Tagged: direction finding

Locating Various HF Transmitters and Number Stations with KiwiSDRs

If you weren't already aware, the KiwiSDR is a US$299 HF SDR that can monitor the entire 0 - 30 MHz band at once. It is designed to be web-based and shared, meaning that the KiwiSDR owner, or anyone that they've given access, can tune and listen to it via a web browser over the internet. Many public KiwiSDRs can be found and browsed from the list at sdr.hu.

One thing that KiwiSDRs have is a GPS input which allows the KiwiSDR to run from an accurate clock, as well as providing positional data. Time Difference of Arrival (TDoA) is a direction finding technique that relies on measuring the difference in time that a signal is received at over multiple receivers spread out over some distance. In order to do this an accurate clock that is synchronized with each receiver is required. GPS provides this and is able to accurately sync KiwiSDR clocks worldwide.

Over on his blog Christoph Mayer has been steadily documenting his work on getting Time Difference of Arrival (TDoA) direction finding to work with KiwiSDRs. This is not an easy task with HF signals, as they tend to bounce around and propagate through various means, meaning that signals can be delayed if not received directly. So far it appears that he's been most successful in locating signals received by ground wave, but he is also working with an ionospheric ray-tracing model and electron density data to take into account propagation delays from skywave propagation.

Skywave and Groundwave Propagation
Skywave and Groundwave Propagation

In one post from late last year Christoph shows that he was able to pinpoint the location of the German DCF77 longwave time station by using three KiwiSDRs spread out around Europe. The actual location of DCF77 is already known, so this shows that the technique actually works. Other posts show him locating transmitters for STANAG 4285, some unknown frequency hopping signals, OTH radar from Cyprus, CODAR, DRM, VOLMET and more.

Christophs' code can be found at https://github.com/hcab14/TDoA. According to users gathering the data and running the code is still a fairly elaborate process. But there is talk over on the KiwiSDR forums about eventually creating a server that would allow users to more easily request a location computation for a particular signal. 

Pinpointing DCF77 with KiwiSDRs
Pinpointing DCF77 with KiwiSDRs (Bottom right image shows pinpointed location)

Also related to this topic, priyom.org has been using KiwiSDRs to try and locate numbers stations. Numbers stations are mysterious voice stations on the HF bands that when transmitting read out a string of numbers. Most speculate that the numbers are some sort of code intended for international spy agents. Using a simpler method of just noting which KiwiSDRs in the world receive a particular numbers station more strongly, they've been able to determine the likely country of some well known stations.

Building an RF Direction Finding Robot with an RTL-SDR

Over on Hackaday.io, project logger Humpelstilzchen has been writing about his attempts to create an autonomous RF direction finding robot RC car with an RTL-SDR. The goal is to set up an ISM band transmitter as a beacon, and use the RTL-SDR on the robot as the receiver. It will then use direction finding techniques to drive towards the beacon. The robot is a 4WD RC toy car with some autonomous navigational features like GPS, ultrasonic, IMU and vision sensors.

In his latest project log Humpelstilzchen describes his first semi-successful attempt at getting RF direction finding working. In the experiment he uses a 433 MHz module to send out an FSK beacon. On the robot two antennas are used for the time difference of arrival/pseudo-doppler direction finding technique, and PIN diodes are used to rapidly switch between the antennas. A GNU Radio script running on a HummingBoard single board computer computes the TDOA/pseudo-doppler algorithm.

Psuedo-doppler direction finding works by rapidly switching between several antennas. The difference in the time that the signal arrives at each antenna can be used to calculate the transmitter's direction.

With the current set up he's been able to get the robot to distinguish if the beacon is closer to the left, or closer to the right, or equidistant. However, he notes that there are still problems with reflections of the beacon signal which can cause the robot to drive in the wrong direction.

This is still a work in progress and we look forward to his future results.

Humpelstilzchen's RF direction finding robot
Humpelstilzchen's RF direction finding robot

Pseudo-Doppler Direction Finding with a HackRF and Opera Cake

Last week we posted about Micheal Ossmann and Schuyler St. Leger's talk on Pseudo-Doppler direction finding with the HackRF. The talk was streamed live from Schmoocon 18, but there doesn't seem to be an recorded version of the talk available as of yet. However, Hackaday have written up a decent summary of their talk.

In their direction finding experiments they use the 'Opera Cake' add-on board for the HackRF, which is essentially an antenna switcher board. It allows you to connect multiple antennas to it, and choose which antenna you want to listen to. By connecting several of the same type of antennas to the Opera Cake and spacing them out in a square, pseudo-doppler measurements can be taken by quickly switching between each antenna. During the presentation they were able to demonstrate their setup by finding the direction of the microphone used in the talk.

If/when the talk is released for viewing we will be sure to post it on the blog for those who are interested.

OperaCake running with four antennas
OperaCake running with four antennas
Schyler's Poster on Pseudo Doppler from GNU Radio Con 17.
Schyler's Poster on Pseudo Doppler from GNU Radio Con 17.


A Tiny Object/Animal Tracking Device with RTL-SDR + Yagi Locator

The Tiny Transmitter
The Tiny Transmitter

Over on Hackaday.io we've come across a project by "Tom" who has created a small tracking device which is located using an RTL-SDR dongle and directional Yagi antenna. The tracking device itself is a simple fingernail sized low power UHF transmitter that transmits short pulses about every second or so in the 915 MHz ISM band. Tom writes that the range is about 400m (line of sight) and with a small button cell battery the device lasts a couple of days with its 180 uA current draw. Presumably longer operation could be achieved by significantly reducing the pulse rate of the circuit.

To receive the tracking device an RTL-SDR is combined with a high gain directional Yagi antenna, a three level 10 - 30 dB attenuator and an Android phone running the RF Analyzer app. The idea is to simply use the attenuator and directional Yagi antenna to determine the direction in which the signal is strongest. That direction with the strongest signal will indicate where the transmitter is. Tom's video below shows an example of the transmitter and RTL-SDR based tracking setup.

Low-tech Tiny UHF tracker transmitter

More Information on The Android RTL-SDR Direction Finding Implementation

Last week we posted about some interesting conference talk videos from GNU Radio Con 17. One of the videos was a talk by Sam Whiting who in conjunction with colleagues Dana Sorensen and Todd Moon from Utah State University have created an Android app that uses two coherent RTL-SDR dongles for direction finding. A coherent RTL-SDR can be created simply by removing the clock on one RTL-SDR and connecting the clock from another, so that they both share the same clock. The V3 RTL-SDR has a clock selector header which can be used to facilitate this as well.

Over on his YouTube account Sam Whiting has uploaded two videos showing the app in action. The backend GNU Radio code for direction analysis is available on GitHub, but unfortunately the Android code/apk is not available to the public as the code is owned by the funders of the project.

In the videos the app shows two arrows, one of which points towards the source of a transmission at a frequency that is being monitored. The second arrow is simply there due to the direction ambiguity produced by the methods used.

The GRCon17 presentation video can be found here, and the slides here.

DOA app

DOA app with maps

Localizing Transmitters to within a few meters with TDOA and RTL-SDR Dongles

Back in August we posted a number of videos from the Software Defined Radio Academy talks held this year in Friedrichshafen, Germany. One of those talks was by Stefan Scholl, DC9ST and titled Introduction and Experiments on Transmitter Localization with TDOA. This was a very interesting talk that showed how Stefan has been using three RTL-SDR + Raspberry Pi setups to locate the almost exact position of various transmitters with time difference of arrival (TDOA) techniques. TDOA works by setting up at least three receivers spread apart by some distance. Due to the speed of radio propagation, the transmitted signal will arrive at each receiver at a different time allowing the physical origin point of the signal to be calculated.

Now over on his blog Stefan has created a very nice writeup of his work with RTL-SDRs and TDOA that is definitely worth a good read. He first explains the basics of how TDOA actually works, and then goes on to explain how his RTL-SDR based system works. He discusses the important challenges such as transferring the raw data, synchronizing the receivers in time and the signal processing required. 

Stefans TDOA System
Stefans TDOA System

He tested the system on various transmitters including a DMR signal at 439 MHz, a mobile phone signal at 922 MHz, an FM signal at 96.9 MHz and an unknown signal at 391 MHz. The results were all extremely accurate, locating transmitters with an accuracy of up to a few meters.

Stefan has also uploaded all his MATLAB code onto GitHub.

Example localization of a DMR transmitter
Example localization of a DMR transmitter
Localizing the position of a mobile phone base station (Stars indicate known base stations)
Localizing the position of a mobile phone base station (Stars indicate known base stations)

Tracking Wildlife with TDOA Direction Finding and RTL-SDR Dongles

At the North-West University in South Africa Masters student SW Krüger submitted his dissertation titled “An inexpensive hyperbolic positioning system for tracking wildlife using off-the-shelf hardware” back in May of this year. Recently it was found online and can be viewed here (large pdf warning).

In his thesis Krüger explains his experiments with using RTL-SDR dongles to set up a very low cost wildlife monitoring system using TDOA (Time Difference of Arrival) techniques, and very low power beacons on the animal tags. TDOA is a difrection finding technique which involves using multiple receivers spread out over a region and calculating the difference in time from when the signal arrives at each receiver. With this information the position of the transmitter can be determined. Typically to do this the system clock in the computing hardware and OS needs to be synchronized as perfectly as possible between receivers, otherwise timing difference will cause huge errors in the position. Krüger uses synchronization bursts from a beacon, but notes that a real-time clock or GPS module could also be used for accurate time keeping.

In his experiment he set up two RTL-SDR receivers spaced 9 km apart and was able to obtain an accuracy of about 3.5m, which he writes is similar to other wildlife positioning systems that use tags with much higher power consumption. The computing hardware used at the RX station is a Raspberry Pi 3 powered by a 20W solar panel and batteries. There is also a wireless 3G modem for communications. The DSP software produced for the project is all open source and available on GitHub.

The RX System with RTL-SDR, Raspberry Pi, Mobile Broadband Modem, Power Supply and Solar Panel.
The RX System with RTL-SDR, Raspberry Pi, Mobile Broadband Modem, Power Supply and Solar Panel.

Feedback Request: New RTL-SDR Product, Ideas and Interest Check

We are considering building a new multi-purpose RTL-SDR product. The idea is to make several difficult to achieve applications and projects much more accessible. We are looking to implement the following ideas:

  • 3x on-board coherent RTL-SDRs built into the PCB
    • 4x SMA inputs: 3x individual inputs, 1x common input (switched between the two). 
    • All RTL-SDRs connected to the same clock source – enables coherent experiments
    • All RTL-SDR feature sets and performance equivalent to RTL-SDR V3 or better
  • On-board noise source and directional coupler
    • Useful for correlation with rtl_coherent
    • Measure filter characteristics, and get rough SWR antenna readings.
  • Noise source able to be switched in and out via silicon switches
    • Useful with rtl_coherent and other coherent experiments for cross correlation timing correction. This allows for accurate direction finding.
  • Ability to mount onto a Raspberry Pi 3, and provide an ESD protected, buffered and filtered output for RpiTX transmissions. (a PCB plugin filter specific to the transmission frequency would need to be installed onto PCB to use this feature)
    • With a filter installed the board can be connected to an antenna and used with RpiTX for simple transmissions.
    • Go portable with an Raspberry Pi 3 compatible HDMI LCD screen and a battery pack. Possible HackRF portapack alternative.

Possible applications:

  • Multi-band RTL-SDR applications
    • One RTL-SDR receiving NOAA, one receiving ADS-B, one scanning the air band.
    • Easy trunk tracking with 2x RTL-SDR. Third RTL-SDR used for something else.
    • One streaming NOAA weather, one scheduled to receive NOAA/Meteor sats and weather balloons, one receiving Outernet weather updates.
  • Coherent applications
    • RF direction finding
    • Passive radar
    • Possible radio astronomy applications?
  • Noise source applications
    • Characterize filters
    • VSWR meter with directional coupler
  • Raspberry Pi mount applications
    • Replay attacks and security analysis of ISM band devices with RpiTX and an ISM band filter.
    • Transmitting WSPR with WSPRpi.
    • Portable if used with a small HDMI screen and battery pack.
    • Possible control of board via an Android app.
    • Similar applications to the HackRF Portapack idea.
    • Multi-band noise locator if a GPS is added to the Pi. e.g. See Tim Havens’ ‘Driveby’ concept.

The idea is still in the concept stages so we’re looking for any feedback from the community to see if this is even something that people would want.

Would a receiver board like this interest anyone? We would also work on providing basic ready to go software on a downloadable image file for the Raspberry Pi 3 so starting an app would be as easy as using a launcher. We would also provide various tutorials as well.

The target price would be $99 USD. If you think this is too much, please let us know what you would expect to pay in the comments.

Are there any additional features that anyone requests? Please let us know in the comments.

Would you pay $99 USD for a 3-input RTL-SDR coherent receiver with built in noise source, antenna switcher and filtered RpiTX output?

View Results

Loading ... Loading ...