Spy radio
Burst encoders
• • • Donate • • •
   Logo (click for homepage)
Handheld radio with voice encryption

The SE-160 was a half-duplex handheld FM/PM radio, manufactured by ASCOM in Switzerland around 1992 and sold by a wide variety of companies, including ASCOM, Bosch, Authophon and Crypto AG (Hagelin). The radios operate in the VHF-L, VHF-H or UHF band. Some versions have built-in voice encryption made by Crypto AG, which is implemented as an embedded chip.
The SE160 is a rugged radio set in a die-cast aluminium enclosure that was very popular with fire brigades, safety personnel, security services and special law enforcement units. In the latter case, strong digital encryption was required.

The radio was available in a variety of colours, including grey, black, red, yellow and orange. The standard version featured analogue speech. Due to the open processor concept, it could easily be adapted for a variety of existing and new networks, including trunking networks like SpeedCom, Actionet, Regionet and Traxys [2][3].
Operating the Bosch SE-160

The image above shows a typical SE-160 in a bright grey enclosure. The version shown here was marketed by the German company Bosch GmbH, and features strong digital encryption provided by Crypto AG (Hagelin). It was used for many years by an undisclosed law enforcement agency in the Netherlands. The SE-160 was first introduced in 1992 and was in production until 2000 [3]. Towards the end of its lifespan, the radio division of Ascom was first taken over by Bosch and then by Motorola, who shut the whole operation down after consolidating the trunking market.
Operating the Bosch SE-160 Ascom SE-160 Bosch SE-160 SE-160 SE-160 rear view PK-160 programming cable HM-160 hand microphone/speaker Single-unit desktop charger LA-140/160

The diagram below shows the layout of a typical SE-160 handheld radio as seen from the top left. The version shown here is for the UHF band (430-470 MHz) and is fitted with a ¼λ antenna. User interaction is via the clear LCD screen and the 16-button rubber keypad at the front of the radio. The battery is attached at the bottom and can be charged in-situ by placing the radio straight up in a suitable desktop charger of which two variants were available: a single one and a 6-slot one.

The radio is operated with the push-to-talk (PTT) switch at the left side, and several additional buttons at the left and at the top of the radio. The button at the top left is marked with a red dot and is used for sending a distress signal (emergency). The button closest to the antenna is the ON/OFF switch. The function of the other buttons is programmable. With the radio shown here, the buttons I and II are programmed to duplicate the volume up and down buttons of the keypad.

The display consists of three areas. At the top row is a fixed set of 10 icons, each of which indicates a specific condition. At the center is a 9-character matrix display with a text line that usually shows the number and/or name of the current channel. The row at the bottom holds four black context-dependent squares that indicate the function of the F-keys just below the display. Depending on the model and software variant of the radio, different letters may be shown here.
  1. Receive
  2. Transmit
  3. Speaker on (tone squelch off)
  4. Call waiting
  5. Battery empty
  6. Scanning
  7. Encrypted
  8. Keypad locked
  9. ?
  10. Shift (additional features)
Note that, depending on the model and software variant, some features may not be available. On the SE-160C version featured here, the ON/OFF button also acts as the Shift-key. Pressing it briefly, engages or disengages the shift-function. Pressing it longer switches the radio OFF.
Trunking version keypad Trunking version (left) and crypto version (right) Right side Peripheral socket Operating the Bosch SE-160 Antenna and screw-mount base

The SE-160 was available in the following basic versions, all of which could be supplied in the available frequency bands, with a variety of options and further variations, in a number of different colours. For a complete overview, check out the model number decoder.
  • SE-160 - Standard
    This is the standard device with no additional features. It is available in all frequency variants and can be programmed with the IPP-160 software.

  • SE-160T - Trunking
    The T-version was made especially for use on trunking radio networks, such as Actionet, SpeedCom, Regionet, Chekker and Traxys. The hardware is identical to that of the standard version, but the firmware and the front panel are different.

  • SE-160X - Safety
    The X-version is nearly identical to the standard and trunking models, but is explosion-safe and has a maximum power output of 1 Watt. It is intended for use in harsh and dangerous environments.

  • SE-160C - Crypto
    This is the crypto-version of the SE-160. It is different from the other models, in that it has an Audio/Digital board with integrated HC-3400 voice encryption module. The dimensions of this version are identical however. The data transfer rate is 9600 baud.

  • SE-160E - Enlarged
    An enlarged version was developed especially for use by railway organisations, like the Swiss Federal Railways (SBB) and its Austrian counterpart ÖBB. The device is much bigger than a standard one and should be carried on the chest. The display is placed at the top, rather than at the front.  Description of the SE-160E (off-site)

The SE-160 was available in the following frequency band variants:
  • VHF-L 1
    68 - 88 MHz
  • VHF-H
    138 - 174 MHz
  • UHF
    400 - 470 MHz
  1. In Motorola-terminology, the VHF-L band is known as MIDBAND.

Trunking   SE-160T
For advanced and (digitally) controlled analogue radio networks, a trunking version of the SE-160 was available, known as the SE-160T. The hardware of the trunking version was identical to that of the standard version of the SE-160, with the exception of the keypad which is shown below.
Due to a flexible and open processor concept, the radio could easily be adapted for existing and new trunking networks, like SpeedCom, Actionet, Regionet, Chekker and Traxys. Extra features and protocols could be added by using Ascom's proprietary macro-based programming language that was available separately.

The image on the right shows the keypad of the SE-160T. As most trunking networks were capable of patching standard phone calls, the keypad resembles that of a standard telephone set, with four additional buttons at the left.
Trunking version keypad

Generally speaking, trunking-capable radios can not be used for direct communication without the presence of the underlying network. This makes these radios less interesting for HAM radio and other use. However, as the SE-160T is identical to the standard (analogue) version of the radio, except for the firmware, it should be possible to reload the radio with standard software and use it as a non-trunking radio. Some radio HAMs seem to have succeeded in doing this.
SE-160T (trunking) HF board inside the SE-160T Interior of the SE-160T (reverse side) Processor board (rear side) Processor board (front side)

Speech encryption   SE-160C
Some versions of the SE-160 feature digital voice encryption, also known as Cryptovox® , which is supplied by Crypto AG (Hagelin) in Zug (Switzerland) as an embedded chip, marked HC-34xx. It was marketed by Crypto AG as Cryptovox SE-160 and was compatible with the SE-580 1 [2].
Note that the crypto unit is only present if the model number of the radio has the letter 'C' at the end. Radios that are fitted with the crypto unit are not larger or thicker than the non-crypto variant, simply because the crypto-chip in part of the Digital/AF board and can be omitted.

In the radio featured on this page, the crypto-chip carries the designator HC-3452, which means that it is probably a special (customised) variant of Crypto AG's proprietary HC-3400 encryption algorithm. This is usually done to avoid crypto-compatibily between customers.
Crypto unit (HC-3452) made by Crypto AG

Up to 3 x 8 cryptographic keys can be entered by means of a KED-3400 key entry device. Each key can be assigned to a specific radio channel, and consists of three parts: a past key, a current key and a future key. This allows automatic key selection when one of the parties switches from a current to a future key. When in secure mode (i.e. crypto-enabled), digital voice data is sent at 9600 baud. The HC-3400 crypto-logic is of the same generation as Crypto AG's HC-3300 phone.

The SE-160C was the successor to the secure version of the SE-20 handheld radio, manufactured by Ascom's predecessor Autophon. Contrary to the SE-160 however, the SE-20 does not provide real voice encryption, but instead features a variant of Vericrypt; a time-domain voice scrambler made by Brown Boveri and Company (BBC). This means that the SE-20 is inherently insecure.
  1. The SE-580 was Crypto AG's variant of the Nokia Mobira portable radio, which was used in many countries for the first generations of analogue mobile phones and trunking radio networks.

  • Standard 600 mAh battery
  • Extended capacity battery 1000 mAh
  • Hand microphone
  • Single desktop charger
  • Single desktop charger (later model)
  • LA-140/160S6R
    6-radio desktop charger
  • EH-160
    Car mounting bracket
  • LT-160/600
    Leather carrying case (standard)
  • LT-160/1000
    Leather carrying case (long, for extended battery)
  • KED-3400
    Key loader for crypto-version
NiCd batteries Battery chargers External microphone/speaker
Flexible antennas Car mounting bracket Leather carrying case Programming cable Programming software

Batteries   AK-160
Different rechargeable NiCd and NiMH batteries were available for the SE-160. The initial one had a capacity of just 600 mAh, but this was later enhanced to 700 mAh. Later batteries were slightly longer and offered extended capacities of 1000, 1200, 1400 or even 2700 mAh.

All battery types can be charged with the same desktop charger, which may have to be modified in order to support the higher capacities. A small internal SMD resistor informs the charger of the battery's capacity. Note that the longer batteries require a different leather carrying case.

Battery charger   LA-140/160
Several battery chargers were available for the SE-160. Users had the choice between a single desktop charger, such as the one shown in the image below, or a large one that could charge 6 radios simultaneously. All chargers were available in various colours including grey and black.
The image on the right shows the standard LA-140/160 that was suitable for charging a single SE-140 or SE-160 handheld radio. The charger has four coloured LEDs at its sloped front panel, that show the status of the current charge cycle and the condition of the battery. If the bottom LED in ON, the battery has to be replaced.

Note that not all LA-140/160 chargers are suitable for all battery types. Early versions are only capable of charging 700 and 1000 mAh NiCd batteries and not the later ones with capacities of 1400 or 1700 mAh, or even more.
Single-unit desktop charger LA-140/160

At least two variants of the single charger were available, both of which were suitable for the SE-160 and its smaller predecessor the SE-140. The one shown above is the LA-140/160, but there was also the later LM-140/160, shown below, which has a different discharge/charge program.
The LM-140/160 is suitable for larger battery capacities up to 2700 mAh, and can also handle the newer NiMH battery technology. In addition, some of the earlier LA-140/160 chargers were modified by the manufacturer, so that they could handle larger batteries and newer technologies.

Both types of desktop chargers are suitable for thin batteries, such as the standard ones used with the SE-140 radio, and thicker ones, such as the expanded capacity battery for the SE-140 and the standard battery for the SE-160, by installing the appropriate insert inside the bay.

in case the battery doesn't fit, an alternative insert is usually stored at the bottom of the charger. It can easily be swapped. Inside each battery is a small resistor of a specific value, that identifies its capacity. By measuring this resistor, via the contact pads at the rear of the battery, the charger knows which battery is installed and can adapt its charge/recondition program accordingly.
Microphone/speaker   HM-160
The optional external microphone/speaker MH-160 can be connected to the peripheral socket at the right side of the SE-160. It has two buttons: the push-to-talk (PTT) switch at the top and a programmable one at the left.

At the bottom of the microphone, to the left of the coiled cable, is a 3 mm socket for a regular earpiece.
HM-160 hand microphone/speaker

Depending on the frequency band in which the radio operates, either a flexible whip antenna (UHF) or a rubber helical antenna (VHF) is used.

In the image on the right, the middle one is the flexible ¼λ antenna that was supplied with the UHF version of the SE-160 that is featured on this page. The one at the left is similar, but has a TNC base which was needed for certain variants.
Different antennas

Car mounting bracket   EH-160
It was possible to use the SE-160 as a mobile transceiver, by using the EH-160 mounting bracket. This plastic bracket could be mounted in a convenient place inside a vehicle, and was connected to the 12V DC power of the car's battery and to an external antenna.

Any peripherals, such as an external microphone/speaker, were connected to the mounting bracket, rather than to the radio.

No image available

Carrying case
A leather carrying case could be used for carrying the SE-160 around the neck or attached to a belt. Two variants were available: a standard one, and a slightly longer one that allowed the extended battery to be used.

No image available

Programming cable   PK-160
Programming and loading of frequencies and cryptographic keys was done with a regular DOS PC with the IPP-160 software (see below), in combination with the special programming cable shown in the image below. Without this special cable, programming of the SE-160 radio is not possible.
One end of the programming cable is attached to the peripheral socket of the SE-160, whilst the other end should be connected to the LPT (parallel) printer port of an old MSDOS PC.

The large rectangular connector at the side of the computer contains a complex circuit with some customised components, and can not be copied easily. It is basically a small computer platform, with a Hitachi industrial processor at its heart, that converts the parallel port of the PC into a bidirectional IIC port, which is used for communication with the SE-160's processor.
PK-160 programming cable

Programming software   IPP-160
Programming of the SE-160 is done with the special Interactive Parameter Programming (IPP) software, IPP-160, running on an old MSDOS computer with a parallel port. It does not run under Windows. The software allows channels, frequencies, CTCSS, special tones, cryptographic keys, etc. to be stored inside the SE-160.

In addition, the software features a so-called MACRO language, in which the radio's behavior can be programmed freely. This allows the radio to be adapted for virtually any application.
Good example of a Toshiba 486 laptop

Battery Battery Single-unit desktop charger LA-140/160 Insert for thin SE-140 batteries installed Alternative insert stored at the bottom of the charger External microphone HM-160 hand microphone/speaker Operating the HM-160 microphone
Connecting the microphone to the peripheral socket PK-160 programming cable PK-160 programming cable PK-160 programming cable PK-160 interior - top view PK-160 interior - bottom view

The interior of the SE-160 can be accessed easily by removing four torx bolts from the corners of the rear panel of the device. This allows both the rear panel and the front panel to be removed. When doing so, be careful not to damage the rubber gaskets that make the radio water resistant.
After removing the rear panel, the HF board is exposed. It holds various oscillators, a Power Amplifier module and the actual transceiver which is housed in a shielded sub-assembly.

The front half of the radio contains the digital and audio parts as shown in the image on the right. At the left is the control board that is mounted inside the front panel. It provides the I/O for the keypad, the LCD display, the speaker and the microphone. It is connected to the rest of the radio by means of a 7-wire flexible PCB, which carries audio and digital control signals.
Interior - front view

Inside the actual body of the radio is the digital board, which is by far the most complex part. It has components on both sides and connects to the rest of the radio via two pin-headers at the sides and can be removed by releasing two screws and pulling the plastic strip at the bottom.
The top side of the board contains a Philips custom chip, and AMS codec and the real-time clock (RTC). The large chip in the bottom left corner is the embedded crypto unit, which was manufactured by the Swiss company Crypto AG.

It provides true digital voice encryption, based on Crypto AG's HC-3400 embedded encryptor which can be adapted freely to the customer's requirements. The exact details of the speech encryption algorithm are currently unknown, but it is probably a self-synchronising stream cipher, like an autoclave, based on NLFSR 1 technology.
Digital board (bottom)

The bottom side of the digital board contains the actual microcontroller, RAM, ROM, flash memory and several custom chips that were made especially for Ascom Radiocom AG. All boards are built to the highest quality standards of the early 1990s and contain first-class components.
  1. NLFSR = Nonlinear feedback shift register  Wikipedia

Radio body - rear view Interior - rear view Interior (rear) - HF board Interior - front view Digital board (top) Digital board (bottom) Control board Crypto unit (HC-3452) made by Crypto AG

Generally speaking, Ascom radios last very long and will hardly ever need repairing. Restoring a surviving device is therefore relatively simple, but there are some potential problems, such as the batteries which are likely to be exhausted after so many years, and are likely to be beyond repair.
Although it might be possible to find suitable aftermarket batteries on the internet, the age and condition of such batteries is often unknown and in most cases the seller gives no warranty.

If you have access to an old worn-out battery it may be worth spending some time with it to see if it can be re-used. In most cases the plastic enclosure of the battery is glued together or welded ultrasonically. In such cases it is possible to open the enclosure by means of a small saw. The image on the right shows an opened battery of which this NiCd cells have been removed.
Original battery opened and cleared-out

Removing the contents of an old battery, and in particular the sticky gum that keeps the batteries together, is a time consuming task, but it is doable. When doing so, be careful not to damage the small green PCB that is located at the bottom left. Once empty, the battery case can be used to accomodate fresh new rechargeable cells, or a socket to allow connection to an external source.

 Battery circuit diagram
Original battery opened and cleared-out Emptied original battery Small PCB inside the battery

Model number
The model number is printed on a label at the back of the radio and always starts with the model number: SE 160. The meaning of the remaining parts is given in the diagram below, based on the model number of the radio that is featured on this page. It is constructed as follows [3]:

Use the tables below to decode the actual digits found at the rear of the radio. In our case, the radio covers the 430 to 470 MHz band (46) with a channel spacing of 20/25 kHz (2). It has an output power of 2.5 Watts (2) and features build-in voice encryption (C). Details about the encryption variant and the digital protocol (if any), are usually provided on a separate label.
Frequency band
  • 08
    68-88 MHz
  • 14
    132-148 MHz
  • 16
    146-174 MHz
  • 42
    400-425 MHz
  • 43
    400-440 MHz
  • 45
    425-450 MHz
  • 46
    430-470 MHz
  • 47
    450-470 MHz
TX power
  • 0
    Driver only
  • 1
    1 W
  • 2
    2.5 W
Channel spacing
  • 1
    12.5 kHz
  • 2
    20/25 kHz
  • 3
    25 kHz
  • 5
    50 kHz
  • S
  • E
    SBB 1 with keyboard
  • C
  • D
  • T
  • X
    Eplosion safe variant (EEX)
  • CT
    Crypto Trunking
  • DT
    Digital Trunking
  • EC
    SBB 1 with keyboard and Crypto
  • ET
    SBB 1 with keyboard and Trunking
  • TX
    Trunking and EEx (147-156 MHz)
  • Seco
    Standard and low-grade
  • Teco
    Trunking and low-grade
  • TXeco
    Trunking and Ex and low-grade
  1. SBB = Schweizerische Bundesbahnen (Swiss Federal Railways).

Peripheral socket
  1. VBAS
    Battery voltage
  2. GND
  3. ZDA
    IIC bus data (SDA)
  4. ZCL
    IIC bus clock (SCL)
  5. ZNF
    Audio (bi-directional), external ON/OFF
  6. RSF
    Status 1
  1. input: programming voltage for flash, output: voltage for mike

Each rechargeable battery pack has four metal contacts at its rear side. When the (radio with) battery is placed in the desktop charger, these contacts are used to charge the battery and to monitor it whilst it is being charged. A PTC resistor inside the battery pack is sensed by the charger to prevent the battery from overheating. The battery connections are as follows:

Connections as seen from the rear side of the battery

The diagram below shows how the parts inside the battery pack are connected. Inside the pack is a small SMD resistor that is used by the charger to identify the battery type. In this case a 450Ω resistor is present, indicating that the 7.5V/1400mAh AK160 S1400 R battery is used.

Internal circuit of the AK160 S1400 R battery

The PTC is a temperature-dependent resistor which is mounted close to the actual battery cells. It is used to measure the battery temperature when charging and allows the charger to turn itself OFF when the battery is overheating. This is useful when trying to charge a broken battery pack.
  • AK160 S600R
    600 mAh NiCd
  • AK160 S700R
    700 mAh NiCd
  • AK160 S1000R
    1000 mAh NiCd
  • AK160 S1400R
    1400 mAh NiCd
    R = 450Ω
  • AK161R-12
    1200 mAh NiCd
  • AK161R-14
    1400 mAh NiCd
  • AK161R-21
    2100 mAh NiMH
  • AK161R-27
    2700 mAh NiMH
  • Ascom SE-160
    actual manufacturer
  • Bosch SE-160
    Bosch HF1208
  • Cryptovox SE-160
    Crypto AG, Hagelin
  • Autophon SE-160
  • Motorola ?
Any additional information about the SE-160, such as operator's manuals, service manuals, circuit diagrams, etc. but also additional perhipherals or parts that are not yet discribed on this page, are most welcome. If you have any such items, please contact us.
Technical specifications
  • Frequency
    VHF-L, VHF-H or UHF (see above)
  • Output
    1 - 2.5 Watt
  • Power
    7.5 V DC
  • Channels
    100, synthesizer controlled (programmable via PC)
  • Mode
    FM, PM
  1. SE-160 Service Manual - WANTED
    Order number: 86999241019.

  1. Anonymous, Bosch SE-160/MB-05 handheld radio with encryption - THANKS !
    December 2016.

  2. Crypto AG, Company brochure, Crypto Products
    1992. Page 3.

  3. Oppermann Telekom, Ascom SE160
    Retrieved December 2016.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Sunday 04 December 2016. Last changed: Friday, 16 December 2016 - 15:12 CET.
Click for homepage