:LOGIX
:photos
:papers
:tutorials
:drm
:n2048
:nmicrocoder
:daes
:dhex
:deadline
:dettuxx
:detLFS
:circdraw
:systemc
:xf86config
:qdslconfig
:bootfloppy
:6502
:alienware
:inhouse
:math
winscp.exe
putty.exe
:impressum
Introduction
So, I have been working with FM radios for a while. It is pretty fun! Using a RTL2382U stick, rtl-sdr software, receiving IQ-Samples is easy.Two of them can be demodulated by feeding them to the atan2() function in C, and the resulting pcm samples can be played back. Instant radio!
This motivated me to analyse the signal even further. I always wanted to see what the RDS stream entails, so a quick google for "IEC62016 1999" gave me access to the full RDS standard.
After tinkering around with the pcm stream, I figured out how to access the RDS bit stream: Simply by filtering the pcm-samples between 55000 and 60000 Hz with a bandpass, and multiplying them with a 57kHz Cosine. The minute I ran audacity I saw how the ones and zeroes where encoded. (Luckily I hit the correct phase by accident)
RDS Groups
RDS data is transmitted at a rate of 1187.5 Bit/s. Why 1187.5 Bit/s? Because 19000Hz is the FM stereo pilot tone. Divide 19000 by 16, you get to 1187.5. (Trust me, I just checked...)So, the data is transmitted in groups, 104 Bits each.
This is broken into 4 blocks of 26 bits, 16 bit data, 10 bit CRC.
aaaaaaaaaaaaaaaaAAAAAAAAAA bbbbbbbbbbbbbbbbBBBBBBBBBB ccccccccccccccccCCCCCCCCCC ddddddddddddddddDDDDDDDDDD
1
0 11 2 2 44 5 5 66 7 7 99 0
56 5 6 12 1 2 78 7 8 34 3
+---- PID -----+ GrtyVT+Pty+..... ................ ................
H E A D E R + P A Y L O A D +
The remaining 64 bits of a frame is broken down into a 27 bits header, and 37 bits payload. The first 16 bits are reserved for the Program ID, a unique identifier for each broadcaster. Bit 31 is the TP bit, "Traffic Program", which tells the radio if the current program is providing Traffic announcemnts or not.
Bits 32 to 36 are the program type, telling the listener what exactly is playing at the moment: Is it music? Sports? Scientific? Or popular music?
The payload is grouped into one of 16 categories (given by bits 26 to 29), transmitted in two variants A/B (Bit 30). This gives 32 possibilities.
Group 6A: Inhouse (IH)
When I read the RDS standard, the description for Group 6A peaked my interest:|
(...)The contents of the unreserved bits in these groups may be defined unilaterally by the operator. Consumer receivers shall ignore the in-house information coded in these groups. The repetition rate of these group types may be chosen to suit the application and the available channel capacity at the time. |
So what is being transmitted in there? Nuclear codes? Next weeks lottery numbers? I did not know. But since I had access to it, I was able to take a look.
All I had to do was to save frames where Bits 26 to 30 had the pattern "01100". This is what I found.
December 26th, 2017. Weyhe, Germany
weyhe_20171226.tar.gz If you are interested in the Raw RDS streamIt is christmas time. I am at my parents, and I recorded the signals I could.
Frequency: 88.3 MHz Label: "BREMEN 2" PID:d342 GT:06A 0002468acf ..F.. Frequency: 89.8 MHz Label: " ENERGY " PID:1342 GT:06A 1e0898aaaa ..... PID:1342 GT:06A 1f17072012 ... . Frequency: 91.1 MHz Label: "NDR1 NDS" PID:d381 GT:06A 00562e3033 .V.03 PID:d381 GT:06A 014e722e30 .Nr.0 PID:d381 GT:06A 1744363831 .D681 Frequency: 92.9 MHz Label: " N-JOY " PID:d385 GT:06A 00562e3036 .V.06 PID:d385 GT:06A 1744333835 .D385 Frequency: 93.8 MHz Label: "BREMEN 1" PID:d341 GT:06A 0002468acf ..F.. Frequency: 94.4 MHz Label: "NDR Kult" PID:d383 GT:06A 00562e3031 .V.01 PID:d383 GT:06A 014e722e30 .Nr.0 PID:d383 GT:06A 1744333833 .D383 Frequency 95.6 MHz Label: "COSMO " PID:d343 GT:06A 0a02468ace ..F.. PID:d343 GT:06A 1413579bdf ..W.. Frequency 97.2 MHz Label: "metropol" PID:102b GT:06A 1e0972bbbb ..r.. PID:102b GT:06A 1f19022016 ... . Frequency 99.8 MHz Label: " NDR 2 " PID:d382 GT:06A 0002468ace ..F.. PID:d382 GT:06A 0113579bdf ..W.. PID:d382 GT:06A 1744383832 .D882 Frequency 101.2 MHz Label: "Bremen 4" PID:d344 GT:06A 0002468acf ..F.. Frequency 102.3 MHz Label: " ffn " PID:d388 GT:06A 1e1023aaaa ..#.. PID:d388 GT:06A 1f22022016 .". . Frequency 104.8 MHz Label: " TEDDY " PID:1b2e GT:06A 1e1048aaaa ..H.. PID:1b2e GT:06A 1f04072017 ... . Frequency 105.7 MHz Label: "ANTENNE " PID:d389 GT:06A 1e1057abaa ..W.. PID:d389 GT:06A 1f20092013 . . .Apparently, not that exciting. Interesting, nonetheless. As you can see, there are some bit-patterns in there, especially within the streams from Radio Bremen.
"metropol", "ANTENNE " and "ffn" seemed to transmit the frequency, as well as some sort of date. Probably the day the transmitter (or the RDS encoder) has been switched on.
The NDR streams revealed something unexpected: A second Program ID! At first I thought it was a typo. But a quick google led me to www.fmlist.org.
And it showed me that those are valid Program IDs for local variants. So somebody must have copied over the configuration from one site to the next, without paying too much attention.
December 26th, 2017. Erlangen, Germany
erlangen_20171226.tar.gz If you are interested in the Raw RDS streamSince I had access to our lab over the holidays via SSH, I was able to receive some signals 500 kms from where I was sitting as well. This is what I found:
Frequency: 87.6 MHz Label: "BR-KLASS" PID:d314 GT:06A 00affeaffe ..... PID:d314 GT:06A 01d1000a19 ..... PID:d314 GT:06A 0200000b01 ..... PID:d314 GT:06A 0320052015 . . . PID:d314 GT:06A 1f0000d314 ..... Frequency: 88.2 MHz Label: "Bayern 2" PID:d312 GT:06A 00affeaffe ..... PID:d312 GT:06A 01d1000a19 ..... PID:d312 GT:06A 0200000b01 ..... PID:d312 GT:06A 0320052015 . . . PID:d312 GT:06A 1f0000d512 ..... Frequency: 92.9 MHz Label: "RADIO N1" PID:d01b GT:06A 1e09290000 ..).. PID:d01b GT:06A 1f16022017 ... . Frequency: 97.9 MHz Label: "BAYERN 3" PID:d313 GT:06A 00affeaffe ..... PID:d313 GT:06A 01d1000a19 ..... PID:d313 GT:06A 0200000b01 ..... PID:d313 GT:06A 0320052015 . . . PID:d313 GT:06A 1f0000d313 ..... Frequency: 100.6 MHz Label:"ANTENNE " PID:d318 GT:06A 1e10060000 ..... PID:d318 GT:06A 1f01012017 ... . Frequency: 101.1 MHz Label:"ANTENNE " PID:d318 GT:06A 1e1011abaa ..... PID:d318 GT:06A 1f01012017 ... .This one makes me smile every time. As you can see, the BAYERN transmissions all have roughly the same "IH" content. Beginning with a packet "00affeaffe", or "monkey monkey", if you are not speaking German. Clearly, somebody left some sort of graffitti in there.
The "ANTENNE " transmissions, which can be received in Erlangen, seem to transmit the frequency as well as the date when the sender has been switched on.
The same goes for the local "RADIO N1" transmission. This makes me wonder if they bought from the same supplier? Probably yes. I mean... Seriously... How big is the market?
The format of the date (16022017) gives a first indication where this supplier is being located.
I still wonder what it is with the "1011abba" part of the "ANTENNE " stream. Why is it sometimes like this, sometimes "0000"? Coincidence? Oversight? Who knows??
Amsterdam, September 2017
I even tried out an old recording. Even though it is not INHOUSE (06A), this one made me yell "score!" when I saw it. Inside the data channel, I saw this:Frequency: 103.6 MHz Label:"RADIO 10" PID:83d2 GT:05A 0000c8006d ....m PID:83d2 GT:05A 01ff000000 ..... PID:83d2 GT:05A 0200e100e2 ..... PID:83d2 GT:05A 0200e200e3 ..... PID:83d2 GT:05A 0300bf00dc ..... PID:83d2 GT:05A 0300c400e0 ..... PID:83d2 GT:05A 0400dd00d5 ..... PID:83d2 GT:05A 0400de00d6 ..... PID:83d2 GT:05A 0400de00d7 ..... PID:83d2 GT:05A 0500d900df ..... PID:83d2 GT:05A 0500de00e4 ..... PID:83d2 GT:05A 0654524453 .TRDS PID:83d2 GT:05A 0734303031 .4001 PID:83d2 GT:05A 082052656c . Rel PID:83d2 GT:05A 0965617365 .ease PID:83d2 GT:05A 0a20303230 . 020 PID:83d2 GT:05A 0b31303930 .1090 PID:83d2 GT:05A 0c30203136 .0 16 PID:83d2 GT:05A 0d2f30362f ./06/ PID:83d2 GT:05A 0e32303033 .2003 PID:83d2 GT:05A 0f202d2052 . - R PID:83d2 GT:05A 1056522045 .VR E PID:83d2 GT:05A 116c657474 .lett PID:83d2 GT:05A 12726f6e69 .roni PID:83d2 GT:05A 1363612053 .ca S PID:83d2 GT:05A 1470610037 .pa.7 PID:83d2 GT:05A 1500202037 .. 7 PID:83d2 GT:05A 1600202037 .. 7 PID:83d2 GT:05A 1700202020 .. PID:83d2 GT:05A 1820202020 . PID:83d2 GT:05A 1920202020 . PID:83d2 GT:05A 1a20202020 . PID:83d2 GT:05A 1b20202020 . PID:83d2 GT:05A 1c20202020 . PID:83d2 GT:05A 1d20202020 . PID:83d2 GT:05A 1e20202020 . PID:83d2 GT:05A 1f205320ac . S .It spells out "TRDS4001 Release 021900 16/06/2003 - RVR Elettronica Spa". Google it, and you will find the data sheet Trds4001.pdf. So this is what they are using. Cool, huh?
Kassel, December 30th, 2017
hr_20171230.tar.gz The raw rds streams, if you are interested.On my way home, I was able to snatch a couple signals.
Frequency: 89.5 MHz Label:" hr 3 " PID:d363 GT:06A 0066624135 .fbA5 Frequency: 99.0 MHz Label:" hr 1 " PID:d361 GT:06A 0066624135 .fbA5I have no idea what this means.