MODEL QS Combination Software Defined Secure Voice and GE Star, MDC-1200, Identification Encoder/Decoder. (Photo enlarged to show detail)

Transcription

1 MODEL QS-5000 Combination Software Defined Secure Voice and GE Star, MDC-1200, Identification Encoder/Decoder (Photo enlarged to show detail) Instruction Manual Manual Number Rev Cimarron Technologies Corp., Escondido, CA, USA. All rights reserved. No part of this manual may be reproduced in any way without the express written permission of Cimarron Technologies Corporation.

2 MODEL QS-5000 COMBINATION SOFTWARE DEFINED SECURE VOICE AND ANI ENCODER/DECODER 2007 Cimarron Technologies Corporation All rights reserved Cimarron Technologies Inc. 934 S. Andreasen Suite G Escondido, CA USA Voice: FAX: service@cimtechcorp.com Web: Cimarron Technologies Corporation is a licensee of the Motorola MDC-1200 Protocol technology. MDC-1200 is a registered trademark of Motorola Inc. GE Star is a registered trademark of General Electric Corporation Manual revision QS

3 Table of Contents Table of Contents...3 C H A P T E R 1 Features and Specifications... 7 What Is the QS Features... 7 Specifications... 9 C H A P T E R 2 Installation Physical Installation Radio Connections Audio Connections and Radio Modifications TX Audio In and TX Audio Out RX Audio In and RX Audio Out Discriminator Audio Level Adjustments Data Deviation Adjustment Assignable Physical Inputs and Outputs Open Collector Outputs OUT0 and OUT Multilevel Outputs OUT2, OUT3 and OUT Crypto Keys or Inversion Frequencies Jumpers Pads Pad Information Physical Assignments Radio connection Definitions A A PTT (Default assignment IN4) Input Key (Default assignment OUT0) Output...19 Emergency (Default assignment IN0) Input Man Down (Default assignment IN1) Input Selective Call (Default assignment OUT3) Output Transmit Control Output Critical Channel Revert (Default assignment OUT1) Output Inversion Status (Default assignment OUT4) Output Radio Disable (Default assignment OUT3) Output Sleep Input Sidetone Output Tone Control Output (Default assignment OUT2) Inversion Switch (Default assignment IN5) Input Inversion Code line 0 Input Inversion Code line 1 Input Inversion Code line 2 Input Inversion Code line 3 Input... 21

4 Channel Busy (Default assignment IN2) Input Transmit Audio In Transmit Audio Out RX Audio In RX Audio Out Discriminator C H A P T E R 3 Programming QuikWare Programming Software Main Menu Mode Product Type FW Version COM Port Chan Inv Type Fix Frq Min Frq Max Frq Min Dwl Max Dwl Mute Mode P/U INV ANI Type ANI Loc PTT ID EM ID M/D ID PTT MSG EM MSG TOT MSG M/D MSG Group ID Crit ANI CRIT RVRT C T ACK Base ID Encrypt ANI Encryption Key Audio Control Gain Settings Microphone Input gain level without inversion Microphone Output gain level without inversion AF Input gain level without inversion AF Output gain level without inversion Microphone Input gain level with inversion Microphone Output gain level with inversion...28 AF Input gain level with inversion AF Output gain level with inversion Common Settings Attack Delay Acknowledgment Delay Startup Delay ANI Repeat Timer TX Time Out Timer TX Data Level... 29

5 PTT Sidetone Mute Data Mute on Incorrect Key MDC Call Alert Encode Disconnect Delay Inversion Preamble MDC Wildcard Enable Unlock PIN Display Received ANI Key Follows PTT Respond to Channel Codes Emergency Number of repeat emergency transmissions Time between emergency repeats Open Microphone Monitor on Emergency TX time Open Microphone Monitor on Emergency RX time Emergency TX Warning Tone ManDown Number of repeat Man Down transmissions Time between Man Down repeats Open Microphone Monitor on Man Down TX time Open Microphone Monitor on Man Down RX time Man Down TX Warning Tone Man Down Warning Delay Man Down Activation Delay Digital I/O Control Memory Characteristics C H A P T E R 4 Operation QS-5000 Basic Operation PTT ANI Operation Time-out-timer Radio Disable/Enable Selective Call/Group Call/All Call Microphone Monitor Emergency Message Man-Down Status Canned Messages Secure Voice Features C H A P T E R 5 Technical Information GE Star Format Selections Format Definitions GE Star Message Descriptions MDC-1200 Message Type... 48

6 Inversion Code Line Interpretation Trunking Operation Emergency PTT at beginning PTT at end Inversion Scrambling Component Location Schematics Parts List C H A P T E R 6 Troubleshooting Installation Hints Isolating System Problems Equipment Problems...58 Radio Keys and Stays Keyed Radio Keys up but stays Keyed only for Duration of ANI ID Decoded is not the same as Programmed Channel Preferences not the same as Programmed C H A P T E R 7 Product Support A P P E N D I X A Secure Voice Considerations Voice Quality Security Level System Considerations Making it Simple A P P E N D I X B Snap-In QS-5000 Carrier I N D E X... 67

7 Chapter 1 Features 7 CHAPTER 1 Features and Specifications What Is the QS-5000 The QS-5000 is a device that combines ANI encoder/decoder signaling with Cimarron Technologies QuikSync voice inversion scrambling. The board is capable of sending PTT ANI and Emergency ANI in GE Star, or MDC-1200 signaling format. It is capable of reception of Selective Calls, Group calls and All calls and will provide audible alerts when called. It responds to radio check commands (interrogates), and to over the air open microphone monitor commands and radio disable/enable commands. The inversion scrambling scheme is unique in that it is adaptive to the communications system in which it will be used. When initially setting up the communications system, the QS-5000 boards must be programmed with configuration information. QuikSync uses dynamic frequency inversion scrambling, but, unlike other schemes, the range of inversion frequencies is specified during set-up as well as minimum and maximum dwell times. In this manner, the actual inversion frequency can be fixed so that all units always use the same split frequency (like current low end boards on the market); or the inversion frequency can change for each press of the PTT, staying at that split frequency only for the period of that transmission; or the board can hop around a predefined range of frequencies in a random manner and for random dwell times. The actual decision (and level of security) can be tailored precisely to the limitations of the communications system. There are five preset levels of security to choose from when configuring the board. These five preset levels can be additionally adjusted if necessary for precise system integration. Features Identify every transmission source with the assigned ANI ID in Signaling formats of MDC-1200, GE Star Reduce nuisance and obscene transmissions Trunking compatible Increased trunking flexibility compatible with latest trunking schemes Programmable ANI PTT repeat timer limits data bursts during continued conversations Go-ahead beep sounds when ready for voice transmission Courtesy beep transmitted when radio is unkeyed Emergency and Man-Down situations instantly identified Programmable open microphone monitor during emergency Stuck microphone identification Time-Out-Timer with alert tone ANI sent at beginning, end or both Responds to selective call, group call and all call messages as well as open microphone monitor and over the air activated

8 Chapter 1 Features 8 radio disable and enable Automatic man-down alarm reporting with unique coding Status and canned messages can be programmed instead of the emergency and man-down reporting Receiver data mute MDC-1200 message adaptability enhances compatibility with existing unique systems Programmable complexity voice inversion scrambling Digitally encrypted MDC-1200 signaling Combines ANI and inversion features or offers both features independently Capable of automatic receive detection and selection of Cipher/Clear mode Up to 100 Hops per second with up to 2000 Hz difference in inversion frequency per hop. Mean difference of 1000 Hz per hop All ANI and Encryption functions can be programmed via Over the air Re-Programming Programmable for a dynamic inversion frequency range of 2.1 khz through 4.1 khz Programmable for a dynamic hop dwell time range between zero ms (no hop) through 1000 ms Unique system protection available to ensure incompatibility with any other radio system even if key is compromised Stores up to sixteen encryption keys or inversion frequencies which can be manually selected or in some radios, assigned and automatically selected with radio channel change. Stores up to sixteen ANI ID s and formats which can be manually selected or in some radios, assigned and automatically selected with radio channel change. Programmable by computer with a USB adapter cable. Software controlled output and input adjustment no resistors to change. Advanced microprocessor control permits precise pairing with communications system. This enhances encryption compatibility with repeaters, voters, varying system links and system degradations Level of security can be increased with communications system upgrades without reinvesting in new/different encryption modules In order to realize these capabilities the QS-5000 must be correctly installed and programmed. Some features may require additional equipment not supplied.

9 Chapter 1 Features 9 Specifications Data Format GE Star MDC-1200 Modulation Type PSK (Phase Shift Key) FSK Rate 400 bps on 1600hz carrier 1200/1800 Hz ID Range 0001 to 16, DEEE ID Locations ANI at Beginning, End or Both Messages PTT ANI, Emergency, Man- Down, TOT. Programmable to any allowable GE Star message. PTT ANI, Emergency. Programmable to any allowable MDC message bit pattern. Sidetone User definable, fully programmable Burst Length 280mS plus preamble time. Fixed length 180mS Attack Delay 0 ms to 1000 ms programmable in 10 ms steps. ANI Repeat Timer (Time since last PTT press. If less, don t send ANI) Programmable 0 S (Send every PTT); 0 to 255 S. Scrambling Type Unique Dynamic Hopping Inversion Scrambling Cipher/Clear Automatic receive detection and selection of cipher/clear mode Detection Transmit Mode Automatic Cipher/Clear on per channel basis with manual over-ride State Warning Device warns user at keyup whether transmission will be encrypted or plain Rate Up to 100 Hops per second with up to 2000 Hz difference in inversion frequency per hop. Mean difference of 1000 Hz per hop Signaling Method Incorporates MDC-1200 and GE Star signaling formats and features. Function Programming All ANI and Encryption functions can be programmed via Over the air Re-Programming or via inexpensive programming cable Encryption Re- Keys entered via software, or Over the air Re-Keying Keying Key Length 64 bits (provides 18 quintillion keys) Inversion Programmable for a dynamic range of 2.1 khz through 4.1 khz Frequency Dwell Time Programmable for a dynamic range between 0 ms (no hop) through 1000 ms Unique System Identifier Unique system protection available to ensure incompatibility with any other radio system even if key is compromised Messaging Includes Short Messaging capability of eight canned messages/statuses with definition aliasing of eight characters Messaging Security Capable of digitally encrypting MDC-1200 data burst for added messaging and ANI security Synchronization MSK sync burst required only at beginning of transmission Burst Sync Burst 80 ms Length Multi-Agency Interoperability Up to 16 Encryption keys or inversion frequencies can be stored. In many host radios, changing the radio channel also changes the key (or inversion frequency) to be used with the agency on that channel. Additionally, ANI ID s and types can be assigned to the sixteen available channels.

10 Chapter 1 Features 10 Radio System Compatibility Outputs Inputs Programming Radio Interface Supply Voltage Supply Current Advanced microprocessor control permits precise pairing with communications system. This enhances encryption compatibility with repeaters, voters, varying system links and system degradations KEY; Tone Control; Aux Output; Sidetone; Selective Call; Disable Radio; TX Audio Out; RX Audio Out Emergency; Man-Down; PTT; Sleep; Aux Input; Inversion enable; Code select 1,2,3,4; TX Audio In; RX Audio In; Discriminator In Programmed via cable and Cimarron Technologies QuikWare software. Also over-the-air programmable with associated hardware. Wired interface between QS-5000 pads and radio components/pads 3.3 to 3.6 VDC regulated or 3.7 to 20 VDC unregulated 12mA quiescent; 35 ma processing Temperature Operating: -30 o C to +60 o C. Humidity Dimensions Upgradeability 0% to 95% RH (non-condensing). 22.5mm x 36.5mm x 1.5mm. Level of security can be increased with communications system upgrades without reinvesting in new/different encryption modules

11 Chapter 2 Installation 11 CHAPTER 2 Installation Physical Installation Find a location in the radio for the Model QS-5000, preferably away from the transmitter output amplifier stage. Locate the interface points for the QS-5000 interface wiring, cut wires to the appropriate length and solder between the radio interface points and the QS-5000 interface pads. Keep all wires as short as possible to avoid RF and noise interference. Place the insulating sleeve over the QS-5000 module and firmly affix to the radio. Radio Connections Teflon insulated wires are included in the QS-5000 package to interface the device to the host radio. Use only the wires required and keep all used wires as short as possible. A wire stripping tool is essential for the correct stripping of Teflon coated wires. Conductors will be nicked or cut if an appropriate stripping tool is not used. Definitions of all radio connections can be found on page 19. Audio Connections and Radio Modifications Proper installation of the QS-5000 into the target radio requires good selection of radio interface points and modifications that cause the microphone audio and receive audio lines to be split. TX Audio In and TX Audio Out Locate a point in the radio microphone circuitry before pre-emphasis and before CTCSS injection. Cut the audio path (some radio manufacturers provide zero ohm resistors in the circuit specifically for this). TX Audio In should be attached on the microphone side of the break and TX Audio Out should be attached on the modulator side of the break. RX Audio In and RX Audio Out Locate a point in the radio receiver circuitry after CTCSS pick off and before receive volume control. Cut the audio path (some radio manufacturers provide zero ohm resistors in the circuit specifically for this). RX Audio In should be attached on the discriminator side of the break and RX Audio Out should be attached on the speaker amplifier side of the break. Discriminator The discriminator connection should be attached as close to the radio discriminator as possible. This dedicated input line is used exclusively for detecting and decoding data. If your application only uses basic fixed inversion scrambling with no receive ANI functions and no digital encryption setup message, then this connection is not required.

12 Chapter 2 Installation 12 Audio Level Adjustments Eight audio level adjustments are available to precisely match the host radio requirements. These adjustments are programmed by software and are realized in the on-board codec. The permitted range for these adjustments is from -42 to +20 db. Microphone input gain level without inversion Microphone output gain level without inversion Microphone input gain level with inversion Microphone output gain level with inversion AF input gain level without inversion AF output gain level without inversion AF input gain level with inversion; AF output gain level with inversion Optimum level adjustments can be achieved by performing the following steps: 1. After installing the board, set the board to without inversion and using an oscilloscope, measure the microphone input to the QS-5000 while speaking into the radio microphone in transmit. 2. Then, measure the microphone output from the QS-5000 while similarly speaking into the microphone. 3. In QuikWare software, set microphone input gain level without inversion to 0 and incrementally adjust microphone output gain level without inversion until the measured level from step 2 matches the level from step If you are unable to get the levels to match, then start adjusting microphone input gain level without inversion incrementally until the measured level from step 2 matches the level from step Now turn inversion on and repeat steps 1 through 4 but adjust the with inversion levels. 6. Then, using a service monitor, generate a signal with correct deviation of a 1KHz audio signal. 7. Perform steps 1 through 4 while measuring the QS-5000 AF input and output lines with the board set to without inversion. 8. Perform steps 1 through 4 as in step 7 but with the board in inversion mode. Data Deviation Adjustment The QS-5000 data deviation is adjusted by software selection. The value can be programmed between 1 and 255. A value of 255 provides the maximum output of 2 VPP. Modify the value of Output Level until data deviation is just below voice deviation. It is most appropriate to start at a deviation that is much lower than voice and then adjust up until the correct point is reached. Assignable Physical Inputs and Outputs There are nine input ports and five output ports. All inputs and outputs required for your particular radio installation must be assigned to these ports. Individual output functions can be assigned to up to two output ports. JP1 affects all input ports and permits the selection of having them all pulled up to 3.3V, attached A+ or not pulled up. Alternatively, the jumper can be removed completely and the microprocessor programmed to provide the pull-up on an individual I/O line basis.

13 Chapter 2 Installation 13 Open Collector Outputs OUT0 and OUT1 Physical outputs OUT0 and OUT1 are standard NPN transistor circuits configured for Open Collector output. They are capable of sinking up to 100 ma. Multilevel Outputs OUT2, OUT3 and OUT4 Physical outputs OUT2, 3 and 4 are configured with combination PNP and NPN transistors and jumper options to permit many different output configurations. Referring to the above schematic which represents one of the three multilevel capable outputs, the following table describes jumper combinations and resulting output characteristics. Note that there are two output columns, one with normal assertion and one with inverted assertion. This relates to how the output function is programmed in QS-5000 configuration software. Jumper Selection Output with normal assertion Output with inverted assertion A B C D E Inactive Active Inactiv Active e Out Out Out In Out Low +3.3vdc +3.3vdc Low Out Out In Out Out HiZ Low Low HiZ Out In In Out Out A+ Low Low A+ In Out In Out Out +3.3vdc Low Low +3.3vdc Out In Out Out In HiZ A+ A+ HiZ In Out Out Out In HiZ +3.3vdc +3.3vdc HiZ Crypto Keys or Inversion Frequencies The QS-5000 can store up to 16 user selectable 64 bit crypto keys or 16 user selectable inversion frequencies. If a digital encryption setup is necessary, transmissions are prefaced with digitally encrypted data packets that describe the inversion process to be used on the voice audio and make use of the pre programmed 64 bit crypto keys. The resulting voice chopping and inversion can randomly vary up to 2000 Hz difference in inversion frequencies at a randomly changing rate of up to 100 times per second.

14 Chapter 2 Installation 14 Without the digital encryption setup databurst, transmissions are scrambled using simple inversion at a frequency fixed and selected from the 16 pre programmed frequencies. This mode permits the QS-5000 to be compatible with most low security simple inversion scrambling systems while still permitting future use of higher quality secure methods. The Key or Frequency in use is selected with four Inversion Code Input lines. Many radios provide interface pads for these Code select lines which are then manipulated according to user preferences in the radio programming software on a per-channel basis.

15 Chapter 2 Installation 15 Jumpers B A B A A = 3.3V B = A+ C = NPN D = Direct E = NPN + PNP See page 13 for details E C D C E D A B Jumper JP-1 JP-2 JP-4 JP-6 JP-7 JP-8 JP-9 JP-10 JP-12 JP-13 Purpose Selects pull-up voltage (A+, 3.3V or none) to be applied to inputs IN0 through IN8. Default is 3.3V Selects voltage to be used (A+, 3.3V or none) for multilevel output OUT4 Selects output criteria for multilevel output OUT4 Selects voltage to be used (A+, 3.3V or none) for multilevel output OUT2 Selects output criteria for multilevel output OUT2 Selects voltage to be used (A+, 3.3V or none) for multilevel output OUT3 Selects output criteria for multilevel output OUT3 Combines Sidetone audio and AFOut audio. This jumper is installed for radio installations where only one wire would be required. Combines OUT0 and IN4. In default conditions, KEY function is assigned to OUT0 and PTT function is assigned to IN4. This jumper is installed for radio installations where only one wire would be required. Supply voltage select. Install jumper if QS-5000 is to be supplied with regulated 3.3VDC. Otherwise provide 3.6 VDC or greater and onboard regulator will be used. Default condition is OUT.

16 Chapter 2 Installation 16 Pads T33/GND T28/IN6 T32/OUT3 T11/IN0 T8/OUT2 T9/RXD0 T12/TXD T13/IN8 T27/IN4 T24/IN3 T16/OUT0 T25/OUT1 T3/MIC Out T4/AFIn T2/AFOut T37/Tone T15/IN7 T30/IN5 T21/IN2 T18/IN1 T10/MICIN T1/DiscIN T7/AIN1 T5/AIN0 T31/A+ T14/OUT4

17 Chapter 2 Installation 17 Pad Information PAD SIGNAL FUNCTION T1 DISCIN This is the radio receive discriminator signal. It is used by the QS-5000 for detecting and decoding data. T2 AFOUT RX Audio Output. This is receive audio back to the radio. If in scramble mode, the microprocessor will have processed the RX Audio In and presented it to the Codec. If in plain mode, the microprocessor will route the RX Audio In back to the Codec. In both cases, this codec output is RX Audio Out. T3 MICOUT TX Audio Output. This is microphone audio back to the radio. If in scramble mode, the microprocessor will have processed the TX Audio In and presented it to the Codec. If in plain mode, the microprocessor will route the TX Audio In back to the Codec. In both cases, this codec output is TX Audio Out. T4 AFIN RX Audio Input. This is receive audio from the radio. The audio is digitized and presented to the microprocessor. T5 AIN0 Analog input for future use T7 AIN1 Analog input for future use T8 OUT2 Configurable output, configured with combination PNP and NPN transistors and jumper options to permit many different output configurations. Default = This line is used to activate a radio amplifier or audio pass gate when Sidetone is being generated by the QS Sidetone is not powerful enough to drive a radio speaker directly so the radio s amplifier must be used. T9 RXD0 Microprocessor digital communications input port T10 MICIN TX Audio Input. This is microphone audio from the radio. The audio is digitized and presented to the microprocessor. T11 IN0 Default = Emergency activation input. The input can be software programmed for reverse logic. This line can alternately be used as a status or canned message. T12 TXD0 Microprocessor digital communications output port T13 IN8 Digital input can be pulled up to A+ or 3.3V with JP-1 T14 OUT4 Configurable output, configured with combination PNP and NPN transistors and jumper options to permit many different output configurations. T15 IN7 Digital input can be pulled up to A+ or 3.3V with JP-1 T16 OUT0 Open collector transistor output, capable of sinking up to 100 ma. Default = Key output used to place the associated radio in transmit mode when required. T17 TCK Factory use T18 IN1 Digital input can be pulled up to A+ or 3.3V with JP-1. Default = Man-Down activation input from an external sensor or switch. The input can be software programmed for reverse logic. This line can alternately be used as a status or canned message. T20 TMS Factory use T21 IN2 Digital input can be pulled up to A+ or 3.3V with JP-1. Default = Channel Busy input used to detect when the radio is actively receiving. The input can be software programmed

18 Chapter 2 Installation 18 for reverse logic. T23 TDI Factory use T24 IN3 Digital input can be pulled up to A+ or 3.3V with JP-1. Default = Sleep Input used to stop ANI generation on channels where data is not desired. T25 OUT1 Open collector transistor output, capable of sinking up to 100 ma. Default = Critical Channel Revert. The output becomes active 50 ms before Key for critical data transmissions T26 TDO Factory use T27 IN4 Digital input can be pulled up to A+ or 3.3V with JP-1. Default = PTT sense input. Used to detect when the radio is transmitting T28 IN6 Digital input can be pulled up to A+ or 3.3V with JP-1 T30 IN5 Digital input can be pulled up to A+ or 3.3V with JP-1. Default = When active, speech inversion will take place T31 A+ Input supply voltage. 3.3 to 3.6 VDC regulated or 4.0 to 16.5 VDC unregulated T32 OUT3 Configurable output, configured with combination PNP and NPN transistors and jumper options to permit many different output configurations. Default = The selective call line becomes active upon receipt of a selective call, group call or all call. It can be programmed for continuous or pulse action. It is usually used to activate an LED to show that the unit has been called. It becomes de-active upon receipt of a call cancel or by pressing the radio PTT button. T33 GND Ground T34 RESET Factory use T35 GND Factory use T36 3.3V Factory use T37 SIDETONE Physical Assignments Audio output capable of different sounds to be presented to radio local speaker amplifier. Used to alert user of various events Signal Input/ Output Default Port/Pad Assignment Wire Color PTT Input IN4/T27 Yellow Channel Acqd Input ** White/Violet Channel Busy Input IN2/T21 Violet Sleep Input IN3/T24 White/Orange Emergency Input IN0/T11 Green Man Down Input IN1/T18 Blue Tone Control Output OUT2/T8 White/Yellow Selective Call Output ** White/Green Transmit Control Output ** Gray Critical Chan Revert Output OUT1/T25 White/Brown Inversion Enable Input IN5/T30 Yellow/Green

19 Chapter 2 Installation 19 Inversion Code 0 Input ** Yellow/Black Inversion Code 1 Input ** Yellow/Brown Inversion Code 2 Input ** Yellow/Red Inversion Code 3 Input ** Yellow/Orange Inversion Status Output OUT4/T14 Gray/Green Key Output OUT0/T16 Brown Radio Disable Output OUT3/T32 White/Blue Sidetone Output Audio/T37 Orange TX Audio IN Input Audio/T10 White TX Audio OUT Output Audio/T3 White/Black RX Audio IN Input Audio/T4 Gray/Red RX Audio OUT Output Audio/T2 Gray/Orange Discriminator Input Audio/T1 White/Red ** = No default port assignment Radio connection Definitions Red Black Yellow Brown Green Blue A+ Positive supply voltage to the QS Unregulated +3.7 to +20 VDC or regulated 3.3 to 3.6 VDC. If using regulated 3.3 to 3.6 VDC, install jumper JP-13. Note: If JP-13 is installed, there is no reverse voltage protection!! A- Supply ground PTT (Default assignment IN4) Input This line is used by the QS-5000 to detect when the radio has been keyed. Connect to a point in the radio that changes state when the radio is actually transmitting. The function is programmable for active high or active low. Key (Default assignment OUT0) Output This line is used to key the radio when required by the QS It can be isolated from the PTT input line by removing Jumper JP12. Connect to a point in the radio that will force the radio to transmit when the line state is changed. This is typically the radio key line which, when grounded, keys the radio. Emergency (Default assignment IN0) Input The Emergency input is used by the QS-5000 to detect a manual emergency condition. The input can be software programmed for reverse logic. This line can alternately be used as a status or canned message. Attach to an unused radio button or an external momentary switch. Man Down (Default assignment IN1) Input Man-Down activation input from an external sensor or switch. The input can be software programmed for reverse logic. This line can alternately be used as a status or canned message.

20 Chapter 2 Installation 20 White/Green Gray White/Brown Gray/Green White/Blue Selective Call (Default assignment OUT3) Output The selective call line becomes active upon receipt of a selective call, group call or all call. It can be programmed for continuous or pulse action. It is usually used to activate an LED to show that the unit has been called. It becomes deactive upon receipt of a call cancel or by pressing the radio PTT button. Transmit Control Output Active state occurs during transmit attack delay and data burst transmission. Typically used to control a transmitter CTCSS, turning it off during ANI transmissions. Critical Channel Revert (Default assignment OUT1) Output Active only during Emergency and Man-Down data transmissions. Typically used to change the radio channel to a Home channel before sending the Emergency or Man-Down message. Becomes active 100 ms before the Key line is activated for critical transmissions. Inversion Status (Default assignment OUT4) Output This line becomes active whenever the boards inversion function is enabled. This is used to advise the user whether their transmissions will be secure or not. Radio Disable (Default assignment OUT3) Output Active upon receipt of a radio disable command. The line becomes de-active only with the receipt of a Radio Enable command and is not affected by cycling of power. Can be used to inhibit the transmit function of the radio. Sleep Input White/Orange The sleep input will stop the QS-5000 from modulating ANI data when active. The input can be software programmed for reverse logic. This is useful if ANI is desired on selected channels only. Emergency and Man-Down features are not available when sleep is active. Sidetone Output Orange Sidetone output should be attached to the input to the radio audio amplifier. The audio is generated for presentation to the local speaker amplifier from two sources; one is directly from the micro (PA1_BEEP) and the other via the Codec (AFOUT). If sidetone is being generated while the radio is in transmit mode, the sidetone source will be from PA1_BEEP. Volume can t be adjusted through

21 Chapter 2 Installation 21 PA1_Beep so R14 reduces the amplitude to compensate for the VCC square wave. Additional resistance can be added between the sidetone pad and the radio during radio installation. If the radio is not in transmit mode, the sidetone source will be via the Codec. The following describes sidetone events: 1. With beginning send ANI and scrambling setup data, the sidetone will start at PTT and last through scrambling setup data and PTT ANI data. 2. With beginning send ANI without scrambling setup data, the sidetone will start at PTT and last through the PTT ANI data. 3. With endsend ANI with scrambling setup data, the sidetone will start at PTT and last through scrambling setup data. 4. The tone that is generated in connection with the impending transmission of a critical message (Emergency, Man Down). 5. Upon receipt of a selective call, group call or all call and continues until receipt of a call cancel or the radio PTT button is pressed. 6. Upon receipt of a critical message from any other unit. 7. After receipt of a scrambled message while the radio is not in scramble mode. The device will descramble the audio and advise the user that the received message was descrambled. White/Yellow Yellow/Green Yellow/Black Yellow/Brown Yellow/Red Tone Control Output (Default assignment OUT2) This line is used to activate a radio amplifier or audio pass gate when Sidetone is being generated by the QS Sidetone is not powerful enough to drive a radio speaker directly so the radio s amplifier must be used. If sidetone is desired, the radio audio amp will need to be turned on for the duration of the tone. This multi-level output is very handy for controlling audio amplifier circuits in a radio. Inversion Switch (Default assignment IN5) Input When active, speech inversion will take place Inversion Code line 0 Input One of four input lines that are used to select which crypto key or which inversion frequency to use as well as per-channel capability for ANI type and ID. Inversion Code line 1 Input One of four input lines that are used to select which crypto key or which inversion frequency to use as well as per-channel capability for ANI type and ID. Inversion Code line 2 Input One of four input lines that are used to select which crypto key or which inversion frequency to use as well as per-channel capability for ANI type and ID. Inversion Code line 3 Input Yellow/Orange One of four input lines that are used to select which crypto key or which inversion frequency to use as well as per-channel capability for ANI type and ID.

22 Chapter 2 Installation 22 Violet White White/Black Gray/Red Gray/Orange White/Red Channel Busy (Default assignment IN2) Input The channel busy line should be interfaced to a point in the radio that changes state when actively receiving signals. Transmit Audio In This is microphone audio from the radio. The audio is digitized and presented to the microprocessor. Transmit Audio Out This is microphone audio back to the radio. If in scramble mode, the microprocessor will have processed the TX Audio In and presented it to the Codec. If in plain mode, the microprocessor will route the TX Audio In back to the Codec. In both cases, this codec output is TX Audio Out. RX Audio In This is receive audio from the radio. The audio is digitized and presented to the microprocessor. RX Audio Out This is receive audio back to the radio. If in scramble mode, the microprocessor will have processed the RX Audio In and presented it to the Codec. If in plain mode, the microprocessor will route the RX Audio In back to the Codec. In both cases, this codec output is RX Audio Out. Discriminator This is the radio receive discriminator signal. It is used by the QS-5000 for detecting and decoding data.

23 Chapter 3 Programming 23 CHAPTER 3 Programming Many functions and features of the QS-5000 are user programmable. In addition to signaling type, ID and radio interface parameters, the device can be optimized for the application s particular needs. QuikWare Programming Software The QS-5000 is programmed using the associated USB programming cable. It can be accomplished while installed in the host radio or prior to installation. In the case of programming while the board is installed, use only the black and white programming cable grabbers and power the board by turning on power to the radio. The Cimarron QuikWare software is used for selection of desired parameters. Main Menu Mode Available selections are Technician, Supervisor, and Manufacturer. Technician level requires no password but does not permit changing or viewing of inversion parameters. Supervisor level permits changing but not viewing of inversion parameters and requires a password to access. Manufacturer level is only for Factory use. Supervisor Password required. May change inversion parameters. May not view inversion parameters. Technician No password required. May not view or change inversion parameters. Manufacturer Factory use only. Product Type Available selections are VQS-400, VQS-420, VQS-500, QS-4000, QS- 4200, and QS Type Function VQS-400 Vertex plug-in capable of simple inversion secure voice VQS-420 Vertex plug-in with full MDC-1200 or GE-Star signaling, including decode and display of decoded ID and simple inversion secure voice

24 Chapter 3 Programming 24 VQS-500 QS-4000 QS-4200 QS-5000 Vertex plug-in with full MDC-1200 or GE-Star signaling, including decode and display of decoded ID and maximum capability hopping secure voice Universal wire in capable of simple inversion secure voice Universal wire-in with MDC or GE-Star signaling and simple inversion secure voice Universal wire-in with MDC or GE-Star signaling and maximum capability hopping secure voice FW Version Once the board has been read, the version of the firmware installed in the board is displayed here. COM Port This box displays which com port has been selected. To change the com port, select Communications from the menu bar and then Setup. Chan A maximum of 16 channels can be designated. If Respond to Channel Codes in the Common menu is set to No then only channel one will be accessible. If a Supervisor right clicks on a channel row, they will be prompted to select one of six predefined security levels, or Manual. Once a security level is selected, the appropriate parameters are automatically entered. After the selection, the supervisor can then modify any of the entered parameters in order to fine tune. See appendix A for further details of pre-defined security levels. Inv Type Inversion type can be None, Fixed, Fixed with Setup, Hop PTT and Hop Fast. None grays out all inversion related cells. Fixed grays out min/max freq cells and Hop grays out the Fix freq cell. If None is selected, then inversion will not be available on that channel. Fix Frq This inversion frequency is used if the inversion type selected is Single. Min Frq This parameter determines the lowest frequency to be used when performing hopping inversion. The field is available if inversion type selected is Multi, otherwise it is grayed out. Valid entries are from 2100 to 4100 Hz. Max Frq This parameter determines the highest frequency to be used when performing hopping inversion. The field is available if inversion type selected is Multi, otherwise it is grayed out. Valid entries are from 2100 to 4100 Hz.

25 Chapter 3 Programming 25 Min Dwl This parameter determines the smallest amount of time to rest at a particular inversion frequency before moving to the next inversion frequency. Valid entries are from 10 to 1000 ms in 10 ms steps. Max Dwl This parameter determines the largest amount of time to rest at a particular inversion frequency before moving to the next inversion frequency. Valid entries are from 10 to 1000 ms in 10 ms steps. Mute Mode If set to ON, in GE Star, the radio will remain muted unless a GE Star Selective Call command is received. A Call Cancel will again mute the receiver. In MDC-1200, VSC will be enabled. In a system that uses Voice Select Call (VSC), all radios remain muted until a VSC command to their ID is received. Then the radio unmutes until loss of receive carrier. If this feature is enabled, the radio will remain muted unless a VSC command is received. P/U INV The power up mode parameter determines the condition of voice inversion scrambling when the radio is powered up. If On, the radio will scramble all transmissions unless it is manually changed to plain mode. If the mode is set to plain, the radio will not scramble transmissions unless it is manually changed to scramble mode. This field is grayed out and unavailable unless the Inversion Enable input line is programmed for PULSE. ANI Type MDC or GE x where x designates the GE Star format. GE Star formats are selectable from A through P. See page 47 for more details. ANI Loc None, Start, End, Both [Default = Start] If programmed Start, the ID will be transmitted when the user keys the radio. If programmed End, the ID will be transmitted when the user unkeys the radio. Both will provide ID transmissions at both the Start and the End. PTT ID EM ID M/D ID Generally, the PTT ID Emergency ID and the Man Down ID are the same; however, they could be programmed different if desired. In MDC- 1200, the valid ID range is from 0001 through DEEE. A radio ID cannot contain the character F nor can it begin with the character E as these are defined as wildcards. However, a radio can encode to a target ID containing these characters. In GE Star, The actual maximum value depends on the GE Star format type selected ( ). A radio cannot be programmed for an ID of 0 (zero) but a radio can encode to a target ID of 0.

26 Chapter 3 Programming 26 PTT MSG In MDC-1200, the default PTT message is In GE Star, the default is 01. Although these values are adjustable to permit worldwide system flexibility, they should never be changed except to accommodate documented system variances. EM MSG In MDC-1200, the default emergency message is In GE Star, the default is 07. Although these values are adjustable to permit worldwide system flexibility, they should never be changed except to accommodate documented system variances. TOT MSG In MDC-1200, the default PTT message is In GE Star, the default is 09. Although these values are adjustable to permit worldwide system flexibility, they should never be changed except to accommodate documented system variances. M/D MSG In MDC-1200, the default man down message is In GE Star, the default is 0F. Although these values are adjustable to permit worldwide system flexibility, they should never be changed except to accommodate documented system variances. Group ID In GE Star format, the actual maximum value depends on the GE Star format type selected ( ). A GE Star ALL CALL is a selective call to ID 0 (zero) and is not re-definable. A group call can be any valid number but must not be used as a PTT or Emergency ID on any radio in the system. The default is 0 (zero) which effectively means that there is no group call (only the all call). In MDC-1200, units can be assigned group ID s that consist of three HEX digits excluding the digit F. Crit ANI If enabled, any PTT press during a critical cycle (e.g. emergency or man down) that would generate a PTT ANI will generate the critical message instead. CRIT RVRT (ONCE, ALL, NONE) [Default ONCE] Determines how the Critical Channel Revert output line reacts (if one is programmed in the I/O). Once means that the line momentarily goes low at the beginning of the critical cycle. ALL means that the line goes low for each critical data transmission within the cycle. NONE means that the Critical Channel Revert output is not activated on that channel. C T Unkey Courtesy Tone. If programmed Yes, a tone will be transmitted when the user unkeys to inform the listener that they may now transmit.

27 Chapter 3 Programming 27 ACK (Y/N) [Default Yes] If this feature is enabled, an acknowledgment will be transmitted whenever required. Base ID [Default=0001] Additional security can be realized by defining the ID of the base authorized to make over the air key changes and reprogramming. If this parameter is set to 0000, then Base ID will be ignored and the QS-5000 will react to commands from any base ID. Encrypt ANI QuikSync is capable of digitally encrypting ANI. This renders the Unit ID and other MDC-1200 data transmissions unreadable except to users that have a correctly keyed decoder. Encryption Key If Hop or Fixed with Setup is selected in Inv Type, or Encrypt ANI has been selected, then an encryption key will be necessary (otherwise, the field is grayed out). A supervisor can enter a key in three different ways: 1. Click on the appropriate Key field, highlight the entry and enter the new 16 character key. OR Click on the appropriate Key field, then click on the appearing button. This will open a new box: Audio Control 2. Enter a Pass Phrase and then click on Generate Key and the phrase is converted to a key. The same phrase always generates the same key 3. Click on Random and then click on Generate Key. Gain Settings Gain settings can range from -42 to +20 db. There are a total of eight independent settings, four that affect levels with inversion taking place and four with inversion disabled.

28 Chapter 3 Programming 28 Microphone Input gain level without inversion This parameter adjusts the transmit (microphone) analog CODEC input audio gain level for the output of the QS-5000 when the inversion process is disabled. Microphone Output gain level without inversion This parameter adjusts the transmit (microphone) analog CODEC output audio gain level for the output of the QS-5000 when the inversion process is disabled. AF Input gain level without inversion This parameter adjusts the receive (speaker) analog CODEC input audio gain level for the output of the QS-5000 when the inversion process is disabled. AF Output gain level without inversion This parameter adjusts the receive (speaker) analog CODEC output audio gain level for the output of the QS-5000 when the inversion process is disabled. Microphone Input gain level with inversion This parameter adjusts the transmit (microphone) analog CODEC input audio gain level for the output of the QS-5000 when the inversion process is enabled. Microphone Output gain level with inversion This parameter adjusts the transmit (microphone) analog CODEC output audio gain level for the output of the QS-5000 when the inversion process is enabled. AF Input gain level with inversion This parameter adjusts the receive (speaker) analog CODEC input audio gain level for the output of the QS-5000 when the inversion process is enabled. AF Output gain level with inversion This parameter adjusts the receive (speaker) analog CODEC output audio gain level for the output of the QS-5000 when the inversion process is enabled. Common Settings Attack Delay 0ms to 1000ms in steps of 50ms. [Default 300mS] The period of time from when the user keys the radio and the data begins to be transmitted. This delay allows the communications system to stabilize and be ready for transmission.

29 Chapter 3 Programming 29 Acknowledgment Delay (0mS to 2550 ms in 10 ms steps) [Default 800 ms] The period of time from when an acknowledgeable message is received and the acknowledge data packet is sent. This delay allows the receiving radio to relax from transmit mode before receiving the data. Startup Delay (0mS to 2550 ms in 10 ms steps)[default 100mS] This parameter holds off the startup of the device after power is applied. Used to ensure host radio stability on power up. ANI Repeat Timer (time since last PTT press. If less, don t send PTT ANI) (0=send every PTT; 10s, 20s, 40s, 60s, 90s, 120s) [Default 0] Used to reduce the amount of data transmissions. If the selected time since the last PTT press is not exceeded, data is not transmitted with that PTT press. TX Time Out Timer (OFF,30s, 60s, 90s, 120s) [Default: OFF] If the radio is held keyed up for greater than the selected time, the ID is transmitted and the radio is automatically unkeyed. TX Data Level (0 255) [Default 50] Changes the data output level in 255 steps. Enter a value between 0 and 255 that provides a data deviation that is just below radio voice deviation. PTT Sidetone (Beginning send only) (Y/N) [Default Yes] If programmed Yes, a tone will sound through the local speaker to advise the user to hold off talking. Prevents Voice syllable clipping which could occur during data transmission. Mute Data (Y/N) [Default Yes] Some applications may require that received ANI data not be stripped from the incoming audio. If this is set to No then data will be forwarded from RX Audio In to RX Audio Out. This is especially necessary if the application is in a base dispatch console that has an ANI decode feature. Mute on Incorrect Key (Y/N) [Default Yes] The Mute on Incorrect Key feature forces the host radio to disable receive functions during receipt of a coded transmission where the receiving key does not match the transmitting key. Plain text transmissions continue to be received as well as transmissions encoded using similar keys.

30 Chapter 3 Programming 30 Emergency MDC Call Alert Encode Not available in the QS product. Disconnect Delay ( ms) [Default = 500] The disconnect delay is the time to wait after losing carrier that the board will cease following the hopping sequence. This delay will permit momentary loss of carrier (due to fading, etc) without losing synchronization with the hopping sequence. If a new MSK initialization burst is received during this delay period, the delay will be terminated and the new burst information will be followed. Inversion Preamble (8, 16, 32, or 64) [Default = 16] The encryption initialization data burst has a preamble length that is programmable for 8, 16, 32, or 64 preamble bits. Longer preambles provide for more robust data transmissions but make the secure voice setup message take longer to transmit. MDC Wildcard Enable (Y/N) [Default Yes] If set to No, MDC-1200 wildcards of F and E will be handled as normal allowable ANI ID s instead of wildcards. Unlock PIN Not available in the QS product. Display Received ANI Not available in the QS product. Key Follows PTT (Y/N) [Default No] Enabling Key Follows PTT makes the QS-5000 key line echo the condition of the PTT line. So if the PTT line goes low, the key line will follow and stay in the condition until the PTT line again changes state. This is especially useful if you desire the QS-5000 to un-key the radio at the expiration of the Time-Out-Timer time. Respond to Channel Codes (Y/N) [Default Yes] If this parameter is set to No, the channel settings screen will have only one channel to be used regardless of the channel the radio is on. Number of repeat emergency transmissions (1, 5, 10, 15, 20, forever) [Default =5] Number of times that an emergency message is transmitted. (1, 5, 10, 15, 20, forever) The emergency message transmission will be repeated a programmed number of times with a programmed period between transmissions. The repeats will be transmitted regardless of radio status.

31 Chapter 3 Programming 31 If this value is set to 1 (one), the transmission will be considered a noncritical message instead of emergency. Time between emergency repeats (5s, 10, 20, 30s) [Default=10s] When in the emergency mode, if the number of repeat emergency transmissions is not One, this is the time that will be waited between emergency transmissions. Open Microphone Monitor on Emergency TX time (0s to 55s, 5s steps) [Default 0s] If not set to zero, once an emergency is activated, the radio will key up and transmit ambient noise for this period of time. It will then unkey and remain unkeyed for a programmed amount of time and then repeat the process. It will alternate between TX and RX throughout the emergency cycle. The length of the cycle is determined by the settings of Number of repeat emergency transmissions and Time between emergency repeats. If the value is set to zero, there will be no open microphone monitor. Open Microphone Monitor on Emergency RX time (0s to 55s, 5s steps) [Default 0s] If open microphone monitor on emergency TX time is not set to zero, the radio will remain unkeyed for this period of time between TX times. Emergency TX Warning Tone (Y/N) [Default No] If programmed Yes, a warning tone will sound through the local speaker to advise the user that an emergency message is being transmitted. ManDown Number of repeat Man Down transmissions (1, 5, 10, 15, 20, forever) [Default =5] Number of times that a Man down message is transmitted. (1, 5, 10, 15, 20, forever) The man down message transmission will be repeated a programmed number of times with a programmed period between transmissions. The repeats will be transmitted regardless of radio status. If this value is set to 1 (one), the transmission will be considered a noncritical message instead of man down.

32 Chapter 3 Programming 32 Time between Man Down repeats (5s, 10, 20, 30s) [Default=10s] Repeated Man Down transmissions will be separated by a programmed delay period between transmissions (5s, 10, 20, and 30s). Open Microphone Monitor on Man Down TX time (0s to 55s, 5s steps) [Default 0s] If not set to zero, once a Man Down is activated, the radio will key up and transmit ambient noise for this period of time (0s to 55s, 5s steps). It will then unkey and remain unkeyed for a programmed amount of time and then repeat the process. It will alternate between TX and RX throughout the Man Down cycle. The length of the cycle is determined by the settings of Number of repeat Man Down transmissions and Time between Man Down repeats. If the value is set to zero, there will be no open microphone monitor. Open Microphone Monitor on Man Down RX time (0s to 55s, 5s steps) [Default 0s] If open microphone monitor on Man Down TX time is not set to zero, the radio will remain unkeyed for this period of time between TX times(0s to 55s, 5s steps). Man Down TX Warning Tone (Y/N) [Default No] If programmed Yes, a warning tone will sound through the local speaker to advise the user that a Man Down message is being transmitted. Man Down Warning Delay (0 255 S) [Default 5 S] Once the QS-5000 senses a man down situation, this timer begins to run (0 255 S). If the radio is not up righted within this period of time, a warning tone lasting 1 second is sounded. If the radio is up righted, the warning timer resets. Man Down Activation Delay (0 255 S)[Default 5 S] If the warning delay timer succeeds to complete its countdown and the warning tone is sounded, the activation delay timer begins to run (0 255 S). The activation delay timer is programmable 0 to 255 seconds. If the radio is not up righted within this period of time, the radio will key up and send a message to the base.

33 Chapter 3 Programming 33 Digital I/O Control There are nine input ports and five output ports. All inputs and outputs required for your particular radio installation must be assigned to these ports. Functions available for assignment to inputs are: Code0, Code1, Code2, Code3, PTT, Busy, Sleep, Emergency, Man Down, Trunk Acquired, and Inversion Enable. Individual output functions can be assigned to up to two output ports. Polarity can be assigned as Neg, Pos, or Pulse. Polarity of the signal in the input section refers to the polarity of the signal presented to the microprocessor. If JP1 on the QS-5000 is removed completely, the microprocessor pull-up feature can be programmed on an individual I/O line basis. Debounce time is the time the line must remain active before the microprocessor recognizes it as a valid input. Functions available for assignment to outputs are: Key, Disable, Tone Control, Selective Call, TX Control, Critical Channel, and Inversion Active. Polarity can be assigned as Neg or Pos. Polarity of the signal in the output section refers to the polarity of the signal generated by the microprocessor. The ultimate polarity achieved at the signal solder pad will be determined by the output port selected as well as the jumpers being used for that output port.

34 Chapter 3 Programming 34

35 Chapter 3 Programming 35

36 Chapter 3 Programming 36

37 Chapter 3 Programming 37

38 Chapter 3 Programming 38

39 Chapter 3 Programming 39

40 Chapter 3 Programming 40 Memory Characteristics Programming parameters are stored in non-volatile memory and will be retained when the radio is turned off or when the battery is removed.

41 Chapter 4 Operation 41 CHAPTER 4 Operation QS-5000 Basic Operation The QS-5000 combines ANI encoder/decoder signaling with the Cimarron Technologies QuikSync voice inversion scrambling function. The board is capable of sending PTT ANI and Emergency ANI in GE Star or MDC-1200 signaling format. It is capable of reception of Selective Calls, Group calls and All calls and will provide audible alerts when called. It responds to radio check commands (interrogates), and to over the air open microphone monitor commands and radio disable/enable commands. PTT ANI Operation ANI (Automatic Numeric Identification) provides for digital identification of a transmission initiated by a transmitter's microphone switch ( Press-To- Talk or PTT switch). This digital burst can occur when the switch is first pressed, or when the switch is released, or at both times. On specified radio channels, with the press of the PTT button, the QS-5000 disables the radio microphone and then transmits the ANI ID and, if scrambling is also enabled, a brief setup message. While the radio is transmitting the data, a tone sounds in the local speaker to advise the user to hold off talking. This prevents syllable clipping. If the QS-5000 is in Cipher Mode and PTT Sidetone is enabled, the beep will sound like boo-beep to advise the user that his transmission will be scrambled. If the board is in Clear Mode, the beep will sound like Bee-boop to remind the user that his voice is being transmitted in the clear. After the data is transmitted, the PTT sidetone stops and the microphone is activated. The digital ANI burst can be programmed to occur when the PTT is first pressed, or when the PTT is released, or at both times. If the burst is programmed for transmission when the PTT is released or the radio is on a non signaling channel, a short go ahead beep will be heard and there will be no sidetone with data transmission. Regardless of ANI location (beginning or end), the encryption setup message occurs at the beginning of transmission. When the PTT is released and transmission is over, a courtesy beep is transmitted to inform the listener that they can now transmit. The PTT sidetone and courtesy beep can be individually deactivated in personality programming. To reduce the amount of data transmissions, data can be programmed to not occur during continuing conversations. A value can be selected for the time since the last PTT press. If the selected time is not exceeded in subsequent key-ups, data is not sent. Programmable times are 0, 10s, 20s, 40s, 60s, and 120s. [Default = 0]. If the time selected is 0 (zero), ANI will be sent with every PTT press.

42 Chapter 4 Operation 42 Time-out-timer When a mobile or portable radio inadvertently remains keyed due to a stuck microphone switch, it generally means that the radio frequency is unusable for communications. Unfortunately, this activity is sometimes deliberately caused by a field operator. Whenever a microphone switch is held closed for more than the designated time-out-timer time either the offending unit's identification is transmitted and a local tone is sounded every ten seconds, or the unit can be programmed to transmit the unit's ID once, sound a local tone, and then automatically open the key line until the microphone switch is released. Radio Disable/Enable The QS-5000 will respond to GE Star or MDC-1200 radio disable/enable commands. This feature makes the radio unusable and is activated by a command sent over-the-air by a capable base station. Depending on how installed, the radio s Transmit and/or receive functions will be disabled until receipt of an Enable command also sent over-the-air. Not affected by cycling of power. The QS-5000 reacts to a disable command by breaking the receive audio path and by activating the Disable output and (if Key-Follows-PTT is enabled) by not forwarding PTT information to the Key output. The actions are reversed only upon receipt of an Enable command. Selective Call/Group Call/All Call Upon receipt of a selective call, group call or all call, the sidetone will be sounded for three seconds and will repeat every ten seconds until receipt of a call cancel or the radio PTT button is pressed. The selective call output can be user programmed to pulse when active or remain in a steady state when active. The line becomes active upon receipt of a selective call, group call or all call. It becomes deactivated upon receipt of a call cancel or the press of the radio PTT button. The line can be used to activate a call lamp which would give a visual indication that the user had been called. Unmute on selective call is a GE Star signaling feature that is useful for systems where talk between users is not allowed. Upon power-up, the QS-5000 breaks the radio receive audio path prohibiting the audio from reaching the radio speaker amplifier. If the dispatcher desires to communicate with the unit, a selective call is transmitted, deactivating the mute line, and the receive audio is allowed to pass to the speaker. When the communications are completed, the dispatcher sends a call cancel message, and the target radio is again muted. The action does not affect transmit, so the user is always able to transmit to the dispatcher. If one unit desires to talk to another unit, they simply call the dispatcher and request permission. If granted, the dispatcher will send a selective call to both units enabling the conversation. At the end of the conversation, dispatcher re-mutes the radios by sending a call cancel message. Microphone Monitor An over-the-air microphone monitor command can be sent by the dispatcher to a target radio equipped with a QS When the target

43 Chapter 4 Operation 43 receives the command, the radio will key up and transmit an acknowledgment and then send ambient noise (in GE Star, for 15 seconds; in MDC-1200, for the time designated by the dispatcher sending he command). Emergency Message An Emergency message is transmitted whenever the designated emergency button is held down for greater than the time programmed in the personality of the radio. The emergency message ID can be programmed to be different than the radio PTT ANI. If the ID s are different and an emergency message is sent, the QS-5000 will expect an acknowledgment to the emergency ID not the PTT ID. The emergency message transmission will be repeated a programmed number of times with a programmed period between transmissions. The repeats will be transmitted regardless of radio status. Available times are as follows: Number of repeat emergency transmissions. (1, 5, 10, 15, 20, forever) [Default = 5]. Time between emergency repeats. (5s, 10, 20, 30s) [Default=10s]. If desired, a warning tone can be sounded in the local speaker to advise the user that an emergency message has been sent. In conjunction with a properly configured radio personality, the radio will change channels prior to sending the emergency message. The emergency cycle is terminated at the conclusion of the repeats; upon receipt of an acknowledgment or by cycling power.

44 Chapter 4 Operation 44 Man-Down The Man-Down feature is primarily for use by law enforcement, security agencies, and fire departments. It also finds uses in business and industry where individuals can be overcome by toxic fumes, lack of oxygen, etc. The Man-Down ID is generally initiated by closure of a mercury switch located within a hand-held radio when the radio is continuously tipped greater than 60 degrees from vertical. To guard against false Man- Down transmissions an initial pause of a few seconds is provided during which the closure must be constant. After this duration a short tone is produced via the radio's speaker. A second pause follows the tone to allow the radio to be placed in an upright position (in the event no actual Man-Down is occurring). Following the second pause the Man-Down- ID data burst is transmitted in the same manner as the Emergency-ID. The Man-Down mode also can include the microphone monitoring alternative. Transmission of a unique coding for the Man-Down message (in lieu of a general Emergency coding), and multiple choices of initiation, tone, and final pause times are special features of the QS when using GE Star signaling. Status Status messages typically relate to the status of the field unit, such as In Service, Out Of Service, On Break, etc. and their appropriate meaning can be displayed at the decoding site equipped with a Cimarron Technologies C Plus decoder. The QS-5000 is capable of transmitting status messages in lieu of the Man-Down, Emergency and PTT ANI as required. Canned Messages Canned messages handle such communications as Request-To-Talk, Priority-Request-To-Talk, Repeat Last Transmission, Repeat Address, 10-4, Roger, and other routine requests and responses. Their appropriate meaning can be displayed at the decoding site equipped with a Cimarron Technologies C Plus decoder. The QS-5000 is capable of transmitting canned messages in lieu of the Man-Down, Emergency and PTT ANI as required. Secure Voice Features The QS-5000 has a programmable method of defining available inversion frequencies and dwell times which will allow the product to be precisely tailored based on the technical requirements of the communications system in which it is used. Additionally, special lock-out parameters can be programmed at the factory to make one users modules incompatible with any other end user even if the same crypto key is used. The receiving QS-5000 can automatically select the correct mode (plain text/cipher) in which to operate. The operator selects whether to transmit in plain text mode or cipher mode. The devices can also be programmed to force the radio receiver to remain muted unless the correct key is in use.

45 Chapter 4 Operation 45 A go-ahead tone in the local speaker advises the user regarding which mode he is transmitting in. For unique data transmission security, the QS-5000 has the capability of digitally encrypting all MDC data. The encryption engine used is a Feistel type cipher that uses operations from mixed (orthogonal) algebraic groups.

46

47 Chapter 5 Technical Information 47 CHAPTER 5 Technical Information GE Star Format Selections Radio systems using GE Star can define the T1, T2 and S1 bits to have different values or various meanings. Industry-wide, there are sixteen accepted variants with Format B being the industry defacto standard. The QS-5000 is programmable for any of the sixteen variants. Format Definitions The following table defines the sixteen GE Star formats. Format Description T1 T2 S1 Comments A IDs to 2047 (1st 11 bits). X X X T1, T2, and S1 ignored B IDs to (14 bit ID) Expanded-ID STAR #1. C IDs to (14 bit ID) GE-STAR #3. D IDs to (14 bit ID) Compatible with GE-STAR #4 E IDs to 4095 (12 bit ID, T2 = 0 ) 2048 M0 X GE-STAR #1. T2 = 0 for Mobile. F IDs to 4095 (12 bit ID, T2= 1 ) 2048 P1 X GE-STAR #1. T2 = 1 for Portable. G IDs to 8191 (13 bit ID, T2 = 0 ) 4096 M GE-STAR #2. T2 = 0 for Mobile. H IDs to 8191 (13 bit ID, T2 = 1 ) 4096 P GE-STAR #2. T2 = 1 for Portable. I IDs to 4095 (12 bit ID), System 0 Tags= 00 J IDs to 4095 (12 bit ID), System 1. Tags= 01 K IDs to 4095 (12 bit ID), System 2. Tags= 10 L IDs to 4095 (12 bit ID), System 3. Tags= 11 M - P IDs to 2047 (11 bit ID) X Identical to I - L with capability only to program IDs to max of Value Assignment Description 8192 If bit is set, add 8192 to ID 4096 If bit is set, add 4096 to ID 2048 If bit is set, add 2048 to ID M0 If the bit is not set, originator is a Mobile P1 If the bit is set, originator is a Portable X This bit is ignored For System types I through P, the C Plus decoder looks for a match in the T1 and T2 bits. If the bits match then the C Plus decoder will react to the received message. If not, the message is ignored. This is for communications systems that have multiple unrelated users so that different users do not see ID s from other users. GE Star Message Descriptions The GE Star bits designated S2, S3, S4 and M1 through M4 are used to code various messages. The QS-5000 can be programmed so that different message types are transmitted for PTT ANI, Emergency ANI,

48 Chapter 5 Technical Information 48 Man-Down and TOT ANI. The desired star code is selected in programming. The table below describes the Star codes, the value to enter while programming and the corresponding decoder displayed message: STAR CODE GE Star Message code C Plus Decoder display REMARKS STATUS 0 Status STATUS 1 Status STATUS 2 Status STATUS 3 Status STATUS 4 Status STATUS 5 Status STATUS 6 Status STATUS 7 Status (none) ANI ID and SelCall Ack INTG ACK Interrogate Ack REQ TALK Request to talk MSSAGE C Canned Message MSSAGE D Canned Message TAXI BID Taxi Bid EMRGENCY Emergency CNCL ACK Call Cancel Ack STUCKMIC Stuck Microphone A MNTR ACK Open Mic Monitor Ack B MSSAGE F Canned Message C MSSAGE G Canned Message D MSSAGE H Canned Message E MSSAGE J Canned Message F MAN-DOWN Man-Down A DSBL ACK Radio Disable Ack A ENBL ACK Radio Enable Ack (not listed) (not listed) UNDEFINE Undefined MDC-1200 Message Type To increase flexibility of the QS-5000 and enhance compatibility with existing communications systems, the format of encoded MDC-1200 messages can be modified. The default message type for a PTT ANI is represented by 0x8001 and the default message type for an Emergency ANI is 0x8000. These parameters should not be changed without a thorough understanding of the signaling system and existing signaling codes. Inversion Code Line Interpretation There are four inversion code lines that can be interfaced to radios that support code selection. The QS-5000 can use these lines to permit the user to assign, on a per channel basis, different ANI type, ID and inversion parameters on up to 16 channels. Code line states relate to channel selection per the following table:

49 Chapter 5 Technical Information 49 Interpreted Inversion Code Line State Channel When installing into a host radio with this capability, note the levels on the associated radio pads while changing the channels as some radios label the code lines in reverse order. In this table, Code Line State refers to logical inputs after QuikWare Digital I/O crossbar polarity has been applied to physical inputs (Neg polarity assigned). Trunking Operation In LTR trunking mode, we will not generate data until we know that the user has been given permission. When the QS-5000 is placed in Trunking mode, the channel acquired line will be used to sense that the channel is ready for use. Emergency The radio operator has just pressed the emergency button. The QS activates the radio PTT line and watches the Channel Acquired line. It holds off modulating data until the channel acquired has become active and remains active for the duration of the time set in the trunk select debounce timer. It then sends out the data and un-keys the radio.

50 Chapter 5 Technical Information 50 In this timing chart, the distance between green lines is 100mS and between brown lines is 200mS. Trunk select debounce time is set for 200mS and channel acquired input is set for trunk available when high. PTT at beginning The user has just keyed up the radio to speak, he waits for the go-ahead beep from the radio speaker, and the QS-5000 starts monitoring the Channel acquired line. Once the line becomes active and stays active for the duration of the trunk select debounce timer, the QS-5000 sends the PTT ANI data and the radio sends the go-ahead beep to the speaker so the user can begin talking. PTT at end The user has keyed the radio, received the go-ahead beep and has sent his voice message. The QS-5000 detects that the radio unkeyed and then rekeys it and waits for the Channel acquired line to become active and remain active for the duration of the time set in the trunk select debounce timer. The QS-5000 then sends out the PTT ANI data and unkeys the radio. If the radio PTT line is placed in series with the QS by using the PTT line and the KEY line and programming Key follows PTT, the QS-5000 will hold the radio keyed and send ANI after the user releases the PTT without actually unkeying the radio. Inversion Scrambling The Cimarron inversion scrambling scheme is unique in that it is adaptive to the communications system in which it will be used. When initially setting up the communications system, the QS-5000 boards must be programmed with configuration information. QuikSync uses dynamic frequency inversion scrambling, but, unlike other schemes, the range of inversion frequencies is specified during set-up as well as minimum and maximum dwell times. In this manner, the actual inversion frequency can be fixed so that all units always use the same split frequency (like current low end boards on the market); or the inversion frequency can change for each press of the PTT, staying at that

51 Chapter 5 Technical Information 51 split frequency only for the period of that transmission; or the board can hop around a pre-defined range of frequencies in a random manner and for random dwell times. The actual decision (and level of security) can be tailored precisely to the limitations of the communications system. There are six preset levels of security to choose from when configuring the board. These preset levels can be additionally adjusted as necessary for precise system integration. Description Pro Con Level 1 Single inversion frequency Best audio quality, Best Not very secure system pass thru Level 2 Frequency changes every PTT Better security, easy system Level 3 Level 4 Level 5 Level 6 Wider frequency changes on every PTT Frequencies changing randomly with fixed dwell times every PTT Frequencies and dwell time changing randomly every PTT Frequencies and dwell time changing randomly at wide variations pass thru Improved security Much better security Very good security Excellent security Marginal security Reduced voice quality System pass thru could suffer Voice quality and system pass thru may suffer Voice quality lower, may not pass thru systems Lowest voice quality, may not pass thru systems. Each transmission that does not use simple single frequency inversion is prefaced with a very short MSK setup data burst. This digitally encrypted data burst initializes the receiving radios and presents the game plan for the inversion scrambling process which is valid only for that transmission. Because the MSK data burst is encrypted, only those QuikSync units with the correct crypto key will successfully decrypt the game plan and be able to extract clear audio from the voice inversion scrambling hash. Additionally, special codes are available for assignment to demanding clients which will make their QS-5000 s totally incompatible with any other QS-5000 even if the crypto key is compromised. If the security level selected is not simple single frequency inversion, the receiving QS-5000 will automatically select the correct mode (plain or scrambled) in which to operate. So even though a radio has the QS installed and activated to transmit scrambled speech, if an unscrambled transmission is received, the board will not attempt to unscramble it, allowing it to pass directly to the receive audio circuits. However, the user will need to turn off his voice inversion scrambling in order to reply to the individual transmitting in plain mode. The QS-5000 can be placed in a mode which uses predefined inversion frequencies instead of using the digital encryption setup mode. The operation is then similar to legacy voice inversion modules where only one inversion frequency is used or a list of inversion frequencies can be selected from. In this mode, there is no setup burst transmitted at the beginning of scrambled transmissions and all received transmissions are assumed to have been scrambled.

52 Component Location Chapter 5 Technical Information 52

53 Schematics Chapter 5 Technical Information 53

54 Chapter 5 Technical Information 54

55 Chapter 5 Technical Information 55

56 Chapter 5 Technical Information 56

57 Chapter 5 Technical Information 57 Parts List Item Quantity Reference Part Manuf Manuf PN Vendor Vendor PN 1 2 C2,C1 0402C 7.5PF Murata GJM1555C1H7R5CB01D Digikey ND 2 1 C3 0402R 1000PF/25V Panasonic ECJ-0EB1H102K Digikey PCC1721CT-ND 3 1 C4 0402C.01uf/25V Murata GRM155R71C103KA01D Digikey ND 4 1 C5 0603C 2.2/6.3V Panasonic ECJ-1VB0J225K Digikey PCC2273CT-ND 5 24 C6,C7,C8,C9,C10,C12,C13,C14, 0402C.1uF Murata GRM155R61A104KA01D Digikey ND C15,C16,C17,C20,C23,C25,C26, C27,C28,C29,C30,C31,C32,C37, C38,C C C 4.7/6.3V Panasonic ECJ-1VB0J475M Digikey PCC2318CT-ND 7 1 C C 3300pF Panasonic ECJ-0EB1H332K Digikey PCC1727CT-ND 8 3 C19,C24,C C.01uF Murata GRM155R71C103KA01D Digikey ND 9 3 C21,C22,C C 1uF Murata GM155R60J105ME19D Digikey ND 10 1 C C 1800pF Panasonic ECJ-0EB1H182K Digikey PCC1724CT-ND 11 1 C C 15000pF Panasonic ECJ-0EB1C153K Digikey PCC1701CT-ND 12 1 C C 470pF Panasonic ECJ-0EB1H471K Digikey PCC1717CT-ND 13 1 C C 4.7uF Panasonic ECJ-1VB0J475M Digikey PCC2318CT-ND 14 1 C C 160pF Murata GRM1555C1H161JA01D Digikey ND 15 1 C C 43pF Murata GRM1555C1H430JZ01D Digikey ND 16 1 C C 2200pF Panasonic ECJ-0EB1H222K Digikey PCC1725CT-ND 17 1 C45 C2PTANT-A4.7uF Rohm TCTAL1E475M8R Digikey ND 18 1 C C 100pF Kemet C0402C101J3GACTU Digikey ND 19 1 C C 10uF Panasonic ECJ-1VB0J106M Digikey PCC2395CT-ND 20 3 DP1,DP2,DP3 QSBT40 Diodes Inc QSBT40-7-F Digikey QSBT40-FDIDKR-ND 21 1 D1 BAT54HT1 ON Semi BAT54HT1G Digikey BAT54HT1GOSCT-ND 22 5 JP1,JP2,JP3,JP6,JP8 JMP2 Not Installed 23 4 JP4,JP5,JP7,JP9 JMP3 Not Installed 24 4 JP10,JP11,JP12,JP13 JMP1 Not Installed 25 1 L1 0402L 600 Murata BLM15AG601SN1D Digikey ND 26 3 Q1,Q3,Q6 UP04316 PANASONIC UP L Digikey UP LCT-ND 27 2 Q4,Q7 UP04216 Panasonic UP L Digikey UP LCT-ND RP2,RP3,RP4,RP5,RP6,RP7,RP 10K Panasonic EXB24V103JX Digikey Y5103TR-ND 8,RP9,RP10,RP11,RP12,RP13,R P14,RP RP16 47K Panasonic EXB24V473JX Digikey Y5473TR-ND 31 1 RP17 100K Panasonic EXB24V104JX Digikey Y5104TR-ND 32 1 RP18 22K Panasonic EXB24V223JX Digikey Y5223TR-ND 33 1 R1,R R 33 Panasonic ERJ-2GEJ330X Digikey P33JCT-ND 34 2 R2,R4 0402R 100 Panasonic ERJ-2GEJ101X Digikey P100JCT-ND 35 1 R3 0402R 910 Panasonic ERJ-2GEJ911X Digikey P910JCT-ND 36 2 R5,R R 10K Panasonic ERJ-2GEJ103X Digikey P10KJCT-ND 37 3 R6,R10,R R 4.7K Panasonic ERJ-2GEJ472X Digikey P4.7KJCT-ND 38 3 R8,R11,R R 1K Panasonic ERJ-3GEYJ102V Digikey P1.0KGCT-ND 39 1 R R 470K Panasonic ERJ-2GEJ474X Digikey P470KJCT-ND 40 2 R15,R R 1K Panasonic ERJ-2GEJ102X Digikey P1.0KJCT-ND 41 1 R R 18K Panasonic ERJ-2GEJ183X Digikey P18KJCT-ND 42 2 R18,R R 0 Panasonic ERJ-2GE0R00X Digikey P0.0JCT-ND 43 1 R R 27K Panasonic ERJ-2GEJ273X Digikey P27KJCT-ND 44 1 R R 110K Panasonic ERJ-2GEJ114X Digikey P110KJCT-ND 45 4 TH1,TH2,TH3,TH4 THRUHOLE Not Installed T1,T2,T3,T4,T5,T6,T7,T8,T9,T10,T11,T12,T13,T14,T15,T16,T17, T18,T19,T20,T21,T22,T23,T24,T 25,T26,T27,T28,T29,T30,T31,T3 2,T33,T34,T35,T36 TERMINAL Not Installed 47 1 U1 AT91SAM7S12 Atmel AT91SAM7S128MU Digikey AT91SAM7S128-MU-ND 48 1 U2 TLV320AIC12KTI TLV320AIC12KIDBT Arrow TLV320AIC12KIDBT 49 1 U3 MAX9030AXT+Maxim MAX9030AXT-T MAXIM MAX9030AXT-T 50 1 U4 LMV772MM National LMV772MM Digikey LMV772MMCT-ND 51 1 U5 LT1763 Linear Tech LT1763CDE-3.3 Linear Tech LT1763CDE Y MHZ,FX FOX FOX R22,R R 330K Panasonic ERJ-2GEJ334X Digikey P2330KJCT-ND 54 1 PT1 0402ESDA-MLPCooper 0402ESDA-MLP7 Digikey ND 55 1 PCB, QS-5000 Cimarron Cimarron

58 Chapter 6 Troubleshooting 58 CHAPTER 6 Troubleshooting Installation Hints The QS-5000 must be programmed with your desires before it will work in your system. For data transmissions, the QS-5000 will be keying the associated transmitter and injecting audio data into the radio. It is very important to adjust data out to ensure the correct deviation level. The deviation level should be just marginally below that of voice. Keep in mind that most transmitters have limiter circuitry. Limiter circuits ensure that the radio will never over-deviate and violate FCC rules. The limiter does this by clipping the transmit audio. The output of the QS-5000 must be adjusted to a point just below where limiter clipping occurs. If the limiter is allowed to function, the data will be distorted. Isolating System Problems Today s modern communication systems take advantage of many available resources. Voters, repeaters, various trunking protocols, scramblers and innumerable other devices make passing data substantially more difficult than it was in the Simplex days. Timing is very important. If you have system problems, the first place to spend your energies is with timing issues. Check attack delay in repeater systems. Start with a long delay that gives you 100% decode and then shorten it up. If you have trunking system problems using the QS-5000, review the trunking information located on page 49 of this manual. Equipment Problems Radio Keys and Stays Keyed If the radio sends ANI data and then stays keyed even after releasing the PTT button, verify the condition of jumper JP-12 on the QS-5000 and the programming parameter Key follows PTT. If you have Key Follows PTT enabled or jumper JP-12 connected when they should not be, this symptom could occur. Radio Keys up but stays Keyed only for Duration of ANI This symptom is usually caused by incorrect conditions of the Key follows PTT parameter and QS-5000 jumper JP-12. ID Decoded is not the same as Programmed This occurs when the unit is in GE Star mode and the QS-5000 format is not set the same as the decoder. See page 47 for details. Channel Preferences not the same as Programmed The QS-5000 is capable of being programmed with different parameters for sixteen different channels. In compatible radios, the radio can be programmed for different codes on different channels. The QS-5000

59 Chapter 6 Troubleshooting 59 can use these lines to permit the user to assign, on a per channel basis, different ANI type, ID and inversion parameters as well as crypto keys and frequencies on up to 16 channels. When installing into a host radio with this capability, note the levels on the associated radio pads while changing the channels as some radios label the code lines in reverse order. Also, note the polarity of active lines and use the QuikWare Digital I/O crossbar polarity field to match that of the radio.

60 Chapter 7 Product Support 60 CHAPTER 7 Product Support If you have any questions or comments about Cimarron products, please make use of our technical support hotline at (760) Cimarron Technologies Corporation 934 South Andreasen Drive, Suite G Escondido, CA Technical Support Hot-Line (760) service@cimtechcorp.com WARRANTY Cimarron Technologies Corporation warrants this product to be free from defects in material and workmanship for a period of three years from date of shipment. If a malfunction occurs due to defective material or workmanship, the product will be repaired or replaced (Cimarron's discretion) without charge if returned to the factory This warranty does not apply to any failure or damage caused by accident, neglect, unreasonable use, improper installation, or to alterations or modifications to the unit. Nor does the warranty extend to damage incurred by force majeure (natural causes) such as lightning, fire, floods, or other such catastrophes, nor to damage caused by environmental extremes, power surges and/or transients Cimarron Technologies Corporation makes no other warranty, either expressed or implied, with respect to this product. Cimarron Technologies Corporation specifically disclaims the implied warranties of merchantability and fitness for a particular purpose. Some states or provinces do not allow limitations on how long an implied warranty lasts, so the above limitation or exclusion may not apply to you. The remedies provided herein are customer's sole and exclusive remedies. In no event shall Cimarron Technologies Corporation be liable for any lost profits, direct, indirect, special, incidental, or consequential damages, whether based on contract, tort, or any other legal theory.

61 Appendix A Secure Voice Considerations 61 APPENDIX A Secure Voice Considerations The QS-5000 is designed to permit adjustment of its inversion parameters to meet the security requirements of the user while remaining within the constraints of the communications system and the desired audio quality of the communications. These adjustments allow the implementing facility (radio shop) to get the best audio quality that their communications system and security requirements will allow. This appendix addresses the interactions between inversion settings, system requirements, security level and voice quality. Voice Quality Voice quality is a function of the permitted voice spectrum and the quality of the procedure (and components) that performs the inversion process. The radio transmitted voice spectrum is limited by the actual radio equipment to a band from 300 Hz to 3000 Hz. So normal audio that has not been processed by an inversion scrambler is limited to that spectrum.

62 Appendix A Secure Voice Considerations 62 Voice inversion scrambling takes the frequency component and creates a mirror image around an inversion frequency. This process results in spectrum loss. To illustrate this loss, consider the following examples. Example 1: Example 2: Inversion frequency is 2200 Hz and results in 300 becoming 1900 and 3000 becoming (!) -800 Hz. Radio processing then allows only the resultant spectrum of 300 through 1900 Hz to be transmitted. At the recovery, 300 becomes 1900 and 1900 becomes 300 resulting in a recovered spectrum of A loss of the 1900 Hz through 3000 Hz audio. Inversion frequency is 4000 Hz and results in 300 becoming 3700 and 3000 becoming 1000 Hz. Radio processing then allows only the resultant spectrum of 1000 through 3000 Hz to be transmitted. At the recovery, 1000 becomes 3000 and 3000 becomes 1000 resulting in a recovered spectrum of A loss of the 300 through 1000 Hz audio. After complete processing and radio filtering, low inversion frequencies kill high freq response and makes audio at speaker "bassy" while high inversion frequencies kill low freq response and makes the audio at speaker "tinny". Now, consider example 3: Inversion frequency is 3300 Hz results in 300 becoming 3000 and 3000 becoming 300 Hz. Radio processing then allows the entire resultant spectrum of 300 through 3000 Hz to be transmitted. At the recovery, 300 once again becomes 3000 and 3000 becomes 300. There is no spectrum loss at an inversion frequency near or on 3300 Hz. So, the best audio quality can be obtained by making an inversion scrambler work at around 3300 Hz. The farther the inversion process moves from 3300 Hz, the more the voice quality suffers. But, a scrambler that inverts at 3300 Hz all of the time only provides minimal security from eavesdroppers while providing the best audio quality. Security Level So, there s minimal tactical security to a scrambler that always uses the same frequency for inversion. In many cases, this level of security is sufficient, and it affords the best audio quality. But, resourceful adversaries require resourceful countermeasures. You could periodically change your inversion frequency, always staying around 3300 Hz and maybe avoiding those inversion frequencies used by the most available and common scramblers. The more frequently you change your inversion frequency, the higher level of security you achieve. Additionally, the greater the change in your

63 Appendix A Secure Voice Considerations 63 inversion frequency without any incremental steps, the more difficult it will be for eavesdroppers to continue monitoring your communications. The actual security level achieved by voice scramblers is inversely proportional to their audio quality. Additionally, existing descramblers and their availability to the general public significantly reduces your chances of maintaining tactical security. Scramblers that periodically change inversion frequency are called Hoppers if they go from one discreet frequency to another without traveling through the in-between frequencies. Otherwise, they could be Rolling code scramblers that make a lot of incremental stops while going from one frequency to another. The greater the frequency difference from one stop to another, the higher the level of security. Additionally, the more frequent the change, the higher the security. Now, together, permit random changing of the direction of the frequency shift, random selection of inversion frequency and random period of time before changing, and your tactical security level has been drastically improved. The QS-5000 allows for programming lower and upper inversion frequency limits as well as minimum and maximum dwell times. A dwell time is the time that the scrambler board will use one inversion frequency before changing to the next. All changes are randomly executed as is the subsequent direction of travel. The QS-5000 is capable of being programmed to use inversion frequencies from 2100 Hz to 4100 Hz and dwell times from 10 ms to 1 Second. You can vary these as required for your tactical security environment. Remember that best audio is achieved at 3300 Hz and slower (or no) dwell times. Best security is achieved with large inversion frequency swings and rapid dwell times. The QS-5000 is also uniquely able to change inversion frequency on a per PTT basis so that each transmission uses a different frequency. These unique capabilities give the implementing radio shop previously unheard of flexibility. The inversion process can be precisely tailored to match the requirements of the end-user. But there is still one additional consideration before deciding on values to use. System Considerations Existing voice security equipment provides a particular fixed level of security. The manufacturer has designed multiple model number scramblers with varying levels of security and voice quality. Typically, a system manager would decide which model number to use by analyzing customer requirements balanced with system capabilities. Then they would implement the model that matched those requirements. The higher level of security, the more the manufacturer charges for the board. If the requirements change, or the communications system is upgraded, they are either stuck with the level of security they already have, or they need to replace all security components with ones that match the new requirements. The QS-5000 has been designed so that the security level is software defined. This means that as requirements change, the boards can be simply reprogrammed to once again match the

64 Appendix A Secure Voice Considerations 64 requirements. The same board will do simple, non-changing inversion scrambling as well as high speed random true hopping and everything in between. We have discussed how as voice security goes up, voice quality goes down. But those are not your only considerations when deciding on inversion process parameters. The overall communications system must be capable of transporting your scrambled signals and, in the case of hopping schemes, the data message that synchronizes the process. Complex communications systems may be made up of a wide mix of microwave links, voters, repeaters, landlines and other equipment. These devices result in processing the audio and as such, influence your maximum attainable security level. If the communications system already limits the available frequency spectrum, you will have less spectrum for the inversion process. If you use a too advanced scrambler board (or software defined scheme in the case of the Cimarron board) on a degraded communications system, the resulting voice quality will be unacceptable or the inversion process will not be able to recover the original audio from the scrambled audio. In hopping schemes, if the setup data message is not successfully being delivered through the communications links, then descrambling will not take place. Making it Simple The QS-5000 offers software definable voice security. To make initial scheme implementation easier, the QS-5000 allows the selection of preprogrammed levels of inversion scrambling when configuring the board. These preset levels can be additionally adjusted if necessary for precise system integration. The lowest level uses only one inversion frequency which is never changed. The remaining levels progressively increase the inversion frequency range and rapidity of changing the inversion frequency. These preset levels will provide the system manager with a starting point and a development tool for experimentation if desired. Once a level is selected that meets user requirements, the parameters can then be further adjusted to fine tune them to attain the security level, voice quality and system limitations desired. Level One Level one is the simplest scrambling method and consists of one nonvarying inversion frequency. The inversion frequency selected provides for the widest bandwidth inversion resultant. This provides the most

65 Appendix A Secure Voice Considerations 65 basic level of security. The presence of a setup databurst instructs the QS-5000 to descramble the incoming audio. Level Two Level Three Level Four Level Five Level Six Level two provides basic security using dynamic inversion scrambling where the inversion frequency is changed for every transmission. The inversion frequency range used is centered around sweet frequencies that afford the largest resultant bandwidth and most easily pass through complex communications systems. A different inversion frequency is selected each time the radio PTT is depressed. Level three security uses a wide range of inversion frequencies that is changed for each transmission. This level provides stronger security by varying inversion frequency at a fixed dwell time. This is dynamic inversion scrambling that hops from frequency to frequency. Inversion frequency range is limited. A typical one minute transmission will be scrambled by different inversion frequencies approximately 250 times. Level Five security uses a wide range of inversion frequencies that are randomly selected and used for random periods of time before they are changed. This results in audio that is scrambled by varying frequencies and varying periods. It would not be possible for a listener without the similar equipment and the precise crypto key to synchronize on the scrambled signal. Inversion frequency and dwell time ranges are conservative, affording high security with good audio quality. Level six affords the most secure of the six preset levels. Inversion frequencies between 2100 Hz and 4100 Hz are randomly selected to scramble the transmitted audio. The selected audio is used for a random period of time, changing up to 100 times a second. Even the period of time that the inversion frequency is used is randomly changed. One frequency might be used for 10 milliseconds while the next frequency might be used for 100 milliseconds.

66 Appendix B Snap-In QS-5000 Carrier 66 APPENDIX B Snap-In QS-5000 Carrier The QS-5000 snap-in carrier consists of a break-out board with mating receptacle and latch devices for insertion of a QS Interface wiring can be soldered to feed-throughs on the carrier. This is handy for console applications or bench testing. 2: A+ 1: 3.3V 4: Reset 3: TXD1 6: Erase 5: PA2 8: TCK 7: RXD1 10: GND 9: PA23 12: PA9 11: TDO 14: TST 13: TMS 16: GND 15: TMS 18: TDI 17: PA3 20: USBP 19: RESIN 22: USBM 21: N/C 24: PA4 23: N/C 26: GND 25: GND 2: AFOUT 1: A+ 4: MICOUT 3: AFIN 6: Sidetone 5: MICIN 8: AIN1 7: DiscIN 10: IN1 9: AIN0 12: IN3 11: IN0 14: IN5 13: IN2 16: IN7 15: IN4 18: OUT0 17: IN6 20: OUT2 19: IN8 22: OUT4 21: OUT1 24: PA6 23: OUT3 26: GND 25: PA5