Tagged: LR2021

LakeShark Update: Using an LR2021 LoRa Chip as an SDR for Portable P25, POCSAG and FM Reception on the ESP32-P4

Back in September, we posted about LakeShark, Samuel Reynolds’ (aka SAMS0N1TE) T-Display P4 ESP32-P4 firmware that turns a USB-connected RTL-SDR into a handheld P25 Phase 1, POCSAG, and FM receiver.

Samuel has now written in to share news that with the T-Display P4 variant containing a Semtech LR2021 LoRa chip, LakeShark no longer needs an RTL-SDR at all. Instead, it can pull raw I/Q samples directly out of the built-in LR2021 LoRa transceiver chip and demodulate them on the ESP32-P4. Back in May, we posted Zoltán Papp and team's discovery that showed how an LR2021 could receive ADS-B. But this relied on the chip’s built-in OOK mode.

With raw I/Q available, the chip’s built-in modes no longer limit what it can receive. Both of the LR2021’s RF paths work, providing continuous coverage from 100 MHz to 2.74 GHz, and no upconverters, external tuners, or extra front-end hardware are used. The sample rate is relatively low at 250 Ksps max, meaning only a narrow bandwidth slice is available, but this is more than large enough for narrowband channels like P25. Samuel notes that it’s pretty unreal being able to listen to his local analog NFM fire department channels from such a low-power chip.

Smanuel notes that the LR2021 is still pretty new, and few products use them. However, it is possible to DIY a receiver for about $28 with Waveshare’s Core2021 LR2021 modules and their ESP32-P4-WIFI6 board. Samuel also has an experimental transmit path working, which has sent custom waveforms, temperature packets and P25 test-tone bursts. In one test, an independent receiver decoded 72 P25 voice frames from a single transmission and recovered the expected tone.

The radio access layer has been released as a separate project called LR2021-SDR. It includes a portable C library, capture firmware, waveform tools and measurements, along with graphs from a real received P25 call and a recording of the recovered transmit tone. The updated handheld firmware is available on the LakeShark GitHub.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).

Receiving ADS-B With a Semtech LR2021 LoRa Chip

Over on his blog, Zoltán Papp and team have created an interesting write-up investigating whether Semtech's LR2021, one of the latest LoRa transceiver chips, which draws only 10.4 mA at 3.3V, can be used as a single-chip ADS-B receiver at 1090 MHz. The LR2021 natively supports OOK modulation, and the datasheet even hints at ADS-B reception. Building on prior work, the team captured live ADS-B signals with an SDR and replayed them into the LR2021 eval board for repeatable bench testing.

The initial 3 MHz Rx bandwidth configuration had only a 50% packet success rate with no reception above -50 dBm, because the AGC could not settle within the short 8 us preamble. Extending the sync pattern into the Mode S 'df' field enabled reception across the full dynamic range, but at the trade-off of broadcast message reception only. Manchester decoding and CRC also had to be moved to the host, since, for an unknown reason, Manchester decoding with inverse polarity would not work on the chip.

Measured sensitivity came in about 5 dB shy of the theoretical -89 dBm, with most of the gap blamed on the eval board's front end being matched for 868 MHz rather than 1090 MHz. The team notes that with a modified front end, the theoretical sensitivity should be possible.

With the rise in Raspberry Pi costs due to the consumer memory chip crisis, cheaper ADS-B receiver hardware is welcome. Some existing microcontroller-based ADS-B decoders that we've seen recently include ADSBee and PicoADSB.

Signal Hound SDR Hardware used to Capture and Replay ADS-B For Testing
Signal Hound SDR Hardware used to Capture and Replay ADS-B For Testing