HR_C6000 as a DMR modem

Facts about driving the Hongrui HR_C6000 as a DMR Tier II modem on a board with an STM32 host. Pins and the MCU side are on the board's hardware page (feature-matrix.md lists the boards); the modem-neutral behavior a DMR stack needs is in dmr-modem.md. This file is register-level: what to write, when, and what the chip reports.

Full register reference: hrc6000-registers.md

Sources: the HR_C6000 user manual (Hongrui; register chapter and the "Layer 2" application chapter) and on-air measurements with an SDR watching (bit exact decode of every burst). Values marked "(unexplained)" are init values the manual does not explain; keep them. Values marked "(unverified)" have not been confirmed on our hardware.

1. Interfaces

All three interrupt lines share one NVIC priority. On the STM32 radios it is 5, which is more urgent than the USB and other EXTI lines at 6 (numerically lower is more urgent). Thread-level SPI traffic must not re-enter the handlers. A thread that touches the modem masks the three EXTI lines and waits until any running handler has finished before it starts its own transfers.

1.1 U_SPI framing

Each transaction is CS low, a command byte, an address, data bytes, CS high. Bytes are MSB first. The bit-banged master sets MOSI, drives CLK low, then high (data sampled on the rising edge; CLK idles high). Reads sample MISO after the falling edge, before the rising edge.

A read sends the command and address, then clocks dummy bytes (0xFF) while reading. The driver uses burst writes of up to 128 data bytes and burst reads of up to 96.

The manual's command table lists page 2 as the RX ("receive end") RAM and page 6 as the TX ("write end") RAM. On air, writes to page 2 land in the TX RAM and are sent bit exact. Page 6 has not been tried.

TX RAM layout (the manual):

V_SPI uses the same command / address framing (page 3, address 0x00, then 27 bytes; read command 0x83).

1.2 Clock

The PLL settings used match the manual's 29.4912 MHz crystal row (crystal frequency on the boards unverified): PLL output 49.152 MHz, system clock 9.8304 MHz, codec clock 12.288 MHz, CLKOUT 24.576 MHz.

2. Registers used (page 4 unless noted)

Names are the manual's. Only the bits we rely on are listed.

Page 1 0x04-0x09 holds the 6-byte data sync pattern the chip transmits. The chip sends the voice sync as its bitwise inverse. Write the MS-sourced data sync for normal operation. The values are the ETSI ones, and the voice syncs are their inverses.

3. Power-on initialization

PWD low, wait 10 ms, then in this order. Everything is page 4 unless a page is given. "(unexplained)" values are not explained by the manual; keep them.

A page 1 burst from 0x60 (a table of 32 three-byte entries nn EF 00) is not needed. Don't send it.

3.1 Entering DMR (after FM, or at every DMR channel change)

0x01=0xF0, 0x45 / 0x46 = the DMR modulation pair from calibration, 0x10=0x6E, 0xE0=0xC9, 0xE4=0x20+DMR mic gain, 0x26=0xFD. Then restart the receiver (section 5.1). In operation 0x10 is 0x6E, not the 0x6B written at init.

3.2 Flushing stale vocoder audio

Set the RX gain to -15 dB (any lower and the flush doesn't take), 0x06=0x22, 128 x 0x7F to page 3, 0x06=0x20, restore the RX gain.

4. Interrupts

4.1 Timeslot interrupt (every 30 ms)

The interrupt comes at each slot boundary once the chip has timing. Passive timing (0x40=0xC3) derives the timing from received bursts. When the signal goes away, it keeps counting from the last sync. Corrections within 1.25 ms are applied in real time. Active timing (0x40=0xE3) generates the timing locally. The interrupt stops only when TxEn and RxEn are both cleared.

At every timeslot interrupt the MCU decides the next slot and writes 0x41. For TX it also writes the payload and 0x50. These writes must land before the slot after the next starts. In the manual's timing, the chip starts framing the next slot's burst at t1, and the MCU must write its data in the window t2 before t1. The driver writes everything at the start of the timeslot handler, and the burst goes out in the following slot. A late setup slips the burst by one slot (30 ms) or by a frame (60 ms). While transmitting, the slot between our bursts gets 0x00. An SFR writes 0x50 there instead, because it hears its inbound slot in that slot (hrc6000_dmr_tx_listen, sfr.md 3).

The CACH TC bit (0x52 bit 2) can be read here. The chip refreshes it only in slots being received.

4.2 System interrupt

Read 0x82 (flags) and 0x52 (CC / CACH) first, handle each set flag, then write the value read back to 0x83.

The mask 0x81=0x19 enables bits 4, 3 and 0. Bit 7 (send rejected) still shows set in 0x82 when 0x82 is read on another interrupt. The SFR debug build counts these. So 0x82 shows more flags than the mask lets interrupt. Whether bit 7 raises the line by itself is unverified.

Two interrupts per voice burst. A voice burst produces one received-data interrupt for its EMB (SyncClass 0) and one for the burst. A voice handler takes a burst number 1..6 at most once per 45 ms. It drops a second report that comes within 45 ms of the last voice burst taken.

Timing of a burst report. For a burst received in step with the chip's slot timing, the received-data interrupt comes 3-5 ms after the timeslot interrupt (2-10 ms observed). A delay of 25-30 ms means the chip's timing is out of step with the sender, because it locked to noise or to another station. The receiver should then be resynchronized.

4.3 RF TX interrupt

The interrupt comes before each burst the chip is about to send. The handler keys the PA and switches the RF chip to TX. On a board without the RF RX interrupt the MCU ends each TX burst itself. At the next timeslot interrupt, if the PA has been on for more than 20 ms, the MCU turns it off and puts the RF chip back in RX. After the last burst of a transmission, a one-shot 29 ms timer does the same. Keying takes the PA enables high and writes AT1846S register 0x30 = 0x60C6 (digital TX). Un-keying takes them low and writes 0x30 = 0x7026 (25 kHz) or 0x6026 (12.5 kHz).

On such a board the RF chip's "transmitting" state therefore goes on and off burst by burst. Code that needs to know whether a transmission is in progress must use the modem slot state (section 7.5), not the PA.

5. Receive

5.1 Restarting the receiver

0x40=0xC3, then 0x41=0x20, 0x41=0x00, 0x41=0x20, 0x41=0x50. (The manual's recipe: if the received CC doesn't match, write 0x20 to drop the sync and search again.) Used after leaving TX in direct mode, after a call ends, after color-code changes, and on any loss of state.

5.2 Per burst (received-data interrupt)

Read 0x51 and 0x5F (and 0x52 already read):

Payloads: page 2 from 0x00. 12 bytes for an LC (voice header, terminator, or the embedded LC once assembled), CSBK, MBC, data header and rate 1/2 blocks; 18 bytes for rate 3/4 (the chip decodes the trellis code); 24 bytes for rate 1. Voice: 27 bytes from page 3 on V_SPI (three 72-bit AMBE+2 frames with their FEC, as the codec expects).

• Mode from sync type: BS sync means a repeater; anything else is direct mode. The receiver follows it unless the channel forces direct mode (and always stays direct for SFR).
• Data blocks have no CRC of their own (the packet CRC-32 covers them): take rate 1/2, 3/4 and 1 blocks even when the CRC flag is set, and flag them. Drop CSBK, MBC and data headers with a CRC error.
• Data on our slot only: through a repeater, accept a data burst only when the slot number (from the TC bit) is ours and it differs from the previous burst's slot (a second report in the same slot is a duplicate). In direct mode, accept the bursts of the slot the receiver is locked to.
• The LC registers are sticky. Page 2 keeps the previous call's LC until the new one is decoded. On a new reception, the first LC read may be the last call's. Either wait for two superframes (burst A seen twice after the slot lock) before trusting it, or capture page 2 when the reception starts and accept an LC only when it differs from that capture, or after more than one superframe of voice. The driver captures page 2 at the first report of a quiet period (a status report before any burst is taken, for a late entry), else at the first burst.
• The voice header's LC and the terminator's LC are read at their bursts; during voice, the embedded LC appears in page 2 once the chip has assembled it from bursts B-E. Working conclusion from HIL 2026-10-10 (c8c9b23): not yet at F's first report (the EMB one): a new LC was first seen there at the second F. So until a reception has its LC the driver also reads page 2 at the next burst A, at F's repeated report and at the post-access interrupt (an LC that differs there is handed over with the next voice burst).
• LC trace (for the bench): every look at page 2 until the reception's LC is handed over is logged, with the ticks since the capture, the voice bursts taken and page 2's source ID. Debug link log lines dle cap<how> <src> (how: 0 status report, A lone burst A, T burst taken) and dle <ev><res> @<ticks> v<voice> <src> (ev: F burst F, f F's repeated report, A the next burst A, P post-access, p post-access just before the reception, H header; res: n differs from the capture, taken; s same, held back; v same, taken after more than one superframe; k differs, kept for the next voice burst; c CRC error flagged). Diagnostics lines lc n= s= v= c= (at F), lc2 a= f= p= k= (found at A, at F's repeat, at post-access; kept LCs handed over) and lt <how><capture src> <ev><res><ticks>... (the last reception).
• Talker alias and GPS embedded data (FLCO 4-8) appear in the same page 2 location as the embedded LC.

5.3 Timeslot tracking (repeater signals)

The TC bit of the CACH alternates 0/1 slot by slot. At each timeslot interrupt the driver toggles its own slot number and compares it with the received TC:

Once locked, write 0x41=0x50 before our slot and 0x41=0x00 before the other. The CACH is then not refreshed in the other slot, so the TC compare is only meaningful before the lock.

In direct mode there is no CACH: lock to the slot of the first good burst (its number is meaningless) and receive one slot in two from then on.

5.4 Color code acquisition (when the user's CC filter is off)

The chip only deframes bursts whose CC matches 0x1F unless 0x41 bit 3 is set. To follow an unknown CC: at each system interrupt with an SNR margin of at least 5 dB, compare 0x52's CC with the last one seen (within 200 ms). On every second match write the new CC to 0x1F and rewrite 0x40=0xC3 (through a repeater also the 0x41 resync sequence: 0x20, 0x00, 0x20, 0x50), then wait 3 ms (a busy wait in the interrupt: faster rewrites crashed the radio). After 8 matches the CC is held. Release the hold after 5 s of no received audio while idle.

5.5 End of a reception

5.6 Late entry

The post-access interrupt (0x82 bit 4) comes when the chip acquires a voice call in progress from its embedded signaling. If idle, with the CC held and matching: write 0x41=0x50 and start receiving as for a header. Skip voice until two bursts A have passed, unless the source ID is already known and isn't our own. The LC comes from page 2 once the embedded LC is complete (subject to the sticky-LC rule above). The driver reads page 2 at the interrupt and keeps an LC that differs from the capture for the next voice burst (counted as lc2 p=, traced as P); whether the interrupt comes on a late entry, and when relative to burst F, is what the trace shows.

5.7 Audio buffering

Decode the 27 bytes as three 20 ms frames. If, between two bursts A, fewer than 5 other voice bursts arrived, insert one frame of silence so the playback buffer recovers instead of stuttering. If the PCM buffer is nearly full (fewer than 3 free 20 ms buffers), skip decoding the next 6 frames. After a voice-abnormal interrupt on our slot, play silence for the next frame. AMBE silence frame (9 bytes, repeated three times per burst): B9 E8 81 52 61 73 00 2A 6B.

6. Transmit

6.1 Burst set-up

For each burst, in the timeslot interrupt before its slot:

CRC: with 0x40 bit 3 (CRC_MCU_Control) clear the chip computes the CRC (masked per data type) for headers, CSBKs and LCs; with it set the 96 info bits are sent exactly as written (the MCU supplies the CRC; bad CRCs go out as given). Change bit 3 only when the next burst needs a different setting (read-modify-write of 0x40). The chip still does the FEC (BPTC, trellis), slot type and sync in both cases. Restore bit 3 to 0 at the end of the transmission: rewriting 0x40=0xC3 does it. Bit 3 seems to affect the receiver's deframer too: inbound headers decoded while the chip was framing a burst with bit 3 set came out bad.

The idle message has its own place in the TX RAM: page 2 from 0x18. Writing it there keeps the LC at 0x00 for voice bursts that follow.

6.2 Starting a transmission

Common: 0x21=0xA2 (polite to own CC, clear the encode buffer), 0x22=0x86 (start encode, I2S).

• Direct mode: from idle, with the modem interrupts masked: 0x21, 0x22 as above, unmask, then 0x40=0xE3 (active timing). The timeslot interrupts start on the chip's own timing; the next one starts the burst sequence.
• Through a repeater, already receiving it (its hang time or a call): stay in passive timing; when the slot tracking is stable with no disagreement and the slot that just started is the other one, lock to ours, write 0x21=0xA2, 0x22=0x86, 0x41=0x00, and start the sequence at the next timeslot interrupt.
• Through a repeater, nothing heard: wake it (section 6.5) first.
• Data: as voice, but the sequence sends the queued bursts instead of headers and voice.

Polite access: with 0x21=0xA2 the chip refuses to send while our CC is busy on the channel (send-rejected interrupt). A transmission that must go out in a busy channel (an SFR repeat, a reply in a repeater's hang time on a single frequency) writes 0x20=0x00 and 0x21=0x02 (impolite).

6.3 Voice sequence (one entry per timeslot interrupt)

So a transmission is 3 voice LC headers in our slot (180 ms of lead-in), then whole superframes, then the terminator. It always ends at a superframe boundary: PTT release takes effect only before burst A.

Encoding: each 40 ms of PCM (two 20 ms buffers) gives one 9-byte AMBE frame; the voice burst takes three. Encode in a 1 ms-tick task ahead of the timeslot interrupt; a 4-burst ring of encoded frames is enough. The AMBE codec code is a binary blob supplied per radio (codec-placement.md); its glue must not be compiled with optimization that changes its inline assembly (it crashed DMR TX at -Os).

6.4 LC content

12 bytes to page 2: FLCO (0x00 group, 0x03 private), FID, service options, destination ID (3 bytes), source ID (3 bytes), 3 bytes 0. The chip computes the RS(12,9) parity unless CRC_MCU_Control is set. For privacy, the FID and service options carry the privacy bit (see dmr-modem.md).

Talker alias: during the first superframe of each pair, page 2 holds the call LC; in the other, one talker alias block, cycling header (FLCO 4) and blocks 1-3 (FLCO 5-7), 7 bytes of text each (the header carries the format and length in byte 2 and 6 characters), and FLCO 8 for GPS (7 bytes: longitude as 25-bit two's complement scaled 2^25/360, latitude 24-bit scaled 2^24/180). The chip spreads the 72-bit embedded LC over bursts B-E.

6.5 Repeater wake-up (BS activation)

1. Write page 2: B8 00 00 00 00 00 00 + source ID (3 bytes) + 00 00 (BS_Dwn_Act CSBK, LB=1, BS address 0), 0x50=0x30 (CSBK), 0x41=0x80, 0x40=0xE3 (active timing). One CSBK in our slot.
2. Next timeslot interrupt: arm the 29 ms PA-off timer, restart the receiver (passive).
3. Wait for the repeater: the received TC must toggle correctly more than 3 times in a row. Then treat it as the "already receiving the repeater" case above.
4. No answer in 600 ms (the retry period): send the CSBK again, up to the codeplug's wake attempt count, then fail.

6.6 Data transmission

A list of up to 40 bursts (CSBKs, headers, blocks) goes out one burst per slot on our slot, with an idle slot between (our slot only), starting from the first "our slot" step of the sequence (no voice headers, no terminator). After the last burst, the end steps 10-11 restore passive timing / the receiver and clear CRC_MCU_Control. Timeout: 10 s plus 60 ms per burst (covers a repeater wake-up). A received-data interrupt for a data burst is queued (8 deep is enough; the packet CRC catches overflow) and handled outside the interrupt.

6.7 Which slot to transmit in

Through a repeater: the channel's timeslot, from the CACH. In direct mode the chip's own timing defines the slots and the "our slot" phase is the one the sequence starts in. Single-frequency repeater users transmit in the other slot than the one heard: when keyed while hearing the repeater, start the sequence from the step that sets up the slot heard, so the first burst lands in the opposite slot.

7. Timing quirks found on air

1. "Transmitting" must come from the modem slot state. The PA and the RF chip's TX mode toggle every burst (section 4.3), and putting the RF chip in RX between bursts clears any "transmitting" flag that follows it. A status reported from that flag dipped to idle for one poll mid-call, and stopping the transmission on it cut the call. Report "transmitting" from the first header's set-up to the end of the terminator's slot (steps 1-11 above, plus the data states).
2. The terminator's slot is step 11, not step 10. Treating step 11 as "already finished" ended every call before its terminator was on air (24 of 24 calls lost their end on the SDR). Only after step 11 is the transmission over.
3. Ending a call (PTT release or a host's end of call) must not stop the RF. Only clear the "transmission enabled" request (as a PTT release does) and let the sequence finish the superframe and the terminator. Switch the RF to receive only once the modem slot state is idle. If a voice frame handed to the modem hasn't been sent yet, wait for it, or the modem sends silence in its place.
4. No startup silence. Feeding silence frames before the first real voice delayed every call by 360 ms per superframe of silence. Start with the real first frame; the 3 headers are the lead-in.
5. A host's end of call (terminator) ends the call once the voice buffer is empty, or 360 ms after the last voice with none.
6. Every voice burst number arrives with the voice bit set (0x9..0xE): matching 1..6 exactly drops every burst.
7. A second received-data interrupt per voice burst (the EMB report): de-duplicate within 45 ms.
8. While the chip transmits, its reports about bursts it hears are unreliable: the CRC flag, CC and sync type, the data type (a second report per slot with another type), and the info bits of headers and terminators (bytes 5-11). Every CSBK and data header heard while sending failed its CRC by 11-23 bits spread over the burst. A deferred re-read of 0x51 at the next timeslot interrupt often reads 0x00. Treat what is heard while transmitting as suspect (an SFR holds data calls until it stops sending).
9. Bursts in step: a received-data interrupt 3-5 ms after the timeslot interrupt means the sender is in step; 25-30 ms means out of step: resynchronize the receiver (section 5.1).
10. The color-code probe busy-waits 3 ms in the interrupt after rewriting 0x40; don't run it while transmitting.
11. SPI contention: the U_SPI is shared by interrupt and thread code with a simple in-use flag; a transfer attempted while another is running is refused (counted on SFR builds). Mask the modem interrupts around thread-level transfers.
12. Retuning the instant "transmitting" clears is safe once (1)-(3) hold: measured 0.70-0.73 s after the host writes its terminator (buffered voice + the rest of the superframe + the terminator), never before the terminator is on air.

8. FM mode on the HR_C6000

The HR_C6000 does the FM modulation (two-point) and the audio paths in FM; the AT1846S does the RF.

FM TX: 0x10=0x80, 0xE0=0xC9, 0xE4=0x20+FM mic gain, 0xC2=0x00, 0xE5=0x1A, 0x25=0x0E, 0x26=0xFE, 0x83=0xFF, 0x87=0x00, 0x45 / 0x46 = FM calibration pair, 0x48=0x00, 0x04 = calibration Mod2 offset, 0x49=0xFF, 0x4A=0xFF, 0x35 = deviation, 0xA0 = CTCSS or DCS deviation, 0x3F=0x04, 0x34=0x3C, 0x3E=0x08, page 1 0x50=0x00 and 0x51=0x00, 0x60=0x80.

FM RX: 0x60=0x00, 0xE0=0x89, 0x10=0x80, 0x34=0x3C, 0x81=0x19, 0x85=0x00, 0x26=0xFD. Audio feed-through 0x36=0x02 (0x00 mutes); 0x10 back to 0x6E for DMR.

Tones (0xA1 mode): 0x80 off, 0x88 CTCSS, 0x84 DCS, 0x82 DTMF.

• CTCSS TX: 0xA1=0x88, 0xA8 = tone index. RX: 0xA1=0x88, 0xA7=0x10 (threshold), 0xD3=0x07 / 0xD2=0xD0 (sampling depth 2000 = 250 ms at 8 kHz), 0xD4 = tone index. Detected: 0x93 bit 0.
• DCS TX: 0xA1=0x84, 0xA2 = 0x00 inverted / 0x08 normal, 0xAB = code bits 7-0, 0xAC = code bit 8. RX: 0xA1=0x84, 0xA2 = 0x04 inverted / 0x00 normal, 0xD4 = code bits 7-0, 0xD3 = (code bit 8 << 4) + 0x03, 0xD2=0x20 (depth 800 = 100 ms).
• DTMF TX: save 0xA1, 0xA0 and 0xD1; 0xA1=0x82, 0xA0 = deviation, 0xA4=0xFA (tone time, continuous), 0xA3=0x19 (gap, 2 ms units), 0xD1=0x01 (one code), 0xAF = code << 4, 0x60=0x00 then 0x80 to send. Restore the three registers after (the high bits of 0xD1 matter).
• Tone table (page 1, extended addresses, value = f x 65536 / 32000, low byte first): 0x11A/0x11B 697 Hz (0x0593), 0x11C/D 770 (0x0629), 0x11E/F 852 (0x06D1), 0x120/1 941 (0x0787), 0x122/3 1209 (0x09AC), 0x124/5 1336 (0x0AB0), 0x126/7 1477 (0x0BD1), 0x128/9 1633 (0x0D10). A single arbitrary tone: put its value in both the 697 and 1209 entries and send DTMF "1"; restore the entries after.

8.1 FM audio paths in the manual (unverified)

What the manual documents about where FM audio can come from and go to, beyond the codec. None of it is used yet; tests/hil/test_audio_probe.py tries it. Measured on an AT1846S board: the RX FM buffers hold 8 kHz big endian 16-bit receive audio, ungated, after 0x34's de-emphasis and filters, one half per 32 ms with 0x82 bit 1 (once 0x81 unmasks it); keyed, 0x82 bit 7 comes every 32 ms and the codec writes its samples into the TX buffers (read back through page 6, U_SPI OPMode 110): they are a tap, and no setting tried (525, with the MCU rewriting each half within 4 ms) makes them the modulation source. MCU audio goes on air through the MOD1 offset 0x04 instead (section 2 table), and 0x06 bit 2 does switch the FM chain's input to the external codec port. The prompt tone FIFO drains at 8000 samples a second whether 0x06 bit 1 is set or not, and doesn't reach the modulator either, with or without 0xE3 bit 0. LINEIN2 (0xE0 bit 5) puts a 2.5-2.6 kHz tone of its own on air when enabled during FM TX: keep it off.

9. Single-frequency repeater (SFR) facts on the HR_C6000

From our SFR work (on air in MMDVM SFR):

• Repeating on the other slot: write the outbound sync pattern (page 1 0x04, e.g. direct mode TS2 data sync) before keying and restore the MS pattern after; save and restore 0x10; keep 0x11=0x80; impolite access (0x20=0x00, 0x21=0x02); voice bursts with the embedded LC from the call's LC (CRC_MCU_Control clear so the chip makes the checksum); headers / terminators / CSBKs / data with CRC_MCU_Control set (verbatim), except the idle message (no checksum: bit clear, written to page 2 0x18).
• Measured: repeats 90.02-90.05 ms after each inbound burst (a burst reported just after the timeslot interrupt that set up the next outbound slot goes out in the one after), bursts 31.3 ms with 0.2 ms ramps, within 25 Hz.
• 0x10 bit 2 (relay) gives BS framing with a CACH whose AT / TC come from 0x52 (written) and short LC from TX RAM 0x24 (9.1). An ETSI single-frequency BS uses guard-time framing without a CACH (TS 102 361-1 4.6.2).
• 0x41 bit 3 (CC_Match_Ctrl) lets the chip deframe any CC while keyed (experiment switch, effect unconfirmed).
• The AT1846S TX/RX switch per burst over I2C takes about 0.5 ms from the interrupt.

9.1 Continuous BS outbound (split duplex TX half)

drivers/modem/hrc6000/hrc6000_bs.c (CONFIG_HOTSPOT_SPLIT, split-duplex.md 5.4) takes the chip over from the slot engine while the split duplex TX half runs; the engine's three ISRs, its watchdog, halt and is_transmitting hand over to it while e->bs is set. Start: color code, page 1 0x04 = BS data sync, 0x20 = 0x00, 0x21 impolite, 0x22 = 0x86, 0x41 = 0x00, then 0x40 = 0xE3 (own timing: the timeslot interrupt runs free every 30 ms). Every timeslot interrupt while keyed sets up the next slot from that slot's queue (or the idle message on page 2 0x18, counted as an underrun): the MCU CRC bit of 0x40 per burst kind, the payload (voice on page 3, LC / data on page 2 0x00), 0x41 = 0x80 and 0x50. Page 2 0x00 is shared by both slots, so a slot's embedded LC is written back before its voice A-E whenever the other slot's header or data overwrote it. The first burst after a key-up is an outbound TS1 slot (outbound slot = ((tick - base) & 1) ? TS1 : TS2). The PA is keyed once, at the first RF TX interrupt, and dropped at the first timeslot interrupt after the unkey, or by the watchdog when no timeslot interrupt came for 200 ms. Stop: 0x10 / 0x11 back to 0x6E / 0x80, MS sync, 0x40 = 0xC3, the slot engine restarts the receiver.

The CACH: the manual has the MCU give the BS downstream CACH's AT and TC in 0x52 (written) and the short LC in TX RAM 0x24-0x28, and the chip encode it. On air (2026-10-12) the layer 2 CACH stays all zero whatever is written there, in every 0x10 / 0x11 / 0x50 combination tried (9.2). What works is the physical layer mode (0x10 = 0x66, LayerMode 00), which the manual documents only for receive: the chip then modulates TX RAM page 2 as given, 288 bits per slot (24 CACH, 264 burst, MSB of the first byte first), from 0x00-0x23 and 0x24-0x47 in alternate slots, and takes its half at the slot start. The slot interrupt, 0x41 = 0x80 and the PA keying work as in layer 2. The driver writes each slot's frame (bsOutboundRawSlot) to both halves, since which half is which slot isn't known, and nothing to 0x50, 0x52 or the vocoder. Variant 1 keeps the layer 2 framing (0x52 and the short LC written for every burst) for comparison; 255 adds up to four raw page 4 pairs at key-up. Host test: tests/host/hrc6000BsTest.c.

Restarting the slot timer (ALIGN, split-duplex.md 3.8; bench 2026-10-21): 0x41 = 0x00, 0x40 = 0xC3, 0x41 = 0x20, 0x00, 0x20, 0x00 (the 5.1 sync drop), then 0x40 = 0xE3 at the chosen time. The first timeslot interrupt comes 1.18-1.24 ms after that write and every 30 ms from it, and none comes during the wait. Clearing TxEn and RxEn (0x40 = 0x03) or 0xC3 then 0xE3 without the sync drop stopped the timer only sometimes: interrupts kept coming during the wait and the old phase came back. The driver takes no interrupt while it waits and gives the requested slot to the first boundary after the write; the diagnostics line bs shows the restarts (rs), interrupts during waits (ri) and the first three after the last write (r1-r3, µs).

No slewing. The manual lists no slot length trim, so the driver offers no bs_slew and INFO capability bit 2 stays clear: a keyed TX half reports its drift (ALIGN flag 10) and is re-aligned by a restart at the next unkey.

9.2 BS framing bench results (2026-10-11 and 12)

467.375 MHz, lowest power, 10 s and about 335 bursts per run, with the framing variants of split-duplex.md 10.1 and sdrmon.py analyze --cach on the SDR bench:

So in the physical layer mode the chip sends TX RAM 0x00-0x23 and 0x24-0x47 in alternate slots and latches its half at the slot start. Earlier runs also found every fourth TS2 burst sent as a zeroed PI header, a driver bug (gotchas 8.14).

10. Open questions

• Page 6 (manual: TX RAM) vs page 2 for TX: page 2 works; page 6 untested.
• The meaning of the unexplained init values (0x10=0xF3 / 0x6B during init, the 0x11-0x3C bulk block, the page 1 tables).
• Whether the post-access interrupt is reliable for data calls (it is a voice mechanism in the manual).
• Crystal frequency on the boards (the PLL values match 29.4912 MHz).
• Passive full duplex (manual 5.4.4) for a true SFR / repeater: not tried.

View the source of this page