Repair: Soyoung S-C18 Soymilk Maker

This weekend, a friend of ours had a small emergency – her soymilk maker stopped working and was completely dead. The particular unit was a Soyoung S-C18 which claimed to be a unit specially made by Joyoung for the Australian market. Accordingly, it seemed to have the appropriate regulatory labels and claimed to be for 240V input – definitely something which we appreciate as many Chinese appliances which are 220V rated tend to fail early. This unit had already run for five years and had definitely done its time, being used at least weekly. Having to buy a new unit was a distinct possibility, but as usual, we are reluctant to dispose of anything until the cause of death is found or we have determined that it would be uneconomical to repair.

The Unit

The unit looks a little like a jug from the side, with some gold accents on a white body.

But once you look at the top, you realise it’s something more sophisticated. There is a sturdy handle and the top panel has a few buttons and clear areas for LED indicators to shine through. On the side, there is an input for an IEC kettle lead.

Pulling out the top unit, we find the bulk of the weight in this section. There are sensor stalks – one for water level, another for boil-over detection and a hidden temperature sensor. The plastic top section joins to a guard …

… which covers the blade and serves to “funnel” the beans into the blade in order to ensure a smooth result. After all the accumulated use, the blade and several other sections exhibit some staining.

The top unit detaches completely from the base but has a four-pin electrical connection with the base. This is because the IEC lead goes into the base, and the base itself also contains a heating element to boil the liquid from below. As a result, I’m guessing there’s a live, neutral, earth and switched heater output that comprises the four connections.

The plug goes into the corresponding socket in the handle and that’s about all there is to see. I’ve never seen or used a soymilk maker, so this was a rather new experience.

Teardown Diagnosis

Before even opening the unit, I felt its prospects may be quite limited. Just rotating the top unit resulted in some rattling noises, which I suspected meant that there were blown component parts jostling about. Many times, this indicates a catastrophic failure with some possible collateral damage. The only way to confirm this was open surgery.

Luckily, the unit is made with screws – these line the perimeter where a silicone gasket seals the top. Unscrewing a large number of screws frees the trim and the top part from the base. Immediately, black gunk spills out and the inside is ashen.

There was evidence of water ingress, as the screws for the top control panel and controller module had rusted quite visibly. Because of this, I decided it was not a good idea to open that section unless everything else checked out, as the screws would almost certainly crumble.

The gunk that spills out looked rather dark, like charcoal, but had a very rough shape and didn’t resemble any component. Seeing that there was a motor, I wonder if the motor had burnt out and brush segments were being thrown everywhere. A seized motor could cause a fuse to blow, resulting in the “dead” symptom.

The first card I paid attention to is this power control board.

Dated Week 20 of 2013, it marshals power around the unit – supplied with mains, forwarding that onto a transformer, receiving power from the secondary, rectifying and regulating it, sending it to the controller top panel and containing relays that switch the power to the remaining components (e.g. heater, motor). It also has a beeper for feedback. The carbon coating was quite severe, with the white “ice cube” relays being turned into a dark grey. Parts of the board, especially the underside, was coated in silicone conformal as if they anticipated moisture ingress, in order to prevent any possibility of short circuits. However, such a carbon coat is concerning as it could provide enough conductivity for a “flashover” or tracking, with occasional complaints of RCD tripping pointing towards a fault within this appliance.

That being said, I spotted no missing components and nothing obviously stressed. A good start, although I couldn’t be certain that the relays hadn’t welded. But because of the conformal coating, I couldn’t test them easily, so I left them alone. I tested the onboard fuse in the shrink wrap – it was still continuous, which is another good sign that the unit didn’t go thermonuclear.

Onto the next board on the side and this is merely just a motor EMI filter board. This is connected in-circuit with the motor using spade connectors and seems like it could be omitted for cost savings in some other markets. Regardless, I tested across the unit and it was showing continuity as well – so the filter didn’t burn out.

Moving down to the transformer, this was a “classical” E-I core transformer. Linear transformer bricks are almost as reliable as bricks, so I didn’t expect much to be wrong, but there was slight corrosion on the steel consistent with moisture exposure. To be safe, I decided to check both coils were continuous and that was when I realised that the primary was open! This seems likely to suggest a thermal fuse may have tripped, so why did it fail? Was it something that had failed on the secondary, keeping the secondary shorted?

The loss of this transformer will cause a dead unit as this unit is responsible for producing the supply that runs the controller and relays. The transformer has a strange 240V to 11V rating at 160mA – I suspect this may have been a relabelling of a 220V to 10V transformer, but because of its strange rating, it seems almost impossible to get a direct replacement. However, it does suggest that it could have been running a bit warm because the higher AC voltage in Australia would cause higher amounts of core saturation.

This still leaves the carbon chunks and gunk unexplained, so I went further in disassembling. For this, I needed to get the motor out, which required removing the blade funnel, undoing the captive nut, removing the blade and washers, then removing two screws, a protective plate, a gasket and another two screws from the front.

The result was this 180W motor from Wolong Electric Group which had slightly unsmooth rotor bearings, a smooth commutator with sufficient brush carbon remaining and lots of gunk.

Looking from the front, especially where the motor fan is, there is evidence of water ingress, rust and accumulation of soy bean which is in various states of dryness – from brown paste through to black goo and black “hard” lumps. With some careful prodding, I was able to dislodge the majority from the motor without damaging the windings.

Given all the evidence, my hypothesis is as follows:

  • Earth leakage breaker trips occurred on this unit primarily due to liquid from the soy milk chamber being drawn up the motor spindle due to capillary action especially near the bearings as well as due to temperature changes due to heat causing steam to be inducted as well. This liquid contains suspended solids which remain behind in the motor assembly and accumulate over time while the water slowly evaporates and dissipates, possibly assisted by the heat of the motor operating in an enclosed environment. Between cycles, some of this accumulated solids dry out sufficiently and combine with the loose carbon evolved from the wearing of the brushes against the commutator and rattle “freely” within the upper unit. The solids that do not, however, can re-accumulate new moisture on a run, which causes a possible bridge of the rotor winding current (e.g. through a nick in the enamel insulation) to ground (the motor chassis) – if the leakage current is high enough, then the earth leakage breaker trips.
  • An alternative explanation would be due to carbon accumulation and tracking. A minor flash could have occurred in the past clearing the conductive path temporarily.
  • The transformer itself may have been a 220V unit relabelled and may have been running hot. As the top unit is sealed, all the heat generated is not easily dissipated especially since the boiling liquid is underneath adding heat into the unit during a cycle. The accumulated heat could lead the transformer to operate close to 100 degrees C throughout its life, stressing the thermal fuse in the primary winding. This would eventually open resulting in a loss of power to the control board, resulting in a seemingly dead unit.

From looking at the design, it’s actually a very tough environment to operate in and the design has a number of downsides. The sealed environment causes heat accumulation which would stress electronic components and even the motor itself. A brushed motor generates carbon dust which is conductive and can cause tracking or short circuits – with a sealed unit, the dust has no chance to escape (unlike in a power tool for example). The remaining components go through severe thermal stress in each cycle. Given the large air void and sealing gaskets, it is inevitable the air will be “purged and sucked back in” in every cycle which would encourage liquid ingress. Further, the motor’s rotating shaft has to go right into liquid through a bearing – another area where liquid ingress is inevitable. As a result, it seems the design was made with a few features to make sure it would last long enough to survive the warranty period … but not indefinitely.


Owing to the short “overnight” timeframe I had with the unit to repair it, I didn’t take many images, but the repair process was a multi-step procedure.

The first was to clean the motor and check its insulation resistance using my Keysight U1461A. Measuring from both poles to the grounded frame, a consistent 66Mohms was recorded in the “dry” state. While this isn’t the best reading, it’s still sufficiently high enough to declare the motor safe to use.

The next step was to attempt to ascertain whether the controller was still alive. I analysed the circuit and determined that the power marshalling board takes the AC from the transformer and puts it into a full bridge rectifier made of four discrete diodes (and then does more regulation). As a result, I felt it was safe to apply DC in any polarity at an appropriate voltage. Using my Keysight E36103A Benchtop Power Supply, I applied 9V DC and saw the top panel light up and the beeper emitting a continuous tone. The current consumption was 50mA or thereabouts, which left me satisfied that the control board had not completely died, but not knowing how to use the unit and not being able to activate it with any buttons (to check the relays), I decided it was worth repairing further to test.

I obtained an old 12V 400mA DC power supply from my wall wart junk box and gave it a good squeeze in my bench vise. This freed the transformer, to which I desoldered the rectifier and joined the original wires to, followed by a layer of heatshrink.

While 12V is slightly higher than the 11V and 400mA rating under 50mA load will probably result in an even higher voltage, this was “available to hand” at almost nil cost, so was the preferable choice compared to trying to obtain this 9V (lower) or 12.6V (higher) alternative from Jaycar. The upside of the Jaycar options is that it could probably be mounted correctly in the original holes – this one is a little larger, so I had to cut a little plastic. Not being designed to be mounted in the same way, it had no frame around it – so I had to glue it with hot glue and pad up the excess room at the top with bubble wrap as I expected the glue to soften in the hot state.

Once repaired in this way, the unit was quickly tested on my inverter current limited supply. It powered up to the same constant beep … which I suspected indicated an error. I couldn’t read the Chinese manual, but I suspected it was complaining of a lack of water. After filling the bottom, it powered up with a short beep and was ready to run. Success! As the inverter couldn’t handle the 700W heater and ~180W of the motor and control mechanism, I reassembled the unit for a full mains test but not before giving the insides a thorough wipe to try and clean off as much carbon deposit as I could.

After reassembly, we ran the unit with just water with some strange results. It did, however, give the unit a good clean. Afterwards, we ran it again with soy beans and it performed correctly – finishing a full cycle and giving us another jug of “fresh” soymilk.


I had never seen a soymilk maker, so having the chance to take it apart for repair was a new experience.

Ultimately while the unit was taken down by the loss of low voltage AC to the marshalling board and consequently the controller, the carbon build-up was potentially dangerous and the dried soybean residue at the front of the motor was likely to have been the cause of prior earth leakage breaker trips.

The concept of a soymilk maker designed in this way actually puts a lot of stress on the components and it seems quite impossible to ensure its reliability in the long term. The fact that we have had five years of service from the unit seems rather surprising given what was found within the unit – but after a repair, I suspect it won’t run for quite as long as the bearings will get worse, other components may become heat damaged, the brushes may become completely consumed and the gaskets may get looser resulting in increased liquid ingress rate.

At least this one lives to see another day …

Posted in Electronics | Tagged , , , | Leave a comment

Project: Scanning the Orion DMR Network (Kurrajong Heights Base)

I was sitting in my room the other day and something seemed off. It was quiet. Too quiet. But why? As it turns out, I used to have a scanner radio active in idle times to listen to what was happening in the community around me. Listening to transit officers and RMS on the NSW GRN, and Sydney Buses would provide an interesting view of what was happening on the roads and tracks without leaving the comfort of my own room while I did some work.

With my recent overseas travel and change of scenery, things haven’t been quite set up in the same way as they have been in the past. As a result of ACMA’s rejig of the 400Mhz band, the radio landscape had changed to (almost all) digital trunked voice systems with new frequency allocations. All those memories in my scanners were now picking up nothing but the chugging of digital FSK signals. Even the NSW GRN doesn’t seem to have the same level of activity it once had – the transit officer talkgroups are nearly silent with an occasional radiocheck. It seems the “new” transit officers might rely on mobile phones instead, or there really isn’t any transit officers “connected” to my local GRN base so I’m not getting the transmissions.

But I wasn’t going to give up – in my new area, I really wanted to listen to the local bus operator (Busways) as I was convinced there was still some good listening to be had, so I spent some time to find them on the air.

The Quest for Busways

The first thing I always do is just to search the ACMA RRL. The first thing I tried was to find a client containing “Busways”. No dice. Knowing that Busways operates out of Glendenning, I tried to search for licenses in that postcode – but there was no clear indication of any such entity. It seems that I might have been too late to catch the trail and follow it … so I had to take a different approach.

I grabbed my IC-R20, still programmed with the old frequencies and found the Busways Blacktown frequency from it – 488.5500Mhz. Who might be using this frequency now? I downloaded the whole 400Mhz transition band table from the RRL (rather than the even larger full dump) to take a search.

There were two results – one for Gearhouse Broadcast Event Communications, the other for Mastercom. The first one has “Sub-Local” coverage, which is probably too small, especially from Mascot so I decided it was irrelevant. However, Mastercom proved to be more interesting …

Mastercom and the Orion Network

In the end, the fingers pointed towards Mastercom, a radio communications solutions provider in Granville (which I used to pass everyday by bus on my way home). They do a lot of work installing radios for many customers – trucks, utes, vans and buses. I figured that while most bus operators may have had their own licensed radio repeaters in the past, the transition to digital might have required external help and it seems that Mastercom may have taken the opportunity to change the way the service is provided.

A look at their site shows that they are a key part of the Orion Network, a DMR network based on Motorola’s MOTOTRBO Connect Plus technology covering most of the capitals in Australia. Mastercom is responsible for the deployment in the Sydney area. As a result, if we’re looking for potential Orion Network DMR network frequencies, we’ll have to be on the lookout for Mastercom’s licenses. From what I can tell based on ACMA’s site location map, there are quite a few sites, but not all of Mastercom’s licenses are DMR, so all that we can conclude is that at least some of these sites are running DMR.

Based on the information thus far, I suspect that Mastercom and Busways may have been involved in the past – maybe Mastercom was responsible for installation and maintenance of radios but the repeater license was owned by Busways. Upon the transition, I suspect the original frequency allocation was “returned” to Mastercom from Busways and a number of other companies so as to create a “pool” of frequencies which could be used to deploy a trunking system that better utilises the spectrum for the benefit of all. In return, Mastercom would be responsible for the licenses.

Because of the flexibility of the DMR trunking system, having frequencies all over the place with different input splits is no problem. This is probably why the frequencies aren’t “evenly spaced” as like in the NSW GRN network, or even in one “clump” as you might otherwise expect. This might create new propagation or performance difficulties, but additionally, it means that any receiver will need to tune across a wide frequency band to catch all the possible trunks. Good luck capturing everything with one SDR!

Receiving the DMR Connect+ Network

Knowing that the Orion DMR Network is probably my target, I tried to see what information is available. Sadly, the RadioReference database is so anemic that it’s almost useless in NSW – the bases have only the control frequencies listed and talkgroup listings are almost non-existent. As a result, I decided to start from scratch – something I haven’t done before.

Step 0: Get your SDR out and set up!

I’m going to assume you have an SDR and it’s set up and ready to go. Ideally, you will also have virtual audio cable software available to route SDR output into a decoder and an SDR package that can demodulate NFM without audio filtering. If you don’t have this, you could still manage this with a quality scanner with discriminator output into a sound card, but the setup is often a bit more finnicky to get good decodes. Personally, I prefer SDR# for initial scoping.

Step 1: Find a good DMR (or P25/NXDN/IDAS/etc) control channel

Rather than focus on the frequencies offered by the licenses, I took the reverse approach to look at what was on the air using my BladeRF SDR instead. There’s really no point trying to focus on existent systems if you can’t hear them! Trunking control channels are continuously broadcasting, making a constant “chugging” noise.

On a spectrogram, it looks like a peak with a periodic waterfall signature. Sometimes it’s not obvious which mode this might be, so having a decoder handy is the only way to make a positive identification and extract relevant metadata from the system. There’s a good chance you might have stumbled on a trunk frequency (in which case, the transmission ceases after a while) or a different mode (i.e. from another system, e.g. P25, NXDN, IDAS).

For reference – 492.5750Mhz is the main control channel for the Orion Network’s Kurrajong Heights base station. A recording of the control channel signal sounds like this.

Step 2: Firing up a decoder

To decode a majority of the digital voice systems, you can use DSDPlus. This software was an extension of an older software called DSD that only decoded digital voices. The new software also manages the trunking data and has been released openly with version 1.101 from 2015 being the currently offered version.

Because of the questionable legality of software that implements decoders for a number of digital voice modes, the software may be illegal to distribute in its binary form (or maybe even to use) depending on how this decoding is implemented and whether it infringes on patented methods. As the source code is unavailable and I am no expert on voice compression, it’s not something I can determine. Regardless, I’m no legal expert, so use the software at your own risk!

In my case, for educational/hobby/personal home use and evaluation of the systems on the air, I don’t see it being a major issue. It might even convince me to buy a scanner for it … although I suspect the prices are still going to be a sore point.

Apparently, there are newer versions of the software that have better features, known as DSD Fast Lane which requires payment – this only makes the legality issue even more murky and as a result, even though I might like some of those features, I don’t think it is right to pay for them as now profit can be considered to enter the equation. Despite this, it still seems to be under active development.

If you have a DMR control channel, you should see something similar to that above. If so, congratulations! As DMR carries two timeslots per frequency, we can see that slot 1 carries the system trunking data, whereas the second slot is idle. This site is named 1-10, and adjacent sites are listed as 1-2, 1-6, 1-7 and 1-8 (for radio roaming). You will notice that no frequencies show up and the trunked system “dimensions” are unknown –

Over time, the number of channels will become clear as calls “light up” each channel/slot in sequence, but the talkgroup IDs and radio IDs are still very much anonymous. There is still much to be done before you can have an enjoyable listen to the DMR system.

But before you go any further, I think it’s a good idea to scan around and note down all the active digital frequencies – things like system type, ID, neighbouring sites. This will allow you to better determine the strongest site and whether there are alternative base stations belonging to the same system and either use or ignore them.

In my case, I was able to detect a neighbouring base (1-6) on 496.625Mhz which belongs to the Orion Network’s Horsley Park base station. The signal was fairly good, but the Kurrajong one was slightly stronger, so I opted to stay.

I also found a DMR Tier 3 system on 504.0875Mhz named “H3-1.7” and one on 504.2875Mhz named “H3-2.3”. Both seem to belong to Mastercom as well, the first at Horsley Park and the other at Kurrajong Heights. This seems to imply there are separate DMR networks for individual users who might not want to share a trunked system with other users – possibly for quality of service concerns.

There was also an NXDN system named E200-7 (with neighbours of -6,-8,-9) on 486.575Mhz. This probably belongs to Vertical Telecommuncations and is part of the Vertel Team Talk NXDN system. Radioreference knows of the system, but there are no talkgroups listed.

There was also an IDAS system, although I misrecorded the frequency – I guess I’ll have to go for a scan for it later. This is aside from the regular clatter of the NSW GRN which has a bucketload of APCO P25 bases.

Step 3: Determining the per-trunk frequencies

The next difficulty is to understand which frequencies belong to each voice channel. To get started, it would be wise to look up the RRL to find which site the control channel belongs to – then find all the frequencies belonging to the licensee at the site. This gives you a list of potential candidates.

Then, it’s a game of waiting to see the channel light up on the DSDPlus decode display, while noting which frequency seems to have activity which matches – when DSDPlus says a transmission is on, there’s “burbling” and when DSDPlus says it’s inactive, the channel goes quiet soon after.

However, DMR has one additional trap (or help) – because of its slotted nature, pairs of channels share the same frequency. Channel 1 and 2 share the same physical frequency, as does 3 and 4, as does 5 and 6 and so on. This can reduce your need to monitor substantially. In the case of the Kurrajong base, the system has 14 voice trunks, corresponding to 7 frequencies. The control frequency is known, and is always the first slot on that frequency, so that narrows it down to 6 to determine.

The best time to do this particular exercise is when the system is busiest – weekdays during business hours are a sure bet. Then you need to key the data into DSDPlus by modifying the frequencies file. You only need to create an entry for each two channels – while it is possible to enter the repeater input frequencies, doing so does not affect the operation, so I just entered the same frequency as the repeater output.

Step 4: Begin Trunked Monitoring

Now begins the fun part – once the system is ready, then you can begin monitoring. However, there are a few problems with DSDPlus that can make life difficult. The first is that it supports only the RTL-SDR and Airspy as inputs – so the easiest way is to grab two RTL dongles and have them connected to decent antennas.

The second seems to be that the software has batch files to run the CC (control channel) and VC (voice channel) receiver instance, using FMP to receive the audio from an RTL over TCP. The inter-process communication between the CC and VC instances is via files on the disk – .traffic and .tuned files. Unfortunately, it seems that for some reason, this doesn’t work on Windows 10. If you try, you might get .traffic files generated and removed on each call, but the VC instance is blind to it. The only way around this was to run it on my older Windows 7 machine where this worked just fine.

The third, and arguably the most annoying, was discovering that the FMP tuning routines have a bug.

Once I had my frequencies configured, all calls were being received correctly except for one pair of channels – those that ran on 507.4125. When a tune is requested, we are “off frequency” every time.

I verified with my IC-R20 – the frequency I keyed is correct. If I nudge the tuning on FMP, I could never get the tuning to be right for the channel – it would jump from being severely below or above the DMR carrier and couldn’t sit right on it.

I thought this might end my monitoring enjoyment, until I dug into the literature, and discovered it was possible to swap the I/F location from low-side to high-side injection by pressing I on the keyboard into the instance of FMP. By running high-side, the frequency compute routine seems to be correct and all 14 channels are decoded correctly! Also of help is the C/c keys which allow you to tweak the RTL crystal ppm compensation to ensure your signals line up correctly.

If you’ve gotten this far and your audio is correctly configured, then you should be listening to some digital voice. The quality of the decode is highly dependent on the signal input, but seems to be a little below that of a legitimate radio, as expected. A lower audio quality is expected as digital vocoders are tuned for voice only, background noises causing intelligibility issues. That being said, occasionally you might get some “stuttery” audio, swimmy sounds, echoes and transmissions which seem to be decoded as “unvoiced”, resulting in a sound like someone who has lost their voice is talking into a radio. It’s not always the fault of the program, but it seems to be the expected result.

From here, you can make your listening more enjoyable by modifying your .groups and .radios file to reflect the users and changing the priority of each group (as you are only decoding one voice transmission at a time).

But remember – most trunking systems have “deliberate” features which can make things hard for you. One of them is the fact that the control channel alternates on a daily basis between the primary control (Ch1) and alternate control (Ch3) in this system. The change happens around 2am and DSDPlus isn’t smart enough to change on its own. You could use a conventional scanner radio with a power-based squelch to provide the control channel to automate this, or (the hard way) retune the control channel FMP instance every night before you sleep.

Talkgroup Mapping

So who uses the Orion Network around here? A lot of listening had to be done to try and find out. Luckily DSDPlus records per-call files, so I monitored from 3rd to 13th August 2018 for a period of 10 days. Only talkgroups with over 300 calls had their recordings reviewed for identification, as a talkgroup averaging 30 calls per day would be very “boring” to listen to on its own. Because very few companies would say their own names over their own channels over the air, I had to make some inferences from information provided – the talkgroup identification isn’t going to be 100% but should be decently close.

Talkgroups Identified:

  • 15011 – seems to be related to Vehicle Recovery.
  • 44990 – Football Tournament, but suspect it is a rental talkgroup along with 44991-44993.
  • 170004 – Transdev NSW (Kuringai) with associated 170000-170003. Radio ID 170838 belongs to Kuringai Base, the give-away was some route numbers which they operate. Radio IDs of 16xxxx where xxxx is the bus number.
  • 203998-203999 – Boral Concrete.
  • 217599 – container transport company.
  • 218496 – Bingo Industries St Marys.
  • 218497 – Bingo Industries Auburn.
  • 218498 – Bingo Industries Ingleburn.
  • 218499 – Bingo Industries Revesby.
  • 218990 – Metromix Concrete (?) – talk about decorative coloured concrete in Seven Hills making this the likely candidate.
  • 219299 – pallet truck deliveries.
  • 220320 – soil and clay, with Arabic language.
  • 220499 – BNP Securities as they mentioned securing Rosebank College for which they are the security provider.
  • 220599 – Cumberland Coachlines – talk of mini charter bus.
  • 223699 – security (maybe MSS? Wilson?) – likely whoever does UNSW as talk of Robert Webster Building.
  • 223801 – Busabout – Narellan depot.
  • 223990 – container delivery company.
  • 224090 – VISA Global Logistics (?) or other container delivery company, as one driver said “should I take it back to VISA?” but in that context is unclear whether that is just the source or the company’s own depot.
  • 226598 – St Marys based skip bin operator.
  • 249991 – Busways Blacktown – main channel, radio IDs of 24xxxx where xxxx is bus number.
  • 249992 – Busways Penrith
  • 249993 – Busways Mulgrave
  • 249994 – Busways Wyong – also likely related to 249996.
  • 260001 – Transit Systems Smithfield, with radio IDs of 25xxxx where xxxx is the bus bumber.
  • 260002 – Transit Systems Hoxton Park – also likely related to 260004.
  • 280001 – Hillsbus (Dural) – likely related to 280000, 280002, 280007, 280008, 280010, 280012, 280014, 280023 as well. Radio IDs of 27xxxx where xxxx is the bus number. All Hillsbus channels use Radio ID 280700 for either the base, or OCC (operations control centre).
  • 280004 – Hillsbus (Parramatta).
  • 280005 – Hillsbus (Northmead).
  • 280006 – Hillsbus (Special Event/Olympic Park).
  • 280010 – Hillsbus (Valley Heights).
  • 280013 – Hillsbus (Auburn).
  • 281498 – School Charter bus.
  • 281699 – clay and topsoil.
  • 281899 – vehicle transportation.

Surprisingly, the listed 228059 talkgroup on Radioreference didn’t light up even once in the ten day monitoring period. As a result, I suspect a lot of the data available is just out of date! However, this list in itself is pretty impressive, considering this is just a 14-channel trunked system.

The Orion Network in Action

Watching the trunk status and seeing them light up and fall away is quite hypnotic, almost like watching a telephone switchboard (not that these really exist anymore). What follows is a speeded-up screen capture over about an hour of operation.

The Orion Network does get fairly busy during certain periods – I’ve seen the control channel occasionally drop out as it gets used as the channel of last resort to carry a last voice trunk.

But an extra channel can be added to the system as long as they get the license for it and the radios are told about what frequency it is.


Getting yourself set-up on digital trunking isn’t exactly a walk in the park compared to the analog days when you could just punch in a frequency and begin listening right away. Now you have to contend with setting up software, configuring frequency maps and talk-group/radio ID data/priorities. That’s assuming everything works as expected in the first place – when you discover a bug along the way, then you’re banging your head against the wall. Audio quality seems to take a hit as well, but something to listen to is better than nothing even if it might be legally problematic. There really isn’t any viable alternative, especially not one that can give you access to the system metadata in the same way to actually discover what is there to listen to.

After spending a few hours intensively reviewing recordings, I was able to identify quite a few talkgroups. As I was interested mainly in Busways, it was a nice find to see several private bus operators in a similar region also on the Orion Network, so I can hear them as well.

In fact, I was listening to the bus drivers and their difficulties during the recent rail meltdown – sometimes hearing things behind the scenes shows just how much of a struggle it is to keep the system going under extraordinary circumstances. Other times, it’s just plain fun to hear drivers report kangaroos, emus, cows on the road as well as commuters trying to ride the bus with bikes and even bed frames!

Posted in Radio | Tagged , , , , , , | Leave a comment

Tech Flashback: Radio Scanning (feat. Uniden UBC93XLT, DSE DTS-96, Icom IC-R20)

Towards my later high-school years, in the mid-2000s, armed with a small amount of money, I picked up the hobby of radio scanning. As a person who was curious by nature and had built a number of FM radio microphone “bug” kits, I always wondered exactly what was going on “behind the scenes” – what were those employees on their handheld radios talking about? For a modest outlay of about AU$300, a radio scanner promised to let you into this “secret” world, kind of like “gossip for nerds”. While it was already late in the days of the scanning hobby, there were still many transmissions worth listening to.

What is “Scanning”?

The hobby of scanning is pretty much named after the “scanner radio”, aptly named due to its scanning mode of operation. Unlike a regular broadcast receiver, or a handheld radio transceiver (sometimes known as a walkie talkie) that would be set to a channel and stays on that channel, a scanner radio is configured in such a way that it has a number of channels (e.g. by having a crystal bank or programmable PLL/VCO synthesizer) which it scans across, only stopping when it receives a signal strong enough to break the squelch.

As most professional radios are only used in case of an immediate need to pass messages, the channels (simplex or repeater output) often remain quiet for a lot of the time. A radio that only listened to one channel wouldn’t be much fun because it’d be silent most of the time. As a result, the scanner allows you to monitor multiple systems (e.g. police, fire, ambulance, delivery drivers, taxis etc) by tuning rapidly between their frequencies and stopping only when it receives a transmission. When multiple simultaneous transmissions are occurring, you will miss one (or the other) transmission, but this was an “acceptable” trade-off compared to sitting in silence or having an (expensive) radio for each frequency!

The transmission frequencies used for these professional radios are outside those normally used for broadcast and use much narrower modulation modes, lower transmission powers and can also convey low-speed data using various modulations (e.g. paging). This is why a specialist radio is needed, however, due to the state of radio technology in the early 2000’s, most transmissions were still analog narrowband FM in commercial bands, so all you needed to get started was the frequencies that a given organisation uses!

Back in those days, wide bandwidth SDR receivers were not a reality – even the computing power needed to realise the DSP computations needed to handle multiple channels simultaneously were too taxing for many home computers. It was not until 2010 that I obtained my first 2Mhz-bandwidth SDR which was enough to stress out even a decently specced dual-core Intel Centrino Duo T2300E-based laptop on a single channel decode!

Uniden Bearcat UBC93XLT Scanner

My first scanner was actually the prior model – a UBC92XLT, however, I ended up selling that off as surplus to needs while keeping the UBC93XLT which I purchased second hand at a good price. To my knowledge, the two units shared identical specifications, with the exception of an updated included radio frequency database CD-ROM. While a big deal is made about their inclusion, those CD-ROMs were woefully out of date – it was just more useful to look up ACMA’s Radiocommunications Register directly for the frequencies we needed! Otherwise, you could just do a blind sweep of the frequencies hoping to catch a transmission …

The UBC92XLT and UBC93XLT was sold as a whole retail bundle including a frequency database CD-ROM, “rubber ducky” antenna, earphones, rechargeable batteries, a car cigarette lighter adapter and a power adapter for about AU$300 in Dick Smith Electronics. This model was the “upgraded” UBC72XLT which featured support for the UHF band, making it a little more expensive but was something I felt was good to have. It had a 200-channel memory separated into 10 separate banks, support for 25-88, 108-174, 400-512, 806-956Mhz frequency ranges and “close call” capture of high-powered nearby transmissions allowing for detection of unknown frequencies. There were also pre-programmed service search banks for police, railroad, air, marine, UHF CB and AM CB, although these weren’t exactly that useful.

The front of the unit had a keypad, with most buttons having more than one feature that can be accessed by using the Func+ key combinations. This was already considered slightly complicated by some due to the segment-LCD display being slightly unintuitive to operate. The speaker in the unit is also in the front, although often when out and about, you’d rather use the headphone output.

On the rear, there is a belt clip that allows for you to conveniently wear the unit when out and about. I have also modified the unit to provide the “discriminator output”, basically an unfiltered output from the demodulator for use with data signal decoding over the sound card. The battery compartment door can be completely detached, with the scanner running on 2xAA batteries. An internal switch controlled whether the unit would attempt to charge the cells or not.

The side of the unit has the DC barrel jack input for a 6v 500mA power supply that can charge the batteries and run the unit at the same time.

The top of the unit has a BNC connector for antenna input. It also hosts a 3.5mm headphone socket wired for use with analog and stereo plugs – however, this arrangement caused stereo headsets to have two channels “anti-phase” which wasn’t the best. Two knobs are present – the squelch and volume controls.

The unit was a relatively basic model, but it was quite a robust model which served as a good introduction to the hobby. I wore it around from time to time, getting curious looks from some and being mistaken as a “security officer” by others. It was rare, although not impossible, to come across another scanning enthusiast from time to time but this wasn’t a particularly exciting unit.

When it came to scanners, there were a number of metrics used to compare them – the most important includes the frequency bands supported, the sensitivity of the radio receiver (e.g. 12dB SINAD value), the number of memory positions, the scanning step rate and modulation modes supported. As a rather basic unit, it didn’t feature a stellar specification in any regard, but the biggest limitation was that of the sensitivity. I found that even with an aftermarket antenna with higher gain, many signals were noisy/scratchy. For home use, this wasn’t as big of an issue as the location can be tuned carefully, but when mobile, it can get difficult.

The biggest problem was that the radio market was just beginning to change at this time with the introduction of trunking systems using hybrid digital modes such as Motorola Smartnet, transitioning to full APCO P25 in later years, LTR, MPT-1327. Listening to trunked networks with a conventional scanner was difficult, as the base station changes the output frequency on a rotating basis, so following a complete conversation over multiple overs became difficult especially if the “break” between overs was long enough for the trunking controller to relinquish and reallocate a new channel. I was also getting into amateur radio, so the lack of any SSB modes was also not optimal.

Regardless, this model was enough to begin to listen to a lot of signals – the ethnic radio band, aviation band, transmissions from buses, taxis, amateur radio operators and CB radio users. It was also what introduced me to POCSAG pager decoding, ACARS decoding and P25 trunking system control-channel decoding. After I had this taste, I decided to take things further.

Even after it became less useful to me as a scanner radio or a signal source for decoding, there is a “hidden” button combination that enables a frequency counter mode, so it can be used to check an RF device for its output frequency.

Dick Smith Electronics DTS-96 Digital Scanner

With the evolution of radio towards digital technologies, the most important local radio system was the NSW Government Radio Network which hosts all of the fire, ambulance, roads and transport officer staff to name a few. This trunked system began as a Motorola Smartnet 3600bps system, making monitoring using a regular conventional scanner rather frustrating, but began transition to a P25 system with 9600bps C4FM transmission instead. To listen into these required an APCO P25 capable scanner.

I wanted to purchase a Uniden UBCD396XT “Trunktracker” scanner, but I wasn’t able to secure a good price on those, so I ended up buying a DSE DTS-96 second hand instead for about AU$300. This was a GRE/Radioshack Pro-96 rebadged for the local market, with a large boxy appearance and plasticky build quality. It has a 500 channel memory in 10 banks, which can be loaded and stored into 10 slots + 1 working memory, headlining a 5500 channel memory capacity. It supports a rather (disjoint) frequency range of 26.965-27.405, 28-29.7, 50-54, 68-88, 108-174, 406-512, 806-960 and 1240-1300Mhz. It was a very sensitive radio as well, which I modified with a discriminator tap, but it seemed to also be vulnerable to intermodulation and “birdies” – false signals which appear due to self-generated interference and non-linearities.

The unit had rubber strips on the side which have since fallen off due to age, but the paint is also starting to come off. There is a DC jack for power input and charging, as well as a PC interface port which could be connected to a PC to program the unit or to analyse the trunking data with Pro96Com. This worked much better than using Unitrunker with a discriminator tap, as other radios still didn’t provide a “clean enough” signal, whereas this worked purely in the digital domain relying on the radio to demodulate the signal.

It was a bit of a regrettable purchase, as it was physically rather inconveniently chunky (using 4xAA batteries) with rather shoddy build quality and a problematic volume potentiometer results in a situation where you’re not sure whether the radio is quiet because the channel is quiet or because the pot has gone wonky again. The DSP decoder also produces slightly lower-quality audio than some of its rivals, but is also incompatible with later P25 systems using Linear Simulcast Modulation (LSM). Even though my local station still uses C4FM at this stage, this may not be the case into the future. It was, however, my first and only digital audio capable scanner to date.

Icom IC-R20 Communications Receiver

In fact, two years prior, I decided to drop about $500 on something that isn’t technically a scanner, but more a communications receiver. Bought brand new, this is a much more sophisticated radio compared to the “scanners” above and it definitely shows. The IC-R20 arguably the best handheld radio receiver I have ever owned – and I don’t regret spending my money on it at all. Built like a tank, with a very sensitive front-end, this thing has almost all the features one could ask for in a handheld.

It has a frequency range of 0.15 – 3304.9999Mhz, support for FM, WFM, AM, USB, LSB and CW receive modes, 1250 memory channels with alphanumeric tags, TV audio reception, a 32MB integrated audio recorder (up to 20 tracks, 4 hours), rechargeable Li-Ion battery and is USB programmable and CI-V remote control compatible.

It also decodes CTCSS and DTCS tones, has a repeater offset monitoring button, adjustable RF gain, S-meter, spectrum scope and dual-watch for simultaneously receiving two channels at once (with limitations in each VFO’s range).

As a result, the unit is somewhat larger, but still relatively compact for what it offers. It was by far my favourite unit with a sensitivity that trounces the others. The interface was somewhat complicated – buttons could activate up to three or four different features depending on the mode, short press or long press.

It didn’t have any discriminator output and modifying it was a risk I wasn’t willing to take – but the dual-watch feature and high sensitivity actually made it possible to monitor multiple ACARS frequencies at once, thus this was my primary ACARS receiver for a number of years.

The unit’s recording feature was also particularly of interest, as this allowed for ADPCM recordings that could be downloaded to the PC (slowly, over USB to serial) but converted back into a .wav file with a special tool.

I carried this radio around a lot and it was the unit that I used to first explore shortwave radio and amateur satellites. Because of its wide frequency range, I even used it to explore the output from satellite LNB IFs, even before I got access to wide-range SDR radios. It led to my purchase of an IC-R75 later for shortwave monitoring – another lovely radio. Unfortunately, the IC-R20’s keypad keys have started to become sticky, along with the port covers making it a little less enjoyable to use. Its receiver performance is, however, still just as good as the day I bought it and I still get some use out of it.

Aside from the three radios I’ve shown in this post, I also owned a Uniden Bearcat UBC355XLT car-mount unit for cheap from eBay, but that one failed after a long time serving as a trunking control channel receiver for Unitrunker monitoring the NSW GRN in the past. I also had a Realistic Pro-2021 I got for “scrap” as it wasn’t working, but I repaired it and used it for a few years but the limited sensitivity, frequency range and large size led it to be retired as well.

A Dying Hobby?

While scanning is still a cool hobby to me, with the idea of getting a behind-the-scenes seat hearing what is happening “at the front line as it happens” being a key part of its allure, it seems like this hobby is dying. For one, with the loss of many local electronics stores, scanner units are rarely ever advertised. I almost never see anyone with a scanner in the streets and it seems that the RadioReference databases for my area aren’t being kept up to date either. It’s a sad thing to see, but there’s a good reason for this.

Because of the limited overcrowded 400Mhz spectrum and a desire to “refarm” some of the former 800Mhz spectrum for use with mobile telephones, a number of changes were made to the bands. Former 800Mhz users were all taken off the air, with 400Mhz band users being given an ultimatum to move to more spectrally efficient technologies. To do this, initially, it would be possible to move to narrower NFM as an interim step, but the writing was on the wall – to get to 6.25khz equivalency, you really needed to go digital. To help them on their way, ACMA rejigged the frequencies in such a way that repeater offsets were chosen such that it would play well with digital technologies and since then, scanning enthusiasts have been living with the consequences – not just here but across the world.

Consequence #1: A Myriad of Incompatibility

The first problem is that the move to digital has splintered many services from a single type (e.g. NFM) into several incompatible digital systems. This includes systems such as APCO P25 (Phase I, Phase II), DMR (MotoTRBO), TETRA, NXDN/IDAS just to name a few that operate nearby me at this time. Each of these systems have different on-the-air characteristics requiring specific decoder implementations to decode the bitstream, but the difficulties do not end here.

Consequence #2: Legality Issues

Once you have the bitstream, the problem is that digital radio depends on different digital voice codecs (e.g. the MBE family). These codecs are optimised to carry voice signals using a very low bitrate (often 2kbit/s to 9.6kbit/s), but are patent encumbered. As a result, to produce scanners that can decode these audio streams, either a non-infringing implementation needs to be used (which normally results in audio quality trade-offs) or licensing fees (sometimes additional to the purchase price of the unit) needs to be paid.

Of course, with the popularisation of low-cost SDR technology (through RTL2832U TV-dongles), it is possible to now decode and even listen to these transmissions but either you have to build your own MBE decoder or download software which is of questionable legality.

Consequence #3: A Loss of Access

While the above points make monitoring digital systems somewhat inconvenient, the move to digital also enables easy access to encryption. Many of the systems allow for “basic” encryption which can be easily provisioned at very low cost to prevent anyone else from listening into the transmissions. More sophisticated encryption module based systems with 3DES/AES/etc are available and used by some agencies already. Transmissions on TETRA systems are encrypted by default. All of this serves to limit our access to the information – of course, it was nice to listen in while it lasted but the transition to digital definitely puts the remainder of the transmissions at risk.

More than that, because of the cost of handheld radios compared to the cost of smartphones, some agencies are foregoing the whole radio idea and instead substituting various telephone-based dial-in systems (e.g. Taxis in Hong Kong) or various application-based solutions to emulate a radio over LTE data.

Consequence #4: Reduced Audio Quality

While the use of forward error correction and robust symbologies, digital systems can provide increased coverage and better reliability with no static or hiss. However, in reality, it is not without its limits.

Tied in with the use of codecs, the digital systems frequently have reduced audio quality that makes listening fatiguing and produces intelligibility issues especially in the case of “reverse engineered” decoders. But even without such issues, many dispatch operators seem to request repeats more frequently due to interactions between background noise and the vocoders causing strange “burbles, underwater noises”. While the digital systems can mask a limited amount of errors, it seems some users like to push the limits of coverage while others are suffering from sub-par equipment installation or strong multi-path issues.

Consequence #5: Increased Expense/Complexity

As mentioned earlier, because of the variety of systems and patents involved, as well as the declining popularity of the hobby, the increased cost and complexity seems to make it even more difficult to affordably purchase a useful scanner.

For example, looking for a DMR-capable portable scanner today, the only options seem to be:

  • GRE/Whistler PSR-800 (Paid Upgrade Required)
  • GRE/Whistler Pro-668 (Paid Upgrade Required)
  • GRE/Whistler Pro-18 (Paid Upgrade Required)
  • Whistler WS1080
  • Whistler WS1088
  • Whistler TRX-1
  • Uniden BCD325P2 (Paid Upgrade Required)
  • Uniden BCD436HP (Paid Upgrade Required)
  • Uniden SDS100 (Paid Upgrade Required)

Even then, it’s not clear as to what the total cost is, as a number of these units seem to require paid upgrades to unlock these features. But if you also want NXDN on top, then you’re down to just the TRX-1, BCD436HP or SDS100. A quick search seems to show that all units are relatively hard to obtain locally, the TRX-1 is about AU$760, the BCD436HP is about AU$673 and the SDS100 is around AU$1032. Of note is the latter two will still require a paid upgrade to decode DMR and NXDN, so this is hardly a friendly “introduction” to a hobby which … frankly … you can’t be sure you’re going to hear anything at all. Part of the reason I say this is that digital systems also need some extra work to determine the correct frequency tables, offsets, talkgroups, etc so that you can actually listen to what you’re interested in. This information, while in the past, might have been kept up to date and openly shared is now rare to find.


Radio scanning was a hobby that I picked up relatively late in the game, but still, was something I enjoyed and led to a number of things including getting my amateur radio license, doing some shortwave DXing, following amateur radio satellites etc. It wasn’t cheap back then, but with the move towards digital voice for spectral efficiency, use of proprietary voice codecs and encryption, the days of scanning may well be numbered. To get into it in the same way now would entail a fairly expensive investment and uncertainty whether there is anything to listen to.

As a result, those who might want to try are better off using SDR radios and (sometimes questionable) software to decode the transmissions. It’s much more flexible and the information displayed is much more useful – the only downside is that it’s not very portable, the audio quality may be sub-par, the reception quality is limited by the SDRs as well and it can also be a bit buggy. Maybe I’ll talk more about this in an upcoming post.

Now with the internet, I guess people like to keep themselves entertained by other means (watching cat videos, perhaps) and old fashioned radio might continue to decline in popularity as communications over the internet become so effortless that it’s taken for granted. I’m a bit sad to see scanning in a decline … but I’m not letting it go. Not just yet.

Posted in Radio, Telecommunications | Tagged , , , , | Leave a comment