HR_C7000 as a DMR modem

How the baseband inside the HR_C7000 SoC is driven as a DMR Tier II layer-2 modem and as an FM modem: registers, buffers, interrupts, what to write when, and what the chip does by itself. Board-level facts (pins, RF chip, PA timer, calibration source) are on the board's hardware page (feature-matrix.md lists the boards); the stack-side contract is in dmr-modem.md; the HR_C6000 equivalent is in modem-hrc6000.md.

Sources: the HR_C7000 chip user guide v2.7 (2016; "the datasheet" below) and measurements on a radio or the SDR bench (marked "measured"). Values without a mark are the ones the driver writes and that work on air (simplex voice both ways and repeater wake are checked on the HR_C7000 radios, docs/feature-matrix.md). "(unverified)" marks what has not been confirmed on a radio.

1. The modem's view of the system

The modem runs DMR at layer 2: the CPU builds every burst's information bits (LC, CSBK, data blocks, AMBE) and the chip adds the FEC (BPTC, Golay slot type, RS(12,9), QR EMB, CRC with masks), sync, CACH handling and timeslot timing. Layer 3 (the chip's own call control, SMS, BS activation) exists but is not used by any working firmware.

2. Register map used for DMR

Offsets from 0x11000000. Values are the ones the driver writes unless noted.

2.1 Mode and RF interface

AF receive input (datasheet, document 2). In AF mode the RF chip's demodulated audio goes to the AF ADC's P input, and a DAC output biases its N input; on some boards that is a board DAC output. Document 1 says the AF bias is set through SIG_CENTER instead. A DC step on either input moves the PHASE_OUT center, which the DMR receiver reads as a frequency offset. AF mode has no frequency offset compensation: RX_IF_FREQ applies to IF mode only.

Reference oscillator control (MOD1, datasheet). In receive the MOD1 level is RF_MOD_BIAS_CTRL b25:16 over 0-3.3 V, which holds only while DAC_CONTROL keeps that DAC powered. In TX it is SIG_CENTER b31:24, ±422 mV around 1.65 V in 3.3 mV steps; RF_MODE b9 sets where the ramp starts (0 = 1.65 V). With cal + 384 in b25:16 both states give about the same voltage, within one step (measured).

2.1a RF_MODE bit 11: the DCDM receive switch

The HR_C7000 datasheet names bit 11 use_dual_phy. It turns on a second receive channel, "for repeater chip receive mode and DCDM mode" (datasheets/C7000/HR_C7000_Document_2.pdf, register table at p. 98; our translation from the Chinese). DCDM is dual-timeslot direct mode: two conversations on the two DMR timeslots of one frequency, with no repeater to supply sync. The community name is "dual-capacity direct mode"; the datasheet doesn't expand it. Its DCDM set-up (section 18.3.5.1, p. 410) is three steps: turn off MS and BS sync receive, enable TDMA1 and TDMA2 sync detection, and set RF_MODE[11]. Receive stays enabled all the time.

• Channel mode. The bit can follow the channel mode: simplex channels (RX frequency equal to TX frequency) set it and enable TDMA1 and TDMA2 sync; repeater channels clear it and enable only MS and BS sync. That is the datasheet's DCDM set-up on simplex. The datasheet also lists "repeater chip receive mode" as a user of bit 11, which a repeater channel with the bit clear suggests is a different mode. Not resolved.
• RadioFoundry: writes 0x03269860 (bit 11 set) and enables the TDMA1 and TDMA2 sync detection on every channel (hrc7000.c, the bench note of 2026-10-16), so RadioFoundry runs the DCDM receive set-up on repeater channels too. Whether that matters on a repeater is not measured.
• Not a second RF chip. The RF chip is unchanged. The second channel is a second modem receive path. Multi-chip dual watch is a separate feature (RadioFoundry issue #96).
• Not known: whether a simplex receiver with bit 11 on hears a second-timeslot call that it misses with the bit off. No on-air test has compared the two (section 10, item 7).

2.2 Sync words

24-bit halves of the 48-bit ETSI sync patterns, high half first (all written once at init):

Voice syncs are not programmed; the chip derives them (they are the bitwise complements of the data syncs; unverified). Bit 31 of the RECV_MS / RECV_BS high halves is an undocumented enable. The RECV_TDMA1 / RECV_TDMA2 high halves need it too: without it the chip never detects the direct mode syncs (bench, 2026-10-16: an SFR's TS1 inbound was not heard until it was set).

SEND_DATA_SYNC is the only send pattern; a voice burst goes out with its complement. RadioFoundry rewrites it before a burst that asks for another sync family (dmr_tx_burst_t.sync_override: an SFR's TS2 direct mode outbound) and back to MS for the next burst without one. On air the burst then carries that family (bench, 2026-10-16: TS2 sync with the repeated LC).

2.3 CRC, RS and color code

2.4 Interrupt control

SYS_INTERP_LIST bits:

2.5 Layer-2 control

Values written to LAYER2_CONTROL: 0xC0 = TX and RX enabled, passive timing (receive, follow the other side's slots); 0xC3 = TX and RX enabled, active TX and RX timing (we set the slot clock); 0xCB = 0xC3 plus b3 rx_master_auto_update, for tx_listen. The datasheet (10.2.2.16) says b0 rx_master_mode should normally be 0, and that in active receive mode the receive slot edges move with the received sync only when b3 is set. With 0xC3 alone an SFR heard almost nothing in its listening slot while it sent (measured, 2026-10-16: L18/1), so tx_listen sets b3 for a transmission on our own timing.

An aligned start (DMR_TIMING_ALIGNED with a burst received, an SFR's repeat) writes no LAYER2_CONTROL value: it stays 0xC0 and LAYER2_SLOTON = 0x25 (0x05 plus b5 dll_rx_open_tx) builds the TX slot from the receive slot. Any LAYER2_CONTROL write at the start left the receiver without slot sync for about 1 s, deaf to the call being repeated: 0xC3 (TX slots 37.7-41.6 ms after the caller's instead of 30), 0xC4 (b2, TX slots following the receiver: 28.6-30.1 ms), even 0xC4 written over 0xC4. With b0 rx_master_mode set (0xC5, 0xCD) the receiver kept its sync but no TX slot started. Without a CACH (an SFR's repeat, a direct-mode answer) the first slot after the start is the one the received bursts came in; the driver sends in the slot whose number (LAYER2_STATUS b31) is the received bursts' chip slot for the same TS, the other one for another TS. Measured on the SDR bench, 2026-10-16: our bursts 30.1 ms after the caller's, the whole call heard and repeated.

Through a repeater (BS-sourced bursts; two boards on the SDR bench, issue 72, 6 of 6 runs on the right slot and on the grid) the slot comes from the CACH TC alone (5.3): the TC lock, then a TC estimate that toggles at every timeslot interrupt and gives the TC of the slot starting at that interrupt. The receiver runs in LAYER2_CONTROL 0xC4 (TX slots follow the receiver) from every receive restart on a repeater channel, and that restart releases both slot syncs (TXRX b23 and b22) and is also the end of every transmission. A start waits in receive for the lock, then writes only TXRX (no LAYER2_CONTROL or SLOTON write at the key-up); the first TX tick sends in the next slot when the estimate is the other TS's TC. A first TX-vector interrupt less than half a slot after the last receive one is the same slot and does not toggle the estimate. Without the lock in 1 s the start is refused (TX_REJECTED, nothing sent).

Bench findings behind this (two boards on the SDR bench, 2026-10-18):

Timing rules the chip follows (what the bench showed; the data sheet doesn't say):

• The TX slot phase is latched, not derived. In 0xC4 the TX slots follow the receiver, but only from the moment the TX slot sync was last released and re-acquired. A TX sync left from an earlier transmission, including a burst sent on our own timing (the wake-up), keeps its phase and the next call goes out off the repeater's grid by whatever the difference was. Every receive restart must release b22 as well as b23.
• Check the phase, not the slot. The measure of "on the grid" is the first TX-vector interrupt 30 ms (one slot) after the last receive one (txh u in the diagnostics: 299-300 in the passing runs, 90-180 in the failing ones). It is cheaper to read than the air capture and gives the same verdict.
• LAYER2_STATUS b31 is not a usable slot number at the start of a transmission (always 0), and RX_TYPE_INFO b19 is one burst's chip slot, not a reference. Neither decides a TX slot on a repeater.
• Writing LAYER2_CONTROL drops the receiver's slot sync for about 1 s, in every value tried. Set it at a receive restart and leave it.
• A TX-vector tick right after an RX-vector one is the same slot. The two interrupts of one slot came about 5 ms apart in some runs; counting both as slots put the estimate one slot off.
• A deframe near a tick belongs to the previous slot. A burst is deframed late in its slot, around the next timeslot interrupt: in the first half of a slot count it to the one before.
• A slot estimate needs a lock first. The first bursts after the receiver syncs can carry a wrong TC; the driver waits for four alternating values.

SFR (two boards on the SDR bench, 2026-10-18, each run after a key-up on our own timing): the repeat's TX slot comes 30.1 ms and 30.7 ms after the inbound one, with the TX slot sync released only on repeater channels (6 runs) and on every channel (10 runs) alike: the SLOTON b5 start takes the receiver's phase whatever the TX sync held, so the stale phase that broke the repeater path does not reach an SFR. Every receive restart releases both syncs. Read at an SFR's start, LAYER2_STATUS b31 picked the right slot in every run (txh e1: b31 set, the received chip slot next, ours after it). The first TX-vector interrupt comes two slots after the last receive one (txh u 599-600), not one as through a repeater: the slot right after the SLOTON strobe has no TX tick, so a tick count across an SFR's start is one short. The phase check is a whole number of slots. A direct mode start can take the slot from the TDMA1 / TDMA2 sync type in RX_TYPE_INFO b3:2 plus LAYER2_STATUS b29 against an offset captured at that moment, never from b31 or b19.

Values written to LAYER2_TXRX_CTRL: 0x00 nothing next slot; 0x40 receive next slot; 0x80 transmit next slot; 0x8040 receive next slot with the voice-access flag; 0x800000 release RX slot sync.

2.6 LAYER2_SEND_TYPE codes

Datasheet example for one superframe: A = 0x08, B = 0x19, C = 0x2B, D = 0x3B, E = 0x4A, F = 0x50, i.e. LCSS 0 on A, 1 (first fragment) on B, 3 (continuation) on C and D, 2 (last) on E, 0 on F. The driver writes LCSS = 0 on every voice burst (0x08, 0x18, 0x28, 0x38, 0x48, 0x58). Whether the chip then still sends the embedded LC fragments correctly is unverified; follow the datasheet.

2.7 RX_TYPE_INFO (0x390, read after a deframe interrupt)

"CRC good" for a deframed burst = bits 30:24 all zero. Data blocks have no CRC-16, so do not drop them on these flags; check CRC-9/CRC-32 in software. RX_INFO (0x394): b24:16 trunking multiframe number, b10:0 received RC.

2.8 Buffer layouts

TX RAM (0x16000000), datasheet table 52: 0x00–0x0B the current control burst (PI header 10 + 2 CRC, LC header / terminator 9 + 3 RS, CSBK / MBC header / data header 10 + 2 CRC, MBC block 12, rate ½ 12, rate ¾ 18, rate 1 24); 0x00–0x09 also embedded LC (72 bits + 5-bit checksum in byte 9, "prepared when voice burst A is about to be sent"); 0x29–0x2C burst F EMB filler (or key ID / algorithm ID for privacy); 0x30–0x4A voice burst when voice comes from TX RAM (layer-2 BS mode, AUDIO_CONTROL b0 = 1); 0x4B–0x50 embedded RC; 0x495–0x4AF send voice key (27 bytes).

RX RAM (0x160004B0), datasheet table 53: the deframed control burst at 0x00 (LC header / terminator 9 + 3, CSBK / headers 10 + 2, data blocks 12 / 18 / 24, idle 12, C_RC 7 + 2). Embedded LC after late entry also appears at 0x00–0x08; the chip keeps the previous call's LC there until a new one is decoded (measured).

Voice RAM (0x16000960): write 27 bytes before arming a voice burst; read 27 bytes after a voice deframe interrupt Burst numbering for privacy keystream purposes is RX_TYPE_INFO's 1–6.

2.9 BS (repeater) mode: bench results 2026-10-20

Datasheet source: the Chinese original (HR_C7000_Document_2, 10.2.2.17, 10.2.2.18, 10.2.2.22, 10.2.2.25-10.2.2.28). The registers, their bits and what the chip does with them were tried on one board (RadioFoundry build with a scratch memory poke command, SDR bench capture on 461.4625 MHz, lowest power, sdrmon.py analyze --cach). (measured)

Datasheet summary:

Findings:

Unresolved: where the chip takes the CACH bits from. The likely source is the same as on the HR_C6000, per slot values the MCU supplies at the RDY_NEXT_SHORT_LC interrupt (BS_CACH written every slot, short LC in a TX RAM window), which a static poke cannot reproduce. Not tried: the real start sequence (arming BS TX without RadioFoundry's call), bs_tx_data_rdy = 1 with MCU data in both slots, tx_voice_source, bs_rx_mode (receive BS, label slots), bs_single_freq, the BS_INTER pins, and two chips. The test was a register switch in the middle of a RadioFoundry call, so the one-slot cadence in 6 may come from RadioFoundry's own TX loop and not the chip.

2.9a gps_pps_en: the simulcast slot lock (datasheet only)

LAYER2_BS_MODE b3 gps_pps_en enables what the datasheet calls same-frequency simulcast (datasheet 10.2.2.25-10.2.2.27). It is a BS mode feature: the chip disciplines its BS slot timing to a GPS second pulse, so several repeaters on one frequency send each slot at the same instant. Datasheet only; nothing below has been tried.

Answers for the split duplex TX half (split-duplex.md 3.8, INFO capability bit 5):

1. It needs a pulse on a chip pin. The datasheet names none for it; the only candidate is BS_INTER_IN (P12, "BS sync interrupt input"). Where an HR_C7000 radio in boards/ has a GPS module, it is wired to an MCU UART only, and no pulse line to the chip or to the MCU is documented. So no radio here can use it.
2. It locks the chip's BS mode slot timing, which the TX half doesn't use (it sends in the physical layer mode, 2.10). Whether it also moves the physical layer's slot timer is unknown.
3. The host-side grid (ALIGN with the host's clock on NTP or a GPS-disciplined source) gives the same slot numbering without a pulse, to the clock sync's error bound. A PPS input report stays a follow-up for a board that wires one.

2.10 Physical layer transmit: the split duplex TX half

The split duplex TX half (split-duplex.md 5.4) needs a CACH whose AT, TC and short LC it controls, which the BS mode of 2.9 doesn't give. It uses the physical layer mode instead (datasheet 9.5), as the HR_C6000 does (modem-hrc6000.md 9.1): the chip sends the CPU's bits without coding, and the core builds every slot (bsOutboundRawSlot: the CACH, then the burst with BS sync, slot type and coded payload). Driver: drivers/modem/hrc7000/hrc7000_bs.c. Datasheet only until the bench results below say otherwise.

The datasheet's example frame for a bit error test carries the MS data sync at bits 120-167. In a burst the sync starts at bit 108, so that frame is 12 bits of guard, the 264-bit burst and 12 bits of guard: an MS slot, aligned to the slot edge. A BS outbound has no guard: its slots follow each other without a gap, each CACH centered on the slot edge. The driver writes the core's slots (CACH first) back to back, so the bit stream on air is the continuous outbound, and the CACH half that falls before the chip's slot edge is only a constant 1.25 ms offset of the slot clock (the RX half's phase tracking absorbs it, split-duplex.md 6). Whether the chip ramps the PA between two slots of the timeslot mode (it would cut into the CACH) is what the continuous mode variant is for.

The driver, while the BS outbound runs (it takes the slot engine's place, as hrc6000_bs.c does):

1. Start: TXRX 0, SLOTON 0, WORK_MODE 0x80 then 0x22 (or 0x02), LAYER2_CONTROL 0x82, codec buffers cleared. A new slot clock.
2. Slot clock: a boundary at the first of the TX timeslot, RX timeslot or PHY_RDY interrupts in a slot (one more within 15 ms is the same slot). Unkeyed the clock runs and nothing is sent.
3. Keyed: at each boundary a slot's 36 bytes go to TX RAM and TXRX = 0x80. The chip sends them in the slot that starts about 5 ms after the boundary's interrupt, not in the one after it (finding 11), so the slot clock names that slot. The key-up starts on an outbound TS1 slot. Each slot plays its own queue, an empty one an idle burst.
4. The first RF TX interrupt keys the RF chip and starts the PA one-shot; the PA then stays up. Unkeyed: no more slots, the PA off one slot later. No boundary for 200 ms: PA off, unkeyed.
5. Stop (and leaving DMR): TXRX 0, PA off, WORK_MODE 0x80 then 0x6E, LAYER2_CONTROL passive, both slot syncs released, then the normal receive restart (5.2). LAYER2_BS_MODE is never written; the power-on set-up writes its reset value 0x900 (2.9: it survives a chip reset).

Bench variants (dmr_bs_config_t.variant, the debug link's SPLIT op 1, split-duplex.md 10.1), a bit field: b0 the continuous mode, b1 the autotest bit with the send bit (0x81), b3:2 the TX RAM halves (0 the slot to both, 1 alternate starting with SEND_DATA0, 2 alternate starting with SEND_DATA1). The default 0 is timeslot mode, 0x80, both halves.

Bench results, 2026-10-20 (TX half keyed 8 s per variant at the lowest power on 461.4625 MHz; no SDR capture: the RTL-SDR was in use elsewhere. A second radio on the same frequency was the receiver). (measured)

Second board on the SDR bench, 2026-10-21 (lowest power, 461.4625 MHz, tests/hil/test_split_duplex.py). (measured)

Variant 0 stays the default. Writing the slot to both TX RAM halves works, so which half the chip sends in each slot isn't needed. Not measured: PA temperature (no sensor on the diagnostics page), receiver desense with the RX half beside it.

The first board gives the same results on the SDR bench (2026-10-21, variant 0): 352 BS bursts, 176 per slot, tact ok 352, TC alternating 351/351, AT following SET_AT, short LC 87 ok and 0 bad, no underrun; the voice call whole. Its RX half's labels pass too (residual 1 us).

The slot clock against the air, SDR bench, 2026-10-21 (TX half; each GET_EPOCH mapped to wall-clock time through the host's time sync, compared with the SDR's timestamps of the outbound's bursts, whose slot comes from their CACH TC). (measured)

Slewing (split-duplex.md 3.8, capability bit 2), 2026-10-22, no RF. (measured)

3. Interrupts

Both timeslot interrupts are handled by one routine; it decides by the current activity (transmitting states on the TX vector, receiving states on the RX vector). DMR TX does not start unless vectors 62 and 64 are hooked.

3.1 TX timing within a burst (inferred from the register values)

3.2 Masking the modem interrupts

PIC_MASK bits 29, 30, 31 and PIC_MASK_1 bit 0 (vectors 61–64) (datasheet mapping). Mask them around multi-register updates from task level.

4. Initialization (power-on, once)

Ordered; (register, value, why). The whole DMR block is written once here and not at every mode change.

5. Entering DMR and starting receive

5.1 Enter DMR (from FM or idle; also at every DMR TX start)

AUDIO_CONTROL is not rewritten here; after FM it ends up 0x00 once FM audio is switched off.

5.2 Start / restart receive

Used at DMR entry, after TX, and wherever reception must be (re)acquired:

A sequence of TXRX 0xC00000, 0, 0xC00000, 0x8040 with no SLOTON writes, or a busy wait in the color code probe, does not acquire sync reliably. Use this one everywhere.

5.3 While receiving

6. Transmit sequences

All transmit actions happen in the timeslot interrupts: the CPU arms one slot at a time with TXRX_CTRL = 0x80 and leaves the other slot unused (0x00, or 0x40 / 0x8040 to listen: tx_listen, an SFR's inbound slot), giving one burst per 60 ms in its timeslot (datasheet figures 99–100). Every arming also starts the PA one-shot (a board with a PA one-shot timer). The RF TX interrupt that follows keys the RF chip.

6.1 Start of transmission

TXRX_CTRL bit 31 (tx_complete_cpu) belongs to continuous mode and must not be set at step 2. For a direct-mode start after receiving on a repeater channel the same LAYER2_CONTROL = 0xC3 applies.

6.2 Voice

Alternating slots: in the inactive slot TXRX_CTRL = 0; in the active slot:

1. For burst A (n = 0): rewrite the call LC (or talker alias LC) into TX RAM bytes 0–8 for the embedded LC.
2. Write 27 bytes of AMBE (three 9-byte frames) to the voice RAM 0x16000960, or the AMBE silence pattern when no encoded audio is ready.
3. TXRX_CTRL = 0x80, SEND_TYPE = 0x08 + (n << 4) (+ LCSS, see 2.6); n = n + 1 modulo 6.

Encoded audio must be produced continuously during TX: encode one 20 ms block per tick whenever two PCM buffers are waiting.

6.3 Terminator and back to receive

6.4 Data and CSBK

Per burst, in an active slot: write the payload to TX RAM (10 bytes for CSBK / MBC header / data header: the chip appends the CRC-16 with the programmed mask because SEND_TYPE b8 = 0; 12 / 18 / 24 bytes for rate ½ / ¾ / 1 blocks, CRC-9 and CRC-32 computed by the CPU), SEND_TYPE = data type << 4, TXRX_CTRL = 0x80, start the PA one-shot. Inactive slot: TXRX_CTRL = 0 (or 0x40 to listen for a response). Sequence for a packet: data header (0x60), blocks (0x70/0x80/0xA0), optional terminator. CSBK signaling: optional preamble CSBKs then the function CSBK, all 0x30 (datasheet appendices B, C). Open RX afterwards to catch the response.

6.5 BS activation (repeater wake)

No layer-3 BS activation: LAYER2_BS_MODE, BS_* registers and WORK_MODE values 0x73/0x76/0x77 are not used. What they do when written is in 2.9 (measured).

One CSBK without keying the PA gives only an unmodulated carrier. The PA one-shot and the second consecutive CSBK make repeater wake work (which of the two matters is not known).

7. CRC and FEC the chip does

On receive the chip checks the same codes and reports them in RX_TYPE_INFO b30:24; it decodes FEC and leaves only information bits in the RX RAM.

8. FM mode

8.1 Registers

8.2 FM entry sequences

Standard CTCSS addresses (datasheet table 59; RX uses the same addresses in CTCSS_ADDR b15:8):

The address order is not ascending; map from frequency, not from a list index. Other tones: USER_DEFINE_CTC. TX sub-audio deviation via SUBVOICE_COEF b15:8 (typical 350 Hz narrow, 600 Hz wide). The FM_BANDWIDTH bits don't scale it: the reset value 0x28 gives 300 Hz CTCSS at both bandwidths, and RadioFoundry writes 0x50 at 25 kHz (600 Hz) (measured, UHF). DCS gets a third of the deviation from the same value (0x28: 100 Hz), and reads the field as signed: 0xF0 sent the code inverted at about 40 Hz. RadioFoundry writes three times the CTCSS value for DCS, capped at 0x7F: 0x78 at 12.5 kHz (305 Hz) and 0x7F at 25 kHz (323 Hz) (measured, UHF). The boot stub's restart doesn't reset the modem, so the field keeps the last transmission's value; RadioFoundry's init writes 0x28 rather than reading it back (one board read 0xFF there after a 25 kHz transmission and sent CTCSS at 1.9 kHz deviation, measured). When FM_PTT drops, the chip sends the reverse burst / turn-off code before stopping. FM_MOD b9 (reset 1) enables the CDCSS turn-off: a 134.4 Hz tone. RadioFoundry sets b9 with DCS and, for the core's tail (radio-features.md 3.3a), drops FM_PTT while the RF stays keyed; FM_PTT on again resumes the code. On the SDR bench: 134.4 Hz for 0.20 s, then the carrier without modulation until the core unkeys (measured). Unkeying together with FM_PTT, as before, put none of it on air. On a detected tone the FM signaling system interrupt fires (SYS_INTERP_LIST b13) and FM_DECODE_FLAG2 b0 (CTCSS) or b1 (CDCSS) goes 1, back to 0 at the end. CDCSS tail detection uses FM_FUNCTION_COEF1 = 0x7F499D (134.4 Hz).

8.3 DTMF and single tones

8.4 Prompt / beep FIFO

Set AUDIO_CONTROL b7, then while AUDIO_CONTROL b31 is 0 write 64 bytes (32 × 16-bit samples, low byte first, 8 kHz) to 0x16000980..0x160009BF; clear b7 when done (measured). High byte first (16 samples per push) sounds distorted. Flushing stale audio: fill with 0x7F bytes.

RadioFoundry plays all speaker PCM through this FIFO (platform/hrc7000/audio_pcm.c). The CPU-fed speaker buffer at 0x180000A0 (AUDIO_CONTROL b5, section 3) gave rough, choppy beeps on one board with every sample layout tried, with no queue underruns (measured).

The prompt path also feeds the TX modulator: with AUDIO_CONTROL b7 set during a DMR transmission, the beep's audio rides on the 4FSK. On one board the talk permit tone overlapped the second and third voice LC headers, which then carried no decodable sync on the SDR bench and the bench modem took the call by late entry; with b7 held clear while transmitting, all three headers decoded in five runs (measured). Keep b7 clear during any transmission; a beep that starts then plays silently, and b7 comes back on at TX end if the beep is still running.

APRS transmit uses the same path on purpose (platform/hrc7000/hrc_afsk.c): during an FM transmission, with b7 set and the microphone muted by the board, the FIFO's samples are the modulation. A timer tops the FIFO up every 2 ms; speaker PCM is held off the FIFO meanwhile (hrc_audio_pcm_hold), since its chunks would land between the tones. Bell 202 decoded off air from this path with a valid FCS (measured, aprs.md 13). The DTMF tone generator (8.3) needs no PCM, but its deviation field tops out near 1.5 kHz, short of the 3 kHz APRS wants.

The datasheet doesn't document this route. It names two FM transmit audio sources, selected by AUDIO_CONTROL b0 (datasheet 7.2.2.1): the codec ADC (0) or the TX RAM (1). As a source, the TX RAM is 0x16000030-0x1600042F, two 512-byte halves of 256 samples (32 ms at 8 kHz), and FM_ADDR_SW (0x56C) names the half in use (1 low, 2 high); SYS_INTERP b15 is the FM TX interrupt. The prompt FIFO is documented only as playback to the codec DAC (datasheet 7.3). LINEOUT_CTRL (0x088) b1 is line out 1 and b0 line out 2, the same PWM waveform on both (RadioFoundry sets 0x01). Two-point modulation: SIG_CENTER b31:24 biases MOD1 (the VC-TCXO) and b23:16 MOD2 (the VCO), 3.3 mV a step; RF_MOD_BIAS b7:0 and b15:8 are the MOD1 and MOD2 amplitudes; RF_MODE b10 sends a 40 Hz test square. The prompt FIFO path decodes on some boards but not on others, which take the mixer route below.

The FM transmit limiter (FM_DEV_COEF b23:16) caps the deviation of audio that enters through the codec ADC, the microphone and the mixer route below. The prompt FIFO's ring play is not capped by it: AFSK through ring play reached 5.1 kHz peak with the limiter at 4. Through the ADC path the ceiling scales with limiter x TX coefficient (measured, 25 kHz, Bell 202 tones):

So a limiter of 4 holds speech to about 1.65 kHz at 25 kHz. A board sets fm_tx_limit for each bandwidth.

Where ring play doesn't reach the modulator on its own, the codec's digital mixer (datasheet 6.5.2.10-11) carries the DAC's audio into the ADC's record path, which is the FM transmit input. CR_MIX (codec 0x10: b7 mix_en, b6 load, b5:0 the MIX_n address) and DR_MIX (0x11) reach MIX_0..3. MIX_2 b0 (mix_rec) makes the ADC's output ADC + DAC, and MIX_3 b7:4 = 0xF zeroes the ADC's own input in that sum. hrc7000_codec_dac_to_tx sets MIX_3 and then MIX_2, clears them in the reverse order and ends with CR_MIX = 0. The codec mic mute (CR_ADC b7) must stay off on this route: it mutes the mix too. Through this route Bell 202 decoded off air with a valid FCS (measured, a board where ring play alone sent a bare carrier).

8.5 FM receive audio to the CPU

In FM (WORK_MODE 0x80) the modem copies its demodulated receive audio into the RX RAM as well as to the codec (the datasheet's "analog receive recording", on by default in FM):

The audio is not squelched: it carries noise while no signal is present, so a demodulator can work below the squelch. Receiver noise reaches full scale (peak 32767) with the reset AF gain (measured).

RadioFoundry reads it in the system interrupt (platform/hrc7000/fm_rx_audio.c): the DMR glue owns that interrupt and calls an FM hook for bit 14, in FM too, and the hook copies each half into a 128 ms ring for the APRS demodulator.

9. Driver requirements

What a working DMR driver does that a first attempt tends to miss. Details are in the sections named.

10. Open questions

1. LCSS bits on voice bursts B–E (2.6): the datasheet sets them, the driver does not. Does late entry work on other radios receiving this modem's transmissions?
2. Whether the 0x370–0x37C, 0x168 and bit-31 sync-enable writes matter.
3. RF_RECV_DELAY 0x36B0 vs the datasheet's 2000 for AF mode.
4. The real timing of the TX timeslot interrupt relative to the slot boundary (section 3.1 is inferred).
5. Data and CSBK transmission on the C7000 have only been checked against the datasheet and shared host tests, not on air.
6. FM sub-audio: the C7000's own CTCSS/CDCSS engine (section 8) is not used on a board with a separate FM RF chip; the driver routes TX CTCSS to that chip instead.
7. RF_MODE b11 (2.1a) on simplex receive: does a radio with the bit set hear a call on the second timeslot that it misses with the bit clear? No on-air test has compared the two. A test: a call on one timeslot while the radio receives the other, with b11 on and then off. Also: RadioFoundry sets b11 on repeater channels. Does that change repeater reception?
8. BS mode (2.9): where the chip's CACH AT, TC and short LC come from (likely BS_CACH and a short LC written at every RDY_NEXT_SHORT_LC). The split duplex TX half doesn't need it: it uses the physical layer (2.10).
9. A slot length trim for the physical layer mode (2.10 finding 13): LAYER2_MAX_CNT has none. Whether the trim works in the layer 2 timing (LAYER2_CONTROL b5 layer2slot), and any other register that does, is untested.

View the source of this page