Motorola TMS, or Text Messaging Service, is the DMR data mechanism IPSC3 uses for short text messages to and from radios. In IPSC3 this is used for service SMS paths such as the IPSC3 data radio ID, including the SMS AI assistant.
Although this page uses the Motorola TMS name because that is how IPSC3 labels the decoded private-data format, the same broad SMS/TMS mechanism is used by Motorola, AnyTone, and many other DMR radio brands. Exact behaviour can still vary by radio firmware, CPS settings, hotspot software, and repeater path.
IPSC3 can receive, acknowledge, store, and send Motorola-style TMS messages over both Motorola IPSC repeaters and MMDVM/Homebrew hotspot paths. The implementation is based on field captures from live radios and repeaters. It should be treated as practical interoperability documentation rather than a complete vendor specification.
4007.4007 as TMS-related.Motorola private data carries an embedded IPv4-style source and destination. IPSC3 supports two source network styles:
| Mode | Network Byte | Use |
|---|---|---|
| Radio | 0x0C | Radio-style source addressing. This is used for local service replies where radios expect the reply to look like radio-side data. |
| Server | 0x0D | Server-style source addressing. This is available for explicit server-originated sends. |
In practice, some radios are strict about this source addressing. IPSC3 keeps the source network style with the queued ACK or reply so the returned message uses the same class of embedded address the radio expects.
IPSC3 currently decodes the TMS payload with this structure:
| Offset | Field | Meaning in IPSC3 |
|---|---|---|
0..1 | Length | Two-byte big-endian length of the bytes following the length field. |
2 | op_b | Operation/control byte. The low five bits carry the message type. Bit 0x40 indicates that an ACK is required. |
3 | Reserved/control | For text messages currently expected to be 0x00. |
4 | Message ID | The low five bits are the message ID used to match ACKs. IPSC3 masks this value with 0x1F. |
5 | Prefix length | Number of bytes to skip before the UTF-16 text body. |
6 + prefix | Text | UTF-16 little-endian text. IPSC3 trims a leading CR/LF and trailing NULs after decoding. |
| Type | Meaning in IPSC3 |
|---|---|
0x00 | Text message. If the destination is the configured IPSC3 data service ID, the text can be queued for the SMS service worker. |
0x1F | TMS ACK. This has no text body and is consumed as signalling. |
Text is encoded as UTF-16 little-endian. IPSC3-generated text messages use a four-byte prefix containing CR/LF in UTF-16LE:
0D 00 0A 00
The generated TMS text envelope is:
length_hi length_lo op_b 00 message_id_with_flag 04 0D 00 0A 00 UTF16LE_TEXT...
For a generated ACK-required text message, IPSC3 uses op_b = 0xE0
and stores the message ID in the low five bits of the message ID field with
the high bit set. For an unconfirmed/no-ACK text message, IPSC3 uses
op_b = 0xA0.
When an inbound text message requests acknowledgement, IPSC3 queues a TMS ACK outside the packet receive path. The ACK payload generated by IPSC3 is five bytes:
00 03 ack_op_b 00 message_id
The ACK operation byte is selected from the inbound operation byte:
Inbound op_b |
ACK op_b |
|---|---|
0xC0 | 0x9F |
| Other observed text operation bytes | 0xBF |
Example ACK for inbound message ID 0x1A:
00 03 BF 00 1A
On Motorola IPSC repeater paths, IPSC3 wraps the TMS UDP payload into Motorola private data frames. The generated burst uses:
The live packet templates are rewritten for the target repeater ID, source radio ID, destination radio ID, timeslot, embedded IP addresses, UDP ports, and TMS payload. This is why the bitstream radio IDs and the outer data routing IDs must remain consistent.
On MMDVM/Homebrew hotspot paths, IPSC3 uses the same Motorola TMS payload but wraps it into MMDVM private data packets. In the DMRD packet stream, IPSC3 uses a Motorola private data header followed by one or more private data blocks. Current generated MMDVM packets use private data header and data block types equivalent to the Motorola private data burst rather than normal voice frames.
This shared payload model is important: Motorola repeater and MMDVM hotspot paths differ in their RF/network wrapper, but the decoded TMS text payload and ACK payload are the same.
4007 is present, IPSC3 attempts TMS parsing.The IPSC3 SMS AI assistant is built on top of the TMS receive/send path. It is intentionally separated from the live packet path:
Server-enforced guardrails prevent radio-originated SMS from executing shell commands, changing files, changing configuration, or performing admin actions. The AI request is text-only and does not include tool or function-call access.
IPSC3 can also relay normal radio-to-radio SMS when the radios are not on the same local repeater or hotspot. Same-endpoint radio-to-radio SMS is left alone so the local repeater or hotspot can handle it without IPSC3 adding another ACK or duplicate delivery path.
For cross-endpoint SMS, IPSC3 ACKs and stores the inbound message quickly, then a background worker tries to deliver it through the destination radio's current roaming route. If the destination is not currently visible in roaming, the message remains queued until the radio appears again or the configured expiry window is reached.
Relayed SMS text is prefixed before delivery:
From:CALLSIGN Time:HH:MM original message text
The callsign comes from RadioID lookup of the sender radio ID, falling back to the numeric radio ID if no callsign is known. The time is formatted in the server's local timezone.
| Destination Type | Delivery Behaviour |
|---|---|
| Motorola ARS radio | Confirmed TMS send. IPSC3 waits for a TMS ACK before marking the message delivered. |
| Non-ARS radio | Unconfirmed TMS send. IPSC3 marks the message sent once queued because many non-Motorola radios do not ACK network-originated SMS reliably. |
Current default retry behaviour is intentionally low-rate to avoid needless radio and database churn: first retry after 10 minutes, later retries hourly, and expiry after 24 hours. These values are configurable in the SMS section of the Configuration dashboard.
Some radios retry SMS transmission while waiting for an ACK. IPSC3 suppresses duplicate AI SMS and store-forward requests using a short key containing the protocol, peer, target endpoint, source radio, destination service ID, timeslot, message ID, operation byte, source network style, and text. This prevents one user SMS from generating multiple AI replies or relay queue rows during retry windows.
IPSC3 can queue explicit outbound TMS messages. Operationally there are three styles:
| Mode | Purpose |
|---|---|
| Explicit endpoint send | The sender provides the target repeater or hotspot path, source radio ID, destination radio ID, timeslot, and text. |
| Roaming send | IPSC3 resolves the destination radio ID from the current roaming table and queues the message to the last valid endpoint. |
| Dashboard roaming action | A logged-in dashboard user clicks a radio on the roaming screen and sends a short SMS from the IPSC3 data radio ID. |
For roaming sends, the destination radio must still be inside the valid roaming dwell window. If the radio is not currently known, IPSC3 cannot reliably choose an endpoint for delivery.
The dashboard roaming action re-checks that the user is logged in and that the current roaming route is valid when the form is submitted. IPSC repeater routes are queued as Motorola TMS private data toward the repeater. MMDVM hotspot routes are queued through the MMDVM Motorola private-data wrapper. Motorola ARS command controls, such as call alert and radio disable or re-enable, remain restricted to operator and admin users.
IPSC3 can generate multi-block TMS sends. The SMS AI assistant separately caps replies for radio compatibility and usability. On VKDMR the configured service cap is normally kept short because radio SMS displays vary widely and some radios are less reliable with long text messages.
| Service | Port or Mechanism | Purpose |
|---|---|---|
| LRRP | UDP 4001 | Motorola location request/response for ARS-present radios. |
| ARS | UDP 4005 | Motorola registration and presence. |
| TMS/SMS | UDP 4007 | Text messaging and IPSC3 SMS services. |
| BMS | UDP 4012 | Motorola battery/status style data. |
| APRS over DMR | Private data payload | GPS/APRS position reports to the IPSC3 data service ID. |