Hytera Pseuso Trunk/XPT systems

[W8JMO]

Good morning group:

I hope this is the correct discussion area to post, seemed most appropriate of "general"

My Retevis RT3S and MD UV380 radio with OpenGD77 firmware have been awesome for helping finding and listening to DMR repeaters and systems I had only been able to receive previously by using DSD+, and then having to program it into a DMR radio with all the information to use it.

For standard repeaters and simplex, this has been fine.

Recently, I've found what DSD+ is showing as an 'XPT' system. This is not an amateur radio system however, it's used by the local University where my wife works, so I thought it would be fun to see what traffic is handled on it. It gives brief busts of data at about a 30% duty cycle, I assume like Moto's Capacity Plus and LTR to give a subscriber radio a "rest channel" to sit on.

To the point, I am not able to use the data derived from either DSD+ or my RT3S into any other radio and hear anything. I also find it interesting how DSD+ and OpenGD77 handle the DMR information and decode it for display differently.

DSD+, for instance, will display Talkgroup 1 as active. My RT3S will show a much longer talkgroup ID like 1043901. Radio IDs are also altered and displayed differently, however whatever radios the school is using will show up on my RT3S with a user ID alias that is believable like "COM 1" etc.

At any rate, if I put in the longer group into a different radio, in my case a Moto XPR5500 and Retevis RT73, the radio won't decode anything. Same for the shorter group ID given by DSD+.

If I program the long group ID into the RT3S, it receives and displays the group as expected... but it will also decode everything, including the short data burts, often coming through like dead-air or noise.

Has anyone got insight on the Hytera Pseudo Trunk or XPT systems enough to know if the data is proprietary enough to not be easily programmed into a non-Hytera pseudo trunk/XPT radio?

A decade ago when I was much more active in DMR scanning/decoding, a regional DMR Connnect Plus system interested me since it was something new taking over in the ashes of Nextel. I was easily able to listen to various groups- conventionally, just by having the frequency, CC, slot, and group... it would just work, wouldn't do any sort of trunking obviously, but any DMR radio could be programmed that way and decode the audio. Maybe this isn't the case, but I would like to think *something* is not decoding the group ID properly since I'm getting mixed results with the resources I have available to me.

-Josh

[G4EML]

I don't know much about the XPT system but it is quite possible Hytera is using some of the DMR protocol in a non standard way. That might explain why the talkgroup information appears strange. They may be using part of the talkgroup field for extended routing information.

These sort of systems are very much proprietary and full details are not available. Another example is the way Motorola deliberately messes with the CRC checksums on its restricted access systems. OpenGD77 only really expects standard DMR PDUs and doesn't do much error checking of them, so it may well decode non standard things differently to DSD+.

Whilst it might be possible to reverse engineer the XPT protocol enough to be able to monitor it is not really within the scope of the OpenGD77 project so it is unlikely that it will get much if any attention.

Colin G4EML

[W8JMO]

Thanks for the reply, sorry it took me so long to reply, I didn't get a notification via e-mail of one.

Not a big deal, I'm just trying to figure out how XPT/Pseudotrunk works. My Kenwood DMR radios can be programmed for "slot 1" "slot 2", or "automatic" so it too, in its own way can get more bank for a repeater buck, but there's really nothing special about it other than "monitoring both time slots" and picking the slow with the Group ID that matches, on that TS.

I would certainly argue for Hytera doing their own thing DSD+ Shows group ID 1, my RT3S shows 2097153. Seems like radio IDs are also limited to 4 numbers.

-Josh

[VK3KYY]

I would certainly argue for Hytera doing their own thing DSD+ Shows group ID 1, my RT3S shows 2097153. Seems like radio IDs are also limited to 4 numbers.

The DMR data for the TG, which is the "Destination" is 3 bytes (24 bits long), so the max value is 16777215, there is also a Flag pattern of binary bits that indicate if its a Group call (TG) or Private call or All Call

2097153 is well within the normal range for a TG

If you are trying to figure out how the trunking works, it may be helpful to look at the value as a binary number

In this case

There are multiple websites which can do this for you
e.g.

https://www.rapidtables.com/convert/num ... inary.html

And in the case of that specific number

The value as 24 bits is

001000000000000000000001

and as 3 byte hexidecimal its

0x200001


Most likely this is 2 or more separate numbers e.g. the last part is 1 and the first part is 0x20 hex i.e 32

But the only way to figure out their numbering system would be to capture a lot of data and see what other numbers are used

If the transmissions are send unencrypted, and you may be able to work out what jobs / functions the people on each subgroup are doing e.g. could be location based or functionally based.

Have fun

[W8JMO]

Thanks for the reply, again... I'm going to have to recheck my settings as I never got a notification and I went other routes to find out what I was looking for.... actually buying a Hytera radio and programming it for the XPT system using the groups shown in the DSD+ program.

XPT trunking is so close to Motorola's Capacity Plus it's ridiculous, even going as far as limits to the radio ID length.I just can't get any other radio to open the audio path with the exception of my MD UV-380/Retevis RT3S, but this is a start to trying to figure it out perhaps.

-Josh