If you know what's good for you, now's the time you be quiet, because this man is literally
invited just so that I can watch him, and he's awesome, so we will throw you out.
All right, ladies and gentlemen, I would like to present Quadling, who normally yells.
No, I would like to present Bonlint Sieber.
He is literally invited every year so that all of us running the contest can stare in
his direction with our mouths open, wondering what the hell just happened.
His bio is kind of lame, software engineer by training, Bonlint is a perpetual hacker,
director of vulnerability research at Bastille Networks, and the guy behind Spench.net.
What you should really know is while most of you were discussing burner phones on Twitter,
this man came into our village, I think it was three years ago, three years ago, and
he said, I need to redirect a space probe real quick.
Can anybody loan me a cell card?
And he borrowed a cell card from a random stranger and beamed commands to something
flying in space to try to redirect it around the planet.
So, yeah, if you all are scared of DEF CON and he's like redirecting space, seriously,
sit down, have a good old time.
I would like to, with the proudest feeling in my chest, introduce Bonlint Sieber and
hacking some more of the wireless world, an extension of his rant of hacking the wireless
world last year.
This will be cut off when he damn well feels like it, or sometime late after lunch.
So, sit down and make yourselves at home, meet your neighbors, and thank you, Bonlint.
Thank you for that very kind introduction, Zero.
And thank you all for coming to the wireless village over some of the other excellent talks
that are going on at the moment at DEF CON.
We just heard an interesting story from two DEF CONs.
Is my voice level all right?
Can you hear me okay?
Up the back?
Yeah?
Thumbs up?
Great.
Where's Anders?
Anders, where are you sitting?
Anders is the man that let me tether to his phone so that I could get on the internet
and talk to the computer at Arecibo, at the Arecibo telescope, to beam commands to IC3.
So, thank you very much, Anders, once again, for trusting me with your internet connection.
So, my name's Bonlint, and I'm...
I'm...
I work with the vulnerability research team at Bastille, and I'm going to talk to you today about three things.
Some of them I started introducing last year, and I'd like to show you some of the additional work that I've done on them since then.
One of them briefly will be Inmarsat.
Another one is implementing something that we saw at Cyber Spectrum.
Previously, Cyber Spectrum is a meetup that we run for people interested in sharing projects on software-defined radio,
in the Bay Area in particular.
And then also some new work that I've done.
So, I'm going to show you some of the things that I've done with Radar, and hopefully, my aim today is that everybody understands a little bit more about how Radar processing actually works.
And so, if you have any questions at any point, please feel free to ask.
I will leave you satisfied if I see nodding heads and smiles, as opposed to quizzical looks.
So, let me know how that goes.
And again, most of this time with GNU Radio, and I'll show you some flow graphs and the general concepts behind them.
So, the first item is going to be Inmarsat.
And later on, I'll also be encouraging audience participation.
I've got some live demos here.
So, that hopefully will go well with the gods willing.
So, just a very quick recap.
If you're interested in more of the details, you can visit the last year's talk.
The Inmarsat is a constellation of birds.
And they offer a number of services, one of which is Inmarsat Aero, which is used by airplanes that travel, you know, elsewhere.
Not over terrestrial coverage of normal VHF ground networks, but if they're particularly going over the ocean.
And Inmarsat is a bent pipe design.
So, transmissions will be sent from aircraft to ground stations and back.
It's actually pretty easy to listen to this over these, on the C-band downlink.
You can just get a dish, make your own feed, use an LNA and a bandpass filter.
And then you're able to decode at least one of these.
The P-channel, which is what I looked at to begin with, to decode basically ACAR's star messages going over this link.
And I have to give credit here to my friend Ian Buckley.
This is a setup that he made so that we could receive these signals.
So, again, I won't go through the detail.
I covered it last time.
But you can start demodulating it.
It's a simple GMSK signal.
And then you can work through the process to actually turn what appears to be noise into intelligible data.
So, the first step would be...
And now, I want you to remember the idea of an interleaver or deinterleaver.
So, the idea is that you read data into the rows.
And then once the memory cell is full, then you read it out from the columns.
And the purpose of this for the transmitter is to redistribute the information bits over time.
So, if you have a burst noise source, then it won't knock out all the bits in a single packet.
Those missed bits will be distributed over time through many packets.
And then you can use convolutional decoding or forward error correction to fix those individual erroneous bits over time.
And therefore, you get a much better chance of recovering any corrupted data.
Once you do the forward error correction, some descrambling, and then things look much more structured.
And then on the P channel here, this was a coordination channel.
And some of the messages are actually user messages that contain text information.
And if you're a...
If you're a plane spotter and you like to listen to ACARS, this is essentially the equivalent, but coming down from a geostationary satellite.
And it's interesting because there's a slightly different flavor to them in terms of navigating and sending directions to planes which are, you know, anywhere above the Pacific, for example.
So, just some examples to give you a feel, you know, random human-readable text messages to the crew.
You've got weather reports in standard notation there.
A different form of weather report, commonly used.
They're used in aviation.
You've got AFN, ADSC, CPDLC, which are different sorts of encodings for, you know, messages that pertain to routing and traffic flow and various other sorts of things.
And then this is a good one that I saw.
Remember the Galaxy Note 7?
They would remind everybody over the Inmarsat error P channel as well.
And then a lot of these messages are also printed out on the cockpit printer or sent to the captain.
So, you know, informing them about preferred routes for their flight plan.
This one is a custom message saying that there's really bad weather somewhere.
And this one is interesting because it's actually a step-by-step to, I think, reset one of the displays or subsystems on the aircraft or in the cockpit.
This one actually...
It would be a message that you print out.
And so just before they close the doors, you know, they print out the manifest and then the pilot, the captain signs it.
And so they would, I'm guessing, print this out there and then the captain would sign it on the line there.
Here you'll recognize these numbers.
Who has a guess as to what these codes are?
AKE91536QF.
Any guesses?
I don't think they're TAL numbers.
I think they're something else.
VOR waypoints?
No, not VOR waypoints.
And I might be wrong here, but I think that they're the codes for the luggage cargo containers.
Because if you look on the side, they're all uniquely coded.
So I think these are some of the containers that they have in the belly of the plane.
Here there's an alert.
The gross takeoff weight exceeds some threshold.
You know, again, routing information, reduce the delay.
And this is interesting.
I called Gateway and had them bring the fuel up.
And they brought it up to some value to take into consideration the point through fuel burn increase.
So they're modeling different aspects of the flight.
This is actually data regarding all sorts of different subsystems.
So the auto brake and, you know, various other telemetry that's sent back to airline operations and manufacturers so they can keep track of the equipment.
Because a lot of the stuff there, like the engines too, are all fly by the hour.
So that's all sent back to Rolls Royce or other manufacturers.
And then, you know, various things that are left to the discretion of the captain as to, you know, takeoff or what have you.
So that's all well and good.
And I also spoke previously about decoding all eight channels at the same time.
And once you do that, then you can actually amass quite a lot of information.
And you might not want to read all that stuff.
But maybe you want to actually have a look at some other stuff, which is what was just pointed out here, the waypoints that are part of the flight plans.
Because if you look at this.
You actually see there.
There are north and west coordinates, latitude, longitude.
And then there are these five letter character combinations.
Anybody have any ideas what these five character codes are?
That's right.
They are navigational waypoints on aviation navigation charts that are established around the world.
So they often don't actually send the raw latitude, longitude coordinates.
They just summarize it with these five letter codes because that's well defined.
And so what you can do there is parse that and plot that.
So at any point when the blue arrow appears, I'm going to show you something outside the presentation.
If for some reason I get caught up and forget about the blue arrow and it's there and I haven't shown you whatever I intended to, yell at me and I'll switch.
So you can amass all that data and then parse it.
And then get something like this.
So I parse all that information and then you can convert it into KML for displaying Google Earth.
And the satellite that I was listening to is actually servicing the Pacific Ocean area.
And so you would expect that most of the information flowing through will be regarding planes flying over the Pacific.
And so if you zoom out, you can kind of almost get a feel for the satellite footprint.
And these are all the flight plans.
These are all the flight plans that have been sent to all of the aircraft flying through.
So it's particularly busy over Japan, say.
And if you zoom in a little bit more, then you get all the five character codes coming up.
And you can see by here, I guess this is the registration number for the aircraft.
And so you can see what flight plan that was actually taking.
I think the red dots are the dots that are actually sent with the raw latitude and longitude coordinates.
And you can parse that out.
So just to show you what that looks like in the raw.
The output of the GNU Radio Decoder, it just dumps all this raw information.
And then you have the frequency here because there are eight channels.
And so if you just parse that a little bit, you can get those sorts of excerpts that I showed you before.
And what I did was I just Googled these five letter codes.
And then through various matches online, you find various listings for these for different areas.
So for Russian airspace, there was this kind of text listing.
So I just throw that in a Python file.
And then at the bottom, I just have it go through and parse that.
And it builds up a list of things.
It's a list of waypoints.
Same for Hong Kong, Japan.
Taiwan actually had a JavaScript listing.
So I did a find and replace to make it parsable in Python.
And then build sort of a self-reflexive object to parse all that.
And then the waypoints file just includes all the points.
And then the parser takes the output of this file and then looks for all those coordinates in five-digit, five-character waypoints.
And then just spits out the KML.
So it's kind of interesting to see the system actually working and visualized that way.
So that was the update on InMars.
So any questions about that before I move on to the next thing?
No?
Okay.
So the next thing is actually also aviation related.
It's an implementation.
Implementation of what's been termed as an unselective AM receiver.
And I have to give full credit to Kevin Reed who at Cyberspectrum number 15 demonstrated this with his shiny SDR platform.
Which is a really neat web-based SDR receiver so that you can use it remotely from the actual hardware.
And what he did and he's documented this on his blog there which I encourage you to have a look at.
Is do a really nifty sort of reversal of the common AM demodulator concept.
So switchborg on Twitter.
So with a normal AM demodulator if you want to listen to aircraft.
Listen to interactions between pilots and the tower.
You know for takeoff or approach taxiing.
If you're a bit of a plane spotter.
Then usually you have a receiver.
So a software defined radio.
And with that thick arrow there that's receiving a very large chunk of the spectrum.
So say you might be receiving I don't know 10 megahertz worth.
So you can get a nice big chunk of the arrow spectrum and see all the little transmissions there.
And then you select a channel to listen to.
And so that gets down sampled and filtered.
And then you go complex to mag.
Actually that should be a thin arrow there.
I didn't fix that.
And then what happens is.
Once you do the AMD mod.
Which is really this step here of complex to magnitude.
Then you output that to your speaker.
And you hear the audio.
And what Kevin Reed did.
Was that he swapped these two here.
So what he did was he swapped the Dan sampling and filtering.
With the complex to mag.
And so what that means is.
You essentially take the magnitude.
Of your entire AM spectrum that you're receiving.
Like 10 megahertz worth.
And then you down sample and filter the entire thing.
So you never actually select a channel to down sample to.
You demodulate the entire band.
But because it's AM.
The side effect is.
You end up hearing the strongest transmitter in the band.
Which is really neat.
Thanks for that.
.
.
.
.
.
Thanks, Ryan.
There we go.
So the idea here is that.
You end up hearing the strongest transmission.
And this works.
Because it's AM, right?
You're demodulating AM.
Because you're simply looking at the power level of your carrier wave.
And if you treat the entire spectrum as your carrier wave.
Then the strongest signal there will cause the largest ripples.
And that's what you'll end up hearing.
So he swapped them like this.
And this is actually really easy to implement.
to implement he did something that was really clever which was take the receive output the
raw complex base band and then apply a slope filter to the spectrum so one path you take out
and you say i want to have the left hand side of the spectrum louder than the right and the other
one you want the right side of the spectrum to be louder than the left and then once you've shaped
your spectrum like that you do the same process so you you do complex to mag or amd modulate the
entire entire spectrum down sample and then you play that into the left speaker and the right
speaker respectively so what ends up happening is stuff that's on the left hand side of the
spectrum you end up hearing out of the left speaker and stuff that's on the right side of
the spectrum you hear out of the rights because so it spatializes the entire am spectrum for you
and
if you're wearing headphones it sounds really cool i've got some speakers here so in a moment i might
might ask for absolute quiet because they're not very loud and they need to be stereo
but i'm going to show you a video here and then i'll show you it interactively
now just before i show you the video
i'll just explain what's going on here so this is the flow graph and this is the whole spectrum
and this is a representation of the frequency response of those
of those shaping filters so
this is not this is the raw baseband that's coming in and this is this is that that shaping and so
there's a blue one and a right and a green one that's the left and the right channel now the
reason why it has these notches in there and you see those notches reflected on the baseband
is because often you you've got birdies and or spurs which are either internal to the receiver
or from from you know man-made noise or from vors which are always transmitting something
or just you know other things that you don't want to listen to and
sometimes they can be powerful and they will drown out legitimate transmissions that you want to listen to
and so i thought it would be cool if you could interactively notch out those frequencies that you didn't want to listen to
and so what this does is and i'll show you you can click on the baseband spectrum on the things that you want to notch out
it'll recompute the filter with those notches included and then apply that to the left and right slopes
and it does it globally so you can change the frequency of your sdr and then it'll actually
compute everything that's in your passband and always keep the stuff out that you don't want to listen to
so if if i could if i have as quiet as you can i'll turn the volume up here so you can hopefully hear it
and so i'm just gonna oh there you go
so notice i clicked on that and the tone went away
i don't know if you can get the sound out of it
i don't know if you can get the stereo effect hopefully you can
so see i clicked there it applied the notch and then
recomputed that and i'm changing the baseband frequency and so it's it's shifting all the notches along to keep them on on the right frequency
and so i moved to to where there's eight cars and it's very loud and powerful you don't want to listen to it so i notch that out
notch that out too
so it's cool right because i'm not actually clicking on the channel that i want to listen to
it just all comes in and you hear the the most powerful thing
and then what's nice is that you can click on remove if you want to remove the notch
and then click on the the the bass bands
and then it'll actually remove that notch recompute the filter and then you get you know in this case the unwanted tone back
so so that's that now the thing is i mentioned that that slope filter and it wasn't immediately
obvious to me how you you generate that and it turns out it's actually really really easy
this is done in a single line of python in a grc block that i'll show you basically you use numpy
and use linspace to create a ramp between zero and one
over the number of uh taps that you want you shift the do an fft shift so it basically rearranges you know one half and the other half back to back you do an inverse for your transform and then you shift it back so what you've done is essentially you say i want this frequency response and then you take the inverse fft and then it gives you the time domain taps that you can apply in a normal fir filter and that that's all it is it's it's really basic
so i've got a blue arrow which means show you the actual thing
now any any questions so far who actually listens to the aero band and listens to
cockpit and tower and all that kind of stuff a few of you all right was there a question over there
just curious with the interactive notch you could do equalization
to null out tones that are continuous but is that too computationally intensive across that
light spectrum so um that's a very good question so i don't have to repeat the question because
he's spoken in the mic usually um yeah so if you remember on that line when it was using a linspace
and have the taps count um you can decrease the number of taps if you're using a higher bandwidth
because naturally yeah the larger bandwidth the like this thing works really hard i think i do 6.25
megahertz off of usurp um
and it it makes it work pretty hard and i i chose a higher tap count so that it would look really
good in the frequency response plot but if you if you make that much smaller it looks far more ugly
the response is obviously rippled but it works okay so you can manage it that way uh so let me
find the flow graph here i'm gonna have a resolution problem so let me just transfer this
make the uh thing fit
all right so i'm looking for am unselected and
turn it off so i'm i'm going to just do a live demo or not i've pre-recorded
so that's it's that and it's that so at the moment i've got a single notch in there
and if i take it out
you can you can hear the tone right you don't want that so let's
and if you're watching the console there um i've got this notches.json that contains the
list so if i click this then it'll load the load the notches calculate the a complex um
uh what did i do
uh a complex filter and then rotate it up to the frequency the baseband frequency that i
selected and then apply that here and what's nice is that you can also change the number of taps
so if i made it 13 instead of 512 then obviously it changes the
the look of your frequency response and one other thing um ian my friend ian buckley observed this
that if you actually add a delay
between the left and the right channel especially if you're on headphones that it makes it
it emphasizes the stereo effect even more i don't know whether we'll necessarily be able to tell here
but if we make i think this was like
yeah you'll need to play with this yourself but you can add a delay to emphasize that
and you can you know mute the left with the right and if you look at the um
the actual response
of um each the output of each filter you can see the baseband uh plus the filter showing that
characteristic you know roll off to one side and the other one and the green lines that are appearing
are just basically selecting the the signal the fft bin that has the strongest energy unit so that
that that's most likely the the audio that you're hearing in that frequency which is being updated at
the bottom there max frequency right then left so again this is just the implementation as well as the
The original idea was Kevin's, but it's, you know, I thought it might be fun to implement
in Gudu Radio.
I can take you through the flow graph very quickly.
I've got a file source here, and then you get your complex baseband output, and as I
mentioned, you, oops, you take one line up to one filter that contains the right channel
taps, and then you take the baseband to the other filter that has the left channel taps,
and what's nice, actually, is that to compute the, you only need to compute one set of taps
because the other channel is just the same taps, but in reverse, which is handy.
And then once you have done the filtering, you immediately do the complex to mag, which
is the AMD mod step, and then you resample it to match the sample.
The sample rate of your sound card.
I've got a DC block in there as well to remove any DC from the AMD modulated signal.
I've got an AGC so that the audio level that comes up the speaker is always more or less
normalized.
A low pass filter so that you, you know, AM is quite narrow band here, so just to focus
on that one channel at the audio pass band, and then it just goes into one channel of
the audio sync, and that's all there is to it.
Additional complexity happens more with that, the interactive thing.
So, the graph there is brought about by, what have we got here?
There's this sort of real-time graph in that plot lib wrapper I made, and so using an
any code block, you just implement the graph like that, and it will cause it to display.
And then every time, every time here, the variable dependencies,
taps left or taps right changes.
This line means create a callback for if those variables change.
Then it does this Python, actually this is multiple lines, but separated by semicolons.
So the first part of it is use SciPy to calculate the frequency response of the left taps, and
then calculate the frequency response of the right taps, and then set the data on the real-time
graph with the FFT shifted.
Log 10 magnitude of the frequency response.
And so, that line, whenever the taps change, will update the graph.
And then in terms of actually clicking on stuff, there's a callback mechanism here.
You know, with these FFT GUI syncs, you can specify a variable to take the frequency that
you clicked on.
So, when that variable changes.
When it changes over here, then I have a little bit of Python that, it's a class, and it has
this add notch function in it, and so it takes the click frequency.
And if remove is disabled, then it adds the notch.
And if remove is enabled, then it removes the notch at that frequency.
And so, there's just a little bit of Python that manages the global database of values.
And once that happens, I think it's, it's done.
It's here.
So, the tap generator class is initialized here, and it basically takes the initial
set of taps, which is just that initial, you know, left and right slope.
And then self.taps is, I think, a reference to the actual taps that the generator will
update.
So, the generator will generate new taps and then call a callback registered within GRC
to update the taps.
And then it, you know, will update in the MFT filter and update on the graph.
And that's it, really.
So, conceptually at least, not, you know, it's pretty elegant.
And again, that's, props to Kevin for figuring that out.
Any questions on any of that so far?
Does it, okay.
All right.
So, next on the agenda, and this is the third and final part, is radar, and particularly
FMCW radar.
I spoke about, a little bit about this last year, but I'd like to show you some more and
explain some more concepts to you as well.
And to do a bit of a recap, who's seen these primary surveillance radars at airports when
you fly?
You know, you see them rotating there?
This is a basic kind of CW radar.
And if you watch here, as it rotates, I'm, I'm going to show you this.
I'm sitting on a hill with a usurp on the frequency.
And on the left-hand side, it's plotting the magnitude of the signal received.
And you can see that it's triggering, play it again, it's triggering on the initial transmission
from the radar.
And the radar then switches to receive mode to listen to any echoes that are coming back
from, in this case, airplanes.
And you can see there that there's also some responses coming back very close in time.
So, I'm picking up both the initial burst of the radar and what turns out to be ground
clutter, mainly nearby.
And so, what is a radar return and how does that work?
So, this is an example return down the bottom.
Just complex IQ that's been, again, turned to AM, essentially, the magnitude.
And the way it works is that the radar sends out what's called a bang, which is that initial
short pulse.
And in this case, it's CW.
So, it's just a continuous pulse.
It's a continuous wave at a single frequency.
And then the radar switches to receive very quickly and then it waits for these echoes
to come back because the radio energy will reflect off, for example, aircraft fuselages.
And some of that energy, just a small portion, will come back and be collected by that massive
dish that's rotating on the radar.
And it's so massive because the signals are so weak and so you want a lot of gain at the
antenna.
And...
Nope.
And then...
And then once that period has elapsed, which is the pulse repetition period, then a new
pulse is sent out.
And then the process just continues.
And this can happen hundreds or thousands of times per second.
And there is some radar concepts which are important to get a hold of.
One is that pulse repetition interval of frequency.
So, that's the amount of time or how many times per second that pulse is sent out.
And then the wait period.
I'm going to call it period.
PRF, which is the number of times it happens per second.
And the width of the actual transmitted pulse.
So for how long the radar is actually transmitting.
That's also important.
So the way you actually figure out how far an object is away from you is by looking at
the delay between when the signal went out and then when you had the signal come back.
And this is called the round trip time.
I'll explain that a little bit later.
I'll explain that in a little bit more detail in a moment.
But if you consider these two diagrams here from RF Cafe, these thick black lines here
are when the transmitted pulse was sent out.
And then you have this return here that comes back.
And there's this notion of unambiguous and ambiguous returns in radar.
So in this diagram, the A diagram, you have a return that occurs before the next transmitted
pulse.
And you can then say that this is an unambiguous return.
Because it happens before the next pulse.
In the B diagram, the real range actually occurs after the second pulse.
So that's in excess of that interval there.
And so if you didn't know any better, you would assume that this target is actually
really close to your radar.
Where in actual fact it's even further away.
And so you get that sort of false return.
And this is ambiguous range.
And so what's important to note is that the way you design the parameters.
The parameters of your radar will constrain you and will set the unambiguous range that
you can compute.
And so the easy way to think about it is that the round trip time times the speed of
light divided by two is your virtual range.
It's not the real range.
It's the virtual range.
So just keep that in mind.
Now with that radar that you saw spinning, the primary spin radar, I did a recording
and then each of these scan lines is triggered.
There's this red part on the left-hand side.
When it hears a really loud burst, which is attributed to the radar doing its transmission.
And then it keeps listening for a fixed period of time for the return.
So this is all, you know, me sitting on the hillside with my little USOP with just a width
antenna.
Not a big radar dish.
And then it captures a fixed number of samples and then it waits for the next radar transmission
as it rotates.
And what amazed me is that you can actually still pick up with a little width antenna
all of these structures that are a little bit smaller.
They're a little bit further out from the ground clutter, which is causing these immediate
returns on the left-hand side.
And so this is just each scan line and then I just recorded it for a number of rotations.
I think this is actually just a single rotation.
This is 50 mega samples per second capture into RAM disk.
And what's nice is that taking that linear plot and if you unwrap it into polar space
and place it on the radar position itself.
This is the Bay Area.
You can see that the ground clutter actually lines up quite neatly with, you know, the
ground and not in the bay.
What blew my mind is that you actually get returns from the power pylons that cross
the bay there and also from the bridge.
So these large structures return enough energy to be received by just a width antenna on
the USOP.
So, you know, that's the simple concept of CW radar returns.
And a bit of theory here from Wikipedia.
So, you know, I've got a couple of things here.
This is to illustrate why CW radar is not the best kind of radar.
There are better forms.
So, again, this is the plot where you have time and the red CW tone here, brief one is
what's transmitted by the radar.
And these blue patches here are the echoes that come back.
And so if you take a match filter, which is in this case just a filter for the frequency
that was sent out.
Then that means you can ignore everything else.
And if you apply the filter, then you get this plot on the right.
So you ignore the transmitted pulse.
And then the peak of the response here is at the time where that target was.
And then this other target is further out.
And so you get a lower amplitude response, but, again, you get the peak there.
And this is not the best, right?
Because you have this ramp up and ramp down.
And you like to have a much more accurate definition in time.
and the time domain of where that target response actually is. And the bigger issue is that
if you have two targets that are close together like this, so those two targets are now not
separated by as much distance and therefore time, then the response, the echo actually
blows together. And so now it looks like there's only a single target if you were applying
a naive detection strategy. So that's why CW has these drawbacks.
And a simple alternative, and there are many other radar alternatives, is FMCW. And what
that means is it's frequency modulated carry wave. So instead of just sending out a fixed
carry wave, you actually send out a carry wave that increases in frequency or might
decrease in frequency. And this is what it looks like in the time domain. So you start
at a low frequency and then you quickly ramp up and it might be linear, it might not be,
but you can ramp up. And by the end of your transmission, you're
actually transmitting at high frequency. And the reason why FMCW is good is because
these chirps, this is known as a chirp when you have something increasing or decreasing
in frequency, it has the property of strong self-correlation. It's got a really good
auto-correlation property. And what that means is if you take that signal and you mix
it with a copy of itself, then you'll get a really good response. But if you mix it
with anything else, then you'll get a really bad response, which is not the case
for what we just saw with the CW tone, because you get this mixing here and the ambiguous
response. So I have a demo for that. We're going to actually listen to what a chirp is
so that you can get a better idea of what that is like.
And you can see it. So this is, again, in the audio domain. I want to emphasize that
these are general concepts and these are transferable between audio and radio and other things.
So you'll hear the chirp and this is actually the response from my microphone in my laptop.
So as I'm speaking, you can see there. Does anybody want to whistle or make a tone?
There you go. Just to prove to you that it's live. And now I'm going to
let you hear the tone and you'll see it on the spectrum.
So you can't even hear that, but the microphone and the speaker still generate a response.
Okay. So this is a chirp. It's a very slow chirp, but it's a chirp nonetheless. The radar
chirps are much, much quicker, and I'll show you what that sounds like and looks like in
a moment. So this is the frequency response. In the time domain, a common construction
that you use is you use a sawtooth wave. So usually a signal source and you might have
a sine wave. But here I'm using a sawtooth, and I hook that up to a VCO, to a voltage
controlled oscillator. So what I'm effectively doing is I'm putting in a linear ramp, a
linear voltage control, and then the VCO will turn that into a frequency modulated continuous
wave. And we can see what that looks like here. So I'm going to speed up the chirp.
Here, with the, where is it? Do I not have that exposed? Delay, multiplier, low pass
federal. Ah, here. So this will take 10 seconds to do the chirp. I'm going to make it do it
every second. Right? And I'm going to make it do it 10 times a second. Okay. Now, if
you look at it in the time domain, this is the output of the sawtooth generator, right?
So this is not the frequency output yet, the FMCW output. This is just controlling the
VCO. Once you feed that through the VCO, it looks like this. So let me slow that down
so you can see it a little bit better. This is the time domain plot of the complex output
of the VCO block. And you can see that you get a complex sine wave, sine your side, but
it's increasing in frequency and then it resets. So this is the basis of a chirp radar. We're
listening to the chirp here. All right.
So, again, this should be familiar to you now. We saw it in the complex domain, but
here it's in the real domain. Now, in this case, we've been listening to a full duty
cycle chirp generator, so it's constantly generating the chirp. And as soon as one
finishes, the next one starts. In the radar scenario we looked at before, we sent out
a chirp, we were quiet for a while, and then we sent out another chirp. You can do both.
They're both equally valid.
They just require different sorts of hardware configurations. I'm going to start talking
about the full duty cycle continuous version now. What did I say there? Now, the other
thing to remember here, and this is really important, too, is that when we talk about
filters, filters need taps, right? Before with the arrow, you know, the left to right
channel unselective receiver, we generated two series of taps to define two filters and
they imposed their shape on the spectrum. Here, we've got two filters. We've got two
filters. We're going to consider a filter whose taps are the chirp, okay? So usually
there are low pass filters and high pass filters and you can think about how they might shape
the spectrum. You can make a filter of whatever you want. You can even use filters in the
digital domain for like the access control word or a preamble for a digital packet. Here,
our filter is actually going to be the chirp itself. So the idea is that whenever it hears
a chirp and then you put a filter through it, you will get the maximum response from
your filter when the incoming chirp lines up with the filter.
This is the chirp that we've defined in the filter. So, and this is what makes it, I think,
really click. This is like a diagram we had before. So we have the transmitted chirp here
and we have these two echoes, right? Because the echoes are going to be the reflection
of what we transmitted. And because we're using this special filter that has this great
autocorrelation property, we get a really nice well-defined peak here in time that lines
up with the response, the exact response echo that came back here. So you get the
first target and the second target. And this is the really cool thing. Then all this noise
is added, right? This is basically swamping out, completely swamping out the echoes.
And amazingly, when you pass that filter with the chirp through it, the noise disappears
and still you're left with the responses, the peaks at the two targets. And even if
they were overlapped, they're still going to be overlapped. So you can see that the
two targets relate on one another, like we had in the previous plot with just the CW.
You would still be able to disambiguate those two targets. So FMCW is pretty simple. Like,
you can use radar techniques that use coded transmissions. But, you know, this is like
an in-between level where it's still fairly doable with easy construction, even in GRC.
So any questions so far? Question? No questions.
Question about the mapping. How did you get the, I guess, rotational rate of that
radar to project in the... This is going back a couple seconds.
Yeah, no, no. I guessed. I mean, I recorded... I think I can record 70 seconds to 16 gigabytes
of RAM. And I think I guessed. The other one was, does the distance from
the actual radar receiver, you on the hill, give like some kind of distortion to...
Yes. Yeah, exactly. So I can show you later.
Okay.
But if anyone's interested in this notion of the distortion and the actual physical
model of the radar system, and if you consider the path propagation, I'll talk about that
just briefly. But in a Blackhack talk I did a couple of years back, I show a slide
where actually I wrote a program to create a rasterization, a visualization of that
distortion map.
Yeah.
So you basically give it the offset and angle between the receiver and the transmitter,
and then it'll calculate a distortion grid that you... I didn't do it, but you would
then apply that to your returns and then it would undistort everything. So that's possible
to do. But that's a very good point in that we're always talking about virtual range and
virtual time echoes, and so you have to keep in mind how the geometry of your radar is
set up. Next question.
Could you just go back a slide?
Yeah.
So there you've shown the filtering...
This is from Wikipedia, by the way.
Yeah. I realize that. I'm going to ask the question.
The previous Wikipedia slide had the two pulses really close together.
Yep.
Is there a limit for the chirp like decoding, filtering the chirp in terms of frequency
or is there something else? Can you...
To be able to disambiguate?
Yes.
So again, that's all set and constrained by the parameters of your radar system.
So how, why the chirp is, what your signal bandwidth is, what your sample rate of the
ADC is, all that stuff. And I've got a little Jupyter Notebook.
Yeah.
That I'll put online and you can enter in all of those parameters and it'll tell
you what the, what all the constraints of your radar system is.
It's just because the Wikipedia page showed that previous kind of, you know, signals
close together.
Yeah.
I was intrigued to see what the parameters were.
Yeah. I mean, that was some simulation that someone put up, but again, it's all up to
the numbers.
Cheers.
Just a quickie. I mean, would an autocorrelation have given you that rotation rate if it may,
as I can just go look at it and get it right?
Yes. Yeah, it would. Yeah, yeah. I mean, you can...
That's enough structure?
You can... It's...
I don't know. Each capture's like... I mean, it's like 15 gigs or something. So, you could
do it. It would take a little while.
Yeah.
But that's exactly right. The point is raised that if you wanted to figure out the
rotation rate, you know, I guess, because I didn't want to do it. But what you would
do, completely correct, is you would run an autocorrelation with the capture and do a correlation
with itself. And as soon as the similar kind of features match up again, you'll get a response.
At the time, whether...
...where the radar has resumed and completed a single rotation. Thank you very much.
Any other questions? That's great. Thank you for these questions. It's really good. No?
I'll move on then. So, with this continuous or full duty cycle radar system, you have
your CHIRP generator and that's transmitted. So, as you heard here, like, it's being transmitted
out of the speakers. And then the receiver, in this case, in that demonstration, it was
the microphone in my laptop. And there...
Yeah.
...I then mix the input with the CHIRP, right? And because we're receiving and generating
this simultaneously on the same hardware, it means that the clocks are synchronized.
Because I'm using the audio hardware, that doesn't allow you to start transmitting and
receiving the streams at the same time. That's different on, say, a USRP, which I'll show
you next. And that's why I have this delay slot factor that you can change and I'll show
you that in a minute.
But you mix the two together and then you get the deCHIRP signal. And the deCHIRP signal
holds wonders that I'll try to explain to you, but it means you can do some really sophisticated
processing in a pretty simple way and get much more rich information out about what's
going on in the space around you.
So, what's important to note here is that once you deCHIRP the receive signal, then
you get constant tones.
So, when it deCHIRPS the...when it deCHIRPS itself, you'll just get a DC tone. And then
any other reflections will end up generating other tones at different frequencies. And
that's the key there. The cool thing about CHIRP radar is that once you deCHIRP stuff,
your reflections become tones at different frequencies and that frequency is controlled
by the distance from your radar, which is kind of mind-blowing when you think about
it. It's just a really nice way all the math kind of falls out. And then you can just use
FFTs and then do cool stuff.
.
I don't think so because you're still just doing it on the basis of the response
of the filter. So, you're still looking for a peak response. And you can send out any
kind of signal you wanted to. And I'll demonstrate that actually. The last thing I'll show you
is passive radar using exactly these concepts.
Using digital television signals off airplanes. So, stick around if you want to see that.
That's what this is building up to. So, what's interesting is that in, you know, properly
deployed radar systems, what often happens is that there's more sophisticated RF plumbing.
So, when you have a receiver and you're continually transmitting, you don't want to have to ingest
your local signal because it's always going to be the strongest thing you hear. And considering
that it's going to be eventually fed into an analog to digital converter that has a fixed
dynamic range, you don't want to blow out your receiver. You don't want to blow out the ADC.
And so, what you can do is you can actually mix out or null out your tone that you're
transmitting just using analog RF mixes and blocks or DC blockers, for example. And that
means that you take the power out, like the actual RF power you subtract, not digitally, but you
know, physically electromagnetic domain, and then all you're left with are the responses,
the echoes. And that way you can much better utilize the dynamic range of your ADC and
see reflections further out. So, from Wikipedia as well, this is a nice diagram to illustrate
that kind of RF setup. So, again, you've got your generator, power divider, transmit that
out, and you split that off, bring in the output of your receiver through a preamplifier, mix
out the signal that you transmitted, low-pass filter, amplify again and into your ADC, and
then you do your digital processing. So, that's the simple kind of structure. So, what I'm
going to try and do now is take you through how you do range calculations, and then this
is the magical new part, how to do Doppler calculations using FMCW and GRC. And it's
basically all FFTs. It's, it's, this would appear like this massive mystery machine,
a three-degree black box to me for the longest time. When I finally kind of sat down and
looked at it, it's actually really, really elegant. So, my goal here today is to make
you want to try to understand at least a little bit of this. So, this is a plot in
the frequency domain, right? We talked about chirps. We know that they look like this
on the spectrum. Here you've got time going from left to right and frequency from bottom
to top. And the red signal here is the chirp that you're transmitting, and the green signal
is the echo. So, remember, an echo is just going to send back what you transmitted,
but with a delay in time, right? So, as you can see, the green is delayed a little bit,
delta T, but from the, the original transmission. Now, what the beautiful thing about this,
as I, as I mentioned, is that any time delay will produce a frequency shift at any single
sample in time. So, if we look at time T1, you've got a frequency shift from your transmitted
tone.
At that particular point in time to your received echo. And what happens is, what
was I going to demonstrate to you there? Maybe the whole thing here. Yeah, that's what I
was going to show you. So, going back to the audio demo.
We had this, right? And we know what the VCO input looks like. We know what the VCO
output looks like. And now we're going to look at the FFT of the output of the de-chirping,
of the mixing, right? So, what this is doing is it's taking the chirp, and then it's going
to multiply that by what is being received from the microphone. And what you'll notice
here is if you compare this one, right, to this one.
Yeah.
What it looks like, and hopefully you'll see this, it looks like the spectrum is being
rotated over and over and over again at a fixed rate. See how it looks like the entire
spectrum is shifting? So, the left-hand side here. So, actually, do people want to whistle?
And you'll see your whistles come out, but they'll be diagonal lines here.
So, see, this is me. And this is the cool thing. Our chirp signal, remember I was telling
you it would turn into a fixed tone? Can you all see the fixed tone here? It's that line
coming down the middle at roughly DC, right? That is the tone that we want to receive.
And any other tones that end up, I think in this case, to the left of it, will be echoes
that have come back from around the room into the microphone on the laptop. And so, that
frequency difference, because remember this is in the frequency domain now, that frequency
difference is going to give you your virtual range information, right? Which is pretty,
pretty neat.
Now, what does this look like? I showed this last year, but...
I've hopefully explained things a little better so that it makes more sense. What I'm going
to show you now is...
the same thing, but actually running in the proper mode. See, this is the chirp again.
It's running at a higher rate because we want to be able to update the display more. And
you see when I'm talking, it's still picking me up because it's constantly rotating the
spectrum.
It doesn't look like a proper frequency response now. So, what I'm going to do is get my other
laptop to be the target.
And...
I'm going to set my...
my delay slop so that you see the...
the DC part of it somewhere.
Okay, apparently it's...
not there.
Nate Temple, the genius here, pointed out that I'm trying to move my laptop in front
of speakers that aren't actually outputting anything. I want to use the speakers in my
laptop because that's where the microphone is, not those speakers. Thanks, Nate.
Nate is an absolute legend, by the way.
If you didn't get to see his cyberspectrum talk from the other night, I recommend you
go online and watch it because he has built some amazing stuff.
All right, here we go. This is better now.
So...
what I'm going to do is... this is the DC component, and because I'm talking right,
we're just going to get this noise showing up here. But if I put my laptop here...
then you can see there's that main response there...
that is directly related to the height of the laptop.
Don't clap though because then you'll upset the microphone.
Right?
So...
That's alright. I planned that.
Um...so what's happening here?
A chirp is being sent out from the laptop.
I mean, this is...
a chirp, those
air molecules are being vibrated
and then that audio wave
is moving up, hitting
the bottom side of my laptop
and then being reflected back down in the microphone.
And amazingly, the microphone can discern
even though it's hearing itself,
it can still discern the response
from an object way out here.
So that's the power of
FMCW.
Now, there was another little thing in there
that was on my screen. I will show you that.
That's actually the Doppler plot
and I'll come to that. What that gives you
is not only range information, but it gives
you velocity information, so you can tell how
quickly a target is moving.
And that's
really cool when it comes to aircraft.
So, what I want
to show you here now is this plot, where
instead of looking at the original frequency domain
what we received, this is the domain
once we've done the de-chirping.
So we have that DC component here
and then in the green line, this is now our
target return
tone, right? Because we've de-chirped it.
And so you have this difference in frequency.
So the frequency change implies
that time delay, and therefore
virtual range. Now,
what's neat is that you can take
the de-chirped output
and then pass it through an FFT,
right? Because an FFT will give you
the energy
in each bin. And so the trick
here is that you use an FFT
you know how you
have a certain size in your FFT,
a certain number of points that you
form. The number of points in your FFT
you can make the same
number of samples
as what is made up in a single chirp.
Right? So you decide how long your chirp
is, and then you set your FFT
in terms of samples to be exactly
the same amount of time. And what
that means is that every single time you do
one full chirp, you take one
FFT. And
I'm trying to illustrate
that here by these
lines. So if you think about
these over time, this is like a waterfall.
These are your frequency
bins that you get out of your
FFT transform. And in this case
the echo return, the green line
ends up falling into, in this
case, arbitrary bin number 5.
And remember how we said that
differences in frequency will imply
your virtual range.
Here, the
bin that it falls into will give you
the range
information for that particular bin.
So here we can say bin 5
and we can calculate
how far away that is. And
to calculate how far away that is,
you know how long one sample lasts
because you set a sample
rate on your SDR, right?
So 10 megahertz or whatever, 1 megahertz.
So you can calculate 1 over that to
calculate the period of a single sample.
And each bin
in terms of duration
maps up with the
duration of a single sample.
And if you know how long it is, if we're
talking about RF now and not audio,
you can multiply it by the speed of light.
And that gives you your round trip
time and you can calculate your virtual range.
So it's cool because you can map
to frequency really easily just by doing
an FFT and then you can map that
directly back to virtual range.
So does that kind of
make sense so far? I see people nodding, which is good.
Now, the wild thing is
in this instance,
you know, this is a target at a fixed
range and it's not changing.
Here, you might have two
different targets moving
toward and away from
your radar receiver.
And so you would expect a plot like this.
And we kind of saw that before
with the FM chirp. Actually, one thing I was
going to try was, I don't have another
laptop, but maybe if somebody has a laptop, we can try it
at the end. We can have two here and then if you
move them separately, you'd get obviously
two different crossing returns like that.
Maybe that's what
I was going to demo, but I'll do that later
because time is short.
So, again, as I was
saying, the sample rate sets
the duration of a single sample
and therefore limits your range
resolution. Because if you consider, you
get discretized bins coming out
of an FFT, and
the length, the total length
of that is going to be your unambiguous
possible round trip time.
And so your pulse repetition
frequency sets your unambiguous range,
but the sample rate
also sets the
distinct
range that you can resolve within a single bin.
So as you step from one bin to the other, you can
to the next. That's going to be some amount of range
that you go, you know, from one
to the next. And so what you have to consider
is that targets, depending upon your radar system,
might be differently
spaced, but they might fall
within the range of a single
bin. And so you'll get
one return for multiple targets
in a single bin, and that's ambiguous.
So you want to do something which is
Doppler processing to make
that unambiguous.
And as I was saying, you've got
different radar geometries. So you've got
a monostatic system where the transmitter
and receiver are co-located, and so it's just
a direct line of sight round trip time.
But if you have a bistatic radar system
where the receiver is separate from the transmitter,
then you have to take into account the
geometry, because that delay is going
to be, you know, different.
You might have a target way out here, and you'll have the signal bounce
out and then come back, or it might be in between the two
and so on. So important
to keep that in mind. So
what I was talking about there is that
with RF, the speed of light, we know what that is.
And for a
single sample, that's going to be a
very large distance, because we're talking about the speed of light.
300,000
kilometers per second. So even at
a high sample rate, megahertz,
a single sample is still going to allow
light to travel a long way.
Or in this case, the RF energy.
And so what we want to do is
you can increase the sample rate to give you
better range resolution, but there comes
a point where if you're just using an SDR
and a laptop, you can't go to, you know, gigahertz
worth of bandwidth.
You will end up being constrained.
By your bus and by your processing
speed. So what you should consider
then with an FFT here is that
this is an FFT
and you have these range bins
and then every time the chirp finishes it, it does
the transform and then it just starts and
keeps cycling like that over and over.
So you can see that cycle there.
And we're talking about
multiple targets
fitting into a single
range bin.
And so once you do the FFT
and you were to take the magnitude, you would
basically get an energy response at
that range.
So as I was saying, you might have two echoes
that fall into the same range because they're not
the same target. They're slightly different, but
from the point of view of your receiver, they
end up giving you the same round
trip time.
And the other
problem too is that you might have
a radar system, and I'll
show you this with a passive one, where the
transmitter is so strong
even out to many range
bins that it completely swamps
your receiver
in the
for, you know, if you were just
doing this transform. And what's nice is that
you can do Doppler processing,
which reveals this hidden information
working in the phase information
that's output from the Fourier transform
that will actually show you these
targets, even though ordinarily you wouldn't
see them because you're swamped by
your local transmitter or ground clutter.
So yeah, the clutter could have
affected that bin, so you don't see them
if you're just looking at range information, or
it'll take out your entire transform.
So the Doppler effect. We've heard about this.
And we know that it will cause a, usually
a shift in frequency. You know, the classic example
is an ambulance that's driving by. And in this
case, what I'm gonna try to illustrate to you
is how it changes the phase of the
echo that comes back to the radar. That's the
key here.
So, we get a phase change due to motion.
And again, if anybody, any, any questions so
far? Any, any comments? If you want me to
repeat anything, please, please ask. Don't be,
don't be afraid, because it took me a while to
figure this out. Yeah. Yeah, so it, it depends
on sort of how you conceptualize it and, and
how you receive it. In this particular case,
there's one you think about. I mean, I'll illustrate it
here and, and hopefully it'll make sense. So the
idea is, with Doppler processing, that you receive not
just echoes from a single chirp, but you do
it for multiple chirps over some arbitrary period that
you select. That'll also have implications on what you
can resolve. But this is referred to as the integration
time. So let's say you can have integration time
of like a second. And let's say you're sending out
a hundred pulses per second. So you collect a hundred
of those returns, and then you process them in one
batch.
And then from that you extract Doppler information. And
the key here, and I'll illustrate this for you,
is that you, instead of just ending where we
had before, where you do an FFT of your
range response bins, you build up then a hundred
of those range response transforms, right. So you imagine
they're in rows. And then you run FFTs on
the columns. So what you end up doing is
you do a second series of FFTs on each individual
range over the integration period. And I'll show you
what that looks like. So the other thing to do
is remember, again, the geometry. So this is Doppler velocity
with respect to your radar system, not with respect
to the moving object. So if you consider this
scenario on the left here, you've got a radar transmitted
receiver, sends out a pulse. The airplane is moving tangentially
at that moment to the radar receiver. So it's
not going to impart any Doppler shift on the return, because the
there's no velocity component in the same plane as
your radar signal. Whereas in the second scenario, in the
middle, if the plane's moving toward the radar receiver,
it's going to impart the biggest Doppler shift on the
return. And if it's offset by some amount, then
even though it's, you know, not entirely tangential, like
in the first scenario, it's still going to impart
a little bit, because there is still a component there
that matches with the, the plane. So with Doppler processing, if you
consider the scenario where at any one time the
target is moving toward the radar there, in, at
T zero, that pulse is sent out. At round trip
time divided by two, the reflection is sent back.
And at the round trip time, you get the return.
And you can see that throughout that period, the
signal amplitude decreases, because of course, there's that loss through,
through free space and, and on the, on the
reflector. And what I want to illustrate to you
here is when that.
return comes back at a particular point in time, right?
It's always going to come back at a particular point,
which implies a particular range, right?
So there's a range there.
There's going to be a phase difference,
which might be zero.
There might be effectively no phase difference
or some phase difference
between the signal that you sent out
and the signal that comes back.
And if you consider the actual propagation of a sine wave,
even though, you know, they're photons and whatnot,
then depending upon where that plane is,
if it's here or it's like a meter over here, offset,
the wavefront will hit it,
and then, you know, if you imagine that wavefront hitting it,
it'll hit it at a particular phase
and then it'll reflect at that phase.
And if you move that plane a little bit,
then the tone will hit the plane
at a slightly different phase
and reflect at a different phase.
And so in this particular...
In this particular case, we're lucky
because everything happens to line up on the phase boundary,
and so when you get the response,
it actually ends up being the same phase.
So in here, it's zero degrees.
And remember, this is all in a single range bin.
Now, you could always say if a plane is traveling,
you'll see it move through the range bins
and that implies that it's moving with some velocity,
but this is all within a single range bin
because we want to disambiguate targets
and get velocity information.
So you've got transmitted pulse, received pulse,
no phase difference.
Now, if you're in a plane,
now let's consider the plane has moved a meter
and, you know,
it also depends upon your wavelength.
That has implications, too.
But here, we're talking about the same scenario.
And if you notice carefully here,
the wave that is returned is slightly offset.
See that?
So see there and then there.
It's a slightly different phase on that wave.
And so when it comes back,
the phase difference is going to be slightly different as well.
And when we...
compare them,
we get some arbitrary phase offset.
Now, let's consider...
These are two distinct pulses.
Now, let's consider four
in more or less successive time order.
So the first one comes back.
The second one comes back with a difference.
Third one comes back.
In this case, it's the same
because the plane moved again
and imparted another phase change.
And then again,
we've got a different phase offset
in the fourth period there.
And remember,
every chirp period that gets sent out,
we get this different energy coming back to the receiver.
It's the same chirp or the same signal.
The magnitude will look the same,
but the phase will be different.
And what you have to think about is
when you do FFTs,
when we look at them on the waterfall
or when we usually think about them,
what are you doing?
You're taking the FFT,
which gives you always a complex output,
and you always end up taking the magnitude
of that complex output.
And the effect of that is?
Anyone?
You lose data.
What do you lose?
You lose the phase information.
So here we want to use that phase information.
And the integration period is important
because that's the period
over which you're monitoring these phase changes
in each of the range bins.
Does that make sense?
So the idea is to get that phase information
from each FFT bin
over that integration period.
And then,
think about this.
What is a changing phase over time?
It's a rotating...
What's the magic P word?
It's a phasor, right?
So you've got a phasor going around.
And I think I have a blue arrow here, yes.
So, I mean, just to illustrate that a little bit more,
very, very simply,
in GNU Radio,
because we usually use fast sample rates
and fast...
in terms of spinning,
you know,
everything is high frequency.
Here I've got a signal source,
which is a sine wave.
The frequency is 0.2 hertz, okay?
So that phasor is rotating very slowly.
And we can very easily illustrate that.
This is an IQ plot.
It's a scope plot in XY mode.
And you can see the samples.
You know, this is a normal sine wave, right?
Where are you?
I get...
No, it takes a long time
because it's...
because it's...
slow.
There it is.
Let's go, I think, strip chart.
Yeah, there it is.
So we have the normal phasor,
the normal sine wave that's being generated.
But if you look at it on XY,
then it's just going to be a phase
that's rotating at a fixed rate
around your unit circle on the complex plane.
So what I want you to think about
is exactly this
in a single range bin, okay?
So you've got your echo coming back,
it's changing in phase,
and so you'll get a bit of this
in that range bin.
And of course,
what happens when you take the FFT
of a sine wave in this case?
You'll get a response in some bin
that maps to the frequency of the thing.
So what does that imply?
Can anybody tell me?
Once you end up taking the FFTs of the columns,
maybe I'll show you the next slide
and somebody can tell me.
So we did all that.
Okay.
Okay, so we...
Oh, microphone stopped working?
Hello?
Oh, there we go, testing.
It's not even wireless,
so we couldn't have blamed somebody
trying to dust my mic.
Right.
So consider this, then.
Each row here is a single FFT
that we took on an echo that came back, right?
Over our integration period,
we build up multiple rows.
So these are all the transforms.
Here, we're just taking an eight-point transform.
And so we build up each row
and have a number of columns
that maps to our integration period.
Then, to get the Doppler information,
what do you do?
You look at the face,
but what's the next step here?
I mean, I've already said it,
so I'm hoping somebody was listening.
You take FFTs of what?
The columns.
So you build up this memory cell, right?
And then once you've built up
and you've populated all of these
with the complex outputs of the first FFT part
of the range information,
you take the FFTs column-wise.
And so what you're doing is
you're doing an FFT
to look at the phase changes of the returns
at each range bin.
And what does that mean?
The Doppler shift
and the movement of the target
imparts the phase change,
and that causes that phase alteration.
and the faster or slower,
and whether it's forward or reversed,
rotating in that phase or,
tells you how fast the object is moving.
And so if you have two targets
that end up ambiguously,
ending up in the same range bin,
but they're maybe flying in different directions
or different speeds,
you can use Doppler processing
to then disambiguate them.
So instead of then just having a 1D plot,
you end up with a 2D plot,
and I'll show you what that looks like.
So you run the FFTs for each of these columns.
And then you get,
oops.
Now, remember how I said remember this slide
earlier in the presentation?
What was I showing you when I showed that slide?
An interleaver.
Look familiar?
Interleaver?
So what you can do in GNU Radio is,
I just wrote a simple row column interleaver block,
and it takes the output of the first FFT state,
and then once it fills the interleaver,
it outputs everything into another FFT,
and then you've got all your data,
the range and velocity information.
Okay, so interleaver.
And so this is a neat little tweak
that I made to my interleaver.
Usually, with an interleaver,
you need to fill up the entire interleaver,
and then you can read it out, right?
So you fill up all the rows,
and then you read it out all the columns.
What I did with my interleaver is that you can set,
I can't remember what the variable is,
but you can actually go to my interleaver,
and you can cause it to read out more quickly.
So it'll actually fill up,
let's say there are eight rows,
instead of outputting all the data
once it's filled up eight rows,
it fills four rows,
moves everything up,
fills up the last four rows, moves everything up,
and then outputs all eight.
And then it fills the next four, outputs all eight,
and then fills up four, and output.
And so effectively you get twice the output
coming out of your interleaver, which means that
even though you might have a long integration period,
like 10 seconds, we don't want to be
waiting 10 seconds to update a pretty plot,
we want to update it much more frequently.
So you have your interleaver spit the data out
more frequently.
So the DCHIP signal goes into an FFT,
you get your range information,
goes into the interleaver, you do another FFT,
and then magically you get your velocity information.
So now what I'm going to show you is
the original audio demo
that I had with the laptop here,
and then that plot that I didn't show you
is going to be the output of all of this
in a 2D image.
That gives you the Doppler information.
Okay, where are we?
And I will take Nate's wonderful advice again.
Use my laptop,
speakers and microphone.
Let me just fix up the,
so see before,
this is the DC component,
it's actually wrapped around,
because the microphone on the audio card
starts sampling at a different time
to when the output,
the digital Allen converter started,
they're offset in frequency space
because they're offset in time,
and so I need to adjust for that
manually myself.
Let me just do that.
Here.
Okay.
All right.
All right, there's that.
It should look familiar to you.
And now let me show you the magic here.
Hopefully it'll work.
All right, here we go.
So this is the Doppler plot.
You're going to see a little bit more of this
because I'm just going to show you
some brief previous experiments after this.
What I want you to think about here
is that the Doppler plot
is that the waterfall behind it
is showing you, effectively,
virtual range over time, right?
The Doppler plot,
the vertical axis here
is the range information.
The horizontal axis
is the velocity information.
So stuff there,
actually you see as I'm moving around
I'm actually causing the echo to change.
So it's surprisingly sensitive.
So yeah.
See how we've got the strong DC
part there on the left?
That maps to vertically that strong
bright spot at the top there.
So what I'm going to do is I might
need to change
the color mapping
here.
Yeah, that's better.
All right, let's see how this works.
So remember, what you'll see is
I'm going to be moving
the target
at a particular velocity.
Maybe up and down, a little bit slower,
and you'll see a bright spot appear there
either on the left or on the right,
depending if I'm going forward or backward.
And the distance from the center point
is going to imply how quickly I'm moving it.
Let's see if this works.
So there's my target. It's a bright spot, right?
And notice that I moved it here.
And now it's settled, so I'm going to move it more.
See, now it's on the left because I'm moving it up.
And now I'm going to stop
and it's going to come back because I've stopped moving it.
Now you still get the range return.
See the bright spot in the middle on the center line?
But I'm not moving it, so there's no doppel...
Well, I am, actually, because I can't keep it totally steady.
But it's that sensitive that even as it's waving here,
you can see that it's moving left and right.
So if I go like this,
then you get the doppel response.
See? And that's just using the audio.
Now, who can...
Apart from the multiple echoes,
who can tell me why we're getting multiple echoes here?
Wait. Skylar, hang on a second.
Anyone else with a hand?
Guy at the back?
Audience member 2 in the back.
audience member 2 in the back.
audience member 2 in the back.
Say it anyway.
audience member 2 in the back.
Yeah, because at least...
because we didn't have a microphone.
But what the two gentlemen were saying
was that
they're so close that
the audio's going to bounce off the bottom of my laptop,
it's going to enter the microphone,
but it's also going to bounce off my bottom laptop
and it'll keep bouncing back and forth.
So we get the multiple returns there.
The strongest one's going to be the direct...
you know, the shortest part.
The other thing is look carefully
what happens to the bright spot
in relation to the edges of this image
as I move it, right?
I'm going to move it very slowly to keep it in there
and maybe a bit further out so we don't get all the returns.
Right? So now it's going to be on the left.
I'm going to move it fast and watch what happens.
Who said that?
That's right. It's aliasing.
Why are we getting aliasing?
It's aliasing.
Yeah, that's exactly right.
So what is happening here
is that the pulse
repetition frequency, right?
How often we send out pulses
and
that'll basically constrain us
in terms of
the maximum unambiguous
velocity that you can make out.
So once you exceed that velocity
just like with a normal signal
if it's above your Nyquist
divided by 2, or Nyquist
if it's complex, it will then
wrap around because
you can't disambiguate above that.
It's exactly the same principle.
So this is another constraint that's applied to
the radar system depending upon the parameters
that you pick initially.
So you have to, as a radar designer
define what your
maximum unambiguous
range should be
and then you have to
balance that with your
maximum unambiguous velocity.
Because you can't have both.
It's got to be either one way or the other.
Yeah.
So that's
basically the...
I need the sound on.
Again, very good advice from the audience.
So any questions about this?
No?
So just a reminder then, remember how
we were basically doing the
interleaving and doing the FFT?
That plot that we saw
is basically the output
of that entire process.
So each of those
each of the rows
was an output of
an FFT.
So that's the audio.
It's almost time so
if you're interested I'll show you
an SDR version.
I've got some
directional antennas here.
I'll try and show you
because what I've done is
I take the bins
that map to the zero range
because remember I was saying light travels really fast, right?
So even though I think I'm using
1 megahertz sample rate
and so 1 over 1 million
is still going to be 100 meters
or 60 meters or whatever it is.
And so
we wouldn't be able to demonstrate
a change in range
but we can demonstrate Doppler because Doppler will still
work in the zero bin
if we're nice and close.
And what I do is I then do an inverse transform
of that FFT at the zero bin
and then I put that to the speakers
and it makes like a theremin
so we can wave something back and forth
and turn it into a musical instrument.
But I'll show you that last in case we run out of time.
You can stick around if you want to see it.
Right, back to the slides.
Okay, so
that's stuff that you can do at home
and I want to show you some stuff
that's used in practice and how you can actually
decode that stuff as well.
So one is CODAR
which is HF radar used to map
the surface of the ocean
and map currents
and you can go on various universities websites
that have these set up and look at interactive
live
plots of currents over the ocean.
The idea is that you send out an HF wave
it'll hit crests of
an RF wave, it'll hit the crests of ocean waves
which will reflect them back to the receiver
and those ocean waves will also have a
velocity component to them
which will then change the phase and once you do
doppler integration over time
then you can both get range and
velocity information of ocean waves.
And then they have them
distributed in certain
ways and
they did something interesting which is
gating the transmitter
so if you look on an ordinary plot
it looks like it's just a chirp
but if you look very closely with the right parameters
you can actually see they gate the transmitter
on and off to give it that dead time
to receive a return
and the side effect of this is that
when you take an FFT you actually end up getting
sidebands on your main signal
and you might think they're returns but they're
just a result of doing the
frequency transform of this gated
waveform and
if you do the math
they're like millions of kilometers away in terms
of range and so the stuff that you want to see
is really really close in.
So that's what it looks like
and you've got your main chirp and
return hidden in the middle and those
symmetric lines going out
are the
AM sidebands that you can forget about.
So I showed this before
there are a bunch of HF
CODAR stations running on the
spectrum all the time so you can pick any one of them
I basically talked about all that
and a shout out
again to Peter Bellings and
Mo Wheatley, Iris Space SpectraView
actually Peter made these
Vivaldi antennas, really cool if you want to check them out
after the talk
and they've used
SpectraView and his SDRs
to produce these amazing plots
where you're not actually looking at the ocean returns
anymore, you're looking at the returns
of the ionosphere because it's HF
and will still
travel all the way up to the ionosphere
and come back on a return
and then this is one of
Iris Space's tweets
really really cool stuff
and then this is in SpectraView
producing on the plot so in this way you can
use the signal in an unintended
way to look at natural phenomena
that are going around the earth
and another
very very amazing
SDR guy, Juha
Vierian
he's done incredible
stuff, he's used this kind of
UHF radar to map
the surface of the moon
amazing paper, he's done something
really cool stuff with ionosons
I've tried my hand at this
and so you also get those multiple returns
this is sort of frequency over time
as an ionoson sweeps the ionosphere
across the entire HF spectrum
you can similarly de-chirp it
because it's just a chirp
and then get these multiple reflections
from the ionosphere
we went out hiking
and
I thought after the hike
my wife
was very kind and she just
read her book in the car
I set my laptop up in the boot
and received Kodar
from around that area
you may recall me showing this previously
so this is the
x-axis is time
y-axis is frequency
and so this is the Kodar over time
and you can see the AM side bands again
and there's some information hidden in there
we're only interested in the center one
if you zoom in
in this case I don't think I had a GPS DO
they're GPS disciplines
so you want to have a GPS 2
so that the phase information is correct
because remember if you're running your interleaver
and the doppler processing
you want to make sure everything is perfectly aligned and stable
so there's something going on there
I didn't know where it was
again you know
that's range information effectively in the middle
so you're getting returns somehow
and then with Ian Buckley
we went out one night and set up
and did some captures with a GPS DO
and
you know we had a long wire set up
and a custom made dipole
I'm going to show you a video here
this is again same kind of output from GNU Radio
using that same plotting thing
but it's a modified SEL sync but also outputs
a series of bitmaps
and so this is the same
everything that I've spoken about so far
exactly the same process
but applied to the HF CODA
returns that I just received on my SDR
now the disclaimer is
I have no idea exactly what we're looking at
I mean obviously there's range and velocity
information in there
and you can see that there's some cool stuff happening
like there are these
returns here
and in terms of velocity which is on the y-axis
things are moving
direction away and toward
the receiver
so there's stuff happening and there are weaker
responses out there
I don't know whether this is purely from the ocean waves
or it's purely from the ionosphere
I meant to do the calculations but I didn't get a chance
if you know
what's contributing to this
I'd be really curious
but you know you can basically
take the parameters of the radar system and calculate
how far those returns are
and what the implications are
and you know it's this information that they
take in the CODA system
and then map to figuring out
the ocean currents
from information gathered from multiple points
like you saw on that map before
so you can generate cool plots
the last thing I want to show you is
the television version with airplanes
so this is using passive radar again
so with CODA I was using someone else's signal
in this case I'm using
digital ATSC terrestrial TV signal
and remember
like I said with the CHIRP
if you have a fixed thing that you're looking at
and you want to run through your filter
in the case of ATSC
happily
in the middle between picture information
there is this synchronization sequence
of a fixed length and it's documented
so this now becomes
the filter
not FMCW CHIRP anymore
but the standards based
synchronization sequence
for ATSC
that we end up filtering and correlating on
and this is
in all TV signals and what's available
what's nice is they use incredibly powerful
transmitters that'll
broadcast the signal
in a broad range
I had this set up first in my house
where I had this directional antenna pointing out to a highway
this is the view from
our place, there's the 280 highway
in San Francisco that runs there
cars are moving back and forth
they might end up being decent radar returns
and so you can see how they're moving there
one direction of traffic on top
the other on the bottom
they're metallic so we might get some returns
and that's
that's the receiver
site, the transmitter site
is over the hill which is nice because we don't get
the direct path from the transmitter
you get the reflections from stuff
that's and the direct path is attenuated
so this is where
I want to illustrate the power of Doppler processing
because in this case
Doppler and velocity is on the Y
and range is on the X
what this is doing is it's correlating that
known synchronization sequence in the signal
and then
that initial
the strongest return from
the filter for that
ends up being in the center there
so you can ignore everything to the left because that's all picture information
and then stuff that's here
this is basically time zero in terms of
the synchronization signal
now if we weren't doing any
Doppler processing, if we didn't care about velocity
and we only got the range information
look at this range line
the green line
there's nothing discernible going on there
you will get reflections
off static structures that are large
and will reflect a lot of the signal
but if you're talking about cars and aeroplanes
the radar cross section is so small
they won't be able to send any appreciable signal
back to that small directional antenna
so there's nothing there
once you add velocity information
you can see that green is
we go from white to red to green
it's the color spectrum
the black and the blue there
are basically down the other end
of your power range
still within the
dynamic range of your ADC
but it's much more easy to
discern stuff
so actually that's the target right there
I'll go back to the beginning
oh look did you see
that's not on my display
let me try that one more time
so at the beginning here some funky stuff happens
as the interleaver fills up
because there's still empty data in the interleaver
and it kind of settles
and just look here and you'll see
little spots appear
and I'm pretty sure they're cars on the highway
so that's the TV signal
there's another one there
and then they appear very briefly
because if you think of them like a mirror
you want to end up seeing the specular reflection
off the car and the car has to be at the right angle
you know the door or the windshield
or whatever it is has to be at the right angle
both with respect to my receiver
and the TV transmitter to produce the reflection
another important point here is that
I have a GPSDO
displaying the oscillator in my receiver
but that's still not good enough
there is still some phase offset
a series of blocks I have
that measure the number of samples
between each successive primary return
of that ATSC synchronization sequence
and there's a polyphase resampler
but it uses a long double ratio
which is
it's not a float, it's not a double
it's a long double
because there are so many decimal points back
where it has to adjust the rate
to be locked on exactly to the signal
and not have the range information wander
and then you have to track the phase
of the primary and it gets a bit messy
if you want to do it well
but you can see there's stuff going on in there
now to prove
this a little bit more with the airplanes
Ian and I went out
to this car park
and we parked there
and this is in this park here
which happens to be here
right under almost the approach path
for planes coming to land at San Francisco
so the geometry there is really nice
we've got a TV transmitter
elsewhere in the north of the bay
and then we're down here
receiving the reflections quite close
to the aircraft
and that's the kind of setup there
we're just using a normal TV antenna
plugged into the USIRP
and then that's the stuff going on there
so I've got a couple of videos
and we'll see some interesting things
so that's a plane
see that
and it's aliasing
because we can't control
the pulse repetition frequency
we can't control the constraints
of unambiguous velocity
because that's defined by the ATC spec
but you can see
these returns
that are coming off planes
and what's interesting is
in terms of range
these ones are actually further out
we wouldn't see them again
if we didn't do the doppler processing
but because we do
we basically ignore the zero velocity line
and these targets are moving
so they make themselves apparent on the rest of the plot
let me go to the next one
some of them are more obvious than others
I think they get
so you can see there that line
and the reason why it's strict like that
remember I'm reading out of my interleaver
faster than the integration period
so you basically end up sort of smushing together
smoothing together
one integration period with the next
and so you'll basically get the blending
of velocity information as you go
I haven't quite got my head around that
it's some artifact of the system
oh look there's something there
yeah I have to think about that
a bit more
it wasn't nearly obvious to me
why that's there
any ideas from anyone?
yeah so there's a return down there
I don't know
I don't know
I don't know
I don't know
I don't know
I don't know
I don't know
some of them are really obvious
what was interesting is that
the planes that are overhead are obviously
going to be very close
I think one pixel here is 30 meters
somewhere around there
or maybe 40 meters
and so they all end up being quite close
especially as they're flying in overhead
but what really blew my mind later
is that
I can't remember which of these videos it is unfortunately
it might just appear
but there are dots that appeared further out
with slowly changing velocity.
And as it turned out, we looked over to the bay,
and of course there's San Francisco,
but what's on the other side of the bay?
Oakland is on the other side of the bay.
And there's a plane that was just smoothly cruising
into land at Oakland, but because of the geometry,
it was headed in a slightly different direction
than our planes coming into SFO,
and so it appeared differently on the plot,
both in terms of velocity and range.
Oh yeah, so there's something out there.
Yeah, so any questions so far?
So you saw that streak there.
I think this one might be a decent one.
Question?
If your plane's spinning on the same SDR,
do you not need a DCS?
Is that all there?
Correct, yeah.
So if you're transmitting and receiving
from the same piece of hardware,
everything's inherently going to be synchronized,
so you don't need to worry about using a GPS DO.
And I'll show you that if you want to stick around.
You mean that vertical line there?
So I think at the moment,
because there's a lot of artifacts happen,
during that disciplining process,
not the GPS DO one,
it's the other one that I talked about
where it measures the number of samples
between two of the primary returns
and it measures the phase.
There's some additional processing going on there,
and as it's doing that very, very fine adjustment
of the resampling,
it produces all these artifacts in the FFTs,
and that's why you get crap in there.
Maybe, question?
What's the frequency of the FFTs?
So I don't remember the exact frequency of this television,
but it's, you know, there are a plethora of stations
throughout the UHF band.
And then, based on the frequency,
that has an implication on how the radar cross-section will look,
so everything is interrelated there,
and here we're constrained, obviously,
by the station frequency and the spec.
So anyway, that brings me to the end of the talk.
If you want to hang around, I'll show you the SDR version.
If you want to hang around now, I'll show you.
It'll just take a couple of minutes.
Or you can clap now and head to lunch.
Totally up to you.
All right, I'll do it quickly.
So here, we've got,
let me find it here.
Oh, one thing I want to show you quickly.
This is the live processing of the coder, right?
So the HF, HF1.
So this should look familiar from the video.
What I wanted to show you here is,
in this plot, you know how I was talking about
usually when we take FFTs,
we always take the magnitude
and we always forget the phase information?
And this plot is showing you phase information only.
So consider it like a waterfall,
but instead of showing the magnitude, it's phase.
And remember how we had those interesting shapes coming up
and, you know, they're a strong return,
so there's going to be some information there?
This looks like noise,
because there's nothing strong there.
But amazingly, you can see this phase structure
in these range bins in the return.
So, you know, it's a good thing.
I haven't, I'd never looked at a phase plot like that before,
a phase waterfall, and it kind of looks cool.
Yeah.
So let me find the, I think it's this one.
I think it's this one.
Try this.
So this is two mega samples per second.
Oh, let me show you that,
that workbook.
No, no, no, there's another thing.
I watch it all the time.
Are there any movies in it?
Ah, we've got a little girl band.
Right.
But it's a two mega sample,
but it's fairly expensive.
It's, I think there's a 90 percent variety
What you can see is three美 oops,
You put in your pulse repetition frequency, you know, you basically can plug in anything
you want into the equation and then it will output all this information.
So for a given frequency, it gives you the wavelength, the range resolution.
For a given pulse repetition frequency, it will give you pulse duration.
Given bandwidth, it will give you an ambiguous range, an ambiguous Doppler, an ambiguous
velocity and then, you know, you can figure out the scales on all of these pictures from
that.
Let's see what's happening here.
Oh, it's running, cool.
So what I've got is I've got this flow graph here and then I've got the plot here.
Nothing is showing which is a little bit, oh, no, of course, nothing is showing.
Skyler correctly points out, thank you, another audience contribution.
The default configuration here is everything is off because I don't want to blow anything
up.
So, and I've got these two directional antennas here.
One is the transmitter and one is the receiver.
So I can put them next to each other and I'm just going to do a very quick setup and put
my bag in between.
I didn't, hopefully that won't affect things.
And I'm using a B200 Mini here in a custom 3D-printed case.
So I'm going to put it here.
And let me try doing this.
This is really arbitrary.
Something like that.
Okay.
And now, no guarantees.
It works also better if you're using separate transmit-receive USURP.
So, for example, I did it with a USURP with a MIMO cable so you can synchronize the clocks,
but the actual boards are different and they won't interfere with them.
Okay.
So, I'm going to do a simple setup.
I'm going to set the gain.
I think I use about 55.
Same gain I'll go, I don't know, 33.
And then I'm going to set my, sorry, I can bring it over here.
My amplitude of the signal of .7.
And what we've got now is, hopefully this is familiar to you, the spectrum is being
rotated.
So this is the FFT of the output of the de-chirping.
And we've got the tone there, which is what the signal is going to be.
The system is hearing, it's the DC tone, it's hearing itself, basically.
Unfortunately, that's really high, and it shouldn't be that high, because we won't be
able to resolve anything otherwise.
Okay.
It might be...
Too much here.
Oh, there it is, see?
See how we've got the center line, which is actually offset?
I haven't figured out why that's offset yet.
But as I move my laptop toward and away from the receiver, you can see that even though
it's in the zero range and it's still overloading, you still get velocity information.
And so that's, you know, that's basically how RF...
Radars work.
Now, let's see if...
Because I promised you music.
Music.
Music.
Is it actually...
Yeah, let me plug in the speaker there.
So it's a little bit finicky in that I need to do that, and then I need to change the
offset here so that it ends up going into the zero bin.
Because that's the one that's being transformed.
Do I have the audio actually on?
I do.
Sorry, what was that?
Your speaker volume is down.
My speaker volume is down.
There we go.
Thank you.
Another audience participation night.
What would I do without you all?
Thank you.
Thank you.
Thank you.
Thank you.