Determining Base/Step/Offset for VHF/UHF Motorola Systems
Motorola Trunked Radio Systems need to tell the radios of each talkgroup which frequency to switch to. This is done via the control channel which sends the instruction coded as channel numbers. These channel numbers are usually represented in hexadecimal.
For 800 and 900 MHz systems, a certain channel number always refers to the same frequency. However, other systems have variable frequency/channel number relationships which are specified by a base, step and offset, i.e., not all systems use the same frequencies!
Finding Base, Step and Offset with Trunker
Channel number 17C hex (380 decimal) is the base frequency and this is the lowest possible output frequency of the system. Channels are numbered sequentially upwards and the step between each channel in kHz is the offset. This is the key to the formulae you've seen. For example, if base = 450.0 and step = 12.5 then:
Hex Channel 17C = 450.0
Hex Channel 17D = 450.0125
Hex Channel 17E = 450.025
Trunker data files contain the frequency and channel number relationships, for example:
The first number after the frequency is the hex channel number. Channel numbers 000-17B are input frequencies which should not be used in the calculation. We will use 406.55 (channel 180 hex) and 407.35 (channel 190 hex) in the formulae below:
If frequency 1 = F1 (in MHz) and its channel number = DEC1 (in decimal,
converting from HEX1) and similarly you have F2 and DEC2:
OFFSET (in kHz) = 1000 x (F1-F2) / (DEC1-DEC2)
If you then convert OFFSET to MHz (divide by 1000 of course)
BASE = F1-(( DEC1-380 ) x OFFSET (in MHz))
BASE = F2-(( DEC2-380 ) x OFFSET (in MHz))
which should give you the same answer.
For WPAFB, knowing output frequencies:
F1 = 406.55 and HEX1 = 180 so DEC1 = 384 (convert from 180 hex)
F2 = 407.35 and HEX2 = 190 so DEC2 = 400
(I just picked any two frequencies)
OFFSET = 1000 x (406.55-407.35) / (384-400) = 50 kHz
BASE = 406.55 - ((384-380) x 0.050) = 406.35 MHz
Finding the Base, Step and Offset with a Uniden BC245XLT or Other Scanner
The BC245XLT reads the talkgroups and channel numbers coming from the data
channel just as the system radios do. It uses the stored base and
offset with the channel number to calculate the frequency that it
should jump to. Since base frequency is channel number 17C hex (380
decimal), if channel number 395 decimal is sent, the BC245XLT will calculate this as:
(Base frequency in MHz) + (395-380) x (offset in MHz)
As a precaution against jumping to the wrong frequency, the 245 will
only jump to the calculated frequency if it is one ALREADY STORED IN
MEMORY. Since the 245 is reading the data channel, this provides a way
of calculating the correct base and offset without using a computer.
To do this you systematically store all possible system output
frequencies in memory and watch for which frequencies the 245 jumps
to. You have to store all possible output frequencies (a block at a
time) otherwise the 245 WILL NOT JUMP and show you where it wants to
go! Comparing the jumps with the actual system output frequencies
allows you to adjust the base and offset bearing in mind the above
formula that the 245 uses. The details of the method follow.
You will need a full list of frequencies and data channel for your
local cell but you can leave your computer off. This technique relies on the 245 using the data channel to calculate the number of offsets above the base that the voice traffic is on, working out the frequency and then checking to see if that calculated frequency is stored in the memory. If it is, the scanner jumps to that frequency.
What you can do is to repeatedly store blocks of frequencies in the
memories with a rough base and offset. You then start the scanner
trunking with the squelch fully clockwise and hold down the LIMIT
button for a couple of seconds to get the scanner to show you the
frequencies it's jumping to. To force the scanner onto the next jump
hit search and note down all the frequencies jumped to before
programming another block of frequencies. An example may help at this
I know that a fictitious local system in Motoville uses:
440.0875, 440.1375, 440.2125, 440.7000, 440.8000, 441.0375, 441.6125,
441.9125, 442.2625, 442.4625, 442.6875, 442.9375,
with a data channel of 440.975.
The gaps between these frequencies (in ascending numerical order and
excluding the data channel) are:
0.05, 0.075, 0.4875, 0.1, 0.2375, 0.575, 0.3, 0.35, 0.2, 0.225, 0.30
I start by guessing that the system base is 440.0 (close to but lower
than the lowest system output frequency and lower than the data
channel output ) and the offset is 12.5 and put these into the 245
together with 440.975 (data channel) 440.0, 440.0125, 440.025,
440.0375.... etc. up to 440.3375 and 440.35.
Pressing TRUNK to start the scanner trunking, setting the squelch
fully clockwise and holding the LIMIT button down for a couple of
seconds and pressing SEARCH to force the scanner to jump again shows
talkgroup IDs and the scanner repeatedly jumping to:
440.1125, 440.1625 and 440.2375 (although it's just receiving noise
on these frequencies since the guessed base happens to be incorrect!).
The gaps between these three frequencies are: 0.05 and 0.075.
If I then reprogram the 245 using the same (incorrect) base of 440.0,
offset 12.5 and store 440.975 (data channel) together with the next
block of frequencies i.e. 440.3625, 440.375, etc up to 440.7125 and
restart trunking, no frequencies show up so I reprogram another block!
If I continue the process, the full list of frequencies jumped to
440.1125, 440.1625, 440.2375, 440.725, 440.825, 441.0625, 441.6375,
441.9375, 442.2875, 442.4875, 442.7125, 442.9625
with gaps of:
0.05, 0.075, 0.4875, 0.1, 0.2375, 0.575, 0.3, 0.35, 0.2, 0.225, 0.30!
It's then not a big jump to assume that the scanner is jumping to
440.1125 instead of 440.0875! i.e. It's 0.025MHz too high AS IS YOUR
GUESSED BASE! EUREKA I hear you cry!!!! (And alleluias that this long and detailed explanation is almost over!!) So the TRUE base is 440.0 less 0.025 MHz, i.e., 439.975 (which works).
Looking at the gaps can be helpful since not all system channels are
active the entire time and you may not see them all in your "jumps."
It's essential to use the same base, offset and data channel for each
frequency block and stick to one cell at a time.
Determining Complete System Frequency Assignments
VHF and UHF Trunked System Frequency Assignments
These systems use a number of variables to arrive at an actual frequency
with regard to the hex value sent out. People have in the past demonstrated
ways to easily determine these frequencies with a few simple formulas. Below
is one method suggested by Jim Conrad(firstname.lastname@example.org):
Data Channel: 408.750 Hex: 1AC Decimal: 428
408.750 - (428 * .0125) = 403.400 (This is ref channel if 12.5 kHz increments)
408.750 - (428 * .0250) = 398.050 (This is ref channel if 25.0 kHz increments)
408.750 - (428 * .0500) = 387.350 (This is ref channel if 50.0 kHz increments)
Now once you have the ref channel(s) you take the voice channel hex numbers
that will show up in the display of Trunker and computer the voice
frequencies as shown below. Most systems that I have found use 25 kHz.
Example Voice Channel - Hex: 1EC Decimal: 492
Ref Channel Freq + (Dec Channel # x Channel Increment) = Voice Channel Freq
403.400 + (492 * .0125) = 409.550
398.050 + (492 * .0250) = 410.350
397.350 + (492 * .0500) = 421.950
You can eliminate the 421.95 because that goes out of bound so it is not
possible. You need to take all the hex channel numbers and run though
looking for the impossibility's like the one above. Monitoring the system
with another scanner to verify the channels as they switch will also help
to verify you have selected the proper perimeters and have the correct
Many of the 400 MHz systems also display the input frequency channel number
so these must be disregard initially. It is difficult to figure out the
input frequencies without knowing what the frequency is on at least one.
The input reference frequency will not normally be the same as the output.
Output hex channels usually start at 380 decimal (17C hex) so anything
lower in value in a 400 MHz system will be an input channel.
This task could be automated in the Trunker program quite easily. It would
just have to prompt for the required parameters (i.e. channel increments).
Since all systems that I have encountered broadcast the data channel hex
number it would be quite a simple task for Trunker to compute the channel
frequency's once it was told what the increments were. I have monitored
over a dozen 400 MHz systems and they all are compliant with my resolution
for computing the frequencies.
Though the above is correct to a point it does not work for systems which
use multiple base frequencies. Here are the values that are taken into
account by a radio and used to compute values from hex values sent out
over the control channel:
1 Channel Spacing
2 Number of Channel Ranges (Up to 3)
3 Base or Starting Frequency
The following are allowable channel spacings:
Channel Starting Freq Channel Starting Freq
Spacing divisible by: Spacing divisible by:
------- ------------- ------- -------------
5.00 kHz 5.00 kHz 25.00 kHz 5.00 kHz
6.25 6.25 31.25 6.25
10 5.00 30 5.00
12.5 6.25 37.5 6.25
15 5.00 35 5.00
18.75 6.25 43.75 6.25
20 5.00 40 5.00
25 6.25 50 6.25
In order for the channel spacing to be valid the starting frequency must
be evenly divisible by either 5.00 kHz or 6.25 kHz depending on the value in question. For example:
You want your starting frequency to be 406.1375 MHz...
406.1375 / 0.00625 = 64982
406.1375 / 0.005 = 81227.5
The above frequency is available to use any channel spacing which is a
multiple of 6.25 kHz such as 6.25 kHz, 12.5 kHz and 18.75 kHz. 25 kHz is evenly divisible by either 6.25 or 5.0 so it is listed twice. 25 kHz seems to be the default channel spacing for analog VHF or UHF system, 12.5 kHz is common for digital SmartZones.
There are a maximum of six channel ranges allowed per system. Up to three
ranges for transmit and up to three ranges for receive. All channel ranges
must equal 380 channels total. If one channel range is chosen then the number of channels available would be 380. If you chose two channel ranges, both
ranges would have to equal 380. If Range 1 was to be 100 then Range 2
would have to be 280.
Each channel range has its own starting frequency. The starting frequency
cannot have a maximum frequency which is out of range of the radio. Take
for example a federal government UHF system. A radio used within this band
generally goes from 403 to 441 but government frequencies cannot exceed
420. Therefore your starting frequency could never be a value such as
415 MHz because the ending frequency, if your channel spacing is 25 kHz and one channel range, would be 424.475 MHz. Choosing a channel spacing of
12.5 kHz or lowering your base frequency would be better.
Channel values sent out have two groups, receive and transmit.
000 - 17B Receive
17C - 2F7 Transmit
000 - 379 Receive
380 - 759 Transmit
Channel ranges are really groups of bandwidth with there own unique
starting frequency and channel spacing. One range cannot begin within
another. If I had a starting frequency of 406 MHz and a 25 kHz spacing
with 137 channels my highest frequency would be 409.425 MHz. The second
channel range could be any frequency AFTER 409.425 MHz. Whatever it is
it cannot start at a value, with 243 channels in mind, which will
exceed the limit of 420. And the second frequency range MUST have 243
channels so that it equals a total of 380. You could divide up the 243
one more time keeping the rules into account. Here's an example of what
I just mentioned...
Receive Number of
Frequency Range Channels Spacing
406.0000 to 409.4250 137 25.0 kHz
410.0000 to 415.0000 100 50.0 kHz
415.0125 to 416.8000 143 12.5 kHz
This is only one part. You must also define for transmit. Transmit
frequencies can exist within the above ranges but will generally be a
few Megahertz apart. Most systems will only use one channel range though.
Can you see how the original formula is not always correct? Here is an
actual system which uses more than one channel range as an example:
Hex values sent out cannot be determined which channel range they are
from if there is more than one channel range. If you are using the control
channel as a reference to figure out the frequencies by formula you can
only figure for which frequencies the range the control channel is in.
Here's an example of a system that uses two or possibly three channel ranges.
Travis Air Force Base (Solano County, CA)
UHF Astro Simulcast
10 410.0000,25c,604 Control Channel at the time
Consider all frequencies except the control channel to be unknown.
I'll make it simple and include the channel spacing which is 12.5 kHz.
Generally all digital systems use 12.5 kHz spacing.
Ch 10 (604 x 0.0125) - 410 = 402.45
Ch 8 (576 x 0.0125) + 402.45 = 409.65 (OK)
Ch 7 (542 x 0.0125) + 402.45 = 409.225 (OK)
Ch 6 (520 x 0.0125) + 402.45 = 408.95 (Incorrect)
409.225 is where the channel range changes. If you used the formula to
find 1 through 6 you would have incorrect frequencies. In actuality 1
and 2 are also control channels so you would still have a reference
value but how would you know which to apply it to? That is why you cannot
trust the formulas sometimes.