RTL-SDR with an E4000 tuner

3 May 2018

I had an older NooElec RTL2832U dongle with the Elonics E4000 tuner in it, rather than the Rafael R820T that most cheap dongles ship with now. The E4000 covers roughly 52 MHz to 2.2 GHz with a gap somewhere around 1.1 to 1.25 GHz, so it reaches a little higher than the R820T. The catch with all of these sticks is the crystal: it's a cheap 28.8 MHz part and can be tens of ppm out, which at 950 MHz is tens of kHz. Before trusting any frequency readout I wanted to know how far off this one was.

GSM base stations are a good free reference. Their downlink carriers are locked to very accurate clocks and every carrier sends a frequency correction burst, a pure tone at a known offset. kalibrate-rtl listens for those bursts and tells you how far the dongle's idea of the frequency is from the truth. This was on Kali Linux in May 2018.

Stop the DVB driver grabbing the stick

The kernel's DVB-T driver will claim the dongle as a TV tuner. librtlsdr can detach it on the fly (you'll see "Detached kernel driver" in the output below), but it's tidier to blacklist it:

echo 'blacklist dvb_usb_rtl28xxu' | sudo tee /etc/modprobe.d/blacklist-rtl.conf
sudo modprobe -r dvb_usb_rtl28xxu

Unplug and replug, then check the tuner is seen:

rtl_test -t

It should report Found Elonics E4000 tuner.

Build kalibrate-rtl

sudo apt-get install build-essential libtool autoconf automake pkg-config \
    librtlsdr-dev libfftw3-dev git
git clone https://github.com/steve-m/kalibrate-rtl.git
cd kalibrate-rtl
./bootstrap && CXXFLAGS='-W -Wall -O3' ./configure && make

The binary is src/kal. I ran it from there rather than installing it.

Scan the band

cd src
./kal -s GSM900 -g 40

-s picks the band (GSM850, GSM-R, GSM900, EGSM, DCS, PCS) and -g sets the tuner gain in dB. The scan takes a minute or two. Trimmed output:

Found 1 device(s):
  0:  Generic RTL2832U OEM

Using device 0: Generic RTL2832U OEM
Detached kernel driver
Found Elonics E4000 tuner
Exact sample rate is: 270833.002142 Hz
Setting gain: 40.0 dB
kal: Scanning for GSM-900 base stations.
GSM-900:
        chan: 90 (953.0MHz -  72Hz)     power: 892672.99
        chan: 114 (957.8MHz -  76Hz)    power: 2412559.94

Each line is an ARFCN (the GSM channel number), its nominal downlink frequency, the offset kal measured, and a relative power figure. The power number has no units; it's only useful for picking the strongest carrier.

Running the scan twice gave me a slightly different list each time, with weaker channels coming and going, and the offset on the same channel moved by up to a couple of hundred Hz between runs. That's normal: it's a quick look, not a measurement.

Measure the error properly

Pick the strongest channel from the scan and let kal sit on it:

./kal -c 114 -g 40

It captures a series of frequency correction bursts on that channel, then prints the average offset and an average absolute error in ppm. That ppm figure is the one you want. Run it on two or three different strong channels; if they agree, you can trust it.

Use the correction

Every librtlsdr tool takes the ppm correction, so you only measure it once per dongle:

rtl_fm -p 12 -f 100.0M -M wbfm -s 200000 -r 48000 - | aplay -r 48000 -f S16_LE
rtl_sdr -p 12 -f 433.92M -s 1024000 -n 10240000 capture.cu8

Swap 12 for your own figure. In gqrx it's the "Freq. correction" box in the device settings, and in GNU Radio it's the ppm setting on the osmocom source block.

What to watch for

The error drifts with temperature. Let the dongle warm up for ten minutes before calibrating, and calibrate in roughly the conditions you'll use it in.
If kal finds nothing, try more gain, a better antenna near a window, or a different band. Some areas have more DCS1800 than GSM900, and in some countries the 900 MHz band has already been handed over to 3G and 4G.
kal only receives. It needs nothing but the published band plan and the frequency correction bursts; it doesn't decode traffic, and you shouldn't need to either. In the UK, deliberately decoding communications you aren't meant to receive is an offence, even if your equipment can do it.

Today: the E4000 went out of production years ago, and dongles with a 1 ppm TCXO are cheap, so calibration matters much less. The ppm figure still matters for older sticks and for anything narrowband.