Teardown or reverse engineering of DMR tier III base stations controllers

Hi, I know this technically doesn’t belong here, but since it’s related to terestrial trunked radio systems, I figured I could give it a shot.

I’m interested if anyone has done any teardown or reverse engineering of DMR tier III base station transceivers and site/zone controllers.
I’m trying to implement ETSI TS 102 361-4 for amateur radio and research purposes and as a stepping stone towards TETRA. I could use any knowledge the community has about these trunked systems, especially since there is not much information or discussion outside of commercial presentations and presumably lots of knowledge is behind heavy NDA firewalls.

DMR tier III is a much simpler standard than ETSI TETRA, and compatible terminals are much easier to acquire in small quantities and right frequency bands. However every manufacturer seems to have their own take on things and sometimes various features are proprietary or incompatible between manufacturers.

1 Like

In case there is more posting activity related to DMR, we can always open a new forum/category here.

I personally have no experience with DMR, other than briefly having read through the specs many years ago. There’s sadly always too many systems/standards and limited amount of time :confused:

Thanks Harald, I’m sure at least some people here thought about implementing a Tetra BTS at some point, I know I have, but for all practical puposes DMR trunked radio is easier to achieve building on lots of existing open source code for tier II.

I have about 45% of the standard implemented so far using SDR transceiver hardware as BTS (LimeSDR or Ettus USRP). With all advantages and disadvantages that come from that. It’s not that different in a way to osmocom-analog, except it’s using GNU Radio as lower PHY.

If people are interested, I can get into more details. Some things still escape my understanding.

Yes, I thought about it too (after doing the GSM BTS). But it’s a significant undertaking for a pet/hobby project, and I didn’t see too much commercial interest in it.

There are still some people hacking in that direction, and I think they had it at a point where the tetra BTS downlink was at least recognized by standard commercial TETRA handsets, so downlink / beacon generation was working. That’s of course just a fraction of the overall task.

Is the source code available somewhere? Would you be interested to give an OsmoDevCall on either the DMR system/standard, and/or about the state of your work? I’d definitely welcome either or both of those topics.

The code is all available on Codeberg and Github. The DMR-related functionality is 99% Jonathan Naylor’s work for tier II (conventional), with some additions by r4d10n and myself which enable it to

  1. use a SDR transceiver and
  2. adapt it for tier III trunking, based on the multi-carrier architecture described here: Implementation of a multicarrier DMR / YSF / M17 base station transceiver in software defined radio (MMDVM, GNU Radio, LimeSDR)

I have a high level schematic of the system:

The repos are at qradiolink - Codeberg.org

SDR PHY code: qradiolink branch next
MMDVM modem adapted to use ZeroMQ: MMDVM-SDR branch trunking
MMDVMHost code adapted for trunking: MMDVMHost-SDR branch trunking
DMR trunking controller: dmrtc branch master
DMRGateway for interconnection with amateur radio networks: DMRGateway branch trunking.

Documentation is sparse to none as the code is still WIP and may change.
I would be glad to talk about it at OsmoDevCall, certainly, if there’s interest.

1 Like