PG&E Wide Area MPT-1327 System - Post your findings here!

kma371 · Dec 29, 2012

454.15 b0c1

adjacents
id 5089 ch 168
id 50b1 ch 170
id 50d9 ch 169
id 50f9 ch 197

im picking up 50c1 on 3 freqs, 454.15, 454.14375 and 454.1375, dunno which is true freq

SCPD · Dec 29, 2012

This is too cool, first time i ever decoded anything,lol, So is all this im hearing PG&E?

kma371 · Dec 29, 2012

rubicon05 said:
This is too cool, first time i ever decoded anything,lol, So is all this im hearing PG&E?

theres tons of other data signals you can decode besides this type. scan around for trunked systems. those are the best to decode. or TRBO signals.

inigo88 · Dec 29, 2012

rubicon05 said:
Hope all this is usefull, i did a limit search from 430.0 to 490.0 for all info given here, from my home location. Is there anything more in trunkview i can set to help better id anything?

That was very helpful! Thank you! The only other thing we could do is try to narrow down where some of the 454 MHz sites are based on where you're located in Butte county and how strong your reception of each site is.

SCPD · Dec 29, 2012

454.1000 is my strongest, let me work on this, every now and then i hear what sounds like morse code, any ideas?

inigo88 · Dec 29, 2012

rubicon05 said:
454.1000 is my strongest, let me work on this, every now and then i hear what sounds like morse code, any ideas?

The morse code is the FCC license identifier (should happen every hour or so). This is the easiest way to figure out FCC data (if you happen to know morse code, unfortunately I do not

).

SCPD · Dec 29, 2012

Freq Bars Signal strength
454.1000 3 solid 560 to 570
454.4875 2 solid 530 to 540
454.5000 1 tickling 2 450 to 460
464.0875 2 solid 460 to 470
454.5625 1 some static 370 to 380
using tune mode on win500 for numbers

SCPD · Dec 29, 2012

on 454.1000 in the bottom of trunkview it gives me CCh:5456 in red with filter 2 on.

DSheirer · Dec 29, 2012

If it helps in solving your puzzle ... the MPT-1327 control channel identifier is made up of a 15-bit field that tells you the network, zone, tower and access label. You can find a description of these in the MPT1327 spec.:

5081 = 1 01 00001 0000 001 = Network #2, Zone #2, Tower #1
5091 = 1 01 00001 0010 001 = Network #2, Zone #2, Tower #3
50A9 = 1 01 00001 0101 001 = Network #2, Zone #2, Tower #6
50B1 = 1 01 00001 0110 001 = Network #2, Zone #2, Tower #7
50C1 = 1 01 00001 1000 001 = Network #2, Zone #2, Tower #9
50D1 = 1 01 00001 1010 001 = Network #2, Zone #2, Tower #11
50D9 = 1 01 00001 1011 001 = Network #2, Zone #2, Tower #12
50E1 = 1 01 00001 1100 001 = Network #2, Zone #2, Tower #13
50F9 = 1 01 00001 1111 001 = Network #2, Zone #2, Tower #16
5109 = 1 01 00010 0001 001 = Network #2, Zone #3, Tower #2
5111 = 1 01 00010 0010 001 = Network #2, Zone #3, Tower #3
5119 = 1 01 00010 0011 001 = Network #2, Zone #3, Tower #4
5399 = 1 01 00111 0011 001 = Network #2, Zone #8, Tower #4
53A9 = 1 01 00111 0101 001 = Network #2, Zone #8, Tower #6
54B9 = 1 01 01001 0111 001 = Network #2, Zone #10, Tower #8
54C1 = 1 01 01001 1000 001 = Network #2, Zone #10, Tower #9
54E1 = 1 01 01001 1100 001 = Network #2, Zone #10, Tower #13
5631 = 1 01 01100 0110 001 = Network #2, Zone #13, Tower #7

Denny

inigo88 · Dec 30, 2012

DSheirer said:
If it helps in solving your puzzle ... the MPT-1327 control channel identifier is made up of a 15-bit field that tells you the network, zone, tower and access label. You can find a description of these in the MPT1327 spec.:

5081 = 1 01 00001 0000 001 = Network #2, Zone #2, Tower #1
5091 = 1 01 00001 0010 001 = Network #2, Zone #2, Tower #3
50A9 = 1 01 00001 0101 001 = Network #2, Zone #2, Tower #6
50B1 = 1 01 00001 0110 001 = Network #2, Zone #2, Tower #7
50C1 = 1 01 00001 1000 001 = Network #2, Zone #2, Tower #9
50D1 = 1 01 00001 1010 001 = Network #2, Zone #2, Tower #11
50D9 = 1 01 00001 1011 001 = Network #2, Zone #2, Tower #12
50E1 = 1 01 00001 1100 001 = Network #2, Zone #2, Tower #13
50F9 = 1 01 00001 1111 001 = Network #2, Zone #2, Tower #16
5109 = 1 01 00010 0001 001 = Network #2, Zone #3, Tower #2
5111 = 1 01 00010 0010 001 = Network #2, Zone #3, Tower #3
5119 = 1 01 00010 0011 001 = Network #2, Zone #3, Tower #4
5399 = 1 01 00111 0011 001 = Network #2, Zone #8, Tower #4
53A9 = 1 01 00111 0101 001 = Network #2, Zone #8, Tower #6
54B9 = 1 01 01001 0111 001 = Network #2, Zone #10, Tower #8
54C1 = 1 01 01001 1000 001 = Network #2, Zone #10, Tower #9
54E1 = 1 01 01001 1100 001 = Network #2, Zone #10, Tower #13
5631 = 1 01 01100 0110 001 = Network #2, Zone #13, Tower #7

Denny

Outstanding Denny, thank you! As you can see I don't know MPT-1327 very well and am kind of learning as I go with TrunkView (not many of these systems in California!).

I believe we just confirmed 50B1 as Mt Tamalpais in Marin County. Would that work with the location of your receiver Bill? Also according to the license, 5081 could be located at the Petaluma sub-station and not Sonoma Mountain, but Sonoma Mountain seems more likely due to the signal strength.

Breaking everything into zones:

Zone 2 - North SF Bay Area:

5081 = 1 01 00001 0000 001 = Network #2, Zone #2, Tower #1 -- Petaluma Sub-Station/Sonoma Mtn
5089 = 1 01 00001 0001 001 = Network #2, Zone #2, Tower #2
5091 = 1 01 00001 0010 001 = Network #2, Zone #2, Tower #3
50A9 = 1 01 00001 0101 001 = Network #2, Zone #2, Tower #6
50B1 = 1 01 00001 0110 001 = Network #2, Zone #2, Tower #7 -- Mt Tamalpais
50C1 = 1 01 00001 1000 001 = Network #2, Zone #2, Tower #9
50D1 = 1 01 00001 1010 001 = Network #2, Zone #2, Tower #11
50D9 = 1 01 00001 1011 001 = Network #2, Zone #2, Tower #12
50E1 = 1 01 00001 1100 001 = Network #2, Zone #2, Tower #13
50F9 = 1 01 00001 1111 001 = Network #2, Zone #2, Tower #16

Zone 3: Possibly another sector of the bay area, or central valley.

5109 = 1 01 00010 0001 001 = Network #2, Zone #3, Tower #2
5111 = 1 01 00010 0010 001 = Network #2, Zone #3, Tower #3
5119 = 1 01 00010 0011 001 = Network #2, Zone #3, Tower #4

Zone 8: Butte County / Northern Central Valley

5399 = 1 01 00111 0011 001 = Network #2, Zone #8, Tower #4
53A9 = 1 01 00111 0101 001 = Network #2, Zone #8, Tower #6
53B1 = 1 01 00111 0110 001 = Network #2, Zone #8, Tower #7

(One of those is probably Sutter Buttes, since one of the old PG&E 800 MHz LTR sites was there.)

Zone 9: Western Sierra?

5411 = 1 01 01000 0010 001 = Network #2, Zone #9, Tower #3 -- Osborne Hill (Grass Valley)

Zone 10:

54B9 = 1 01 01001 0111 001 = Network #2, Zone #10, Tower #8
54C1 = 1 01 01001 1000 001 = Network #2, Zone #10, Tower #9
54E1 = 1 01 01001 1100 001 = Network #2, Zone #10, Tower #13

Zone 13: Northern coast? (Only seen as neighbor of Sonoma county site)

5631 = 1 01 01100 0110 001 = Network #2, Zone #13, Tower #7

kma371 · Dec 30, 2012

my remote receiver is in San Leandro so Mt Tam does come in well but I can't be positive.

I'll try the central valley stuff Sunday afternoon and see what I get.

SCPD · Dec 30, 2012

SCPD · Dec 30, 2012

new sites
461.8375 196.6 55c1
452.075 196.6 54c1

kma371 · Dec 30, 2012

******

system 5391
454.0875

adjacent sites:
id 5389 ch 312
id 53b9 ch 378
id 53d1 ch 194
id 53d9 ch 199
id 5431 ch 200

******

system 5431
454.49375

adjacent sites
id 53d9 ch 199
id 53e1 ch 198
id 5391 ch 168

real weak copy

******

system 5099
454.55625

adjacent sites
none

even weaker copy

******

inigo88 · Dec 31, 2012

rubicon05 said:
I let trunkview run for few hours, and this is some of the log for Freq 454.1000.
12:33:41 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 180 Freq: 1.12500 MHz |
12:33:41 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 180 Freq: 1.12500 MHz |
12:33:43 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 180 Freq: 1.12500 MHz |
12:33:53 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 180 Freq: 1.12500 MHz |
12:36:56 - ACK | General acknowledgement | (000) Org: 2969 Tar: Registration ident
12:36:56 - ACK | General acknowledgement | (000) Org: 2969 Tar: Registration ident
12:49:33 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 189 Freq: 1.18125 MHz |
12:49:33 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 189 Freq: 1.18125 MHz |
12:49:34 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 189 Freq: 1.18125 MHz |
12:49:44 - GTC | Go To Channel - Voice | (001) Org: 421 Tar: 6743
| Ch: 189 Freq: 1.18125 MHz |

Woohoo voice activity!

I believe Org is the originating radio ID, while Tar is the target group (or radio) ID. The (001) is the MPT1327 prefix (sort of like the first number of an LTR talkgroup). If I'm reading this right, radio ID 1-421 is transmitting on talkgroup 1-6743. Also keep an eye out for two voice frequencies (Ch 180 and Ch 189).

From the adjacent site list for the other site 54B9, it looks like the control channel on 454.1000 on site 53A9 is Ch 168. The formulas are:

Current Freq = Base Freq + (Ch # * Step Size)

so to find the base frequency...

Base Freq = Current Freq - (Ch # * Step Size)

We know 454.10 = Ch 168, but the system could use 12.5 KHz steps or 6.25 KHz steps.

If it uses 6.25 KHz steps:

Base Freq = 454.10 - (168*0.00625) = 453.05

Then Ch 180 would be 453.05 + (180*0.00625) = 454.17500
and Ch 189 would be 453.05 + (189*0.00625) = 454.23125

Or if it uses 12.5 KHz steps:

Base Freq = 454.10 - (168*0.0125) = 452.0000

Then Ch 180 would be 452.00 + (180*0.0125) = 454.2500
and Ch 189 would be 452.00 + (189*0.0125) = 454.3625

What this all means, is that if you wouldn't mind plugging in 454.175, 454.23125, 454.25 and 454.3625 into a scan list for a while, we can figure out which step size they're using and thus the custom bandplan for the site. MPT1327 voice channels can apparently be identified pretty easily because there is a digital sounding databurst at the beginning and end of every transmission.

The bad news is, I'm pretty sure there will be a different custom bandplan for almost every one of these sites... so we're going to have to figure out a lot of them.

SCPD · Dec 31, 2012

Im loading those freqs now, ill turn the hit list on for them, I was wondering on trunkview what i should have for a base freq?

SCPD · Dec 31, 2012

454.2500 i have captured the 196.6 ctcss, with occasional data burst and what im guessing is the morse code FCC ID. no voice activity yet

SCPD · Dec 31, 2012

is there something i can run to try to capture the morse code to get some FCC id's? i setup win500 to record audio and hit counts on the base and 4 freqs mentioned above, this will run 24/7 for awhile.

ScannerDude244 · Jan 2, 2013

454.5750 I notice the pl change from 196.6 to 100.0
FYI it was real weak no bars
ID 50A1:
ID: 5089 Ch: 168
ID: 50F9 Ch: 197
ID: 5189 Ch: 436
ID: 5199 Ch: 197
ID: 53F9 Ch: 202\

This one was coming in full bars
461.8000 pl 196.6
ID 51B9:
ID: 5191 Ch: 356
ID: 51B1 Ch: 442
ID: 51D1 Ch: 084

464.08750 pl 196.6
- ID 5189:
ID: 50A1 Ch: 204
ID: 50E9 Ch: 171
ID: 5199 Ch: 197

464.16250 pl 196.6
- ID 51B1:
ID: 50A1 Ch: 204
ID: 5189 Ch: 436
ID: 5199 Ch: 197
ID: 51B9 Ch: 306

SCPD · Jan 2, 2013

PG & E had the most disjointed radio system for a large company, especially utility company, that I've ever seen. Low band, VHF High and UHF depending on locations and within short distances of each other. Weren't the two functions, gas and electric, on different frequencies as well? I was in Livermore visiting my sister some years ago when the power went off in the middle of the summer during thunderstorm activity (read hot and humid) and had a bit of a challenge finding a frequency to listen to the activity on. I lucked out and found it within 5 minutes.

With this new service area wide trunked system will PG & E have a centralized dispatch system or did they already have that? This will be an interesting system to figure out.

PG&E Wide Area MPT-1327 System - Post your findings here!

QRT

QRT

QRT

California DB Admin

QRT

California DB Admin

QRT

QRT

Member

California DB Admin

QRT

QRT

QRT

QRT

California DB Admin

QRT

QRT

QRT

Member

QRT

Similar threads