+    python3 tools/spi_read.py 0 16 --out cur_cal.bin     # блоки 0..15 (первые 16 КБ)
+    python3 tools/spi_read.py 0 4096 --out full.bin      # весь 4 МБ (долго)
+"""
+import argparse, subprocess, sys, os
+
+WIN_TMP_WSL = "/mnt/c/Users/vikto/AppData/Local/Temp"
+WIN_TMP_WIN = r"C:\Users\vikto\AppData\Local\Temp"
+
+PS = r'''
+$ErrorActionPreference='Stop'
+$p = New-Object System.IO.Ports.SerialPort "{port}",115200,"None",8,"one"
+$p.ReadTimeout=1500; $p.WriteTimeout=3000
+try {{ $p.Open() }} catch {{ Write-Output "ERR:openfail"; exit 1 }}
+function ck([byte[]]$a,$n){{ $s=0; for($i=0;$i -lt $n;$i++){{ $s=($s+$a[$i]) -band 0xFF }}; return [byte]$s }}
+# notify
+$p.DiscardInBuffer()
+$nf=[byte[]](0x34,0x00,0x00,0x10,0x44)
+$p.Write($nf,0,5)
+$ok=$false; $sw=[Diagnostics.Stopwatch]::StartNew()
+while($sw.ElapsedMilliseconds -lt 3000){{ try {{ if($p.ReadByte() -eq 6){{ $ok=$true; break }} }} catch {{}} }}
+if(-not $ok){{ Write-Output "ERR:notify"; $p.Close(); exit 1 }}
+$fs=[System.IO.File]::Open("{outwin}",[System.IO.FileMode]::Create)
+for($off={first}; $off -lt {last}; $off++){{
+  $cmd=[byte[]](0x52,(($off -shr 8) -band 0xFF),($off -band 0xFF),0)
+  $cmd[3]=ck $cmd 3
+  $p.DiscardInBuffer(); $p.Write($cmd,0,4)
+  $buf=New-Object byte[] 1028; $got=0; $sw2=[Diagnostics.Stopwatch]::StartNew()
+  while($got -lt 1028 -and $sw2.ElapsedMilliseconds -lt 2500){{
+    try {{ $b=$p.ReadByte(); $buf[$got]=[byte]$b; $got++ }} catch {{}}
+  }}
+  if($got -lt 1028){{ Write-Output ("ERR:read@"+$off); $fs.Close(); $p.Close(); exit 1 }}
+  if($buf[0] -eq 0xFF){{ Write-Output ("ERR:noblk@"+$off); $fs.Close(); $p.Close(); exit 1 }}
+  $fs.Write($buf,3,1024)
+  if(($off % 64) -eq 0){{ Write-Output ("PROG:"+$off) }}
+}}
+$fs.Close()
+$cl=[byte[]](0x34,0x52,0x05,0xEE,0x79); $p.Write($cl,0,5)
+$p.Close()
+Write-Output "OK"
+'''
+
+
+def find_port():
+    out = subprocess.run(["powershell.exe","-NoProfile","-Command",
+        "[System.IO.Ports.SerialPort]::GetPortNames() -join ','"],
+        capture_output=True, text=True).stdout
+    ports=[p for p in out.strip().replace("\r","").split(",") if p]
+    if not ports: sys.exit("нет COM-порта")
+    return ports[0]
+
+
+def main():
+    ap=argparse.ArgumentParser()
+    ap.add_argument("first", type=lambda x:int(x,0))
+    ap.add_argument("last", type=lambda x:int(x,0))
+    ap.add_argument("--out", default="spi_read.bin")
+    ap.add_argument("--port")
+    a=ap.parse_args()
+    port=a.port or find_port()
+    name="rt4d_spiread.bin"
+    outwin=os.path.join(WIN_TMP_WIN,name)
+    script=PS.format(port=port,outwin=outwin.replace("\\","\\\\"),first=a.first,last=a.last)
+    print(f"[чтение SPI блоков {a.first}..{a.last-1} ({(a.last-a.first)} КБ), порт {port}]")
+    proc=subprocess.Popen(["powershell.exe","-NoProfile","-Command",script],
+        stdout=subprocess.PIPE,stderr=subprocess.STDOUT,text=True,encoding="utf-8",errors="replace")
+    for line in proc.stdout:
+        line=line.strip()
+        if line.startswith("PROG:"): print(f"\r  блок {line[5:]}",end="",flush=True)
+        elif line.startswith("ERR:"): print("\n"+line);
+        elif line=="OK": print("\n  чтение завершено")
+    proc.wait()
+    # забрать файл из Windows temp
+    src=os.path.join(WIN_TMP_WSL,name)
+    if os.path.exists(src):
+        import shutil; shutil.copy(src,a.out)
+        print(f"сохранено: {a.out} ({os.path.getsize(a.out)} Б)")
+    else:
+        print("файл не создан — чтение не удалось")
+
+
+if __name__=="__main__":
+    main()
diff --git a/tools/spi_restore.py b/tools/spi_restore.py
new file mode 100644
index 0000000..9e2ea80
--- /dev/null
+++ b/tools/spi_restore.py
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""Полное восстановление SPI рации из заводского эталона (radio-spi-dump.bin, до экспериментов).
+
+Пишет все регионы codeplug/калибровки CPS-протоколом (USART6) из WSL через powershell.exe.
+Рация — в ОБЫЧНОМ режиме. Возвращает рацию к состоянию на момент дампа.
+
+Регионы (region_id, address, size) — из rt4d-cps constants.
+"""
+import argparse, subprocess, sys, os, json
+
+WIN_TMP_WSL = "/mnt/c/Users/vikto/AppData/Local/Temp"
+WIN_TMP_WIN = r"C:\Users\vikto\AppData\Local\Temp"
+REF = "radio-spi-dump.bin"
+
+REGIONS = [
+    ("calibration",   0x40, 0x000000, 0x001000),
+    ("main_settings", 0x90, 0x002000, 0x001000),
+    ("channels",      0x91, 0x004000, 0x00C000),
+    ("zones",         0x92, 0x01C000, 0x020000),
+    ("contacts",      0x93, 0x05C000, 0x010000),
+    ("groups",        0x94, 0x07C000, 0x003000),
+    ("dmr_keys",      0x95, 0x082000, 0x003000),
+    ("call_log",      0x96, 0x088000, 0x00C000),
+    ("default_sms",   0x97, 0x094000, 0x001000),
+    ("schedules",     0x98, 0x0C6000, 0x008000),
+    ("fm_settings",   0x99, 0x0D6000, 0x001000),
+]
+
+PS = r'''
+$ErrorActionPreference='Stop'
+$data=[System.IO.File]::ReadAllBytes("{datawin}")
+$plan=ConvertFrom-Json '{planjson}'
+$p=New-Object System.IO.Ports.SerialPort "{port}",115200,"None",8,"one"
+$p.ReadTimeout=1500; $p.WriteTimeout=3000
+try {{ $p.Open() }} catch {{ Write-Output "ERR:openfail"; exit 1 }}
+function ck([byte[]]$a,$n){{ $s=0; for($i=0;$i -lt $n;$i++){{ $s=($s+$a[$i]) -band 0xFF }}; return [byte]$s }}
+$p.DiscardInBuffer()
+$nf=[byte[]](0x34,0x00,0x00,0x10,0x44); $p.Write($nf,0,5)
+$ok=$false; $sw=[Diagnostics.Stopwatch]::StartNew()
+while($sw.ElapsedMilliseconds -lt 3000){{ try {{ if($p.ReadByte() -eq 6){{ $ok=$true; break }} }} catch {{}} }}
+if(-not $ok){{ Write-Output "ERR:notify"; $p.Close(); exit 1 }}
+Write-Output "INFO:notify ok"
+$doff=0
+foreach($r in $plan){{
+  $region=[int]$r.region; $size=[int]$r.size; $name=$r.name
+  Write-Output ("REGION:"+$name)
+  for($i=0; $i -lt $size; $i+=1024){{
+    $cmd=New-Object byte[] 1028
+    $cmd[0]=$region
+    $blk=[int]($i/1024)
+    $cmd[1]=(($blk -shr 8) -band 0xFF); $cmd[2]=($blk -band 0xFF)
+    [Array]::Copy($data,$doff+$i,$cmd,3,1024)
+    $cmd[1027]=ck $cmd 1027
+    $p.DiscardInBuffer(); $p.Write($cmd,0,1028)
+    $ok=$false; $sw2=[Diagnostics.Stopwatch]::StartNew()
+    while($sw2.ElapsedMilliseconds -lt 3000){{ try {{ if($p.ReadByte() -eq 6){{ $ok=$true; break }} }} catch {{}} }}
+    if(-not $ok){{ Write-Output ("ERR:"+$name+"@"+$blk); $p.Close(); exit 1 }}
+  }}
+  $doff += $size
+}}
+$cl=[byte[]](0x34,0x52,0x05,0xEE,0x79); $p.Write($cl,0,5)
+$p.Close()
+Write-Output "OK"
+'''
+
+
+def find_port():
+    out = subprocess.run(["powershell.exe","-NoProfile","-Command",
+        "[System.IO.Ports.SerialPort]::GetPortNames() -join ','"],
+        capture_output=True, text=True).stdout
+    ports=[p for p in out.strip().replace("\r","").split(",") if p]
+    if not ports: sys.exit("нет COM-порта")
+    return ports[0]
+
+
+def main():
+    ap=argparse.ArgumentParser()
+    ap.add_argument("--only", help="только регионы через запятую (напр. calibration,main_settings)")
+    ap.add_argument("--port")
+    a=ap.parse_args()
+
+    ref=open(REF,"rb").read()
+    sel=REGIONS
+    if a.only:
+        want=set(a.only.split(","))
+        sel=[r for r in REGIONS if r[0] in want]
+    total=sum(r[3] for r in sel)
+    print("восстановление SPI из эталона (до экспериментов):")
+    for n,rid,addr,sz in sel:
+        print(f"  {n:14s} region 0x{rid:02X}  0x{addr:06X}  {sz//1024:4d} КБ")
+    print(f"  ИТОГО {total//1024} КБ, ~{total//1024} блоков")
+
+    # собрать данные подряд в порядке регионов
+    blob=b"".join(ref[addr:addr+sz] for _,_,addr,sz in sel)
+    name="rt4d_restore.bin"
+    open(os.path.join(WIN_TMP_WSL,name),"wb").write(blob)
+    datawin=os.path.join(WIN_TMP_WIN,name)
+    plan=[{"name":n,"region":rid,"size":sz} for n,rid,addr,sz in sel]
+    port=a.port or find_port()
+    script=PS.format(datawin=datawin.replace("\\","\\\\"),port=port,
+                     planjson=json.dumps(plan).replace('"','\\"'))
+    print()
+    proc=subprocess.Popen(["powershell.exe","-NoProfile","-Command",script],
+        stdout=subprocess.PIPE,stderr=subprocess.STDOUT,text=True,encoding="utf-8",errors="replace")
+    rc=0
+    for line in proc.stdout:
+        line=line.strip()
+        if line.startswith("REGION:"): print(f"  → {line[7:]}")
+        elif line.startswith("INFO:"): print(f"    {line[5:]}")
+        elif line.startswith("ERR:"): print(f"    ОШИБКА: {line[4:]}"); rc=1
+        elif line=="OK": print("  ✅ SPI восстановлен из эталона")
+    proc.wait()
+    sys.exit(rc)
+
+
+if __name__=="__main__":
+    main()
diff --git a/tools/spi_wr.py b/tools/spi_wr.py
new file mode 100644
index 0000000..2c49c36
--- /dev/null
+++ b/tools/spi_wr.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""spi_wr.py REGION SRCADDR SIZE  — пишет SIZE байт из radio-spi-dump.bin[SRCADDR]
+в SPI рации регионом REGION (блоки 0..). Рация в обычном режиме. CPS через powershell."""
+import subprocess, sys, os
+WIN_TMP_WSL="/mnt/c/Users/vikto/AppData/Local/Temp"; WIN_TMP_WIN=r"C:\Users\vikto\AppData\Local\Temp"
+region=int(sys.argv[1],0); srcaddr=int(sys.argv[2],0); size=int(sys.argv[3],0)
+ref=open("radio-spi-dump.bin","rb").read()
+data=ref[srcaddr:srcaddr+size]
+open(os.path.join(WIN_TMP_WSL,"rt4d_wr.bin"),"wb").write(data)
+dw=os.path.join(WIN_TMP_WIN,"rt4d_wr.bin").replace("\\","\\\\")
+out=subprocess.run(["powershell.exe","-NoProfile","-Command","[System.IO.Ports.SerialPort]::GetPortNames() -join ','"],capture_output=True,text=True).stdout
+port=[x for x in out.strip().replace("\r","").split(",") if x][0]
+PS=f'''
+$ErrorActionPreference='Stop'
+$data=[System.IO.File]::ReadAllBytes("{dw}")
+$p=New-Object System.IO.Ports.SerialPort "{port}",115200,"None",8,"one"
+$p.ReadTimeout=1500;$p.WriteTimeout=3000
+$p.Open()
+function ck([byte[]]$a,$n){{$s=0;for($i=0;$i -lt $n;$i++){{$s=($s+$a[$i]) -band 0xFF}};return [byte]$s}}
+$p.DiscardInBuffer();$nf=[byte[]](0x34,0x00,0x00,0x10,0x44);$p.Write($nf,0,5)
+$ok=$false;$sw=[Diagnostics.Stopwatch]::StartNew()
+while($sw.ElapsedMilliseconds -lt 3000){{try{{if($p.ReadByte() -eq 6){{$ok=$true;break}}}}catch{{}}}}
+if(-not $ok){{Write-Output "ERR:notify";exit 1}}
+Write-Output "notify ok"
+for($i=0;$i -lt {size};$i+=1024){{
+  $cmd=New-Object byte[] 1028;$cmd[0]={region}
+  $blk=[int]($i/1024);$cmd[1]=(($blk -shr 8) -band 0xFF);$cmd[2]=($blk -band 0xFF)
+  [Array]::Copy($data,$i,$cmd,3,1024);$cmd[1027]=ck $cmd 1027
+  $p.DiscardInBuffer();$p.Write($cmd,0,1028)
+  $ok=$false;$sw2=[Diagnostics.Stopwatch]::StartNew()
+  while($sw2.ElapsedMilliseconds -lt 3000){{try{{if($p.ReadByte() -eq 6){{$ok=$true;break}}}}catch{{}}}}
+  if(-not $ok){{Write-Output ("ERR@"+$blk);exit 1}}
+  Write-Output ("blk "+$blk)
+}}
+$cl=[byte[]](0x34,0x52,0x05,0xEE,0x79);$p.Write($cl,0,5);$p.Close();Write-Output "OK"
+'''
+r=subprocess.run(["powershell.exe","-NoProfile","-Command",PS],capture_output=True,text=True,encoding="utf-8",errors="replace")
+print(r.stdout.strip()[-400:])
diff --git a/tools/spi_write_cal.py b/tools/spi_write_cal.py
new file mode 100644
index 0000000..3fcc25a
--- /dev/null
+++ b/tools/spi_write_cal.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Восстановление калибровки рации (SPI region 0x40, 4 КБ) из заводского эталона.
+
+Пишет 4 КБ калибровки CPS-протоколом (USART6) из WSL через powershell.exe.
+Источник — radio-spi-dump.bin[0:0x1000] (снят ДО экспериментов).
+
+Протокол записи (CPS):
+  notify : 34 00 00 10 44                       -> ACK 06
+  write  :    <1024 Б>   -> ACK 06   (region=0x40 калибровка)
+  cksum  : sum & 0xFF, seed 0
+
+    python3 tools/spi_write_cal.py            # запись region 0x40 из эталона (с подтверждением)
+    python3 tools/spi_write_cal.py --yes      # без подтверждения
+"""
+import argparse, subprocess, sys, os, shutil
+
+WIN_TMP_WSL = "/mnt/c/Users/vikto/AppData/Local/Temp"
+WIN_TMP_WIN = r"C:\Users\vikto\AppData\Local\Temp"
+REF = "radio-spi-dump.bin"
+REGION = 0x40          # calibration
+SIZE   = 0x1000        # 4 КБ
+
+PS = r'''
+$ErrorActionPreference='Stop'
+$data=[System.IO.File]::ReadAllBytes("{datawin}")
+$p=New-Object System.IO.Ports.SerialPort "{port}",115200,"None",8,"one"
+$p.ReadTimeout=1500; $p.WriteTimeout=3000
+try {{ $p.Open() }} catch {{ Write-Output "ERR:openfail"; exit 1 }}
+function ck([byte[]]$a,$n){{ $s=0; for($i=0;$i -lt $n;$i++){{ $s=($s+$a[$i]) -band 0xFF }}; return [byte]$s }}
+$p.DiscardInBuffer()
+$nf=[byte[]](0x34,0x00,0x00,0x10,0x44); $p.Write($nf,0,5)
+$ok=$false; $sw=[Diagnostics.Stopwatch]::StartNew()
+while($sw.ElapsedMilliseconds -lt 3000){{ try {{ if($p.ReadByte() -eq 6){{ $ok=$true; break }} }} catch {{}} }}
+if(-not $ok){{ Write-Output "ERR:notify"; $p.Close(); exit 1 }}
+Write-Output "INFO:notify ok"
+$region={region}; $size={size}
+for($i=0; $i -lt $size; $i+=1024){{
+  $cmd=New-Object byte[] 1028
+  $cmd[0]=$region
+  $blk=[int]($i/1024)
+  $cmd[1]=(($blk -shr 8) -band 0xFF); $cmd[2]=($blk -band 0xFF)
+  [Array]::Copy($data,$i,$cmd,3,1024)
+  $cmd[1027]=ck $cmd 1027
+  $p.DiscardInBuffer(); $p.Write($cmd,0,1028)
+  $ok=$false; $sw2=[Diagnostics.Stopwatch]::StartNew()
+  while($sw2.ElapsedMilliseconds -lt 3000){{ try {{ if($p.ReadByte() -eq 6){{ $ok=$true; break }} }} catch {{}} }}
+  if(-not $ok){{ Write-Output ("ERR:write@"+$blk); $p.Close(); exit 1 }}
+  Write-Output ("PROG:"+$blk)
+}}
+$cl=[byte[]](0x34,0x52,0x05,0xEE,0x79); $p.Write($cl,0,5)
+$p.Close()
+Write-Output "OK"
+'''
+
+
+def find_port():
+    out = subprocess.run(["powershell.exe","-NoProfile","-Command",
+        "[System.IO.Ports.SerialPort]::GetPortNames() -join ','"],
+        capture_output=True, text=True).stdout
+    ports=[p for p in out.strip().replace("\r","").split(",") if p]
+    if not ports: sys.exit("нет COM-порта")
+    return ports[0]
+
+
+def main():
+    ap=argparse.ArgumentParser()
+    ap.add_argument("--yes", action="store_true")
+    ap.add_argument("--port")
+    a=ap.parse_args()
+
+    ref=open(REF,"rb").read()
+    cal=ref[:SIZE]
+    print(f"калибровка из эталона: {SIZE} Б, region 0x{REGION:02X}")
+    print(f"  начало: {cal[:16].hex(' ')}")
+    if not a.yes:
+        print("\nЗАПИСЬ в SPI-калибровку рации. Рация должна быть в ОБЫЧНОМ режиме.")
+        if input("продолжить? [y/N] ").strip().lower() != "y":
+            print("отменено"); return
+
+    name="rt4d_cal.bin"
+    open(os.path.join(WIN_TMP_WSL,name),"wb").write(cal)
+    datawin=os.path.join(WIN_TMP_WIN,name)
+    port=a.port or find_port()
+    script=PS.format(datawin=datawin.replace("\\","\\\\"),port=port,region=REGION,size=SIZE)
+    proc=subprocess.Popen(["powershell.exe","-NoProfile","-Command",script],
+        stdout=subprocess.PIPE,stderr=subprocess.STDOUT,text=True,encoding="utf-8",errors="replace")
+    rc=0
+    for line in proc.stdout:
+        line=line.strip()
+        if line.startswith("PROG:"): print(f"  записан блок {line[5:]}")
+        elif line.startswith("INFO:"): print(f"  {line[5:]}")
+        elif line.startswith("ERR:"): print(f"  ОШИБКА: {line[4:]}"); rc=1
+        elif line=="OK": print("  ✅ калибровка восстановлена")
+    proc.wait()
+    sys.exit(rc)
+
+
+if __name__=="__main__":
+    main()