Tutorial GSM R

Tutorial: GSM-R

What it is. GSM-R is the railway version of GSM, used for train control and communication on the European rail network. Its downlink sits at 921 to 925 MHz. OnAir reads only the public broadcast of the base stations (BCCH): which cells are there, their identity and the channel lists. Calls and data are not decoded.

Read this first. Receive only. Only the broadcast control channel is read, which every terminal receives. Nothing is decrypted and no call, message or subscriber is followed. Check the rules where you live. See Legal.

What you need

• A radio that tunes about 920 to 960 MHz. The mode asks for 5 Msps (the tuning range is 860 to 960 MHz) and works from 1 Msps, so an RTL-SDR can listen to a part of the band at a time. The channel width is 4.8 MHz.
• A 900 MHz antenna.
• Frequencies: the mode starts on 922.8 MHz. The database lists 921.2 MHz (GSM-R downlink start) and 925.8 MHz as the upper end (UIC GSM-R downlink 921 to 925 MHz in Europe). The railway allocation is ARFCN 955 to 973 (921.2 to 924.8 MHz), as the panel says.

Before you start

Go where the railway is: GSM-R base stations stand along tracks, so the signal falls off quickly away from the line. A wider sample rate covers more of the band at once; at 1 to 2 Msps use Scan to step through it.

Step by step

1. In the mode list open Cellular & rail and choose Railway, 921 - 925 MHz.
2. Pick the radio under Source and start the receiver.
3. Under Bands tick GSM-R 921 - 925 (the railway allocation) or GSM 900 925 - 960 (the public GSM 900 downlink, which uses the same broadcast and the same decoder).
4. Press Scan to step through the chosen band. Stop scan ends it. The panel notes how much of the band the radio sees at once.
5. Open Cells.

What you should see

Base stations with their ARFCN, BSIC (NCC and BCC), cell identity, location area code and operator code. A status line counts blocks searched, system information messages and failures.

Reading the screen

• Cells: ARFCN, frequency, BSIC, offset, level, last seen.
• Channel lists: the cell allocation (SI1) and the BCCH neighbours (SI2) of the selected base station.
• Carriers: the carriers found in the last block.
• Log: messages read.

Options and settings

Clear empties the table. The two band boxes and Scan are the main controls.

Troubleshooting

• No cells. Are you near a railway? Try the public GSM 900 925 - 960 box to prove the setup works, then go back to the railway band.
• Cells but no channel lists. SI1 and SI2 take time; wait.
• Weak, wobbling signal in a moving train. Expected.
• Offset shows several kHz. Normal for a cheap oscillator.

Tips

Public GSM 900 stations are a good test: the same decoder, stronger and everywhere.

Legal and privacy notes

Only broadcast information, as every GSM phone sees it. Voice and data are not decoded.

Under the hood

GSM downlink with GMSK, 270.833 kbit/s per carrier, BCCH carrying FCCH, SCH and system information (3GPP TS 45.002, 44.018). GSM-R follows the UIC EIRENE specification.

Related

Mode-GSM-R, Tutorial-LBJ, Tutorial-Cell-towers, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.