The HackRF One SDR is a great value but it’s frequency stability leaves something to be desired. Using the Si5338 clock generator from Silicon Laboratories is an easy way to address the problem (if it’s really a problem for your application). The Si5338 is a programmable clock generator that can take an input reference clock (like a 10MHz sine wave from a GPS) and then generate any output frequency with a variety of different output driver types. Ironically in this case, we are simply generating a 10MHz output; but this output is “locked” to the input and so will behave with the same frequency changes, which luckily for us is very minimal if you are using an external GPS as the reference. Another advantage is that the output of the Si5338 is square wave and this is precisely what the HackRF needs (in some cases if you sine wave is at the appropriate voltage levels, you can feed this directly to the CLKIN of the HackRF). The output levels of my GPS are not correct for the HackRF. It’s not clear if the sine wave would be an issue or not.
Below you can see the HackRF One and beside it the Si5338 Evaluation Board. I am using an Evaluation Board to make sure everything works and then I will attempt to make a PCB with the exact configuration and programming that is needed.
Si5338 Clock Generator.
I am using my very inexpensive Rigol DS-1102D digital oscilloscope to ensure the output has correct voltage requirements for input into the HackRF One. In this case, I have programmed the Si5338 to use 3.3V CMOS output for the clock.
HackRF One with Si5338 board.
After a quick reset to the HackRF the SDR automatically switches over to the external clock. You do need to ensure you have the latest firmware and CPLD code (at one point there was a bug that prevented the automatic swith over).
So, now we just need to check the frequency accuracy. To do that I am comparing the “center frequencies” of an Inmarsat Aero decoder. This is a good test because the signals have very little drift since they are used by Aircraft that need to adjust for doppler. I removed the previously determined static error correction of -4250 Hz and Voila! Also, in addition to the static correct there was dynamic drift as well, that is gone too. All that is left is that of the satellite itself. I know this because i have another system that is completely locked to external reference and delta is +- 1 Hz. Not bad!
Below is screenshot from Aero decoder, the highlighted area in yellow is the real time delta from decoder PLL.
I’m always looking for opportunities to reduce the costs associated with high quality decoding tasks. The HackRF One is intriguing because it’s not very expensive, has a wide band receiver (10MHz – 6GHz) and an SDR that is capable of sample rates of 2-20 MS/sec (albeit with only an 8-bit sample size). The only way to find out how good (or bad) this SDR was to order one and test it out. Below is my new HackRF One wide band SDR.
Normally, I would hook up an SDR to the IF output to a communication receiver, but this little SDR has a wide band front end that supports 10MHz to 6GHz. So, I hooked it up directly to the Inmarsat POR L-band splitter that feeds many of the receivers here at USA-Satcom.com.
L-Band Splitter for Inmarsat POR.
The next step was to just do a quick test to ensure things works. So, I used SDR-Console V2 to get the HackRF One up and running on windows, tuning to the Inmarsat POR L-Band. It’s quite amazing to see almost the entire satellite transponder space on one screen! Again, using the SDR-Console-V2 I set it up for USB demodulation and directed the audio output to one my really old soundcard based decoders. Below you can see the old-school Inmarsat Standard-C decoder running without any immediate issues.
Decoding Std-C using HackRF One.
Soundcard based decoding is error prone for many reasons, so now that we have gotten this far, I went ahead and made a quick modification to my Aero-P multi-channel decoder to see how well things would work. This time I took advantage of the UDP Broadcast feature to steam IQ samples to my decoder. Below you can see 3 channels of Aero-P being decoded, again without any immediate issues.
HackRF One is set to the minimum sample rate of 2MHz for this test. As you know, the HackRF One uses just 8-bit samples and so there is some concerns about having adequate dynamic rage. But so, far with the fairly strong Aero-P signals there are no problems, it was running for about 4 hours without a single frame being lost or even a single CRC error.
While the testing so far has been successful I still want to do some additional modifications to allow full Aero decoding, which requires 4MHz of BW and 9 total channels. Voice channels can be weak and 8-bit sampling could introduce problems.
Two issues exist so far; The frequency stability is not so good (i had to correct for 4.5KHz out of the box), however, once set, it’s OK. This should be easily fixed by getting a more precise clock source – but there appears to be a HackRF One firmware bug preventing switch over to external clock source. The other issue is while 2MHz sample rate looks pretty clean, 4MHz has some spurs and images – this could be problematic for wide band use for my applications.
So, next steps are firmware upgrade to fix clock issues, more accurate clock source and finally some modifications to Aero decoder to allow 4MHz of spectrum as input.
If all this is successful, the HackRF One will replace one communications receiver and two SDR (that are limited to 2MHz sample rate). That would be quite amazing.
The diagram below illustrates the current Aero coverage that is possible here at USA-Satcom. As you can see there is quite a bit of IQ bandwidth to deal with and consequently at least two i7 hex core machines are needed to handle all the filtering and demodulation techniques. The industry really needs some multi-channel SDRs to avoid the needless transfer of so much spectrum. Multiple channels at the SDR would reduce CPU utilization, network traffic etc.
CONUS and POR Aero Coverage.
Protocols currently supported are:
Aero-H and H+
SDRs that are currently supported are:
The decoders just interface to the SDRs, so the communication receivers are not too important. However, we are currently using the following:
It’s that time of year again! Regular science crew transportation missions to and from Antarctica using US Air Force aircraft. Communications occur via Military Satcom in the Pacific Ocean Region. Below are a few recent satcom intercepts as well as ACARS from AERO-I via Inmarsat. I will post more intercepts to this thread as they occur.
Photo by afrc.af.mil. C-17 offloading in Antarctica.
Currently there are 9 AERO-I 600 Baud GMSK channels on POR. Quite a bit of ACARS and CPDLC traffic along with the usual Call Management signaling units. These signals are huge as you can see from the “tightness” of the phase diagram shown below. The AERO-I decoder shown below is simultaneously decoding all channels using just one SDR. There are also some 1200 Baud AERO-I channels present on POR, something to look at next.
Finally found an Aero H/H+ call that was encrypted. Supported crypto services on Aero are US-STU-III (Secure Telephone Unit), STE (Secure Terminal Equipment), FNBDT (Future Narrow Band Digital Terminal). Not clear which service this actually is but I suspect it’s STE. Nice to see encryption being used appropriately. This particular aircraft is a Gulfstream and is registered to Bank of Utah.
This call was not likely intended to be routed via the AMBE voice path. The AMBE codec bandwidth is not sufficient to run crypto.
Most of the popular Inmarsat activity is associated with ships and planes in AOR-E, AOR-W, POR and IOR. There is an Inmarsat satellite called 4F3 parked at 98W that gives CONUS coverage. This satellite is inclined and so does move up and down a bit. This satellite has quite a bit of BGAN services but there is also low rate paging (standard-D) and well as mini-c (standard-C) for fleet tracking. What is fleet tracking? It gives the ability to a company to track and communicate with all of the vehicles that make up a “fleet”. Two way message is possible as well as “polling” (group or individual). The dispatcher can see truck location and provide driving directions as needed.
Example of truck with fleet management.
98W coverage is on left.
On 98W there are currently two mini-c signals, both designated as “private LES” with LES ids of 252 and 253. The protocol is the same as the usual standard-c for the ocean regions but the NCS and LES stations are combined into one. Making some small changes to an existing decoder it was really quite easy to see what fleet tracking is all about. See screenshot below for one bulletin board packet identifying services.
Bulletin Board output.
See the screenshot below for example decode of both private LES simultaneously.
Example fleet tracking decode.
There are many different kinds of trucks that are tracked, some carry petroleum, some carry UPS, FED-EX and AMAZON loads, others more clandestine loads.
Below is a sample antenna that you may see on the top of some trucks that are under fleet management.
The AOR AR2300 is a PC Controlled All-Mode Communications Receiver that spans 40kHz to 3.15GHz. Since the radio is simply a black box with no front panel one must either use the software that comes with it or roll your own. I chose the latter path and wrote my own.
The AOR AR2300 Receiver.
The radio is used with an SDR and so all demodulation occurs in software, therefore only very basic controls are necessary. One feature is a software link to RF Space SprectraVue so that any frequency changes are automatically tracked. Also, the ability to adjust actual frequency for converters that employ a local oscillator.
Too many signals on different bands and tired of manually changing feed lines? Mini-circuits has a nice line of RF Matrix Switches that are USB controlled. I recently acquired a USB-4SPDR-A18 and have now finally gotten around to mounting and installing the new switch.
The switch is made of 4 independent relays that must be wired for proper group operation. The relays are controlled by a small embedded processor with a USB interface.
USB-4SPDT-A18 configured as SP5T (except for one missing jumper).
Since the relays have SMA connectors it is necessary to jumper to some additional SMA to N Female bulkhead adaptors for proper stress relief and cable management.
5 inputs and 1 output.
Bank od sma to N female bulkheads and grounding block.
The final placement, just before wiring. Note the station ground block, this will connect all receivers to station ground system (located near the coax entry area in another room).
Freshly installed microwave switch along with station grounding block.
Here is screenshot of the software that comes with the switch to control the relays.
The sample software from mini-circuits for relay control.
Luckily Mini-Circuits includes a DLL that can be used to customize your own application, which is exactly what i did.
Another new decoder project is in the works. This is another Multi-Channel decoder for Aero but instead of just ACARS and CPDLC it does AMBE and LPC voice decode. The screenshot below shows call logging status output from the prototype decoder. Like the Aero-P project this decoder uses the same control or NCS channels that carries the ACARS/CPDLC traffic except this application focuses on call “following” and directs up to 8 other decoders for actual voice demodulation. Note the captured call highlighted in yellow below. That is a 519 second AMBE call that was classified as non-safety from the aircraft associated with ICAO address 7CF865, which happens to be an Airbus A-300 registered to the Royal Australian Air Force (RAAF). You can look it up yourself at airframes.org.
Status output from decoders.
The AMBE algorithm for Aero is owned by DVSI and therefore requires licensed HW or SW. I am using licensed HW as shown below. This card was available from DVSI but may no longer be due to the inability for them to acquire all the legacy parts to build the boards! I purchased the board a couple years ago for a Mini-M project.
DVSI AMBE DSP Board.
More updates later as the project continues development.This software is intended for commercial use so please don’t ask if you can download it.