Aero Decoding and Full Support for HackRF One

After some work it is now possible to fully support HackRF One with my Inmarsat Aero decoder. In the past, the Inmarsat Aero decoder used two SDRs (each covering 2MHz) to cover up to 4MHz of L-Band spectrum as well as an expensive communication receiver. All this has been replaced by one HackRF One SDR/receiver. The diagram below shows the old setup and the new setup.

inmarsat_por_coverage_old
inmarsat_por_coverage_new

A sample screenshot showing the Aero Call Log (upper left), Single AMBE Voice decoder (upper right, 6 channels running, but only one shown), Overall Status of all 9 decoders (not including linked Aero-I channels) and finally the streamer application that is responsible for interfacing the HackRF One over USB and then streaming multiple channel of IQ over Ethernet to other decoders.

hackrf_aero_full_support_status

I am so happy with the HackRF One that I have ordered another for some more applications.

Posted in Inmarsat, Projects Tagged ,

Adding External Reference to HackRF One SDR

The HackRF One SDR is a great value but it’s frequency stability leaves something to be desired. Using the Si5338 clock generator from Silicon Laboratories is an easy way to address the problem (if it’s really a problem for your application). The Si5338 is a programmable clock generator that can take an input reference clock (like a 10MHz sine wave from a GPS) and then generate any output frequency with a variety of different output driver types. Ironically in this case, we are simply generating a 10MHz output; but this output is “locked” to the input and so will behave with the same frequency changes, which luckily for us is very minimal if you are using an external GPS as the reference. Another advantage is that the output of the Si5338 is square wave and this is precisely what the HackRF needs (in some cases if you sine wave is at the appropriate voltage levels, you can feed this directly to the CLKIN of the HackRF). The output levels of my GPS are not correct for the HackRF. It’s not clear if the sine wave would be an issue or not.

Below you can see the HackRF One and beside it the Si5338 Evaluation Board. I am using an Evaluation Board to make sure everything works and then I will attempt to make a PCB with the exact configuration and programming that is needed.

Si5338 Clock Generator.

Si5338 Clock Generator.

I am using my very inexpensive Rigol DS-1102D digital oscilloscope to ensure the output has correct voltage requirements for input into the HackRF One. In this case, I have programmed the Si5338 to use 3.3V CMOS output for the clock.

HackRF One with Si5338 board.

HackRF One with Si5338 board.

After a quick reset to the HackRF the SDR automatically switches over to the external clock. You do need to ensure you have the latest firmware and CPLD code (at one point there was a bug that prevented the automatic swith over).

So, now we just need to check the frequency accuracy. To do that I am comparing the “center frequencies” of an Inmarsat Aero decoder. This is a good test because the signals have very little drift since they are used by Aircraft that need to adjust for doppler. I removed the previously determined static error correction of -4250 Hz and Voila! Also, in addition to the static correct there was dynamic drift as well, that is gone too. All that is left is that of the satellite itself. I know this because i have another system that is completely locked to external reference and delta is +- 1 Hz. Not bad!

Below is screenshot from Aero decoder, the highlighted area in yellow is the real time delta from decoder PLL.

Aero Decoder Status Output.

Aero Decoder Status Output.

Posted in Inmarsat, Projects Tagged ,

HackRF One and Decoders

I’m always looking for opportunities to reduce the costs associated with high quality decoding tasks. The HackRF One is intriguing because it’s not very expensive, has a wide band receiver (10MHz – 6GHz) and an SDR that is capable of sample rates of 2-20 MS/sec (albeit with only an 8-bit sample size). The only way to find out how good (or bad) this SDR was to order one and test it out. Below is my new HackRF One wide band SDR.

HackRF One.

HackRF One.

Normally, I would hook up an SDR to the IF output to a communication receiver, but this little SDR has a wide band front end that supports 10MHz to 6GHz. So, I hooked it up directly to the Inmarsat POR L-band splitter that feeds many of the receivers here at USA-Satcom.com.

L-Band Splitter for POR.

L-Band Splitter for Inmarsat POR.

 

The next step was to just do a quick test to ensure things works. So, I used SDR-Console V2 to get the HackRF One up and running on windows, tuning to the Inmarsat POR L-Band. It’s quite amazing to see almost the entire satellite transponder space on one screen! Again, using the SDR-Console-V2 I set it up for USB demodulation and directed the audio output to one my really old soundcard based decoders. Below you can see the old-school Inmarsat Standard-C decoder running without any immediate issues.

Decoding Std-C using HackRF One.

Decoding Std-C using HackRF One.

Soundcard based decoding is error prone for many reasons, so now that we have gotten this far, I went ahead and made a quick modification to my Aero-P multi-channel decoder to see how well things would work. This time I took advantage of the UDP Broadcast feature to steam IQ samples to my decoder. Below you can see 3 channels of Aero-P being decoded, again without any immediate issues.

hackrfone_aero

HackRF One is set to the minimum sample rate of 2MHz for this test. As you know, the HackRF One uses just 8-bit samples and so there is some concerns about having adequate dynamic rage. But so, far with the fairly strong Aero-P signals there are no problems, it was running for about 4 hours without a single frame being lost or even a single CRC error.

While the testing so far has been successful I still want to do some additional modifications to allow full Aero decoding, which requires 4MHz of BW and 9 total channels. Voice channels can be weak and 8-bit sampling could introduce problems.

Two issues exist so far; The frequency stability is not so good (i had to correct for 4.5KHz out of the box), however, once set, it’s OK. This should be easily fixed by getting a more precise clock source – but there appears to be a HackRF One firmware bug preventing switch over to external clock source. The other issue is while 2MHz sample rate looks pretty clean, 4MHz has some spurs and images – this could be problematic for wide band use for my applications.

So, next steps are firmware upgrade to fix clock issues, more accurate clock source and finally some modifications to Aero decoder to allow 4MHz of spectrum as input.

If all this is successful, the HackRF One will replace one communications receiver and two SDR (that are limited to 2MHz sample rate). That would be quite amazing.

Posted in Inmarsat, Projects, Uncategorized Tagged , ,

Aero Coverage of POR and CONUS

The diagram below illustrates the current Aero coverage that is possible here at USA-Satcom. As you can see there is quite a bit of IQ bandwidth to deal with and consequently at least two i7 hex core machines are needed to handle all the filtering and demodulation techniques. The industry really needs some multi-channel SDRs to avoid the needless transfer of so much spectrum. Multiple channels at the SDR would reduce CPU utilization, network traffic etc.

CONUS and POR Aero Coverage.

CONUS and POR Aero Coverage.

Protocols currently supported are:

  • Aero-P
  • Aero-I
  • Aero-H and H+

SDRs that are currently supported are:

  • SDR-IP
  • NetSDR
  • QSDR

The decoders just interface to the SDRs, so the communication receivers are not too important. However, we are currently using the following:

  • ICOM IC-R9500 (fantastic receiver, ext reference lock)
  • ICOM IC-R8500 (just OK receiver)
  • AOR AR2300 (good receiver, ext reference lock)

Multiple SDRs are hooked up to the various receivers using simply splitters from mini-circuits.

Posted in Inmarsat, Projects, SATCOM Tagged , ,

Operation Deep Freeze 2014

It’s that time of year again! Regular science crew transportation missions to and from Antarctica using US Air Force aircraft. Communications occur via Military Satcom in the Pacific Ocean Region. Below are a few recent satcom intercepts as well as ACARS from AERO-I via Inmarsat. I will post more intercepts to this thread as they occur.

Photo by afrc.af.mil. C-17 offloading in Antarctica.

Photo by afrc.af.mil. C-17 offloading in Antarctica.

2014-15 field season in Antarctica starts with pair of flights on Sept. 30

Reach 5 Echo 2 doing radio check.
POR 257.05 MHz 09-25-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Radio Maintenance, Deep Freeze Ops. Mac Center. C17 doing radio checks for the season.

POR 257.05 MHz 09-26-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Additional radio checks. Base Ops, Charleston Roth, ICE 04. ICE 04 position report and weather. Quite a bit of good quality traffic.

POR 257.05 MHz 09-29-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

POR 257.05 MHz 10-01-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Mac Center, ICE 05, Charleston Roth, having issues texts weather via iridium and ACARS. But I can see the ACARS messages no problem Smilie: :)

POR 257.05 MHz 10-06-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

POR 257.05 MHz 10-07-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Deep Freeze Ops, ICE 06 with some problem with engine #4, iridium issues, Charleston Roth.

POR 257.05 MHz 10-08-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

I think they test satcom with radio check too many times! Reach 5E3 and ICE07.
POR 257.05 MHz 10-10-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

POR 257.05 MHz 10-11-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

POR 257.05 MHz 10-12-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

POR 257.05 MHz 10-14-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

POR 257.05 MHz 10-18-2014:

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

Here are two ACARS messages to ICE04 and ICE05 (same aircraft on two different days known as ICAO AE49C5). Via AERO-I POR Satellite:

ICE04 known as AE49C5.

ICE04 known as AE49C5.

ICE05 associated with AE49C5.

ICE05 associated with AE49C5.

NZPG is the ICAO code for Pegasus field at McMurdo station in Antarctica.

Here is nice shot by Patrick Weis of the cockpit of the actual C17 called ICE04/05 in the audio intercepts.

ICE04 C17 Cockpit. Photo by Patrick Weis.

ICE04/05 C17 Cockpit. Photo by Patrick Weis.

Posted in Inmarsat, Milair, SATCOM Tagged

AERO-I 600 Baud GMSK

Currently there are 9 AERO-I 600 Baud GMSK channels on POR. Quite a bit of ACARS and CPDLC traffic along with the usual Call Management signaling units. These signals are huge as you can see from the “tightness” of the phase diagram shown below. The AERO-I decoder shown below is simultaneously decoding all channels using just one SDR. There are also some 1200 Baud AERO-I channels present on POR, something to look at next.

AERO-I with ACARS, CPDLC and Call Management.

AERO-I with ACARS, CPDLC and Call Management.

Posted in Inmarsat, Projects Tagged

Aero Crypto Calls

Finally found an Aero H/H+ call that was encrypted. Supported crypto services on Aero are US-STU-III (Secure Telephone Unit), STE (Secure Terminal Equipment), FNBDT (Future Narrow Band Digital Terminal). Not clear which service this actually is but I suspect it’s STE. Nice to see encryption being used appropriately. This particular aircraft is a Gulfstream and is registered to Bank of Utah.

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.

This call was not likely intended to be routed via the AMBE voice path. The AMBE codec bandwidth is not sufficient to run crypto.

Posted in Inmarsat Tagged ,

Fleet Tracking on Inmarsat 4F3

Most of the popular Inmarsat activity is associated with ships and planes in AOR-E, AOR-W, POR and IOR. There is an Inmarsat satellite called 4F3 parked at 98W that gives CONUS coverage. This satellite is inclined and so does move up and down a bit. This satellite has quite a bit of BGAN services but there is also low rate paging (standard-D) and well as mini-c (standard-C) for fleet tracking. What is fleet tracking? It gives the ability to a company to track and communicate with all of the vehicles that make up a “fleet”. Two way message is possible as well as “polling” (group or individual). The dispatcher can see truck location and provide driving directions as needed.

Example of truck with fleet management.

Example of truck with fleet management.

98W coverage is on left.

98W coverage is on left.

On 98W there are currently two mini-c signals, both designated as “private LES” with LES ids of 252 and 253. The protocol is the same as the usual standard-c for the ocean regions but the NCS and LES stations are combined into one. Making some small changes to an existing decoder it was really quite easy to see what fleet tracking is all about. See screenshot below for one bulletin board packet identifying services.

Bulletin Board output.

Bulletin Board output.

See the screenshot below for example decode of both private LES simultaneously.

Example fleet tracking decode.

Example fleet tracking decode.

There are many different kinds of trucks that are tracked, some carry petroleum, some carry UPS, FED-EX and AMAZON loads, others more clandestine loads.

Below is a sample antenna that you may see on the top of some trucks that are under fleet management.

Sample mini-c antenna.

Sample mini-c antenna.

Posted in Inmarsat Tagged

Control Software for AOR AR2300

The AOR AR2300 is a PC Controlled All-Mode Communications Receiver that spans 40kHz to 3.15GHz. Since the radio is simply a black box with no front panel one must either use the software that comes with it or roll your own. I chose the latter path and wrote my own.

The AOR AR2300 Receiver.

The AOR AR2300 Receiver.

The radio is used with an SDR and so all demodulation occurs in software, therefore only very basic controls are necessary. One feature is a software link to RF Space SprectraVue so that any frequency changes are automatically tracked. Also, the ability to adjust actual frequency for converters that employ a local oscillator.

Control Software for AR2300.

Control Software for AR2300.

Posted in Projects Tagged

SP5T Microwave Switch

Too many signals on different bands and tired of manually changing feed lines? Mini-circuits has a nice line of RF Matrix Switches that are USB controlled. I recently acquired a USB-4SPDR-A18 and have now finally gotten around to mounting and installing the new switch.

The switch is made of 4 independent relays that must be wired for proper group operation. The relays are controlled by a small embedded processor with a USB interface.

USB-4SPDT-A18 configured as SP5T (except for one missing jumper).

USB-4SPDT-A18 configured as SP5T (except for one missing jumper).

Since the relays have SMA connectors it is necessary to jumper to some additional SMA to N Female bulkhead adaptors for proper stress relief and cable management.

5 inputs and 1 output.

5 inputs and 1 output.

Bank od sma to N female bulkheads and grounding block.

Bank od sma to N female bulkheads and grounding block.

The final placement, just before wiring. Note the station ground block, this will connect all receivers to station ground system (located near the coax entry area in another room).

Freshly installed microwave switch along with station grounding block.

Freshly installed microwave switch along with station grounding block.

Here is screenshot of the software that comes with the switch to control the relays.

The sample software from mini-circuits for relay control.

The sample software from mini-circuits for relay control.

Luckily Mini-Circuits includes a DLL that can be used to customize your own application, which is exactly what i did.

Antenna Switch Software.

Antenna Switch Software.

Posted in Projects Tagged