KerberosSDR is our four tuner coherent RTL-SDR product made in collaboration with Othernet. With KerberosSDR applications like radio direction finding and passive radar are possible, and our free open source demo software helps to make it easier to get started exploring these applications. In this post we explore how a simple passive radar setup can be used to measure how busy a neighborhood is in terms of vehicular traffic.
Passive radar makes use of already existing strong 'illuminator' signals such as broadcast FM, DAB, digital TV and cellular. When these signals reflect off a moving metallic object like an aircraft or vehicle, it distorts the signal slightly. By comparing the distorted signal to a clean signal we can determine the distance and speed of the object causing the reflection. Wide reaching digital signals like DVB-T and DAB are often the best illuminators to use. Wideband cellular signals can also be used to detect more local targets.
In a simple passive radar system we use two directional antennas such as Yagi's. One Yagi points towards the broadcast tower and receives the clean non-distorted reference signal. This is known as the reference channel. A second Yagi points towards the area you'd like to monitor for reflections, and this is called the surveillance channel.
In our setup we point the reference channel Yagi towards a 601 MHz DVB-T transmitter roughly 33 km away. A second Yagi is placed on a vantage point overlooking a neighborhood. The Yagi's used are cheap DVB-T TV Yagi's that can be found in any electronics or TV retail store (or on Amazon for ~$30 - $60 USD). In the software we used a bandwidth of 2.4 MHz and adjusted the gains for maximum SNR.
It is important that the surveillance channel is isolated from the reference signal as much as possible. We improve the isolation simply by placing a metal sheet next to the surveillance Yagi to block the reference DVB-T signal more. Note that putting the antennas outside will obviously result in much better results. These walls and windows contain metal which significantly reduce signal strength. We also added our RTL-SDR Blog wideband LNA to the surveillance channel powered by a cheap external bias tee to improve the noise figure of the surveillance channel.
The resulting passive radar display shows us a live view of objects reflecting. Each dot on the display represents a moving vehicle that is reflecting the DVB-T surveillance signal. In the image shown below the multiple colored objects in the left center are vehicles. The X-Axis shows the distance to the object, and the Y-Axis shows the doppler speed. Both axes are relative to the observation location AND the transmit tower location.
Vehicles on the Passive Radar Display
When there are more moving cars on the road during the day and rush hours, there are more blips seen on the passive radar display. Larger vehicles also produce larger and stronger blips. By simply summing the matrix that produces this 2D display, we can get a crude measurement of how busy the neighborhood is, in terms of cars on the road since reflections are represented by higher values in the matrix. We logged this busyness value over the course of a day and plotted it on a graph.
The resulting graph is as you'd intuitively expect. At 6AM we start to see an increase in vehicles with people beginning their commute to work. This peaks at around 8:30AM - 9am with parents presumably dropping their kids off to the neighborhood school which starts classes at 9AM. From there busyness is relatively stable throughout the day. Busyness begins to drop right down again at 7PM when most people are home from work, and reaches it's minimum at around 3am.
Traffic Busyness detected with KerberosSDR Passive Radar
One limitation is that this system cannot detect vehicles that are not moving (i.e. stuck in standstill traffic). Since the doppler speed return will be zero, resulting in no ping on the radar display. The detection of ground traffic can also be distorted by aircraft flying nearby. Aircraft detections result in strong blips on the radar display which can give a false traffic result.
It would also be possible to further break down the data. We could determine the overall direction of traffic flow by looking at the positive and negative doppler shifts, and also break down busyness by distance and determine which distances correspond to particular roads. In the future we hope to be able to use the additional channels on the KerberosSDR to combine passive radar and direction finding, so that the the blips can actually be directly plotted on a map.
If you want to try something similar on the KerberosSDR software edit the RD_plot function in the _GUI/hydra_main_window.py file, and add the following simple code before CAFMatrix is normalized. You'll then get a log file traffic.txt which can be plotted in excel (remember to convert Unix time to real time and apply a moving average)
SDRPlay have recently published a video demonstrating how the new RSPduo diversity feature in SDRUno can be used to cancel local interference. The SDRplay RSPDuo is a 14-bit dual tuner software defined radio capable of tuning between 1 kHz - 2 GHz. It's defining feature is that it has two receivers in one radio, which should allow for interesting phase coherent applications such as diversity. The RSPDuo's diversity feature allows us to either combine two antenna signals together for an up to 3 dB increase, or for removal of an unwanted noise source via subtraction of signals.
In the video they show a broadcast AM signal that has it's SNR reduced by being on top of a local electrical noise source. The use a Bonito Mega-dipole on tuner 1, and a Bonito Mini-whip on tuner 2. The Mini-whip appears to receive the local interference stronger, so can be subtracted away from the Mega-dipole's signal with the diversity function. The result is improved SNR, and the noise is almost entirely cancelled.
There are 2 very practical applications for diversity software. The first is MRC (Maximum Ratio Combination) Diversity which, in order to be effective, needs two antennas presenting the same signal with some degree of diversity. Then there is this second impressive application which is becoming more and more useful due to the growing number of domestic sources of interference.
This is possible in an RSPduo, due to the coherent nature of the combined tuner streams being presented to the computer for processing.
Using Diversity in SDRplay's SDRuno to Cancel Local Interference
As promised we announced the release to KerberosSDR mailing list subscribers first, so that they'd be the first to get the initial discounted early bird units. However due to much higher than expected interest, we have released a few "second early bird" units at a still discounted price of $115 + shipping. We're only going to release 300 of these so get in quick before the price jumps up to $125. Our pre-order campaign will last 30 days, and afterwards the retail price will become $150.
If you weren't already aware, over the past few months we've been working with the engineering team at Othernet.is to create a 4x Coherent RTL-SDR that we're calling KerberosSDR. A coherent RTL-SDR allows you to perform interesting experiments such as RF direction finding, passive radar and beam forming. In conjunction with developer Tamas Peto, we have also had developed open source demo software for the board, which allows you to test direction finding and passive radar. The open source software also provides a good DSP base for extension.
KerberosSDR with Calibration Board Attached (Metal Enclosure with SMA connectors Not Shown)KerberosSDR Main Board (Metal Enclosure with SMA connectors Not Shown)
KerberosSDR is our upcoming low cost 4-tuner coherent RTL-SDR. With four antenna inputs it can be used as a standard array of four individual RTL-SDRs, or in coherent applications such as direction finding, passive radar and beam forming. More information can be found on the KerberosSDR main post. Please remember to sign up to our KerberosSDR mailing list on the main post or at the end of this post, as subscribers will receive a discount coupon valid for the first 100 pre-order sales. The list also helps us determine interest levels and how many units to produce.
In this post we're showing some more passive radar demos. The first video is a time lapse of aircraft coming in to land at a nearby airport. The setup consists of two DVB-T Yagi antennas, with KerberosSDR tuned to a DVB-T signal at 584 MHz. The reference antenna points towards a TV tower to the west, and the surveillance antenna points south. Two highlighted lines indicate roughly where reflections can be seen from within the beam width (not taking into account blockages from mountains, trees etc).
The second video shows a short time lapse of a circling helicopter captured by the passive radar. The helicopter did not show up on ADS-B. On the left are reflections from cars and in the middle you can see the helicopter's reflection moving around.
We are expecting to receive the final prototype of KerberosSDR within the next few weeks. If all is well we may begin taking pre-orders shortly after confirming the prototype.
KerberosSDR is our upcoming low cost 4-tuner coherent RTL-SDR. With four antenna inputs it can be used as a standard array of four individual RTL-SDRs, or in coherent applications such as direction finding, passive radar and beam forming. More information can be found on the KerberosSDR main post. Please remember to sign up to our KerberosSDR mailing list on the main post or at the end of this post, as subscribers will receive a discount coupon valid for the first 100 pre-order sales. The list also helps us determine interest levels and how many units to produce.
In this post we'll show an experiment that we performed which was to pinpoint the location of a transmitter using KerberosSDR's coherent direction finding capabilities. RF direction finding is the art of using equipment to determine the location of a transmitting signal. The simplest way is by using a directional antenna like a Yagi to try and determine the bearing based on signal strength. Another method is using a pseudo-doppler or coherent array of antennas to determine a bearing based on phase information.
For the test we tuned the KerberosSDR RTL-SDRs to listen to a signal at 858 MHz and then drove to multiple locations to take direction readings. The antennas were set up as a linear array of four dipole antennas mounted on the windshield of a car. To save space, the dipoles were spaced at approximately a 1/3 the frequency wavelength, but we note that optimal spacing is at half a wavelength. The four dipole antennas were connected to KerberosSDR, with a laptop running the direction finding demo software.
Low cost direction finding array mounted to vehicle windshield.
Our open source demo software (to be released later when KerberosSDR ships) developed by Tamás Peto gives us a graph and compass display that shows the measured bearing towards the transmitter location. The measured bearing is relative to the antenna array, so we simply convert it by taking the difference between the car's bearing (determined approximately via road direction and landmarks in Google Earth) and the measured bearing. This hopefully results in a line crossing near to the transmitter. Multiple readings taken at different locations will end up intersecting, and where the intersection occurs is near to where the transmitter should be.
KerberoSDR SDR Directing Finding DOA Reading
In the image below you can see the five bearing measurements that we made with KerberosSDR. Four lines converge to the vicinity of the transmitter, and one diverges. The divergent reading can be explained by multipath. In that location the direct path to the transmitter was blocked by a large house and trees, so it probably detected the signal as coming in from the direction of a reflection. But regardless with four good readings it was possible to pinpoint the transmitting tower to within 400 meters.
In the future we hope to be able to automate this process by using GPS and/or e-compass data to automatically draw bearings on a map as the car moves around. The readings could also be combined with signal strength heatmap data for improved accuracy.
This sort of capability could be useful for finding the transmit location of a mystery signal, locating a lost beacon, locating pirate or interfering transmitters, determining a source of noise, for use during fox hunts and more.
KerberosSDR pinpointing a transmitters locationKerberosSDR Prototype
KerberosSDR (formerly HydraSDR) is our upcoming 4-input coherent RTL-SDR. It's designed for coherent applications like RF direction finding, passive radar, beam forming and more, but can also be used as a standard 4-channel SDR for monitoring multiple frequencies. In this post we demonstrate the direction finding application running on the TinkerBoard.
Reminder: If you have any interest in KerberosSDR, please sign up to our KerberosSDR mailing list. Subscribers to this list will be the first to know when KerberosSDR goes on preorder, and the first 100 sales will receive a discounted price.
KerberosSDR Updates
This week we've managed to get the KerberosSDR demo software made by Tamás Peto functioning on a TinkerBoard. The TinkerBoard is a US$60 single board computer. It's similar to a Raspberry Pi 3, but more powerful. We've also tested the app running on the Raspberry Pi 3 and Odroid XU4. The Pi 3 is capable of running the software but it is a little slow, and the Odroid XU4 is a little faster than the TinkerBoard. In the future we hope to further optimize the code so even Raspberry Pi 3's will be smooth.
In the video below we used a circular array of four whip antennas connected to KerberosSDR. The TinkerBoard is connected to KerberosSDR and is set up to generate a WiFi hotspot, which we connect to with an Android phone and a Windows laptop. The Windows laptop connects to the TinkerBoard's desktop via VNC, and the Android phone receives an HTML/JavaScript based compass display via an Apache server running on the Tinkerboard. With this setup we can wirelessly control and view information from KerberosSDR and the TinkerBoard.
We've also tested the KerberosSDR system on a real signal, and have found it to work as expected. More demo's of that coming later.
Over the last few months we've been working on a 4-input coherent RTL-SDR called 'KerberosSDR' (formerly known as HydraSDR) that is designed to be a low cost way to get into applications such as RF direction finding, passive radar, beam forming and more. It can also be used as a standard 4-channel SDR for monitoring multiple frequencies as well.
Phase coherent RTL-SDRs have been worked on and demonstrated several times over the past few years, but we've been disappointed to find that so far there hasn't been any easy way to replicate these experiments. The required hardware has been difficult to build and access, and the software has been kept as unreleased closed source or has been too complicated to install and use. With KerberosSDR we aim to change that by making phase coherent applications easier to access and run by providing ready to use hardware and software.
Thanks to our developer Tamás Peto, a PhD student at Budapest University of Technology and Economics whom we hired via the ad in our previous post, and the Othernet (formerly Outernet) engineering team who are our partners on this project, we've been able to build a working system, and demonstrate coherent direction finding and passive radar working as expected (demo videos below). We plan to eventually release Tamás' code as open source so that the entire community can benefit and build on it. Also if KerberosSDR turns a profit, we plan to reinvest some of the profits into continually improving the software and expanding the list of use cases.
KerberosSDR will be usable for coherent applications from ~80-100 MHz up to 1.7 GHz (as a standard receiver it will work down to 24 MHz like a regular RTL-SDR). The lower coherent limitation is due to the phase calibration board, and could be improved by custom creating a larger calibration PCB.
At the moment we are finalizing our prototype, and plan to begin final production within the next 2-3 months.
If you have any interest in KerberosSDR, please sign up to our Kerberos mailing list.
Direction Finding
KerberosSDR can be used to find the bearing towards a signal using it's coherent direction finding capabilities. The software by Tamás currently implements several direction finding algorithms such as Bartlett, Capon, Maximum Entropy (MEM) and MUSIC. In the video below we show a quick test of the direction finding system working with a HackRF being used as a signal source, and four dipole antennas connected to KerberosSDR in a linear array. The MUSIC algorithm is used.
KerberosSDR Direction Finding Test
In the image below we also attempted to find the direction towards a known TETRA transmitter. We were able to confirm the direction with an Android compass app that points towards the known transmitter location. As the two angles match, we can be confident that Kerberos is finding the correct direction to the transmitter.
Finding the direction of a TETRA Transmitter
Passive Radar
KerberosSDR can also be used for passive radar. Normal radar systems work by transmitting a pulse of RF energy, and listening to the reflections from objects like planes, cars and ships. Passive radar works by using already existing transmitters such as those for FM/TV and listening for reflections that bounce of objects.
With a simple passive radar system you need two directional antennas and two coherent receivers. One antenna points at the transmitting 'reference' tower, and the other at the 'surveillance' area where you want to listen for reflections. It's important to try and keep as much of the reference signal out of the surveillance antenna as possible, which is why directional antennas like Yagi's are used.
The result is a doppler vs time delay graph, where the reflection of aircraft, cars, ships and other objects can be seen. The doppler gives you the speed of the object relative to your antenna and the transmitting tower, and the time delay gives you the distance relative to your antenna and the transmitter tower.
Below is an example time lapse video of KerberosSDR being used for passive radar. The reference antenna points towards a DVB-T transmitter at 588 MHz, and the surveillance antenna overlooks a small neighborhood, with aircraft sometimes flying over. The antennas we used were two very cheap TV Yagis.
You can constantly see the reflections from vehicles at small doppler values (low speeds), and every now and then you see an aircraft reflection which shows up at much higher doppler (speed) and further time delay (distance) points.
More information about KerberosSDR
KerberosSDR includes:
4x Coherent R820T2 based RTL-SDR dongles with standard 24 MHz - 1.7 GHz frequency range
On board GPIO switched wide band noise source for sample sync and phase calibration
Special phase calibration PCB for 4x inputs. Required to make the Kerberos phase coherent.
On board USB Hub, so only one USB port is required on the PC
Shielded metal enclosure
KerberosSDR can also be extended to 8x receivers by daisy chaining two boards together, so that their clocks and noise sources are connected. We've also taken into account undesirable effects such as heat related PLL drift which can be an issue for phase coherence.
At the moment we are also investigating whether singleboard computers like the Raspberry Pi 3 or Tinkerboard can be used, and there will be a header available for powering them via the Kerberos PCB. In the future we also plan to work on optimizing the code and potentially using CUDA/OpenCL GPU optimizations for passive radar so everything runs smoothly.
Once released we plan to have extensive tutorials and documentation that show exactly how to set up and replicate direction finding and passive radar experiments with low cost antennas.
Screenshots of KerberosSDR software:
Screenshots of each KerberosSDR software screen
Remember, if you're interested please sign up to the KerberosSDR mailing list for announcements and the chance to get in early with the cheaper first 100 units.
Be on the look out for more interesting demos that will be posted in the coming weeks!
[the_ad id="14114"]
Update: Please note that due to a Trademark complaint, we have changed the name of this unit from HydraSDR to KerberosSDR.
KerberosSDR Updates: 27 August 18
This week we've managed to get the KerberosSDR demo software made by Tamás Peto functioning on a TinkerBoard. The TinkerBoard is a US$60 single board computer. It's similar to a Raspberry Pi 3, but more powerful. We've also tested the app running on the Raspberry Pi 3 and Odroid XU4. The Pi 3 is capable of running the software but it is a little slow, and the Odroid XU4 is a little faster than the TinkerBoard. In the future we hope to further optimize the code so even Raspberry Pi 3's will be smooth.
In the video below we used a circular array of four whip antennas connected to KerberosSDR. The TinkerBoard is connected to KerberosSDR and is set up to generate a WiFi hotspot, which we connect to with an Android phone and a Windows laptop. The Windows laptop connects to the TinkerBoard's desktop via VNC, and the Android phone receives an HTML/JavaScript based compass display via an Apache server running on the Tinkerboard. With this setup we can wirelessly control and view information from KerberosSDR and the TinkerBoard.
We've also tested the KerberosSDR system on a real signal, and have found it to work as expected. More demo's of that coming later.
KerberosSDR Direction Finding Test 2: Tinkerboard + Circular Array
KerberosSDR Prototype with TinkerBoard Running Computations
KerberosSDR Updates: 4 September 2018
In this post we'll show an experiment that we performed which was to pinpoint the location of a transmitter using KerberosSDR's coherent direction finding capabilities. RF direction finding is the art of using equipment to determine the location of a transmitting signal. The simplest way is by using a directional antenna like a Yagi to try and determine the bearing based on signal strength. Another method is using a pseudo-doppler or coherent array of antennas to determine a bearing based on phase information.
For the test we tuned the KerberosSDR RTL-SDRs to listen to a signal at 858 MHz and then drove to multiple locations to take direction readings. The antennas were set up as a linear array of four dipole antennas mounted on the windshield of a car. To save space, the dipoles were spaced at approximately a 1/3 the frequency wavelength, but we note that optimal spacing is at half a wavelength. The four dipole antennas were connected to KerberosSDR, with a laptop running the direction finding demo software.
Low cost direction finding array mounted to vehicle windshield.
Our open source demo software (to be released later when KerberosSDR ships) developed by Tamás Peto gives us a graph and compass display that shows the measured bearing towards the transmitter location. The measured bearing is relative to the antenna array, so we simply convert it by taking the difference between the car's bearing (determined approximately via road direction and landmarks in Google Earth) and the measured bearing. This hopefully results in a line crossing near to the transmitter. Multiple readings taken at different locations will end up intersecting, and where the intersection occurs is near to where the transmitter should be.
KerberoSDR SDR Directing Finding DOA Reading
In the image below you can see the five bearing measurements that we made with KerberosSDR. Four lines converge to the vicinity of the transmitter, and one diverges. The divergent reading can be explained by multipath. In that location the direct path to the transmitter was blocked by a large house and trees, so it probably detected the signal as coming in from the direction of a reflection. But regardless with four good readings it was possible to pinpoint the transmitting tower to within 400 meters.
In the future we hope to be able to automate this process by using GPS and/or e-compass data to automatically draw bearings on a map as the car moves around. The readings could also be combined with signal strength heatmap data for improved accuracy.
This sort of capability could be useful for finding the transmit location of a mystery signal, locating a lost beacon, locating pirate or interfering transmitters, determining a source of noise and more.
KerberosSDR pinpointing a transmitters location
KerberosSDR Updates 7 September 2018
For this test we parked our car to the side of a highway and pointed a cheap DVB-T Yagi antenna towards a DVB-T transmission tower, and another cheap Yagi down the road. The video shown below displays the results captured over a 5 minute period. The blips on the top half of the display indicate vehicles closing on our location (positive doppler shift), and the blips on the bottom half indicate objects moving away (negative doppler shift).
DVB-T Antennas In Car
The resolution of each individual vehicle is not great, but it is sufficient to see the overall speed of the highway and could be used to determine if a road is experiencing traffic slowdowns or not. When larger vehicles pass by it is also obvious on the display by the brighter blip that they show. The display also shows us that the highway direction coming towards us is much busier than the direction moving away.
In the future we'll be working on optimizing the code so that the display updates much faster and smoother. It may also be possible in the future to use the third and fourth tuners to obtain even greater object resolution.
KerberosSDR Updates 27 September 2018
In this post we're showing some more passive radar demos. The first video is a time lapse of aircraft coming in to land at a nearby airport. The setup consists of two DVB-T Yagi antennas, with KerberosSDR tuned to a DVB-T signal at 584 MHz. The reference antenna points towards a TV tower to the west, and the surveillance antenna points south. Two highlighted lines indicate roughly where reflections can be seen from within the beam width (not taking into account blockages from mountains, trees etc).
The second video shows a short time lapse of a circling helicopter captured by the passive radar. The helicopter did not show up on ADS-B. On the left are reflections from cars and in the middle you can see the helicopter's reflection moving around.
We are expecting to receive the final prototype of KerberosSDR within the next few weeks. If all is well we may begin taking pre-orders shortly after confirming the prototype.
The RTL-SDR has a maximum available stable bandwidth of about 2.4 MHz. Many people have had the idea to combine multiple RTL-SDR dongles together to implement a wider band or multi channel RX device, but very few successful implementations have been seen. The biggest challenge is time synchronization between the multiple RTL-SDR units. Even if a common clock is used, there is no guarantee that the samples streams are synchronized, which can cause problems for the decoding of many signals. The most successful implementations so far have used a common clock, and an external synchronization signal from a generator in addition to other hardware like switches.
In his Multi-RTL block he implemented a method of a discovery he made that allows a way to time synchronize the dongles by using a signal that is already being broadcast over the air. He writes that his method is the following:
tuning the RTL-SDR dongles to the same frequency where some transmission is present,
recording a short signals with all of the dongles,
computing cross-correlation of the signals (i.e. with respect to a one selected channel),
finding position of maximums of cross-correlations in order to estimate relative delays of the channels,
correcting the delays so the channels are time-synchronized,
switching the dongles to their target frequencies,
changing other parameters of the channels (like gains) to target values.
With his Multi-RTL GNU Radio block Piotr was able to successfully monitor a GSM uplink and downlink channel pair that were spaced 45 MHz apart. Whilst monitoring the signals he sent an SMS to his phone, and then using his recovered encryption key was able to use gr-gsm to decode his message.
The successful implementation of this tool opens the door for many more RTL-SDR based projects, such as the reception of GSM uplink and downlink channels simultaneously, reception of frequency hopping signals, passive radar, and the receiving and decoding of signals with a bandwidth wider than 2.4 MHz.
Two dongles with a common clock.Synchronizing two dongles by using an external signal.
