The DARC side of Munich

[] When you live in Munich and use public transportation, especially Buses and Trams, you will have noticed that during the last couple of month a lot of new displays appeared at almost any station which had no real-time info display before. They obviously have no cables/connections and no visible antennas, so I kept wondering:

1. How do they get powered?
2. How do they get updated?
3. Can we access the data as well?
4. Is it possible to display other data?

What follows is a journey describing how it's possible to answer these questions and learn something completely new in just a couple of days with the help of the Internet and other kindred spirits who shared and published their research and results. Read on and you will learn how the system works and get detailed answers to those questions.

After a couple of fruitless runs through different search engines, to find out if anyone else might already have asked or even answered those questions, a post on the mikrocontroller.net board popped up. Not much in there, but enough to justify putting time into looking deeper into the FM Band and adjusting search keywords accordingly, which finally led to this german blog entry. Additionally there was also this radio board post which increased the level of perceived probability that there might be a signal on 90 MHz (B5 Aktuell) transmitted from Ismaning.

In another discussion on IRC, someone mentioned this talk @ 30c3 about FM and RDS. Supplied with the gained knowledge about the DARC system for buses and trams deployed in Helsinki another search turned up this MVG press release and at long last this datasheet.

The image in the datasheet is an actual picture of the displays we can find in Munich, so the probability increased even further. At least far enough to hack a crude a 3m dipole (aligned horizontally!), pick up an RTL-SDR/E4K stick and hack a receiver in GNU Radio to try to verify that the signal actually exists.

Let's compress all the information found above into a summarized system description:

The new infrastructure, tested by the MVG since 2011 and deployed since 2013, seems to be the Axentia iBus FM/DARC public transport information system. The units are battery powered (with a supposed 3 year cycle) and receive near real-time updates via Data Radio Channel (DARC), embedded into the signal of FM broadcast news radio station B5 Aktuell, transmitted from Ismaning. DARC is a digital 16 kbps LMSK component, centered on 76 kHz (4th harmonic of the 19 kHz stereo pilot tone), of the WBFM (Wide-Band Frequency Modulation) composite signal found on 90.0 MHz.

Thanks to codec, we have a revealing bootloop video:

The next logical step is to have a crash course in broadcast FM technology and then just observe the band itself, to verify the existence of the DARC signal and the current theory. In simple terms, we need to build a simple software defined receiver, tuned onto a broadcast radio station on 90 MHz and feed the output into a spectrum analyzer, which will draw a nice picture for us, thereby making invisible radio frequencies observable.

But how does it look, what do we have to expect when we see the spectrum?

Have a look at the following two images, which show the RF baseband spectral views in different sample sizes and different tools, both centered on 90 MHz with other broadcasting stations on 89.5 MHz and 90.6 MHz in the 2Msps view.

[]

[]

This looks fancy, but I don't know how to interpret it…

The spectrum chart (left top/right bottom) shows what's going on right now, the waterfall (left bottom/right top) gives you the same information, but is a sequence of spectrum charts stacked together and observed from the top as 3 dimensional chart, showing time (y), frequency (x) and signal strength (z), which is an invaluable tool to actually watch and observe frequency ranges and modulations over a period of time, to recognize patterns visually.

It's also interesting to note, how the spectrum of B5 on 90.0 MHz is clearly distinguishable from the other broadcasting stations in the RF baseband. There seem to be two signals 76 kHz left and right from 90.0 MHz

And where exactly is this DARC signal?

In order to determine the existence of the DARC signal we probably have to dig deeper (like opening another part of a matroska doll) and demodulate/decimate this WBFM signal down to 96 kHz and look at the spectrum again, especially around 76 kHz.

Not really knowing the inner workings of broadcast FM won't make the job easier but the following chart seemed easy enough to understand and learn from. We basically just have to visually compare the spectrum to this chart and relate what we see at 19, 38, 57, and 76 kHz to identify each part of the multiplexed composite FM signal.

Mono

The (L+R) Main channel signal is transmitted as baseband audio in the range of 30 Hz to 15 kHz.

Stereo Pilot

A 19 kHz pilot tone, at exactly half the 38 kHz stereo difference signal's sub-carrier frequency and with a precise phase relationship to it. This is transmitted at 8–10% of overall modulation level and used by the receiver to regenerate the 38 kHz stereo difference sub-carrier with the correct phase.

Stereo Difference Signal

The stereo difference signal (L−R) is modulated onto a 38 kHz double-sideband suppressed-carrier (DSB-SC) signal occupying the baseband range of 23 to 53 kHz.

RDS

The RDS sub-carrier transmits digital data at 1187.5 bps on a sub-carrier centered on 57 kHz, which is the 3rd harmonic of the 19 kHz FM stereo pilot tone, to minimize interference and intermodulation between the data signal, the stereo pilot and the 38 kHz DSB-SC stereo difference signal. The stereo difference signal extends up to 38 kHz + 15 kHz = 53 kHz, leaving 4 kHz for the lower sideband of the RDS signal.

DARC

The final multiplex signal can contain a combination of the Main (Mono) Channel (L+R), the pilot tone, the stereo sub-channel (L−R), the RDS channel and the DARC channel. This composite signal then modulates the FM transmitter.

Enough with the theory already, let's have a peek

Now that we know what to expect, we can have a look at two different real world broadcasting stations in Munich, of course, our most probable candidate B5 Aktuell on 90.0 MHz where we suspect our DARC signal and some other reference station on 102.3 MHz, where we do not.

In case you want to to re-verify the results or look through the bands where ever else you might live, here's a little documentation about the setup to have somewhat comparable results.

RTL SDR Sticks

• Hama-Nano (E4K) as already described here
• Scalar (R820T) (13 EUR)

Antenna

A DIY 3m dipole designed for 90.0 MHz (horizontal polarization) hacked out of 75 ohms TV coax and two 83cm legs of silver speaker wire, one connected to coax center and the other to the shield. The speaker cables are taped to a beam (wood), the coax leaves in the center, giving a T shaped configuration. Another set of extremely cheap industry produced FM antennas have been tested and work equally well, if you don't want to hack your own.

All software used here is free and open-source, of course:

• GNU Radio 3.7.4
• gr-osmosdr - Provides GR sink and useful console utils (osmocom_fft etc.)
• gr-fosphor - Awesome OpenCL/GL FFT Spectrum/Waterfall
• rtl-sdr - Provides GR sink and useful console utils (rtl_fm etc.)
• SDRangelove - QT5/GR based all-in-one-receiver
• gqrx - Another QT/GR based all-in-one receiver

$ vi ~/.gnuradio/config.conf

[audio_alsa]
nperiods = 16
period_time = 0.100

Flowgraph of a quick hack in GRC to verify the DARC channel

This is the spectrum of our selected negative reference stereo FM broadcasting station on 102.3 MHz where we expect to find a full analog stereo WBFM set from 0-53 kHz and a digital RDS carrier centered at 57 kHz but nothing on the 4th harmonic at 76 kHz where DARC is supposed to be:

No surprise here. The spectrum lines up precisely according to our reference negative schema and shows exactly what we expected from a modern stereo FM broadcast station without a DARC signal.

This is the spectrum of our DARC signal candidate stereo FM broadcasting station on 90.0 MHz where we expect to find a full analog stereo WBFM set from 0-53 kHz, a digital RDS carrier centered at 57 kHz and the DARC signal on the 4th harmonic at 76 kHz:

The big surprise here is that B5 seems to be a mono signal, all stereo components are missing in the multiplex mix. However, on the 4th we can clearly see a digital signal that matches the characteristics we would expect from a DARC signal. LMSK modulation would need a pilot tone for synchronization but as this is a mono signal there is no pilot tone. According to ETSI EN 300 751 DARC will just simply be MSK modulated. Let's see how it looks when we get even closer:

At this point, it's reasonable to say, that we could verify the existence of the DARC signal, now we just have to decode the LMSK in order to get the infos. Windytan's crazy hack was to actually use sox and a couple of pipes to form the base of an FSK decoder in order to, albeit non-coherently, decode the LMSK of DARC. Now, when I observe something like this, it tell's me, that she really knows what she is doing. If you are able deeply abstract and really understand a concept, you can start to simplify and apply other means to it as well. That is the difference between learning to repeat “facts” or learning to gain deeper understanding.

http://www.windytan.com/2013/11/decoding-radio-controlled-bus-stop.html http://www.windytan.com/2013/11/broadcast-messages-on-darc-side.html https://github.com/windytan/darcdec

A quick preliminary test with darcdec was rather unstable (it will mess up your machine, yo! :)) and didn't yield any usable results yet, but we're obviously on the right track, considering the decoded network name:

BIC2 info:10b0 3040 9700 a704 8f20 af00 9f40 bf80 8401 e080 1c80  crc:212c (synd=302a)
parity:01ab202b801d2a0a2753f0 (synd=28481ff07a891dd2cef55)  uncorrectable
SI/LCh: 0x8 Service Channel (SeCH)
Dup: 0
CID: d
Type: 0 Channel Organization Table (COT)
Network ID: 12
Block #0

???? 

BIC2 info:1cb6 3804 116c 8531 5c04 117c 8411 3c04 317c a410 0000  crc:1df5 (synd=14b9)
parity:0384f0b87ae8413110b6f8 (synd=12d73a3f61b8bcd9413a1)  uncorrectable
SI/LCh: 0x8 Service Channel (SeCH)
Last Fragment
Dup: 0
CID: d
Type: 6 Synchronous Channel Organization Table (SCOT)
Network ID: 12
Block #1
Service Message (errs 11) [[
  ECC: 02
  TSEID: 74
  Message Length: 256 bytes
  Channel Organization Table (COT)
    ServID  Scrambl  Avail
    e508      [ ]     [ ]
    f101      [ ]     [ ]
    f500      [ ]     [ ]
    f900      [X]     [ ]
    0108      [ ]     [X]
    8001      [X]     [X]
    3800      [ ]     [X]
    2022      [ ]     [ ]
    3628      [ ]     [X]
    8c0e      [X]     [ ]
    880f      [X]     [ ]
    880f      [ ]     [ ]
    2023      [ ]     [ ]
    3e09      [ ]     [X]
    0800      [ ]     [ ]
]]

BIC2 info:14aa 3007 4050 8306 a242 ecf1 30b6 6ee2 0020 0000 4000  crc:22ef (synd=3b60)
parity:018d89d2d944f1b5bd2f30 (synd=0585b36cdf39bc91e4a9a)  uncorrectable
SI/LCh: 0x8 Service Channel (SeCH)
Last Fragment
Dup: 0
CID: 5
Type: 5 Time and Date Table (TDT)
Network ID: 12
Block #0
Service Message (errs 1) [[
  ECC: e0
  TSEID: 01
  Message Length: 10 bytes
  Time and Date Table (TDT)
  Time: 2014-08-23 16:22:01
  Network name: "mvG"
]]

???? 

So we either have to hack around in darcdec and find out why it's not putting out anything or we build something like a gr-darcdec module which can be used as a functional block in gnuradio (preferable).

Since this particular signal can only be received in Munich, here are some dump files to download, for smart, creative or bored minds anywhere else, who may enjoy the challenge to go after it too. If you need more or other tools/parameters, just drop a note.

L/MSK Links:

https://github.com/zacinaction/kicksat/wiki/Radio-Info http://patentimages.storage.googleapis.com/EP1843535A1/imgf0001.png http://www.dsplog.com/2009/06/16/msk-transmitter-receiver/ http://gnuradio.org/redmine/projects/gnuradio/wiki/Enhanced_GMSK_Demodulator

http://signals-analysis.blogspot.com/2009/06/fsk-gfsk-msk-gmsk http://www.ne.jp/asahi/hamradio/je9pel/aausati2.htm

• DARC GNU Radio Block Implementation by chris007 & andz - presented at EH2015
• the-darc-knight-rises