Back in July we posted about PICTOR, an open source and RTL-SDR based radio telescope project. The owner of the project recently wrote in and wanted to share some updates. His text is below:
The goal of this effort is to introduce students, educators, astronomers and others to the majesty of the radio sky, promoting radio astronomy education, without the need of building a large and expensive radio telescope.
Since the initial launch, PICTOR has gotten lots of updates and improvements, particularly in the software backend, providing more data to the users, using advanced techniques to increase the signal-to-noise ratio by calibrating spectra and mitigating radio frequency interference (RFI) (if present).
Here is an example observation with PICTOR, clearly showing the detection of 3 hydrogen-dense regions corresponding to 3 unique spiral arms in the Milky Way!
Graphs from the PICTOR RTL-SDR Radio Telescope showing the 3 unique spiral arms in the Milky Way.
The transmitting side consists of a GNU Radio flowchart that encodes the text file into a binary string, modulates that binary string with Binary Phase Shift Keying (BPSK), and then transmits it using the LimeSDR.
The receiving side uses an RTL-SDR, and is based on another GNU Radio flowgraph that uses a polyphase clock sync block to synchronize the sampling time, a costas loop for fine frequency correction, an LMS DD equalizer block to compensate for multipath effects, and finally demodulation blocks that recover the bits and text file from the BPSK signal.
His results showed that he can almost recover the entire file except for the first few bytes of data which is always lost since it takes time for the clock sync and costas loop block to converge. The post goes into further detail about what each of the blocks do and some of the signal theory math behind everything. The GNU Radio GRC file is also provided if you want to try it out yourself.
LimeSDR Transmitting a CSV file to a RTL-SDR with BPSK modulation.
Over on his YouTube channel Corrosive from the SignalsEverywhere YouTube channel has uploaded a video where he tests out the new US$29.95 NooElec PCB patch antenna for receiving L-band satellite signals. In the video he shows how it can be combined with one of their SAWBird L-band low noise amplifiers in order to receive L-band satellite signals such as Inmarsat STD-C and AERO.
We note that our own RTL-SDR Blog Active L-band patch antenna will be ready to ship out before the end of this month, and while waiting for it we are currently having a preorder sale for US$34.95 including free shipping over on our store. For US$34.95 our patch antenna is fully contained in a waterproof enclosure, includes an LNA built in, and comes with several mounting options, so we believe that it is really a great deal. The patch design is based on the Outernet ceramic patch that was compared against the NooElec PCB patch shown in Corrosives video, so performance will be very similar.
Nooelec NEW Inmarsat Patch Antenna with Airspy SDR
Over on YouTube user HackedExistence has uploaded a video explaining how POCSAG pager signals work, and he also shows some experiments that he's been performing with his HackRF PortaPack and an old pager.
The Portapack is an add on for the HackRF SDR that allows the HackRF to be used without the need for a PC. If you're interested in the past we reviewed the PortaPack with the Havok Firmware, which enables many TX features such as POCSAG transmissions.
POCSAG is a common RF protocol used by pagers. Pagers have been under the scrutiny of information security experts for some time now as it is common for hospital pagers to spew out unencrypted patient data [1][2][3] into the air for anyone with a radio and computer to decode.
In the video HackedExistence first shows that he can easily transmit to his pager with the HackRF PortaPack and view the signals on the spectrum with an RTL-SDR. Later in the video he explains the different types of pager signals that you might encounter on the spectrum, and goes on to dissect and explain how the POCSAG protocol works.
Corrosive (KR0SIV) from the SignalsEverywhere YouTube channel has uploaded a new video that explains and shows HD radio being decoded with an RTL-SDR.
If you are in the USA, you might recognize HD (Hybrid Digital) Radio (aka NRSC-5) signals as the rectangular looking bars on the frequency spectrum that surround common broadcast FM radio signals. These signals only exist in the USA and they carry digital audio data which can be received by special HD Radio receivers. Back in June 2017 we posted about how [Theori] was able to piece together a full HD Radio software audio decoder that works in real time. Later developments saw additional data such as traffic data and weather info extracted from HD Radio too.
Corrosive's video also shows a comparison between analog and HD Radio audio. We note that the "HD" doesn't stand for high definition, so audio quality is not really better than the analog stream. He also notes that the HD Radio data stream can contain multiple audio channels, and often they are not the same as the analog station it surrounds. One example he shows is a Simulcast AM radio station being rebroadcast via HD Radio.
Over on YouTube user Tech Addict Attic has uploaded a video demonstrating what lightning strikes look like on the radio spectrum. To receive the pulses he uses an RTL-SDR and a simple wire antenna located on his roof. He notes that the pulses show up at HF frequencies, and continue all the way up to the broadcast FM band and above.
When lightning strikes it emits a wideband RF pulse that can be detected several miles away by radios. On a software defined radio spectrum display the pulse shows up as a quick horizontal blip. Detecting this blip is how lightning detection websites like blitzortung.org work, although they use their own radio hardware.
In the past we posted about another user who also demonstrated lightning pulses using his RTL-SDR V3.
It is well known that almost all electronic devices unintentionally emit unique spurious RF signals when in operation. By using an SDR like an RTL-SDR to record the spectra from electronic devices, it's possible to build up a database of known emissions. We can then detect when an electronic device is active by comparing the live spectrum to spectra stored in the database.
In a previous post we covered Disney's EM sense which is an experimental smart watch that automatically detects what electronic device the wearer is touching. With EM Sense they use an RTL-SDR and a database of raw pre-recorded spectrum data. To detect what the wearer is touching the live signal from the RTL-SDR is correlated against the database, and the closest match is returned.
José's script does something very similar, however instead of correlating with raw spectrum data he instead uses the waterfall image that is generated by rtl_power and heatmap.py. The rtl_power program allows an RTL-SDR to scan the frequency spectrum over a wider bandwidth by rapidly scanning ~2.4 MHz chunks of bandwidth at different frequencies. Heatmap.py is a program that turns the scanned data from rtl_power into a heatmap image of the spectrum.
To add an entry to the database, the electronic device is placed 7-8 centimeters away from the RTL-SDR, and a heatmap image recorded between 24 - 921 MHz is saved to disk. This can be repeated for multiple electronic devices. Each image will record the spurious signals from the electronic device, resulting in a unique heatmap image per electronic device.
Once the database has been created, you can then place any of the devices found in the database next to the RTL-SDR, and record a heatmap for 20-30s. That heatmap will then be compared against the images in the database using imagemagick which is an image analysis and manipulation library. The electronic device associated with the closest matching image in the database will be returned.
In his experiments he tested various electronic devices like an iPhone and was able to successfully determine when it was nearby.
Various electronic device spectra waterfall images recorded in the database
Recently we came across Electrosense which is an interesting open source project that aims to deploy radio spectrum sensors worldwide in order to analyze and understand radio spectrum usage. This information could be extremely valuable in order to make more efficient use of the limited radio spectrum, and for detecting sources of interference and illegal transmissions. The hardware that Electrosense uses consists of just an RTL-SDR, Raspberry Pi, antenna and an optional GPS for time synchronization.
The ElectroSense network is a crowd-sourcing initiative to collect and analyse spectrum data. It uses small radio sensors based on cheap commodity hardware and offers aggregated spectrum information over an open API.
The initiative's goal is to sense the entire spectrum in populated regions of the world and to make the data available in real-time for different kinds of stakeholders which require a deeper knowledge of the actual spectrum usage.
ElectroSense is an open initiative in which everyone can contribute with spectrum measurements and access the collected data.
Overview of the Electrosense network
There are already several spectrum sensing projects in the works by big companies like Google, Microsoft, and IBM, but these only cover a small portion of the spectrum, or use high cost sensing stations limiting their ability to be deployed on a wide scale. Electrosense solves these problems by using low cost RTL-SDRs, and a crowd sourcing paradigm.
At the time of writing there are 103 sensors registered to the Electrosense network, with 23 being online, most of which are in Europe. Once you register an account on their site, you can browse the active sensors. Clicking on the spectrum button for a sensor brings up a live spectrum graph. For example in the screenshot below we access the data from an RTL-SDR + downconverter sensor in Madrid. We're able to see a live wideband 20 MHz to 6 GHz spectrum scan, and graphs of frequency occupancy rates.
Electrosense Active SensorsElectrosense Spectrum Scan and Occupancy Graphs
In addition to the standard SDR hardware being used, they've also designed a very interesting open hardware/source DC to 6 GHz up/downconverter board. The board is USB controlled, and switches between the upconverter for the lower HF bands, pass through for receiving DC- 1.6 GHz, and the downconverter for receiving up to 6 GHz. It has a 20 MHz output bandwidth which means that wide band SDRs can also make use of it.
Electrosense Up/Downconverter
The Electrosense website notes that anyone can host a sensor, and if you meet their criteria (permanent internet connection, ethernet connectivity and a low interference location) you can apply for a free kit. If you aren't selected for a free kit, then the Jetvision store based in Europe is selling Electrosense kits that include an RTL-SDR Blog V3, Raspberry Pi 3, power supply, SD card with preinstalled Electrosense software, and either our multipurpose dipole antenna, or a wideband discone with 15m of low loss cable for roof mounting.
The Electrosense team have been working hard on this project and have already published several related papers and a magazine article about the Electrosense network and it's use cases. One interesting paper discusses a method for decoding wideband signals using a network of non-coherent RTL-SDRs. Another paper discusses using using deep learning for automatic signal classification. The full list of publications can be found on their publications page.
If you're interested in this type of crowd sourced spectrum project, then you might also want to take a look at the KiwiSDR which is a networked 0 - 30 MHz SDR. Multiple crowd sourced KiwiSDR's can be used in a TDoA calculation for determining transmitter locations.
