Extracting GPS Data from the Retevis RT8

These notes are largely for my own benefit. My motiviation was pretty simple. I had purchased the Retevis RT8 and, as I am interested in the use of APRS and other tracking technologies for Public Service (AREN), I simply wanted to get the GPS function working.

So with that in mind I started by turning on debugging in MMDVM and see what I could figure out. I posted a question to the MMDVM group outlining my initial findings.

From that, I had some discussions with Jonathan Naylor, G4KLX regarding the UDT Header, and we determined that MMDVM was dropping a frame at the end of each transmission when the GPS was enabled (the fix).

I also came across this thread where Carlos, EB4FBZ had done some work decoding the GPS data from the MD-390.

        Hello Michael, these are my notes in 0 based indexing:

        bit 0: Not used
        bit 1 : 1=N, 0=S
        bit 2 : 1=E, 0=W
        bit 3 : Fix
        bits(4:10): Speed in knots/2
        bits(11:17): Latitude. Degrees
        bits(18:23): Latitude. Minutes integer part
        bits(24:37): Latitude. Minutes decimal part
        bits(38:45): Longitude. Degrees
        bits(46:51): Longitude. Minutes integer part
        bits(52:65): Longitude. Minutes decimal part
        bits(66:79): Altitude in meters, only least 8bits used (bug)
        bits(80:95): Garbage?

        This is working on BM network since 2 weeks ago, i'm pretty sure it's correct. I injected simulated NMEA frames into the radio instead of the real GPS ones and tested each value.

        Best regards,
        Carlos EB4FBZ
      

So with this information I set about figuring out the data stream. This was a pretty much done by brute force i.e. lots of debugging statements.

Firstly I set about figuring out what my RT8 was sending this was the first packet I saw:

      00 05 04 2A 67 29 81 32 00 1B 42 A8
      

Breaking the bytes down further (from left to right) into individual bits (see ETSI TS 102 361-1 - V2.2.1 Page 79), this is what you get:

      00 = 0000 0000  
      Bit  7   = Individial (0) or Talkgroup (1) is the destination  
           6   = Response Requested (1) 
           5   = 0
           4   = 0
      Bits 3-0 = 0000 = UDT Data transport Format is Binary (see ETSI TS 102 361-1 - V2.2.1 Page 109)

      05 = 0000 0101
      Bits 7-4 = 0000 = UDT Service Access Point ID (see ETSI TS 102 361-1 - V2.2.1 Page 103)
      Bist 3-0 = 0101 = NMEA location coded (see ETSI TS 102 361-1 - V2.2.1 Page 109)


      04 2A 67 = 0000 0100 0020 1100 0101 0111 = Destination Logical Link ID = 272999 (Destination DMR ID set in my Codeplug)

      29 81 32 = 0010 1001 1000 0001 0011 0010 = Source Logical Link ID = 2720050 (My DMR ID)

      00 = 0000 0000
      Bits 7-3 = 00000 = Pad Nibble
      Bit    2 = 0     = Reserved
      Bits 1-0 = 00    = 1 Appended Data UDT Blocks 
      
      1B = 0001 1011   
      Bit    7 = 0      = Supplementary Flag
             6 = 0      = Protect Flag (Reserved for Future Use)
      Bits 5-0 = 011011 = UDT Opcode = Unified Data Transport inbound Header (see ETSI TS 102-361-4 v1.7.1, page 252 Table B.1)

      42 A8 = Header CRC which I really wasn't concerned about.   
      

      50 0D 09 98 00 1C 96 50 80 3F C7 B8
      

      50 = 0101 0000 
      Bit    7 = 0 = Encrypted (1), not encrypted (0)         = Not encrypted
             6 = 1 = Latitude Direction, North(1), South(0)   = North
             5 = 0 = Longitude Direction, East(1), West(0)    = West
             4 = 1 = GPS Quality Indicator Fix (1), No Fix(0) = GPS Fix
      Bits 3-0 = 0000 = Top 4 bits of the Speed in knots
      
      0D = 0000 1101
      Bits 7-5 = 000   = Bottom 3 bits of the Speed in knots (127 = Greater than 126 knots)
      Bits 4-0 = 01101 = Top 5 bits of Latitude Degrees 

      Speed = 0000000 = 0 Knots

      The notes from Carlos, EB4FBZ suggest that this is knots/2. I haven't had the opportunity to test this yet.
      
      09 = 0000 1001 
      Bits 7-6 = 00     = Bottom 2 bits of Latitude Degrees (0-89)
      Bits 5-0 = 001001 = Latitude Minutes (00-59) 

      Latitude Degrees = 0110100 = 52 Degrees
      Latitude Minutes = 001001  = 9 Minutes
      
      98 = 1001 1000     = Top 8 bits of Latitude Fractions of minutes 

      00 = 0000 0000 
      Bits 7-2 = 000000  = Bottom 6 bits of Latitude Fractions of minutes (0000-9999)
      Bits 1=0 = 00      = Top two bits of Longitude Degrees

      Latitude fractions of minutes = 10 0110 0000 0000 = 9728

      1C = 0001 1100
      Bits 7-2 = 000111  = Bottom 6 bits of Longitude Degrees (000-179)
      bits 1-0 = 00      = Top two bits of Longitude Minutes
      
      Longitude Degrees = 0000 0111 = 7

      96 = 1001 0110 
      Bits 7-4 = 1001 = Bottom 4 bits of Longitude Minutes (00-59)
      Bits 3-0 = 0110 = Top 4 bits of Longitude Fractions of minutes 

      Longitude Minutes = 001001 = 9

      50 = 0101 0000 = Bits 10-3 of Longitude Fractions of minutes

      

At this point the Radio appears to diverge from the specifications as per the notes from Carlos EB4FBZ and I'm taking the next 14 bits as Altitude in Meters which appears to be correct so far. I never tested what happens when the altitude is negative.

      80 = 1000 0000 
      Bits 7-6 = 10 = Bottom two bits of Longitude Fractions of Minutes (0000-9999)
      
      Bits 5-0 = 00000 = Top 6 bits of Altitude
      Longitude fractions of minutes = 0110 0101 0000 10 = 6466

      3F = 0011 1111 = Bottom 8 bits of Altitude   

      Altitude = 00 0000 0011 1111 = 63 Meters
      

So fully decoded that gives:

• Speed = 0
• 52 9 9728 = 52.1662N
• 7 9 6446 = 7.1607W
• Altitude = 63 Meters