PG&E Wide Area MPT-1327 System - Post your findings here!

[inigo88]

Originally Posted by Unitrunker

Be sure to use headphone audio, not discriminator audio. Most use a CTCSS tone which ruins decoding for discriminator audio.

I actually tried it both ways but got no response from Unitrunker with MPT-1327. It worked fine for the local Motorola systems however.

[inigo88]

Sad to say I am back in southern California and out of PG&E receiving range for the near future. I'm glad to see the renewed interest in this system, and look forward to reading what WayneH and the rest of you guys are able to figure out.

Here are the MPT1327 control channels I was able to find during my drive down I-5 today:

454.55625 - I-580 near Dublin BART/Livermore. (WayneH ID'ed through neighbors as Ch 205, could belong to site 5099, 5439 or 5419. I suspect 5099 is what I was hearing near Livermore, since it is in the network ID range of other bay area sites.)
454.49375 - East of Altamont Pass. (WayneH ID'ed as site 5431 Ch 200.)
454.48125 - East of Altamont Pass. (WayneH ID'ed as site 53D9 Ch 199.)
454.46875 - East of Altamont Pass somewhere. (WayneH ID'ed as site 53E1 Ch 198.)
454.09375 - Eastbound I-580 merge onto southbound I-5. (WayneH ID'ed as site 5391 Ch 168.)
451.11250 - That same general area. - Their only license I could find on RR, WQMJ358, is for itinerant temporary portable repeaters on Mt Reba, Alpine Co. Clearly that's not what's going on here. (WayneH ID'ed as site 53C1. From his neighbor list for site 53E1, this freq was apparently getting called Ch 009.)

454.41875 - Patterson. (WayneH ID'ed as site 53D1 Ch 194.)
463.41250 - Patterson. - Two licenses in Fresno County: WQOH694 (Meadow Lakes, east of Fresno), WPVS941 (another site on the same ridge line just south of the first). (WayneH ID'ed as site 5321 Ch 382.)

Took a break from bandscanning for a couple hours (sorry!)

463.36250 - Arvin / Grapevine (south of Bakersfield). - WQNP293 (Pampa Peak - SE of Bakersfield). (Possibly site 53B9, per WayneH's post.)
451.20000 - Arvin / Grapevine (south of Bakersfield). - WQNA668 (Pelato Peak - South of Taft).
451.08750 - Arvin / Grapevine (south of Bakersfield). - WQME374 (Double Mountain - South of Tehachapi).

If any of you are in the southern central valley area, consider giving those a try.

[Comint]

Just a couple of points.

By the Standard, an MPT1327 Network can have 1023 Channels.

TrunkView only has one Base/Step Table, so the 1023 frequencies must be contiguous.

Non-contiguous frequencies require a Custom Band Plan which is stored in a Profile.
You can have a Profile per Site, in which case the Profile MUST have the SAME name as that Site, or it won't function.

Or you can have a single Profile for the whole Network, in which case each Site Name MUST start with the Profile name. For example:- If you name the Profile PG&E.tvp, then the Sites must be named PG&E Mt Tamalpais, PG&E Meadow Lakes, PG&E xxyyzz, etc.

TrunkView will only allow entry of about 29 Custom channels into a Profile, from within the program, so what you have to do, is create a Profile in TrunkView - add a few Channels - save the Profile, then exit TrunkView and edit the file, with something like Notepad or Wordpad, to enter the rest of the required Channels.

Each Site can have up to 15 Adjacent Sites (peers).

By convention, each Site has up to 24 Channels.

--
Comint

[Comint]

Originally Posted by inigo88

Also spotted some ACKX (Acknowledge, message rejected) messages from a radio with prefix 002 (2-703) on target ID 8185 (Trunkview just says "Registration Ident", but the target ID is in the MPT standard).

The Rejected message just means a Unit has tried to register (affiliate) with that Site, and it was not approved to do so.

TrunkView automatically shows the important System Idents in 'plain english', to save the program user from having to remember the details. You can revert back to displaying the number by deleting the applicable entry in the System Idents.txt file, or you could edit an entry to include the Ident (in brackets), at the end of the Label, and have the best of both worlds.

The contents of the System Idents.txt file:-

8191=System-wide ident
8190=TSC ident
8189=Interprefix ident
8188=SDM ident
8187=Divert ident
8186=Include ident
8185=Registration ident
8103=Data Network gateway ident
8102=PABX gateway ident
8101=PSTN gateway ident

This is why I suspect Tar:8136 is some kind of similar system function, although unfortunately the MPT1327 standard just calls it a "spare for system customization."

It is called "spare" in the Standard, because it is "spare", as in "not yet defined", and is currently available for a Client to use to customise the System to their particular requirements.

--
Comint

[WayneH]

I've had a chance to go over a lot of the data and PG&E licenses. Here's what I've got so far:

There are at least six to seven freq ranges. Because PG&E has such a large system and has licenses for practically every UHF IG freq they need several ranges to support the channel identifiers. Based on what I have so far this is a rough estimate of them:

Ranges	Start	        End        	Spacing
000-161	451.000000	453.012500	12.5kHz
162-213	454.018750	454.656250	12.5kHz
214-364	460.650000	462.525000	12.5kHz
365-508	463.200000	464.987500	12.5kHz

My guess is because they need to support such large sections of spectrum they have further ranges within the above sections of spectrum to cover them. For example, channel 703 is for a freq in 454-455 even though there's already one defined.

I've found Unitrunker easier to set up for the multiple ranges (sorry ComInt) but still run TrunkView alongside it for what UT lacks. Remember, anyone with a computer, scanner and audio cable can decode this system. It does not require a discriminator tap. It would be great to get other's support since this system is so large.

With the system ID's we have so far there are at least ten known zones. They appear to start around the Bay Area, go down the coast and then up the Central Valley to the high North and possibly back around to the North Coast (so CCW from SF aka the HQ). This is also how PG&E defines their service areas but unfortunately the Area numbers don't match the Zones.

Rough guesses so far:
Zone 2: SF Bay area (SF, Peninsula, East Bay, Mission, San Jose, etc Divs)
Zones 3-6: central coast down to the lower service area and in to Kern?
Zone 7: Central Valley (Kern and Fresno Divisions?)
Zone 8: southern Sac Valley (probably Stockton and Yosemite Divisions)
Zone 9: Sacramento
Zones 10+: north or northeast of Sac

I do the sysid conversion automatically in Excel. Here's the function I use:

Zone: =BIN2DEC(MID(HEX2BIN(MID(A2,2,1),4)&HEX2BIN(MID(A2,3,1),4)&HEX2BIN(MID(A2,4,1),4),1,5))+1
Site: =BIN2DEC(MID(HEX2BIN(MID(A2,2,1),4)&HEX2BIN(MID(A2,3,1),4)&HEX2BIN(MID(A2,4,1),4),6,4))+1

Replace "A2" with whichever cell has your sysid.

Also, I don't think you can always go by the license as to which freq is used where. For one, most sites are using the auction paging freqs in the 454MHz sub-band. Those are licensed regionally so there is no FCC record of the site locations from what I can see.

[WayneH]

Here's my list of sites with their sysid, channel, calculated freq and Zone-Site#. Some of the freq calculations could be wrong. There's no way to know until someone verifies by listening.

See updated post below

[rubicon05]

Im willing to do whatever is needed, but i am new to this stuff, lol, im really close to site 53a9, and using tune mode on my 600 i have 454.09375 @ 284-285 signal and .90v, from 454.0950 to 454.1000 its @ 608 to 612 signal and 1.95v, @ 454.10125 its 370 to 400 signal and 1.30v, i could not get unitrunker to work, but im sure it was me, so any help or info would be appreciated.

[WayneH]

Originally Posted by rubicon05

Im willing to do whatever is needed, but i am new to this stuff, lol, im really close to site 53a9, and using tune mode on my 600 i have 454.09375 @ 284-285 signal and .90v, from 454.0950 to 454.1000 its @ 608 to 612 signal and 1.95v, @ 454.10125 its 370 to 400 signal and 1.30v, i could not get unitrunker to work, but im sure it was me, so any help or info would be appreciated.

Actually, the best thing you or anyone can do is run TrunkView and tell us the site's sysid, the frequency, the neighbor channels and any voice channels. So you've done fine so far. And if you want to give signal strength I think the number of bars would be better. I don't know the bar ranges off the top of my head.

To get UniTrunker to work you click the "+" on the main window. Choose "Signal". A window will pop up. Go to "Audio Port" and choose the sound input you're feeding your data to. Click the play icon at the top. Then click the "Scope" tab at the bottom. You want to see something other than a flat line and the waveform should not clip, i.e. hit the very top and bottom which causes the peaks to flatten.

If you do it right a new window should pop up that says "Site 0 Adhoc". Since the control channel does not announce its channel number you will not see anything at first. Once voice calls happen you will see their numbers appear under "LCN". You can click the "Channels" tab at the bottom and edit them. Or you can get fancy and go to "Band Plan" and input the ranges I listed in the post a few above this one.

[WayneH]

Originally Posted by rubicon05

im really close to site 53a9, and using tune mode on my 600 i have 454.09375 @ 284-285 signal and .90v, from 454.0950 to 454.1000 its @ 608 to 612 signal and 1.95v, @ 454.10125 its 370 to 400 signal and 1.30v

53A9 is definitely 454.09375. It's broadcasted with a channel of 168 which is confirmed to be calculated to that freq.

[rubicon05]

ok, managed to get unitrunker running, i am letting unitrunker and trunkview run side by side from now till 5ish tommorow night, will update with any findings.

[inigo88]

Originally Posted by Comint

It is called "spare" in the Standard, because it is "spare", as in "not yet defined", and is currently available for a Client to use to customise the System to their particular requirements.

Thanks for the clarification Comint (and the tips on running Trunkview profiles properly, I was having trouble finding documentation on that).

I'm curious if US manufacturers (aka Motorola) may use the 'spare' IDs for their own MPT-1327 proprietary system features. Case in point, Motorola's MotoTRBO systems just use the European DMR open standard for voice, but they managed to make two entire trunking variants and GPS/text messaging capability using spare "CSBK" system messages. So when we first ran DMRDecode on american MotoTRBO trunking systems, we just got a bunch of CSBK message types that weren't documented in the DMR standard.

I suspect a similar thing may be happening here (to a lesser degree). I am curious what system function that ID serves though, since we've seen it documented now on multiple PG&E sites.

[inigo88]

Originally Posted by WayneH

53A9 is definitely 454.09375. It's broadcasted with a channel of 168 which is confirmed to be calculated to that freq.

He is only about 15 miles NE of Sutter Buttes. We know from PG&E's 800 MHz LTR days that they definitely had a site on the Buttes, so I'd like to throw that out there as a possible site location for 53A9.

Rubicon, how does the strength of the control channel on 454.09375 compare to some other frequencies known to be at the Sutter Buttes site, like Sutter County Sheriff on 460.225 or Sutter County Fire on 153.935?

[Comint]

Originally Posted by inigo88

I am curious what system function that ID serves though, since we've seen it documented now on multiple PG&E sites.

May take a while to discover that. It could be used for just about anything.

One of the Australian networks uses another "spare" ID (8145), as the Target address for their "Call maintenance parameters", and "Registration parameters" broadcasts, which each of their Sites broadcast.

--
Comint

[rubicon05]

the 454.09375 is a little less than sutter s.o. on signal strength, i did some tuning while mobile to work in chico, which showed that @ the time using 454.1000 was weaker heading north, in chico 454.5000 was full bars, and 454.1000 would not break the squelch just above the static floor. unitrunker is giving me a lcn of 189, the frequency is blank, is this something i need to fill in?

[inigo88]

Originally Posted by rubicon05

unitrunker is giving me a lcn of 189, the frequency is blank, is this something i need to fill in?

You should be able to double click on the LCN 189 and add the frequency manually. For that LCN range, our system's custom bandplan parameters are:

Base Freq: 451.99375 MHz
Step Size: 12.5 KHz (0.0125 MHz)

This is stored in the radio's memory, because when the control channel sends out a voice call via a "Goto Channel" message, it only refers to that channel in terms of LCN. The radio then uses the following equation to figure out which frequency to switch to:

Frequency = Base + (LCN * Step)

So in this case:

Freq = 451.99375 + (189*0.0125) = 454.35625

Thus you should check 454.35625 MHz next time you see a voice call on LCN 189. Did you see this when running unitrunker on 454.09375 (system 53A9)?

[rubicon05]

ok im confused, doesnt LCN mean Local Control Number? and if it does wouldnt that be the frequency that im running trunkview on, as in the control channel? or is 451.99375 the base and every channel is that many 12.5 steps from there? just trying to understand this.

[inigo88]

Originally Posted by rubicon05

ok im confused, doesnt LCN mean Local Control Number? and if it does wouldnt that be the frequency that im running trunkview on, as in the control channel? or is 451.99375 the base and every channel is that many 12.5 steps from there? just trying to understand this.

LCN means Logical Channel Number (aka just Ch). Every frequency on the system is assigned a corresponding LCN based on the bandplan base freq and step size tables, and you are absolutely right - it represents that number of 12.5 KHz steps above the base freq.

Also, if you're running TrunkView/Unitrunker on the control channel, there is no way for the software to directly figure out the channel number of the current frequency. Any LCNs that show up in Goto Ch (GTC) messages are referring to other voice frequencies on that site. The only ways to get the control channel LCN are to park on a voice channel and decode a "CLEAR" message (telling the radio to switch back to the control channel), or more easily just look at an adjacent site's control channel and then find your site on its list of neighbors.

[Comint]

FWIW - GTC actually means Goto Traffic Channel.

--
Comint

[inigo88]

For what it's worth, word is that PG&E is using a TaitNet MPT (or MPT-IP) system, and it is indeed over 100 sites. Tait specifically markets versions of this system to public utilities, and has a website dedicated to it below:

TaitNet MPT 1327 Product Information - Tait Communications

That means this system must be based on the TN5100 network node, which can support up to 960 sites (with up to 24 channels per site). (Source)
From what I understand, this is the Tait MPT-1327 equivalent of a 'Zone Controller' on a Motorola trunking system.

Repeaters at each site are likely TB8100s, and mobiles and portables are likely TM8255s and TP8140s respectively. Brochures for all the above are available on the aforementioned TaitNet MPT-IP product information page.

Also, WayneH advised me that he caught a voice call recently where the individual radio ID matched the four-digit ID number of the person making the call. This agrees with what I've observed on the San Diego Gas & Electric trunking system (a Motorola Type II 900 MHz system) which also uses radio IDs that are matched to the truck ID number used over the air. I believe this is a preferred practice for utility customers as it simplifies the process of doing a unit-to-unit individual call.

This is also good news, because I had read up on many MPT-1327 systems using the MPT-1343 numbering for talkgroups and radio IDs, which requires a conversion to be made between the MPT-1327 ID and the actual group/radio ID. Thankfully that isn't the case with this system, which makes things easier to keep track of.

[citylink_uk]

Originally Posted by Comint

May take a while to discover that. It could be used for just about anything.

One of the Australian networks uses another "spare" ID (8145), as the Target address for their "Call maintenance parameters", and "Registration parameters" broadcasts, which each of their Sites broadcast.

--
Comint

Many utilities here use MPT networks. They tend to send allot of telemetry over the control channel from fixed assets such as small supply stations.

You will often see those spare 81xx idents used as data targets for a central database to collect the telemetry reports.

The appeal of these MPT systems is that they can easily combine their telemetry and voice systems into one.