← Back
Home › Systems › Telecom

land-mobile-radio

Connects handheld and vehicle radios to dispatchers and each other for group calls, so police, fire and utility crews stay reachable even when the backbone fails.

Motorola ASTRO 25, Airbus TETRA, Hytera

Open the land-mobile-radio pageland-mobile-radio Hdr histogramdata-structures: Log-linear bucketed histograms with bounded relative error for latency percentilesDeterministic simulationtestingdistributed: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Hot-standby redundancyembedded: A second, always-current controller shadows the primary and takes over within a few cycles of silence; epochs stop the old primary from fighting back.›Process supervisionhardware-os: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Jitter buffermedia: A receiver-side buffer holds packets just long enough, a delay tracked from recent arrivals, to reorder them and hand out media at a steady rate.›Linear predictive coding (LPC)media: Predict each sample from the previous p; code only the small prediction error plus p coefficients. Core of FLAC, speech codecs and the Opus SILK layer.›RTP and RTCPmedia: RTP stamps each media packet with sequence number, media-clock timestamp and source ID; RTCP reports loss, jitter, round trip and clock mapping within a bandwidth cap.›Sip signalingmedia: SIP call setup, dialogs, SDP offer/answer and registrar/proxy routingSRTPmedia: Per-packet encryption, authentication and replay protection for RTP and RTCP that keeps the headers readable, with the packet index derived from the 16-bit sequence number.›IP multicastnetworking: Send each datagram once to a class D group address; the network copies it to every joined receiver, and sequence numbers let receivers find loss.›Aes key wrapsecurity: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key materialAKA (authentication and keyagreement)security: Symmetric-key challenge-response in which a chip and its home server prove knowledge of one key, with a sequence number for freshness, and derive session keys.›Coverage-guided fuzzingsecurity: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Key rotationsecurity: Rotating keys without downtime: key ids, overlap windows, re-wrapping, JWKS publication, revocationMutual TLSsecurity: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›Adaptive equalizationsignal-processing: LMS/RLS equalizer filters that invert channel distortion from training or decisionsAloha random accesssignal-processing: Pure/slotted ALOHA random access MAC: collisions, throughput limits, backoffConvolutional codes and theViterbi decodersignal-processing: Streaming error-correcting code: each output bit is a parity of the last K input bits; the Viterbi decoder finds the most likely path through a 2^(K-1)-state trellis.›Hamming codessignal-processing: Hamming and SECDED block codes for single-error correction in links and memoryHandover managementsignal-processing: Moving a session between cells/beams/satellites without dropping itPhase-locked loop (digital)signal-processing: Feedback loop that locks a local oscillator to the phase and frequency of an input tone; the core of carrier recovery, clock recovery and GNSS tracking.›Ptt floor controlsignal-processing: Push-to-talk floor arbitration: grant one talker per group, with priority, pre-emption, queueing and talk-burst timeoutsReed-Solomon codessignal-processing: Byte-oriented MDS code: n-k parity symbols correct (n-k)/2 unknown symbol errors or n-k known erasures; the workhorse for bursts, QR codes, discs and storage.›Symbol timing recoverysignal-processing: Gardner/Mueller-Muller timing error detectors with interpolators for symbol synchronizationTdma schedulingsignal-processing: Time-slot scheduling of shared radio links among users/beamsTrunked channel assignmentsignal-processing: Trunked radio: control channel grants voice channels from a shared pool to talkgroups, with priority queueing and busy handlingPoint-in-time recoverystorage: Periodic base backups plus a continuously archived change log let you rebuild the state as of any instant, then branch from there.›Graceful drainingsystems: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.›Priority and preemptionsystems: Priority classes, quota and evicting lower-priority work to admit higherCooperative schedulingconcurrency: Green threads/coroutines yielding at await points on a user-space schedulerFault injectiondistributed: Inject latency, errors, kills and partitions via proxies, netem or hooksRecord replaydistributed: Record every nondeterministic input (time, randomness, I/O, model and tool outputs, per-tick player input) and re-execute deterministically for debugging, replays and state rebuildLeasesdistributed: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.›Health checkingsystems: Decide per backend whether to route to it using probes and real-traffic errors, with consecutive-count hysteresis, capped ejection and a panic fallback.›Watchdog timerembedded: A hardware down-counter that resets the chip unless software proves, in time and in a plausible pattern, that it is still healthy.›A/V sync and media clocksmedia: How audio and video stay lip-synced: per-stream timebases, PTS/DTS, PCR and RTCP clock mapping, and a master clock that slave streams chase by dropping, repeating or resampling.›Packet loss concealmentmedia: Synthesize missing audio frames from prior signal (pitch repetition, neural PLC)Exponential smoothing (ETS,Holt-Winters)statistics: Forecast by keeping a few running states (level, trend, seasonal) updated by a fraction of each forecast error; O(1) memory per series and a strong baseline.›Scalar quantizationsearch-sort: Per-dimension int8/binary quantization of vectors with rescoringIIR and FIR filterssignal-processing: Two ways to shape a sampled signal's spectrum: FIR (finite taps, always stable, exact linear phase) or IIR (feedback, a few coefficients, cheap but phase-distorting).›PRNGs (PCG, xoshiro)numerics: Small, fast, statistically strong non-cryptographic generators: PCG32 and xoshiro256**, with seeding, parallel streams and unbiased ranges.›+ 17 moreTransparent interceptionnetworking: Redirect traffic to a local proxy (iptables TPROXY/REDIRECT, eBPF) without app changesSyscall interceptionsecurity: Intercept syscalls via ptrace, seccomp user notify or a user-space kernelFencing tokensdistributed: A number that grows with every lock grant and is checked by the protected resource, so a paused ex-holder's late write is rejected.›Media containersmedia: MP4/ISO BMFF, fragmented MP4/CMAF, Matroska and MPEG-TS mux/demuxRecurrent networksmachine-learning: GRU and LSTM cells for streaming sequence modelsBiquad filterssignal-processing: Second-order IIR sections (RBJ cookbook): low/high pass, peaking EQ; stable cascades+ 11 moreEbpfhardware-os: Verified in-kernel programs on hooks (kprobes, XDP, tc) with mapsPtrace process controlhardware-os: Ptrace: attach, read and write registers and memory, single-step, intercept signalsSeccomp bpfsecurity: Syscall filtering with seccomp BPF programs+ 8 more+ 1 more

How it is built

Architecture overview

A land mobile radio (LMR) network connects handheld and vehicle radios to dispatchers and to each other so that one press of a button reaches a whole group, within a fraction of a second, at the edge of coverage, and even when the backbone has failed. Police, fire, ambulance, rail and utilities use standards such as P25 (the TIA-102 suite, developed for public safety), TETRA (an ETSI standard for professional mobile radio) and DMR (an ETSI digital standard with a cheaper, simpler goal) (sources: Wikipedia, Project 25; Terrestrial Trunked Radio; Digital mobile radio). The design centre is not data rate. It is call setup time, group calling, priority, coverage and survivability, with voice carried at a few kilobits per second.

Two ideas shape the architecture. First, trunking: a small pool of radio channels is shared by many talkgroups, and a control channel tells each radio which channel to use for a call, so spectrum is used efficiently and users never pick frequencies. A trunked system "is essentially a packet switching computer network" in which radios send requests to a controller on a dedicated frequency (source: Wikipedia, Trunked radio system). Second, push-to-talk floor control: only one speaker holds the floor at a time in a talkgroup, and a higher-priority request can take it away. Newer broadband systems keep the same service on LTE: 3GPP created a working group in 2014 to specify mission critical push-to-talk (MCPTT) in Release 13 (source: 3GPP, LTE Mission Critical Applications).

Parts:

 handheld ──radio──► base station / repeater ──► site controller ──► zone controller ──► core
 (PTT, vocoder,       (receiver: PLL, timing,     (control channel,     (talkgroups,        (AAA/keys, console
  FEC, TDMA slot)      equalizer, Viterbi)         channel grants)       priority, roaming)  gateway, recorder)
        ▲                       │                          │                  │
        │                  voice frames over IP (RTP / SRTP, multicast to sites that need them)
        │                       ▼                          ▼                  ▼
        └── direct mode ◄── talkgroup members     dispatch consoles    other sites, other networks
            (no network)                                  ▲
                                           hot-standby pairs at controllers and core

How the parts fit together

Receiver chain: lock, undo the channel, decode

A digital voice radio sends symbols: P25 Phase I uses 4-level FM (C4FM) at 4,800 baud with two bits per symbol, 9,600 bit/s per channel (source: Wikipedia, Project 25); DMR uses 4-state FSK at the same 4,800 symbols/s (source: Wikipedia, Digital mobile radio). The receiver must recover three things before decoding. It must lock to the carrier frequency, which a Phase-locked loop (digital) does, tracking the offset between transmitter and receiver oscillators. It must find the symbol boundaries, symbol-timing-recovery (no page yet), so it samples at the right instant. And it must remove inter-symbol interference from multipath with adaptive-equalization (no page yet), with a training sequence in each burst to adapt on.

Error protection and the vocoder

Voice is compressed by a vocoder because the channel carries very little: TETRA's ACELP codec belongs to the linear-prediction family (see Linear predictive coding (LPC)), while P25's IMBE and AMBE+2 are multi-band excitation codecs. The budget in P25 Phase I shows the proportions: of 9,600 bit/s, 4,400 is voice data from the IMBE codec, 2,800 is forward error correction and 2,400 is signalling (source: Wikipedia, Project 25). DMR leaves 2,450 bit/s for one voice channel after overhead, error correction and splitting into two channels (source: Wikipedia, Digital mobile radio). TETRA samples speech at 8 kHz and compresses it with ACELP to 4.567 kbit/s, then error-protects it to 7.2 kbit/s (source: Wikipedia, Terrestrial Trunked Radio). P25 uses the proprietary IMBE and AMBE+2 codecs from Digital Voice Systems (source: Wikipedia, Project 25).

The code families are used where each fits: Convolutional codes and the Viterbi decoder for the main protection of the stream, Reed-Solomon codes for block-level protection against bursts, and short block codes such as hamming-codes (no page yet) for small fields like headers and control words. Which code protects which field is in the air-interface specifications (not read for this page). Control and header information deserve stronger protection than voice: a wrong grant is worse than a garbled syllable.

Channel access: slots for traffic, random access for requests

Spectrum is shared two ways. Traffic channels are divided in time with tdma-scheduling (no page yet): P25 Phase II and DMR use two slots in a 12.5 kHz channel, and TETRA uses four slots on a 25 kHz carrier (source: Wikipedia, Digital mobile radio). DMR's two-slot structure is built around 30 ms; a TETRA frame has four slots and a multiframe of 18 frames lasts 1.02 s (sources: Wikipedia, Digital mobile radio; Terrestrial Trunked Radio). Slots are assigned by the base station, so a voice call is scheduled and collision-free.

The inbound request is different. A radio that has just been keyed does not yet own a slot, and many radios may ask at once, so requests use aloha-random-access (no page yet) on a shared channel. A collision is detected by the missing reply and retried after a random wait. This suits rare, short messages and not traffic, so the call moves onto an assigned slot as soon as the grant arrives. Request load can spike in an emergency, so retries must be bounded.

Trunking: channel assignment, priority, handover

trunked-channel-assignment (no page yet) turns the shared pool into a service. When a user presses the push-to-talk key, the radio sends a request on the control channel naming its talkgroup; the controller picks an idle channel and sends a grant that every radio monitoring that talkgroup follows; when speech ends, the radios return to the control channel (source: Wikipedia, Trunked radio system). Groups, not frequencies, are the unit users see, and an agency's talkgroups are laid out in a "fleetmap" (same source). Channel count for a given load is an Erlang-B problem; once capacity is used up, later users get a busy signal, the failure to plan for in a disaster (same source).

priority-and-preemption (no page yet) decides who wins when capacity runs out. Talkgroups are assigned different priority levels, sometimes with pre-emption (source: Wikipedia, Trunked radio system). TETRA terminals have an emergency button that signals the dispatcher and overrides other activity (source: Wikipedia, Terrestrial Trunked Radio). The mechanism is a priority-ordered queue plus a rule for taking a busy channel from the lowest-ranked call; the agencies set the policy, the system enforces it uniformly.

handover-management (no page yet) keeps a call alive as the radio moves between sites. In TETRA a voice call is not interrupted when moving to another network site, which the source lists as a feature (source: Wikipedia, Terrestrial Trunked Radio). The radio measures neighbouring sites; the infrastructure moves the call or the radio re-registers and rejoins its talkgroup. Check that the target site has a free channel before the move.

Security: who is allowed, and whose keys

TETRA authenticates terminals to the infrastructure and the infrastructure to terminals, and offers air-interface and end-to-end encryption (source: Wikipedia, Terrestrial Trunked Radio). P25 supports several cipher options up to AES with 256-bit keys, and specifies a Key Fill Interface for loading keys into radios from a key-fill device and an interface between key management facilities (source: Wikipedia, Project 25). The pattern is the one in AKA (authentication and key agreement): the radio and the network prove they hold a shared secret, and session keys are derived from it. Voice and talkgroup keys then have to reach thousands of radios without being exposed in transit, which is the job of key wrapping, aes-key-wrap (no page yet), defined in RFC 3394 as an algorithm for wrapping AES keys (source: RFC 3394). Keys have a lifetime: key-rotation (no page yet) replaces them on a schedule and when a radio is lost, and the system must make the old key stop working on the old radio. 3GPP's MC security specification covers the same needs for broadband: a key management server, user key provisioning, and derivation of SRTP master keys for group media (source: ETSI TS 133 180).

The engineering risk sits less in the cipher than in key distribution, rotation and the weakest permitted mode: P25's 40-bit RC4 option is described as offering no real protection (source: Wikipedia, Project 25), and TETRA's original TEA1 cipher was intentionally weakened to meet export controls (source: Wikipedia, Terrestrial Trunked Radio). Disable weak modes by policy.

Push-to-talk and IP transport

Inside the network, voice travels as IP packets between sites, consoles, recorders and gateways. Voice frames use RTP and RTCP, encrypted per packet with SRTP (RFC 3550 and RFC 3711). One speaker's stream must reach all sites that host members of the talkgroup, which is a one-to-many problem for IP multicast inside the network, or replication by a media server where multicast is unavailable. Receivers use a small Jitter buffer, because push-to-talk suffers most from added delay.

Session setup between IP-attached parties uses sip-signaling (no page yet), an application-layer protocol for creating, modifying and terminating sessions with one or more participants (source: RFC 3261). ptt-floor-control (no page yet) is the arbiter on top of it. In 3GPP MCPTT, the media-plane protocol (TS 24.380) defines floor control with a floor request when the button is pressed, a floor granted reply, and queue position information, and defines the effective priority of a participant, including a pre-emptive priority that can take the floor from the current speaker (source: ETSI TS 124 380). The architecture of the whole service is in TS 23.179 (source: ETSI TS 123 179). Floor control is a distributed state machine with timers: a lost release must not hold the floor forever, so every grant times out.

Resilience: no single point of failure, and no network at all

Mission-critical networks duplicate their controllers, core and links. Hot-standby redundancy is the pattern: a standby shadows the primary and takes over within a few cycles, with an epoch or lease so that the old primary cannot return and drive the outputs. TETRA's description adds the cases beyond duplication: networks can be built so that "all aspects are fail-safe/multiple-redundant", base stations can process local calls in a fall-back mode, and terminals can use direct mode, which does not rely on any network (source: Wikipedia, Terrestrial Trunked Radio). In TETRA's direct mode a chain of terminals can relay, or a gateway can bridge a direct-mode group back into the trunked network (same source). A radio that can still talk to its neighbours when everything else has failed is the reason the system exists.

Operations

Primary-backup replication. Hot-standby controllers keep the call state of the radio air interface, but the data behind them also needs a copy: subscriber records, talkgroup membership and priorities, site configuration and key-management tables. Their database has a primary and a backup (Primary-backup replication), so that when the controller fails over the new controller authenticates radios and grants calls with the same talkgroup and priority rules. The epoch of the standby decides who is primary, so the old controller cannot come back and grant a channel as well.

Point-in-time recovery. A wrong bulk change (a talkgroup merge, a priority table edit, a key-table import) can strip radios of access across a whole agency. Point-in-time recovery restores the subscriber, talkgroup and key tables to the moment before the change from base backups plus the log, and the restore is done on a side copy first so that the radios keep working on the current tables while it is checked.

Process supervision. Site controllers, the trunking controller, the SIP and push-to-talk servers, gateways to consoles and recorders, and the key-management service run as supervised processes (Process supervision). A restarted media server rejoins its talkgroups from the controller's call table. A supervisor never restarts a process into a mode that bypasses security checks or accepts unauthenticated radios.

Graceful draining. Upgrading an IP gateway, media server or console server must not cut a transmission. Such a node is drained by no longer being chosen for new calls, while calls in progress finish at the next release of the push-to-talk key (Graceful draining); the floor timer still frees the floor if a release is lost. Sites are drained at a quiet time and handover moves radios to neighbouring sites first.

Mutual TLS. On the IP side, sites, controllers, consoles, recorders, gateways and the key-management facility authenticate each other with certificates (Mutual TLS), in addition to SRTP for the voice packets. That makes "who may fetch or load keys" and "who may join a talkgroup from the IP network" a question of certified identity, and a rogue console or recorder on the network cannot subscribe to voice.

Latency percentiles. The service is defined by call setup, so hdr-histogram (no page yet) records the intervals: key press to grant, grant to first voice frame heard by the receivers, and the handover interruption. Emergency and routine calls are recorded separately, so a priority-override path that is slow shows up even when routine calls are fast, and busy hours show the tail rather than an average.

Deterministic simulation testing. Channel assignment, priority preemption, handover and failover interact in rare orders: an emergency request during a handover, a release lost while a standby takes over, the same talkgroup requested from two sites at once. Deterministic simulation testing runs the trunking controller, a simulated radio population and a simulated lossy control channel and backbone under a seeded clock, and checks that no channel is granted twice and an emergency call is never delayed behind routine ones. A failing seed replays exactly.

Coverage-guided fuzzing. Coverage-guided fuzzing is aimed at the decoders of untrusted input: control-channel messages from radios, the SIP and push-to-talk floor-control messages, RTP/SRTP packets arriving from the IP network, and the key-fill and key-management interfaces.

Data and control flow

Flow 1: a group call

  1. The user presses the push-to-talk key. The radio sends a request on the control channel (random access), carrying its identity and talkgroup.
  2. The controller checks the radio is authenticated and allowed on the talkgroup, finds an idle traffic channel or slot, applies priority if none is free, and sends a grant.
  3. Radios in the talkgroup move to the assigned channel; sites with members open the channel and the voice path is set up between them.
  4. The speaker's vocoder produces frames; they are protected with error correction, encrypted with the group key, and sent in the assigned slot.
  5. Each receiver locks, equalises, decodes, decrypts and plays; network sites forward the frames over IP via multicast or replication, and consoles and recorders listen in.
  6. When the key is released, the controller frees the channel; the radios return to the control channel. A timer frees the floor if the release is lost.

Flow 2: priority override

  1. All channels are busy with routine calls. An emergency request arrives on the control channel.
  2. The controller ranks it above all active calls and selects the lowest-priority one.
  3. That call is ended or moved and its radios are told; the emergency talkgroup is granted the channel.
  4. The dispatcher is alerted, the call is recorded, and the displaced groups see a busy indication and can retry.

Scaling

  • Voice capacity is channels, not bandwidth. Plan with Erlang-B for normal load, then separately for the disaster load the system exists for.
  • Slots multiply channels. Two-slot (P25 Phase II, DMR) and four-slot (TETRA) TDMA give more voice paths per carrier, at the cost of tighter timing.
  • The control channel is the bottleneck. Every call setup, status message and registration passes through it; separate registration, data and voice load where possible and cap retries.
  • Keys scale by hierarchy. Provision once into a key management facility and distribute from there.
  • Broadband relieves capacity and adds a dependency. MCPTT moves group voice to LTE with the same floor and priority concepts, but needs the cell network (source: 3GPP, LTE Mission Critical Applications).

Failure modes

FailureSymptomCauseFix
Control channel overloadlong or failed call setups in a big incidenttoo many requests and registrations, retry stormsbounded retries with random back-off; priority for emergency; more control capacity
Busy signal at the worst timecritical users cannot talkchannels sized only for normal loadErlang-B for disaster load; priority and pre-emption; reserved channels
Call drops on movingvoice cuts out between sitesno free channel at the target site; late handover decisioncheck target capacity first; hand over earlier; keep neighbour lists current
Floor stucknobody can talk in a grouprelease message lost; the speaker's radio died holding the floorfloor timers; dispatcher override; periodic floor-keepalive
Key out of syncsome radios hear noise or silence on an encrypted groupkey rollover reached some radios and not othersoverlap old and new keys for a transition period; verify key state at registration
Choppy voice between siteslate or missing packetscongested backhaul; badly sized jitter bufferprioritise voice traffic; small adaptive jitter buffer
Split brain in the coretwo controllers grant the same channelstandby promoted while the primary is still aliveepoch or lease fencing; heartbeat over two paths

Real implementations

namewhat it isrepolicencenotes
GNU Radioopen-source signal processing runtime and toolkitgnuradio/gnuradioGPL-3.0has digital and filtering modules; use for receiver-chain experiments
osmo-tetraexperimental TETRA MAC/PHY code between MAC blocks and the modulator bits, with demodulator toolsosmocom/osmo-tetraAGPL-3.0experimental; project description says so
MMDVMopen-source multi-mode digital voice modem firmware (D-Star, DMR, System Fusion, P25, NXDN, POCSAG, FM)g4klx/MMDVMGPL-2.0amateur-radio hotspot and repeater firmware, a small working example of the radio modes
Kamailioopen-source SIP signalling serverkamailio/kamailioGPL-2.0, some parts BSDthe SIP layer, not the radio floor control

The standards themselves (P25, TETRA, DMR, 3GPP MCPTT) are publicly documented and are listed in Sources. Commercial systems named in the field (Motorola ASTRO 25, Airbus TETRA, Hytera) are closed source and are not covered, because no official architecture document was fetched.

The alternative: commercial cellular push-to-talk or a plain LTE app is cheaper to deploy where coverage is good. Choose a dedicated LMR network when coverage at the edge, guaranteed priority, direct mode without any network and independence from public infrastructure are requirements.

Sources

  • Wikipedia, Project 25: Phase I and II, the bit budget, NAC, cipher options, key fill interface. article
  • Wikipedia, Terrestrial Trunked Radio: TDMA structure, ACELP rate, modes, authentication, security issues. article; ETSI, TETRA technology page
  • Wikipedia, Digital mobile radio: two-slot TDMA, 4FSK, bit budget, tiers. article
  • Wikipedia, Trunked radio system: control channel, talkgroups, fleetmaps, Erlang-B, priority. article
  • 3GPP, LTE Mission Critical Applications (2014): creation of the MCPTT work. page
  • ETSI TS 124 380, MCPTT media plane control, protocol specification (3GPP TS 24.380): floor control and priority. directory
  • ETSI TS 123 179, functional architecture for mission critical communication services (3GPP TS 23.179). directory
  • ETSI TS 133 180, security of the MC service (3GPP TS 33.180): key management, SRTP key derivation. directory
  • RFC 3261, SIP: Session Initiation Protocol. RFC
  • RFC 3550, RTP: A Transport Protocol for Real-Time Applications. RFC
  • RFC 3711, The Secure Real-time Transport Protocol (SRTP). RFC
  • RFC 3394, Advanced Encryption Standard (AES) Key Wrap Algorithm. RFC
  • GNU Radio repo; osmo-tetra repo; MMDVM repo; Kamailio repo

Similar systems

Share the most building blocks with this one.

tactical-radio 58 %voip 29 %telehealth 29 %contact-center 25 %video-call 24 %