May 2012 Archives

Callsigns in IPv6 reports that:

Embedded Callsigns in IPv6 Addresses

Club Members Jacques N1ZZH and Vinnie N1LQJ have developed a method of embedding a 2x5 (7 Character) callsign plus up to 185 nodes, plus 1 universal bit and three reserved bits in the 2nd octet, and a 16 bit amateur radio identifer at bit 24 of an IPv6 /64 Subnet address. 

Sample programs and information on this proposed standard can be found at


Motorola References

References for Motorola Paging and Trunking Radio:

A discussion of a FLEX decoder, including some C code.
Local copy: here.

FLEX at 6400 Hz
Covers the "FM Click Noise" and some high-level math.  Mostly describes the modulation used which is an additional level of "FSK" accomplished by using higher frequency tones to drive the FM modulator, and various other related radio phenomenon. Intersymbol interference (ISI) in FSK is also mentioned, which may be of interest to those studying GMSK. This can also be used as a reference point for C4FM/4FSK, since 4FSK is part of the FLEX standard.
This is the patent that documents the Motorola Systems 9000 Bus signalling.
Programmer's Reference Manual by Phillip Musumeci
Freescale M68HC11E Programming Reference Guide
The Motorola 68HC11 Reference Manual, V3.0.
I have version 1.0 of this on dead trees.

The 68HC11 is used in the Motorola Syntor X9000, Saber, Spectra, Maxtrac, GM300, Radius (mobile), Maratrac, etc. Are we detecting a pattern? The 68HC11 will execute code targeted for a 6803.

The 6803 was used in the Trunking Syntor X's trunking control module. The actual Syntor X radio CPU was a Z80. I may be wrong about this, other research points to the CPU being based on a Mostek 3870.

Trunked Syntor X Smartnet Dual Operation radio 68P81066E80-A
"6303 processor running at 3.888MHz" - Typo of "6803"?
"Bidirectional balanced serial data link U410D, Q416D, Q401, and U408C provides two-way data communications at 949.2 baud between the trunked personality board and the control head."

Trunked Syntor X FM Radio Control Station 68P81043E55-B
6803 CPU at 3.6MHz processor clock, derived from 14.4MHz RF/PLL reference clock/standard.
Clock sent to head is 76.8KHz, but the head is a dumb (no CPU) combination of a UART and some miscellaneous logic to collect inputs and drive outputs. And the control head communications resembles the SB9600 patent.
The Syntor X9000, all models, used a 68HC11 in the radio for control and a 68HC11 in the radio control head. Most of the option modules included 68HC11 processors, including the DTMF encoder/decoder, MDC600 encoder/decoder, Securenet option, external Siren/PA amplifier (HLN1185), Vehicular Repeater System (VRS), and so on. These devices, internal and external, communicated using the Systems 9000 bus (SB9600), an RS-485 multi-dropped 9600 bps interface. This hierarchy was carried over into the Spectra along with the Systems 9000 bus and some of the accessories such as the VRS and Siren/PA amplifier.

Motorola in general:
Syntor, X, X9000, MCX100, MCX1000, Mostar:
GM300 Series (Maxtrac,Radius, etc):

Mike Blendermann:
Syntor X:
Syntor X Trunked:
Syntor X9000:

From the trunked  Syntor X page above;
HCN1032 Control Head:

The HCN1032 control head merits special mention. This control head only looks like a normal Systems 9000 control head. The case, buttons, internal Display Board and the individual parts from the internal Control Board (except for U1, U6 and the printed circuit board) are compatible with other Systems 9000 heads. The incompatible hardware parts are U1 is specially programed for this control head and U6 is a digital volume control chip (all the other X 9000 or X 9000E radios have their own internal digital volume controls inside the radio). The HCN1032 is missing a busy line and reset line, it uses hard wired PTT control lines, runs the serial link at 949.2 baud and has a volume control chip U6. A normal Systems 9000 control head has a bidirectional busy line, bidirectional reset line, uses serial link commands to control the PTT, runs the serial link at 9600 baud and has no U6 volume control chip. The HCN1032 uses two microprocessor control pins for its unique U6 volume control chip, which are normally used for the busy line interface that is missing from this control head (another reason why U1 is an incompatible part). Both the HCN1032 and other Systems 9000 control heads use the exact same radio to control head cable.

949.2 baud is mentioned in the Maratrac/M400 manual, and is used by RSS to program a number of radios at 7E1. 

Unsurprisingly, this appears because the defaults for the 68HC11 is to use a ten-bit buffer on the serial port, which works out to a start bit, a stop bit, and seven bits of data plus a parity bit.

An older analog/digital hardware engineer I used to work with would use combinations like 9600-N-8-2, or 9600 bps per second, no parity, eight bits, and two stop bits because it resulted in a signal that was 10 or 12 bits long at 9600 Hz. His experience was second to none, and like most experienced engineers (and fathers) he was able to concisely explain why a particular challenge was solved using a certain method. Unfortunately, many of these engineers don't write down these things down after retirement, so the new crop of engineers don't benefit from that experience. There's a lot of human knowledge going down the pipes because it's "old technology" and being thrown out because of the sheer volume of information. Some of it is discarded or kept from public eyes because it's a "trade secret" or "proprietary". But I digress.

9600 bps is mentioned in the Saber theory manual, along with 57.6kbps, which is used by the CORE to talk to the COPE (display, DTMF, PLs, etc.) and other internal peripherals.

The Syntor itself (not the X or the X9000) along with the MCX100 used a special mode built into the Synthesizer that caused it to generate a sweep across some address/data lines and load itself with a frequency. The Syntor and the MCX100 are CPUless radios.

The MCX1000 uses a 68HC05 in the control head, 9600 BPS differential bus, 4.0MHz clock, and a 68HC05 on the Analog control board and still a third processor in some sort of PLCC ASIC. This radio has some odd use of the MOSI/MISO SPI bus, whereas other 68HC11-based radios use the SCI (serial) interface.  Otherwise, the MCX1000 looks like an MCX100 with a processor shoved into it.

The benefit to FSK/2FSK/4FSK is that it can be decoded without a modem.

Birmingham 146.76

146.76 in Birmingham doesn't use duplexers. Instead, each receiver is located some distance from the transmitter and linked back using another band.

Active/known tones:

103.5 (disabled)
131.8 (portable remote)

LVM XFS and Fun

parted isn't really your friend. Give it as little info as needed. Then remember what your device mappings are, and how they are accomplished.

Long story short: partition drive gpt, set raid flag on partition 1.

# mdadm --create --verbose /dev/md1  --assume-clean --level=1 --raid-devices=2 /dev/sd[bc]1

# pvcreate /dev/md1
# vgcreate VG01 /dev/md1
# lvcreate -l 93%VG -n LV02 VG01
If you want to create one with 93% of your total (mirrored) disk space... Not really a problem, can always grow lvm/xfs later.

# mkfs.xfs -f /dev/VG01/LV02
Edit /etc/fstab and mount the filesystem using mount /filesystemname. Why this way? So the **** thing automounts on boot. Dropping to single user is lame, y0.

Converting Images

mogrify -resample 72 -quality 80% -path /path/to/pictures *.jpg


convert *.jpg -resample 72 -quality 80% -set filename:orig %t SM%[filename:orig].jpg

As always, the mogrify/convert utilities overwrite the existing file unless you give it an argument to write them to a new location.
Background here is that I scanned a few documents at 600 DPI, and needed to convert to a smaller DPI because the PDF creation tool was unable to cope with 25+ 55MB BMPs and TIFFs. After copying to a test directory (remember the warning above, make backups!), I found that the file size dropped by 90%, and the PDF engine was able to load the images quickly and process them quickly.

Amazingly enough, 80% quality with JPG netted decent results. Even at 80% 72DPI, the originals look great in uncompressed form.

The above is clickable man pages for Image Magick.


When all else fails, try 2400 7E1.

Even with autobaud turned on, the bloody thing won't.

cmd: autobaud off

awlen 8
parity 0



AWLEN sets the bits over serial. This one was set to 7, but I had pulled the battery.

PARITY sets the parity. 3 seems to be Even, 1 is odd, and 0 is none.

DISPLAY dumps out all the variables.

DAYTime yymmddhhmmss

PACLEN should always go to 255.

TXD to appropriate. I've seen in manuals some radios need about 200.

DO NOT TYPE "RESET". This wipes the TNC back to defaults. To reboot, type "restart".

Oh, but more fun. When you're trying to reduce the modulation slope (excessive pre-emphasis), in the 1278 there is a jumper. In the 1274, there is not. Simply short C71 and some other stuff:

These modifications affect only the transmit audio circuitry of the mfj1270b and also clean up a few "gotchas'" in the use of the tnc. The main modification is to bring the deviation levels of the low tone and the high tones closer together, remove the default 6db/octave pre-emphasis implemented in the tnc and increase the tx drive level.

In the unmodified circuit of several mfj1270b tested and modified so far, the audio output levels resulted in an approximate FM deviation of 1.8kHz for the low tone and 4.8kHz for the high tone, the deviation difference being 3kHz.

After modification, the low and high tone transmit audio output levels are such that the FM deviation levels are within 200Hz of each other. This is particularly critical when connecting to tnc's that use the exar 2206/2211 chipset for the modem, (as the mfj1270b does) as the demod chip of the set will NOT decode if the recovered low and high tone signal levels are too different.

The output circuitry of the mfj1270b has two monolithic capacitors in series in the signal path; c71 (4.7nF) which provides 6dB per octave pre-emphasis (which will add to the 6dB/octave pre-emphasis done in the radio if the tx audio goes through the mic amplifier) and c73 (0.33uF) which decouples the transmit audio output of the xr2206 modem.

The four components (c71, c73, r56 & r57) of the tx audio path form a filter whose response is frequency dependent. Changing the capacitor values changes the filter's effect on the low and high tones, changing the resistance values increases the tx audio level.

The output deviation level mod as shown is to short out c71, change r56 (7.5k) to 2.7k, remove r57 (560r) and change c73 (0.33uF) to 0.47uF. The analogue loopback feature provided by jmp7 is unaffected by this modification.

After modification the difference between the low and the high tone levels is approx 200Hz.

Just go read about it there. They have pictures.

GMSK Tutorial and Implementation

From Spread Spectrum Scene, (go read everything they have!), there's an app-note from MX about GMSK entitled: Practical GMSK Data Transmission.

Here's the link from the 'scene: and a local link.

This PDF explains and shows the phase-discontinuous nature of PSK and other modulations:
What people don't immediately realize is that GMSK is MSK, with rounded edges. Why is that important? Because square waves are by definition made up of the fundamental frequency and all of the odd harmonics of that frequency. However, when you cram a square wave into a multiplication process, like modulation, it creates mixing products -- lots of them. We call these products "sidebands" and typically try to reduce them through filters in some way.

Filtering can be done before or after modulation. It is more effective, and a better use of power to filter before the modulation process than after. In the case of GMSK, a specially designed Gaussian filter is used, which has two effects on the signal. One effect the Gaussian filter has is that it is intentionally set lower than the frequency passing through it. This causes it to have a rather pronounced effect on the signal passing through; specifically on the Gaussian filter, this gives rise to "InterSymbol Interference" or ISI. This interference happens because the filter causes the bits to lag a little in the time domain, causing the receiving modem to occasionally decide a bit is a one when it should be a zero or a zero when it should be a one. The second effect of the Gaussian filter is that it turns the sharp, square edges of the data into a rounded spike-like pulse. This rounded pulse has advantages.

The rounded Gaussian pulse has many advantages. Recall that in FM radio, a modulating signal is applied to a modulator. As the signal sweeps in one direction, say from zero to V+, the resulting frequency of the transmitter rises to a set maximum. Likewise, as the signal sweeps from zero to V-, the transmitter lowers in frequency to another set minimum. The advantage to the rounded spike is that, much like a plotter connected to an oscilloscope, the path is easily followed with smooth transitions. This is extremely important, as sudden jumps in amplitude and frequency cause phase discontinuities which make the signal hard to process. In Frequency Modulation, the signal must always remain phase-continuous without rapid reversals. The reason for this is manyfold, but I'll settle on two: 1) If it wasn't, then it isn't by definition FM, and 2) because the most common amplifier used to amplify FM signals, the often 80% efficient Class C, requires that the signal "ring" or spend half the time per cycle coming out of a RC "tank". So the Gaussian pulse allows the modulator to follow along, smoothly, generating a signal with minimal harmonics as a result of the modulation process. Again, because of this smoothness of action, rather than jumping around like QPSK or QAM, the GMSK signal is FM-complaint, allowing common, off the shelf gear to be used to generate, receive and amplify the GMSK signal. In short, GMSK appears to be a preferred way to transmit FSK signals, mostly due to removing unwanted sidebands which would otherwise be wasted as heat in the filters following the modulator. Bt=0.3 seems best, apparently the commercial data guys are aiming for 0.25 and 0.27.

Remember, of course, that MSK is defined as the shift at half the frequency of the data, and the modulation index is 0.5. GMSK doesn't get all the way down there, but it's still spectrally more efficient than FSK. Often, the same gear can receive GMSK as FSK, particularly the MX589 used by Kantronics in the KPC9612.

From the commercial perspective, I want to point out a few things:

1) Motorola has for years, since the Syntor X series, provided a split low-frequency and high frequency modulation path. This allows the CTCSS tones to be modulated at the lower frequencies that the VCO's PLL would otherwise automatically remove as detected frequency error.

2) Motorola has also used multi-level FSK to transmit and receive trunking control information.

FSK has the advantage of simple transmission -- attach the data stream to the modulator -- and simple detection: one need only use a data slicer to recover the data if the center frequency or one of the frequencies is known. 

Seeing as how the Motorola Spectra, Saber, and X9000 lines are based heavily off of the 68HC11, and the Kantronics KPC-9612, -9612+, -3, and -3+ all use the HC11 as well, I would not be surprised if Motorola was bit-banging data in from the trunking control channel without a modem much like how Kantronics recovers data in the 1200 BPS port of the above mentioned TNCs.

Update: I've just become aware that GMSK is being referred to by some as "GFSK with a modulation index of 0.5." GFSK is "Gaussian Frequency Shift Keying", per Analog Devices ADF7023-J product information:

US Patent 5,551,068

I found a sheet of paper bearing this number and couldn't make heads or tails of what it was. So I plugged the number into Google Patent, and started reading. The fact that it was a Motorola patent wasn't unusual; at the time I had been reading about trunking radio. No, the part that got my attention was when I started remembering what SB9600 meant and what I was reading:

This is the patent that documents the Motorola Systems 9000 Bus signalling.

All your Spectra are belong to me. =D

Moseley TRL-1 and CIP-2 Manuals

Highly unlikely you'll need these unless you're a broadcast engineer servicing some old equipment.

If you're interested in two-way or microwave, you might take note of the 200KHz IF filters the device has in it. One can cram a lot of data through that interface. (GRAPES modem anyone?)


These are meant to be printed with "auto-rotate" turned on, except the backsides of the 11"x17" pages were not scanned. Everything has been rotated so that one may view the PDF without printing or turning one's head sideways every other page.

About this Archive

This page is an archive of entries from May 2012 listed from newest to oldest.

April 2012 is the previous archive.

June 2012 is the next archive.

Find recent content on the main index or look in the archives to find all content.