A hidden model was asked to find why this firmware struggles to decode P25 Phase 1 and Phase 2 voice on the radio’s HR-C6000, and what to do about it. I checked every claim against the code, reran its evidence, and modelled what it left out through the firmware’s own demodulator.
Accurate to the line number. Silent on what stops the radio decoding.
Everything UNIONALPHA checked, it checked well. Its line references, test results, byte counts and reproductions all hold up. The problem is what it chose to check. Its four “confirmed findings” cover a diagnostic export, a Python parser, a telemetry counter and the linker map, and all four already sat, in the same order, in the repository’s Sep 10 review. None of them explains why the radio would fail to decode P25.
The configuration that most plausibly does is never mentioned. For a P25 session the monitor switches the receiver into analog FM mode: the AT1846S high- and low-pass filters on, low-frequency audio blocked, 25 kHz channel bandwidth, and HR-C6000 de-emphasis enabled. Modelled through the firmware’s demodulator, any audio high-pass at 75 Hz or above leaves zero decodable voice frames. And even with a perfect signal, emulated instruction counts show the IMBE vocoder needs 11 to 16 times the radio’s 72 MHz CPU.
The host suite passes with byte-identical output (104 lines). The capture-parser defect reproduces exactly. SRAM reservations end on 0x20020000 with CCM 1,160 bytes short of full.
The Golay Gray-code argument and the mismatch between a ±10% health gate and a ±1% timing clamp are both right.
tests/p25/run.py · tools/p25_capture.py · build/MDUV380_FW.elf · p25_fec.c:65–70 · p25_4fsk.c:240–241
p25mon.c:724 calls trxSetModeAndBandwidth(RADIO_MODE_ANALOG, true). That loads the AT1846S FM set: filters on (0x58=0xBC85), the “low freq audio” bit cleared (0x40=0x0030), AF gain 80%, 25 kHz.
HR-C6000 de-emphasis and a 3 kHz filter come on too. OpenGD77’s DMR set, built for the same 4800-baud 4FSK, does the opposite.
AT1846S.c:191–199 vs 204–217 · HR-C6000.c:2846–2854 · manual §6.2
It calls the RF route unproven “either direction”, but the evidence leans. OpenGD77 reads the identical I2S slot for transmit audio and labels it “Mic Audio”.
Bit 6 of 0xE0, set in 0xC9, enables mic → LineIn1. The manual says the I2S frame clock “must be 8KHz”, yet the monitor runs it at 24 kHz.
sound.c:444 · HR-C6000.c:2849, 2872, 2964 · manual line 1218
F1 capture stride, F2 parser, F3 starvation counter and F4 memory map match F1–F4 of P25-PROJECT-REVIEW-2026-09-10.md in order and substance, down to the samples=66 fixture. Its C3 is that review’s F5.
None of it is cited, while that review’s analog-filter, test-oracle and 72 MHz points were dropped.
P25-PROJECT-REVIEW-2026-09-10.md §4 · file dated 10 Sep, six days earlier
It cites “C4FM channel vectors”, but the generator uses the same RRC filter as the receiver. Against a standard C4FM waveform (raised cosine × inverse sinc), the noise-free eye closes from 0.93 to 0.37, costing about 2 dB. A band-limited integrate-and-dump FIR restores it to 0.98.
p25_4fsk.c:84–124 · p25_selftest.c:258 · TIA-102.BAAA C4FM shaping
Its tick arithmetic stops at the sample ring. This port clocks the STM32F405 at 72 MHz (PLLN=72). In an emulated Cortex-M4F with the firmware’s own compiler and newlib, the demodulator uses about 40% of that core, but mbelib’s IMBE synthesis needs 11–16 times all of it. A loud 20 ms frame costs roughly 430 ms of CPU, because unwrapped harmonic phases push cosf onto newlib’s slow large-argument path.
mbelib.c:306, 333–388 · libm cosf → __kernel_rem_pio2f (linked in MDUV380_FW.elf) · Core/Src/main.c:271–273
Weights reflect the question asked: find what stops P25 decoding and say how to fix it. Accuracy carries the most weight because a wrong review does harm; coverage and root cause together outweigh it because an accurate review of the wrong things does not help.
Hover or focus a bar for the reasoning. Weighted total 65, grade C−.
| Dimension | Weight | Score | Points | Why |
|---|---|---|---|---|
| Accuracy & evidence | 30% | 90 | 27.0 | Every checked line reference, test result and byte count holds; the evidence bundle reproduces. Two overstatements: RRC test vectors called “C4FM channel vectors”, trellis coverage described as independently referenced. |
| Coverage of decode problems | 25% | 45 | 11.2 | Misses the analog-FM receive chain, the microphone evidence, the manual’s 8 kHz frame-clock limit and the circular RRC test oracle, and never quantifies that the IMBE vocoder needs 11–16× the 72 MHz CPU. Its confirmed findings are about tooling, telemetry and the linker map. |
| Root cause & prioritisation | 15% | 55 | 8.2 | Fixing the instruments first is sound, but two software-fixable blockers (the analog-FM settings and a vocoder an order of magnitude over budget) are absent, and the RF-route question is framed as unproven “either direction” despite evidence that leans to the microphone. |
| Fix plan & acceptance gates | 15% | 74 | 11.1 | Clear phases with measurable gates. Missing the cheapest high-value step (a flat receive configuration before any RF test), a concrete receive-filter change, and the tap precedent the repo already documents. |
| Originality & attribution | 10% | 40 | 4.0 | F1–F4 match F1–F4 of the repo’s Sep 10 review in order and substance, C3 matches its F5, with the same parser fixture; none of it is cited. Genuinely new: the gate-versus-clamp mismatch, the Golay check, a fuller Phase 2 section. |
| Clarity & calibration | 5% | 76 | 3.8 | Scrupulous about what it does not claim. Over-hedged where evidence leans one way, and dense enough to slow a decision-maker. |
| Weighted total | 100% | 65 | Grade scale: A ≥ 90 · B 80–89 · C+ 75–79 · C 70–74 · C− 65–69 · D 50–64 · F < 50 |
The monitor’s intended path runs from RF to speaker; the capture export branches off at the DMA interrupt for diagnostics. UNIONALPHA’s issues cluster on that diagnostic branch. The issues it missed sit on the path the voice actually takes.
P25 Phase 1 is four-level FSK at 4800 symbols per second, and its baseband reaches almost down to DC. Runs of equal symbols, such as the frame sync’s five +3s, carry energy that any audio high-pass removes, and the filter’s phase shift smears neighbouring symbols. OpenGD77 already knows this: its DMR mode sets the AT1846S “magic” low-frequency bit and bypasses its filters for the same symbol rate. The P25 monitor selects the FM set instead.
What trxSetModeAndBandwidth(RADIO_MODE_ANALOG, true) leaves in place, next to OpenGD77’s own settings for 4800-baud 4FSK.
| Register | Monitor today (analog FM) | OpenGD77 DMR mode | Effect on C4FM |
|---|---|---|---|
| AT1846S 0x40 | 0x0030, low-frequency bit cleared: “so it should be cleared to receive FM” | 0x0031, “allows low freq audio” | Removes the near-DC content that runs of equal symbols depend on |
| AT1846S 0x58 | 0xBC85, “enable some filters for FM e.g. high and low pass filters” | 0x9CDD, “disable all filters in DMR mode” | High- and low-pass shaping of the symbol stream |
| AT1846S 0x44 | 0x06CC, AF gain 80% | 0x07FF, 100%; the DM-1701 “needs higher AF gain” to decode 4FSK | Lower discriminator level into the next stage |
| AT1846S bandwidth | 25 kHz | 12.5 kHz, forced for digital | Wider noise bandwidth and deviation scaling set for ±5 kHz FM |
| HR-C6000 0x34 | 0x3C, “compressor off, de-emph on, 3 kHz audio filter” | not written; the FM value persists | −6 dB/octave from 300 Hz and a 3 kHz low-pass on the FM receive path (manual §6.2) |
Standard C4FM through a 2nd-order Butterworth high-pass, then the firmware’s live demodulator and framer. 20 back-to-back LDUs: 180 IMBE frames and 20 NIDs possible.
| Corner (Hz) | Noise-free frames · NIDs | Noise-free SER | 20 dB frames · NIDs | 20 dB SER |
|---|---|---|---|---|
| off | 100% · 20/20 | 0.00% | 100% · 20/20 | 0.00% |
| 10 | 100% · 20/20 | 0.00% | 100% · 20/20 | 0.01% |
| 20 | 100% · 20/20 | 0.13% | 100% · 20/20 | 0.23% |
| 35 | 75% · 15/20 | 2.31% | 60% · 12/20 | 2.80% |
| 50 | 10% · 2/20 | 7.04% | 20% · 4/20 | 7.45% |
| 75 | 0% · 0/20 | 15.17% | 0% · 0/20 | 15.37% |
| 100 | 0% · 0/20 | 21.29% | 0% · 0/20 | 21.70% |
| 150 | 0% · 0/20 | 30.21% | 0% · 0/20 | 30.58% |
| 200 | 0% · 0/20 | 36.59% | 0% · 0/20 | 36.19% |
| 300 | 0% · 0/20 | 44.46% | 0% · 0/20 | 44.67% |
Matched-filter output folded over two symbols at the ideal sampling instant, normalised so the four levels sit at ±1 and ±3. Horizontal hairlines mark levels and decision thresholds.
RRC transmit → firmware RRC
→ firmware RRC (as shipped)
→ band-limited integrate-and-dump FIR
C4FM → firmware RRC
HPF 300 Hz + LPF 3 kHz + de-emphasis
| Case | Signal → receive filter | Eye | Noise-free frames · NIDs | Noise-free SER | 20 dB frames · SER | 14 dB frames · SER |
|---|---|---|---|---|---|---|
| S0 | Project test model: RRC transmit -> firmware RRC | +0.93 | 180/180 · 20/20 | 0.00% | 180/180 · 0.00% | 180/180 · 0.00% |
| S1 | Standard C4FM -> firmware RRC (as shipped) | +0.36 | 180/180 · 20/20 | 0.00% | 180/180 · 0.00% | 180/180 · 0.05% |
| S2 | Standard C4FM -> integrate-and-dump (TIA reference) | +0.96 | 180/180 · 20/20 | 0.00% | 180/180 · 0.04% | 180/180 · 0.38% |
| S2b | Standard C4FM -> band-limited integrate-and-dump FIR (81 taps) | +0.98 | 180/180 · 20/20 | 0.00% | 180/180 · 0.00% | 180/180 · 0.05% |
| S3 | C4FM + 150 Hz high-pass -> RRC | -2.01 | 0/180 · 0/20 | 30.21% | 0/180 · 30.40% | 0/180 · 30.97% |
| S4 | C4FM + 300 Hz high-pass -> RRC | -2.50 | 0/180 · 0/20 | 44.46% | 0/180 · 44.33% | 0/180 · 44.12% |
| S5 | C4FM + 300 Hz HPF + 3 kHz LPF -> RRC | -2.53 | 0/180 · 0/20 | 48.28% | 0/180 · 48.08% | 0/180 · 47.99% |
| S6 | C4FM + 300 Hz HPF + 3 kHz LPF + de-emphasis -> RRC | -3.62 | 0/180 · 0/20 | 46.72% | 0/180 · 46.77% | 0/180 · 47.05% |
| S7 | C4FM + 300 Hz HPF + 3 kHz LPF + de-emphasis -> integrate-and-dump | -3.95 | 0/180 · 0/20 | 49.12% | 0/180 · 49.18% | 0/180 · 49.38% |
The self-test and timing sweeps synthesise the transmitter with the receiver’s own 81-tap root-raised-cosine filter, at 40 dB SNR in the timing sweeps. Standard C4FM uses a full raised cosine with inverse-sinc compensation, and the reference receiver integrates and dumps. The shipped filter still decodes clean signals, but the tests hide its margin loss.
Firmware demodulator and framer, white noise at the discriminator. Hollow markers sit on the floor where no errors were seen in 51,600 symbols.
| SNR (dB) | Test model → RRC | C4FM → RRC | C4FM → band-limited I&D | C4FM → 8-sample I&D |
|---|---|---|---|---|
| 6 | 4.238% · 174 | 6.496% · 129 | 7.008% · 150 | 11.880% · 90 |
| 8 | 1.279% · 180 | 2.802% · 177 | 3.306% · 171 | 6.246% · 153 |
| 10 | 0.182% · 180 | 0.897% · 177 | 0.975% · 180 | 2.709% · 168 |
| 12 | 0.012% · 180 | 0.223% · 180 | 0.194% · 180 | 0.955% · 174 |
| 14 | 0 · 180 | 0.045% · 180 | 0.027% · 180 | 0.576% · 174 |
| 16 | 0 · 180 | 0.006% · 180 | 0 · 180 | 0.184% · 177 |
| 20 | 0 · 180 | 0 · 180 | 0 · 180 | 0.054% · 180 |
Each cell: symbol error rate · mean IMBE frames decoded of 180.
Magnitude responses. The C4FM transmitter boosts toward 2.88 kHz to pre-compensate the integrate-and-dump receiver; the voice-path model cuts the low end and rolls off above 300 Hz.
| Hz | C4FM transmit shaping (RC × inverse sinc) | Firmware RRC receive filter | Band-limited integrate-and-dump FIR | Analog-FM path model (HPF + LPF + de-emphasis) |
|---|---|---|---|---|
| 100 | +0.0 | -0.0 | -0.0 | -19.6 |
| 199 | +0.0 | -0.0 | -0.0 | -9.5 |
| 301 | +0.1 | -0.0 | -0.1 | -6.0 |
| 601 | +0.2 | -0.0 | -0.2 | -7.3 |
| 998 | +0.6 | +0.0 | -0.6 | -10.9 |
| 1902 | +2.4 | +0.0 | -2.4 | -16.3 |
| 2394 | -1.9 | -3.0 | -3.9 | -18.8 |
| 2878 | < −40 | -22.0 | -6.7 | -22.2 |
| 3973 | < −40 | < −40 | < −40 | -33.5 |
UNIONALPHA’s memory finding is exactly right: static reservations fill SRAM to the last byte. Its real-time discussion stops at ring arithmetic, which is where the budget holds. This port runs the Cortex-M4F at 72 MHz rather than the part’s 168 MHz, and even a 168 MHz clock would leave the vocoder several times over budget.
The firmware’s streaming loop, compiled with its own GCC flags and newlib and run in an emulated Cortex-M4F over 2.2 s of input (12 LDUs, 108 IMBE frames, all decoded). Instruction counts become time by assuming one clock cycle per instruction, the optimistic end.
| Stage | -Os, M instr/s | Share at 1.0 · 1.5 c/i | -O2, M instr/s |
|---|---|---|---|
| Resampler ×1.6 | 1.40 | 1.9% · 2.9% | 1.32 |
| RRC FIR, timing and level fit | 28.00 | 38.9% · 58.3% | 27.70 |
| Framing, NID and FEC | 0.74 | 1.0% · 1.5% | 0.73 |
| mbelib IMBE decode and synthesis | 781.90 | 1,086.0% · 1,629.0% | 781.60 |
| Total | 812.1 | 1,128% · 1,692% | 811.4 |
One call to mbelib’s IMBE decoder per frame, uvquality 1, FEC-valid codewords with chosen pitch and voicing, mean over 100 consecutive frames.
cosf argument exceeds about 201 radians, and newlib’s cosf takes its __kernel_rem_pio2f path at roughly 1,700 instructions per call instead of 40 to 100. The real firmware links that same path.| Frame type | Mean, M instr | Worst, M instr | Mean ms at 1.0 · 1.5 c/i |
|---|---|---|---|
| L=20, all bands unvoiced | 3.00 | 5.02 | 42 · 62 |
| L=20, typical (15 of 20 voiced) | 9.68 | 10.23 | 134 · 202 |
| L=30, typical (21 of 30 voiced) | 13.97 | 14.76 | 194 · 291 |
| Random pitch and voicing | 15.86 | 26.17 | 220 · 330 |
| L=56, all bands voiced | 31.25 | 32.97 | 434 · 651 |
Fresh ELF section table: _ebss = 0x2001F9FC, end = 0x2001FA00, plus 0x600 of heap and stack reservations = 0x20020000.
Twenty-one hold as written, some with omissions noted. Two are overstated. None is false.
| Item | What UNIONALPHA claims | Where | Result | Notes |
|---|---|---|---|---|
| F1 | Live decoder reads even (left-slot) halfwords; the capture export stages the contiguous first 80 of each row, so 158 of 160 positions differ | p25mon.c:432–467, 443, 464–465 | Holds | Code matches; OpenGD77’s own mic path (sound.c:444) reads the same [j][i*2] slot. |
| F2 | Parser anchors to the first observed sequence number and never reconciles the footer’s samples= count; missing chunk 0 exits 0 with complete=True | tools/p25_capture.py:104–190, 218–222 | Holds | Reproduced. A lost final chunk passes too (not mentioned, but covered by the proposed fix). |
| F3 | p25monAudioUnderruns (pcm_starve) is declared and printed but never incremented | p25mon.c:123, 517 | Holds | Two references firmware-wide; STAGE3-BRINGUP.md documents the counter as working. |
| F4 | SRAM .data 17,000 + .bss 112,532 + heap/stack 1,540 = 131,072 bytes, ending at 0x20020000; CCM 64,376 of 65,536 | build/MDUV380_FW.elf | Holds | _ebss 0x2001F9FC, end 0x2001FA00, 0x600 reserved; ucHeap 20,480 in .bss from heap_4.o. |
| G1 | Monitor writes 0xE0=0xC9 and the codec refresh set; the source itself tags the route UNVERIFIED | p25mon.c:642–656, 648, 733, 519, 699–700, 1345 | Holds | The refresh list omits 0x06=0x21, which is harmless. |
| G1 | Manual §4.5 and §6.2 document no discriminator-to-I2S tap | HR_C6000_user_manual.txt | Incomplete | True, but §4.6 also says the I2S frame clock “must be 8KHz”, and §6.2 puts de-emphasis before the codec. |
| G1 | HR-C6000.c input labels are community reverse-engineering, not datasheet proof | HR-C6000.c:2778, 2872, 2964 | Understated | Those labels say mic → LineIn1 via E0 bit 6, and sound.c:444 calls the same I2S slot “Mic Audio”. |
| G1 | ref-sources/openrtx_hrc6000.cpp contains no 0xE0 writes | ref-sources/openrtx_hrc6000.cpp | Holds | grep finds none. |
| C1 | Drain ≤ 4×32 = 128 samples per tick, needing 187.5 calls/s at 24 kS/s against a 512-sample ring in a 1 ms super-loop; synthesis load unmeasured | p25mon.c:95, 570, 583–591; applicationMain.c:1451–1456 | Understated | Arithmetic is right, but emulated counts put IMBE synthesis alone at 11–16× the 72 MHz CPU, a hard blocker rather than a tight budget. |
| C2 | Resampler and playback use the nominal rate; a ±10% health gate accepts rates the ±1% symbol-period clamp cannot track | p25mon.c:398, 574–577, 896–897, 1066–1067; p25_4fsk.c:240–241 | Holds | A real mismatch, and new relative to the repo’s earlier reviews. |
| C3 | Retunes, clock changes and restarts are not stamped into capture sessions | p25mon.c (capture start/stop, tune) | Holds | Also, the header hard-codes measured=0. |
| P1 | DUIDs match the standard table | p25_tables.h:85–92 | Holds | HDU 0x0, TDU 0x3, LDU1 0x5, TSBK 0x7, LDU2 0xA, PDU 0xC, TDULC 0xF. |
| P1 | NID/status handling corrected: 35 data + 1 status per 36 dibits; LDU = 784 payload + 24 sync + 32 NID, 864 on air | p25rx.c:347–355 | Holds | Checked the full LDU1/LDU2 layout, HDU/TDULC lengths and status placement. |
| P1 | Golay decoder’s i ^ (i >> 1) is correct Gray-code enumeration, not a bug | p25_fec.c:65–70 | Holds | g(i) ⊕ g(i−1) = 1 ≪ ctz(i), and the code is linear. |
| P1 | Golay, Hamming and RS are checked against independent reference encoders | tests/p25/fec_reference.cpp; signalling.py:12–40 | Holds | DSD’s Golay24, Hamming and ReedSolomon classes. |
| P1 | Trellis, CRC and trunk coverage, acceptance plus rejection, listed under “independently referenced” | signalling.py:78–124 | Overstated | The trellis test re-implements the production transition table, and trunk tests live in trunk.py. |
| P1 | No confirmed new Phase 1 protocol bug | p25rx.c, p25_fec.c, p25_nid.c, p25_trunk.c | Agree | An independent read found none; non-standard MFID link control mutes audio by design. |
| V1 | Host suite exits 0 with a 104-line log, selftest=PASS tests=111111 | python3 tests/p25/run.py | Holds | Rerun is byte-identical apart from debug lines. |
| V1 | Timing sweeps −1000…+1000 ppm, 0/6480 raw dibit errors; described as “C4FM channel vectors” | tests/p25/run.py, p25_selftest.c | Mislabelled | Numbers are right, but the generator is RRC-shaped, the same filter the receiver uses, at 40 dB SNR. |
| V1 | Incremental relink produced an 810,252-byte image | build log | Holds | File size and timestamp match. |
| P2 | Phase 2 needs H-DQPSK at 6000 sps, TDMA and ISCH, WACN/SYSID/NAC descrambling and AMBE+2 half-rate voice | §6 | Holds | Misses that the radio already runs an AMBE+2 decoder for DMR. |
| P2 | mbelib path is IMBE-only; TDMA identifier update 0x33 is rejected | p25rx.c:105; p25_trunk.c:26 | Holds | Exact lines. |
| P2 | Wider RS configurations are needed beyond the current bounded FEC | p25_fec.c:77, 104 (n ≤ 36) | Holds | Phase 2 uses codes up to n = 63 over GF(64). |
Two earlier reviews sit in the same repository. UNIONALPHA plainly read the second: it corrects that review’s memory figure and reuses its parser fixture. What it kept, added and dropped:
| Issue | P25-HARDWARE-REVIEW Sep 8 | P25-PROJECT-REVIEW Sep 10 | UNIONALPHA Sep 16 |
|---|---|---|---|
| Capture export stages the wrong I2S halfwords | absent | raised F1 | raised F1 |
| Capture parser certifies an incomplete stream (samples=66 fixture) | absent | raised F2 | raised F2 |
| pcm_starve never increments | partly asks for underrun counts | raised F3 | raised F3 |
| No static RAM margin | partly 648 bytes then | raised F4, 0 in workspace map | raised F4, 0 bytes |
| Capture sessions lack epochs | absent | raised F5 | raised C3 |
| Ring and tick real-time budget | raised | raised | raised C1 |
| RF-to-I2S route unproven; OpenGD77 calls it mic/LineIn1 | raised cites sound.c | raised | partly “either direction” |
| Analog FM mode: high/low-pass, de-emphasis, 25 kHz IF dropped | raised | raised | absent |
| Test waveform shares the receiver’s RRC filter dropped | raised | raised F6 | absent |
| MCU runs at 72 MHz, not 168 MHz dropped | raised | raised | absent |
| Direct discriminator-to-ADC tap (M17 mod precedent) | raised with pins | raised | partly no precedent, no pins |
| ±10% health gate versus ±1% symbol-period clamp | absent | absent | raised new |
| Golay Gray-code enumeration verified correct | absent | absent | raised new |
| Phase 2 requirements | partly scope note | partly scope note | raised detailed |
| Manual: I2S frame clock “must be 8KHz” | absent | absent | absent |
| Modelled decode loss from audio-path high-pass filtering | absent | absent | absent |
| Two unverified SPI writes per decoded 20 ms frame | absent | absent | absent |
| Vocoder cost measured: 11–16× the 72 MHz CPU | absent | partly cycles per frame, unmeasured | partly “synthesis load” to measure |
The last four rows are new in this audit. Dropped rows were raised by both earlier reviews in the same repository and are absent from UNIONALPHA.
UNIONALPHA’s phases are a good skeleton. This version keeps its instrument fixes and gates, then does everything that can be verified in software before the RF experiments, so a negative result on the radio actually means something.
Stage i2s_Rx_Buffer[bufNum][j][i*2] for i < 80 in the capture export, exactly what the decoder consumes. Make p25_capture.py strict: sequence origin 0, footer samples= reconciliation, non-zero exit. Increment pcm_starve only during an active clear call.
GateA ramp through the real DMA adapter matches 160/160. Missing-first-chunk and missing-last-chunk fixtures fail. A forced dry ring counts, and intentional silence does not.
For the P25 session, send the AT1846S the DMR register set over I2C: 0x40 low-frequency bit set, 0x58=0x9CDD, 0x44=0x07FF, 12.5 kHz bandwidth. Leave the HR-C6000 codec state the bring-up notes found fragile alone. Call radioSetAudioPath(false) once at start instead of on every decoded frame.
GateAT1846S register readback in the 1 Hz report. No new codec-clock dips over a 10-minute run.
Replace mbelib’s per-sample cosf calls with a per-harmonic phase accumulator and a cosine table, and wrap phases every frame. Wrapping alone is not enough: even newlib’s fast path, at 40–100 instructions per call, leaves a loud frame near the whole core. The demodulator’s 81-tap FIR, at about 40%, is the next target; its symmetric taps halve the multiplies. A 168 MHz clock, after checking the USB and I2S clock trees, adds headroom but does not close an 11–16× gap.
GateOn host and emulator, decoded audio matches unmodified mbelib within a small tolerance. On the radio, DWT shows the worst voiced frame under 10 ms and zero ring overruns across a 10-minute voice replay.
Generate standard TIA C4FM vectors (raised cosine α = 0.2 × inverse sinc), add real recordings, and keep high-pass and DC-offset sweeps as regressions. Offer a band-limited integrate-and-dump FIR next to the RRC.
GateSymbol error rate on independent vectors within 1 dB of the ideal slicer. The high-pass regression fails loudly if someone reintroduces a voice filter.
With the flat path and fixed capture, compare keyed RF against mic taps on both I2S slots. Also check the 24 kHz stream is really 24 kHz: energy above 4 kHz and no repeated samples, since the manual says the frame clock must be 8 kHz. Modulate a 20–30 Hz tone to confirm the low end survives.
GateRF-correlated samples with mic coupling at least 30 dB down and a flat 20 Hz–3 kHz response. Otherwise stop register experiments after two days.
The repo’s own analysis cites the M17 DM-1701 modification: AT1846S pin 9 to MCU pin 18. For receive-only P25, keep the path DC-coupled or give it a single-digit-hertz corner, since the model loses frames by 35 Hz. Add anti-alias filtering, then timer-triggered ADC + DMA into SRAM (not CCM) at 24 or 48 kS/s. Keep the HR-C6000 as the speaker DAC only.
GateAn independently recorded clear P25 signal decodes with the expected NAC and talkgroup, repeatedly, with audio keeping pace.
Qualify late entry, encrypted muting and terminators, then trunk following. Consider holding an established clear call through a single failed RS decode rather than muting nine frames. Treat Phase 2 separately, as below.
GateIntelligible known speech against a trusted receiver, then passive grant following on one in-band system.
UNIONALPHA’s Phase 2 section is accurate. Downlink H-DQPSK at 6000 symbols per second is a different modulation. TDMA slots, ISCH, descrambling seeded from WACN, System ID and NAC, FACCH/SACCH, and Reed–Solomon codes up to n = 63 are all absent. p25rx.c:105 is IMBE-only, and p25_trunk.c:26 invalidates TDMA identifier updates.
What it misses is that the vocoder is not the hard part. The radio already runs a licensed AMBE+2 half-rate decoder for DMR. DSD-FME, bundled in ref-sources/, sends P25 Phase 2 voice frames through the same 3600×2450 AMBE+2 path it uses for DMR (dsd_mbe.c, “DMR and P25p2” handling). The work is the demodulator, framing and descrambling.
A discriminator tap can, in principle, recover H-DQPSK phase steps by integrating frequency over each symbol, but with less margin than an IQ receiver. Plan the tap in step 4 to be wide and DC-coupled, and budget for IQ if Phase 2 matters.
The model’s name was hidden. I didn’t open any session logs, so this is a reading of the document’s style, not a lookup.
I read every P25 receiver source file in the integrated OpenGD77 tree (mbelib only in part), plus the OpenGD77 radio drivers they depend on: AT1846S, HR-C6000, trx, sound, I2S and application main. I also read the HR-C6000 manual translation, the stock-firmware analysis and the bring-up notes, and checked both earlier reviews. Each UNIONALPHA claim was checked at its cited lines.
The simulations compile the firmware’s own p25_4fsk.c, p25rx.c, NID, FEC and mbelib sources for the host exactly as tests/p25/run.py does. They drive them with 20 back-to-back LDUs built by that suite’s independent framing helpers. Only the waveform, the audio-path filters and, in scratch copies, the receive-filter taps were changed.
The CPU budget replays the firmware’s streaming loop in the Unicorn emulator. It uses the firmware’s compiler, flags, newlib and libm; instruction counts were cross-checked with Capstone, and 108 of 108 IMBE frames decoded inside the emulator.
python3 tests/p25/run.py # 104 lines, byte-identical to UNIONALPHA's evidence python3 tools/p25_capture.py parse \ analysis/unionalpha-review/capture_missing_first_chunk.txt # sample_count=2 complete=True, exit 0 arm-none-eabi-size -A build/MDUV380_FW.elf arm-none-eabi-nm build/MDUV380_FW.elf | grep -E ' (_ebss|end)$' # .bss ends 0x2001F9FC; reservations end 0x20020000
Simulation source: c4fm_sim.py and metrics.json. Run from the repository root with DM1701_REPO set; it needs numpy and a C compiler.