1 00:00:00,000 --> 00:00:06,080 From the bowels of the Wi-Fi village, I bring you the next presenter that has nothing to do with Wi-Fi. 2 00:00:06,920 --> 00:00:11,700 Thanks, Defcon. It's been five years we've been in the wireless village and they still haven't updated a goddamn thing. 3 00:00:11,880 --> 00:00:20,840 But it's great to be here anyway with Robert Gilduda, who I've known for about three, four years now and I just learned how to pronounce his name. 4 00:00:20,840 --> 00:00:30,840 So this is the fine gentleman who's been a very integral part of BladeRF from the beginning and a couple other projects that were stolen from them and just re-released. 5 00:00:30,940 --> 00:00:35,160 But it was basically his work anyway. So he's going to talk about designing an automatic game control. 6 00:00:35,300 --> 00:00:40,340 And if you are here and you are interested in this, you are sitting too far away. 7 00:00:40,680 --> 00:00:46,260 Come and bask in this fine gentleman's glory. Get close enough to smell him because it's actually quite nice. 8 00:00:46,720 --> 00:00:49,940 So without further ado, designing an automatic game control. 9 00:00:50,040 --> 00:00:50,820 And hopefully... 10 00:00:50,840 --> 00:00:54,640 Hopefully you can use that to pick up some, I don't know, traffic to the military base. 11 00:00:54,880 --> 00:00:55,320 Thanks. 12 00:01:03,980 --> 00:01:10,880 Yeah, so out of curiosity, who here is familiar with software-defined radios and what they do and what they are and how they work? 13 00:01:11,100 --> 00:01:11,760 All right, cool. 14 00:01:12,720 --> 00:01:16,100 Who here has an SDR that they've... 15 00:01:16,940 --> 00:01:20,620 Actually, better yet, who's familiar with automatic game control? 16 00:01:23,320 --> 00:01:29,740 Okay, I'm going to teach all you guys why you might want an automatic game control in your software-defined radio in this talk. 17 00:01:30,860 --> 00:01:32,680 Currently, the BladeRF does not have it. 18 00:01:32,780 --> 00:01:40,560 Or as of about a month ago, the BladeRF did not have an automatic game control, but now it does if you check release 2017-07. 19 00:01:40,900 --> 00:01:44,420 Who has checked it out and played with it by any chance? Anyone in the audience? 20 00:01:46,120 --> 00:01:50,620 All right, well, there's a blog post that's imminent, and it's been imminent. 21 00:01:50,840 --> 00:01:57,380 For the past couple of months, so, yeah, maybe this will motivate me to release the blog post, but, yeah. 22 00:01:57,500 --> 00:02:01,380 So, introduction. Who am I? I'm the owner of Nuon. We're about four people now. 23 00:02:01,600 --> 00:02:04,540 I have sort of like a small team of software, hardware, and RF engineers. 24 00:02:05,240 --> 00:02:09,260 My interests and that of everyone else on my team include software, hardware, and RF engineering. 25 00:02:10,480 --> 00:02:12,740 I'm kind of assuming that's not a surprise to anyone. 26 00:02:13,060 --> 00:02:20,660 I have a background in DSP, specifically telecoms, so telecommunications, like building modems and having wireless. 27 00:02:20,680 --> 00:02:20,820 Okay. 28 00:02:20,840 --> 00:02:21,840 Radios talk to one another. 29 00:02:22,100 --> 00:02:31,140 And acoustics. I did my master's degree in voice processing, so speaker recognition as opposed to speech recognition. 30 00:02:31,440 --> 00:02:35,640 So I can build things that identify who a speaker is as opposed to what they're saying. 31 00:02:36,400 --> 00:02:40,980 I have about six years of experience building enterprise network equipment. 32 00:02:41,240 --> 00:02:47,620 I worked on a pretty big publicly traded company's Wave 1, Wave 2 enterprise AC access points. 33 00:02:48,160 --> 00:02:50,760 And I've been a long-time information security. 34 00:02:51,280 --> 00:02:54,680 I've been coming to DEF CON since 08, and I've only missed one year since. 35 00:02:56,900 --> 00:02:58,080 So, the Blade RF. 36 00:02:58,480 --> 00:03:00,300 If, who here has a Blade RF? 37 00:03:01,180 --> 00:03:02,740 Who here has a Blade RF on them? 38 00:03:03,520 --> 00:03:04,120 All right. 39 00:03:04,640 --> 00:03:08,340 So, basically, the Blade RF is a USB 3.0 software-defined radio. 40 00:03:09,420 --> 00:03:13,460 We designed it in Orcad, like, about four and a half years ago. 41 00:03:13,620 --> 00:03:15,160 It's got, like, about 300 components. 42 00:03:15,840 --> 00:03:17,500 We use Cadence for the layout. 43 00:03:17,640 --> 00:03:20,300 As you can see, that's, like, the pretty little layout graph. 44 00:03:20,840 --> 00:03:20,920 You can see it up there. 45 00:03:22,660 --> 00:03:29,960 The design is mostly, like, an eight-layer PCB with five-by-five mil, or five-mil thick 46 00:03:29,960 --> 00:03:31,720 traces of five-mil spacing. 47 00:03:32,360 --> 00:03:34,680 It's an FR-4 TG material. 48 00:03:35,140 --> 00:03:38,500 So pretty much, like, commodity consumer-grade materials. 49 00:03:38,960 --> 00:03:43,740 The cool thing is we kind of went overboard with the amount of simulations and design 50 00:03:43,740 --> 00:03:45,520 that we put into building this radio. 51 00:03:45,840 --> 00:03:49,440 So we used a lot of HSPICE simulations. 52 00:03:49,440 --> 00:03:52,460 We used the Agilent ADS and Genesis. 53 00:03:53,600 --> 00:03:58,260 We got sort of an interesting license from them that they gave us. 54 00:03:58,540 --> 00:04:05,000 It's a 2.5D field solver that we were able to simulate sort of what happens to the RF 55 00:04:05,000 --> 00:04:10,780 traces on one side of the board when you're sending USB 3.0 super speed traces on the 56 00:04:10,780 --> 00:04:11,480 other side of the board. 57 00:04:11,820 --> 00:04:17,980 So back about four years ago or so, Intel had an advisory paper that's like, hey, if 58 00:04:17,980 --> 00:04:19,420 you're running USB 3.0, you're going to have to have a super speed trace on the other side 59 00:04:19,440 --> 00:04:26,420 So if you're running USB 3.0, you might end up knocking out your 2.4 gigahertz band radio 60 00:04:26,420 --> 00:04:27,860 receivers that are in your laptop. 61 00:04:28,140 --> 00:04:35,940 So we did a bunch of simulations just to make sure that there was no emanating, like, wideband 62 00:04:35,940 --> 00:04:41,540 2.4 gigahertz noise coming from the Blade RF's super speed traces. 63 00:04:42,720 --> 00:04:49,400 So the architecture of the Blade RF is basically a Cypress FX3 USB 3.0 transceiver chip. 64 00:04:49,400 --> 00:04:49,420 It's a single-core chip. 65 00:04:49,440 --> 00:04:55,300 Which essentially just has a USB 3.0 super speed peripheral side on one side, and then 66 00:04:55,300 --> 00:05:00,840 this general-purpose 32-bit bus GPIF on the other side. 67 00:05:00,940 --> 00:05:07,380 The GPIF is a, again, a 32-bit parallel bus that can run up to 100 megahertz. 68 00:05:07,500 --> 00:05:12,780 So it's capable of transferring up to about 400 megabytes of raw data per second. 69 00:05:12,940 --> 00:05:18,020 So when you multiply the Blade RF's maximum sampling rate, which is 40 mega samples, so 70 00:05:18,020 --> 00:05:24,300 it's 40 mega samples, receive and transmit, and an I and Q pair for each sample, you kind 71 00:05:24,300 --> 00:05:29,580 of notice that you can't fit into a USB 2.0 throughput constraint. 72 00:05:29,960 --> 00:05:32,760 So that's why we decided to go with USB 3.0. 73 00:05:32,760 --> 00:05:39,440 And, um, that provides us ample bandwidth to be able to do full duplex 40 megahertz 74 00:05:39,440 --> 00:05:41,420 channels, 28 filtered and instantaneous. 75 00:05:42,920 --> 00:05:45,920 And still have a bit of extra bandwidth to spare. 76 00:05:46,100 --> 00:05:46,360 So. 77 00:05:46,360 --> 00:05:49,040 So that extra bandwidth goes to things like the metadata. 78 00:05:49,400 --> 00:05:51,600 Has anyone used timestamping, 79 00:05:52,080 --> 00:05:53,340 like the timestamping functionality 80 00:05:53,340 --> 00:05:56,020 or the scheduled tuning functionality within BladeRF? 81 00:05:56,180 --> 00:05:57,720 I know we've only had like about 50 people 82 00:05:57,720 --> 00:05:58,960 that have actually asked us about that, 83 00:05:59,060 --> 00:06:00,480 and I'm wondering if one of you 50s 84 00:06:01,080 --> 00:06:03,120 in the audience or in this room at the moment. 85 00:06:04,040 --> 00:06:05,660 No one, all right. 86 00:06:07,680 --> 00:06:12,420 So the general purpose chip is then hooked up to an FPGA, 87 00:06:12,620 --> 00:06:14,920 which sort of acts as like the glue logic 88 00:06:14,920 --> 00:06:17,620 between the USB3 transceiver chip 89 00:06:17,990 --> 00:06:24,080 and the LMS602D transceiver chip, 90 00:06:24,240 --> 00:06:27,180 which is sort of like an all-in-one RF to bits chip. 91 00:06:27,820 --> 00:06:31,680 Essentially it has the amplifiers, the mixers, 92 00:06:32,150 --> 00:06:36,580 the low-pass filters, and the impedance matching circuitry, 93 00:06:36,700 --> 00:06:38,960 and the data converters like the ADCs and DACs 94 00:06:38,960 --> 00:06:40,400 all built into one single chip. 95 00:06:40,560 --> 00:06:42,140 So essentially on one side of the chip, 96 00:06:42,200 --> 00:06:44,460 you hook up a ballon, and on the other side of the chip, 97 00:06:44,460 --> 00:06:47,800 you have your 12 bits of I and Q data 98 00:06:47,800 --> 00:06:50,480 coming out as actual physical pins. 99 00:06:50,800 --> 00:06:53,100 So you hook those up to an FPGA, 100 00:06:53,260 --> 00:06:55,300 you do a little bit of buffering inside of the FPGA, 101 00:06:55,380 --> 00:06:57,960 you do some additional signal conditioning and processing, 102 00:06:58,240 --> 00:07:02,320 and then you shove things into the USB3 transceiver, 103 00:07:02,480 --> 00:07:05,860 and all of a sudden you're collecting RF samples 104 00:07:06,260 --> 00:07:08,620 and pushing them into a host computer 105 00:07:08,620 --> 00:07:11,340 and doing processing and software. 106 00:07:11,520 --> 00:07:14,440 Hence the software-defined radio aspect of this whole chip. 107 00:07:14,440 --> 00:07:14,760 So that's the whole project. 108 00:07:15,460 --> 00:07:18,180 The frequency range of the device is about 300 megahertz 109 00:07:18,180 --> 00:07:19,220 to 3.8 gigahertz. 110 00:07:19,380 --> 00:07:20,880 Some devices go a little bit lower, 111 00:07:20,940 --> 00:07:21,900 some go a little bit higher, 112 00:07:22,040 --> 00:07:25,020 but that's the range that we feel comfortable guaranteeing. 113 00:07:27,020 --> 00:07:30,380 And yeah, it's a full-duplex, 12-bit, 40-megasample, 114 00:07:30,380 --> 00:07:31,560 quadrature sampling device. 115 00:07:33,440 --> 00:07:37,480 On it, though, the LMS602D doesn't have the ability 116 00:07:37,480 --> 00:07:38,780 to create its own reference clocks, 117 00:07:38,980 --> 00:07:40,300 so the sampling clock is created 118 00:07:40,300 --> 00:07:43,380 by an SI5338 synthesizer chip. 119 00:07:43,380 --> 00:07:49,640 So this chip is able to create very clean reference clocks 120 00:07:49,640 --> 00:07:53,400 between like 100 kilohertz and 200 megahertz. 121 00:07:53,600 --> 00:07:56,360 So that's sort of, when you go and type like 122 00:07:56,360 --> 00:08:00,320 set sample rate 20M in BladeRF command line, 123 00:08:00,480 --> 00:08:04,740 that's the chip that's doing the 20 megahertz. 124 00:08:04,960 --> 00:08:08,260 And it's feeding it to the LMS chip and also to the FPGA, 125 00:08:08,500 --> 00:08:13,360 and then the LMS's ADC uses that chip 126 00:08:13,380 --> 00:08:15,040 and that reference clock to digitize 127 00:08:16,960 --> 00:08:19,480 the incoming RF signal that it sees, 128 00:08:19,660 --> 00:08:22,060 and eventually all those come out 129 00:08:22,060 --> 00:08:25,200 on the digital side of the LMS chip and go into the FPGA. 130 00:08:25,600 --> 00:08:28,380 The synthesizer chip also feeds the LOs, 131 00:08:28,380 --> 00:08:30,660 which are the local oscillators, on the BladeRF, 132 00:08:30,840 --> 00:08:36,980 so you can kind of think of radio receivers 133 00:08:36,980 --> 00:08:40,640 as sort of this like house of cards. 134 00:08:40,840 --> 00:08:42,740 So if you have a really weak foundation, 135 00:08:42,740 --> 00:08:44,960 in the quality of your signals, 136 00:08:45,100 --> 00:08:49,160 it's gonna propagate, like the poor quality of your signals 137 00:08:49,160 --> 00:08:50,340 is gonna propagate through everything. 138 00:08:50,720 --> 00:08:54,960 So the SI5338 has, is also the reference 139 00:08:54,960 --> 00:08:57,140 for the local oscillator, which is used 140 00:08:57,140 --> 00:08:59,880 to tune the device across the RF range. 141 00:09:00,080 --> 00:09:03,320 So internal to the LMS6 chip, there's an LO, 142 00:09:03,500 --> 00:09:04,920 which is again, the local oscillator, 143 00:09:05,100 --> 00:09:08,180 which essentially defines which channel you are on. 144 00:09:08,260 --> 00:09:08,660 Question? 145 00:09:08,940 --> 00:09:11,080 Do you have an external LO port on the BladeRF? 146 00:09:11,080 --> 00:09:13,300 We do not have an external LO port. 147 00:09:13,660 --> 00:09:16,140 No, there is a transverter board, 148 00:09:16,340 --> 00:09:21,080 the thing that takes RF, mixes it down to 300 megahertz, 149 00:09:21,200 --> 00:09:25,680 or mixes everything below 300 megahertz up to 1200 megahertz, 150 00:09:25,880 --> 00:09:29,820 and then this transceiver chip is able to see 1200 megahertz, 151 00:09:30,500 --> 00:09:33,600 but what you're actually seeing coming in from the antenna 152 00:09:33,600 --> 00:09:34,900 is below 300 megahertz. 153 00:09:39,000 --> 00:09:41,020 So this is sort of like the rough architecture, 154 00:09:41,020 --> 00:09:44,440 of soft-refined radios, sort of the idea 155 00:09:44,440 --> 00:09:46,300 is having flexible RF hardware, 156 00:09:46,480 --> 00:09:51,060 so signal conditioning things such as LNAs, PAs, filters, 157 00:09:53,580 --> 00:09:55,560 LOs, modulators, and demodulators, 158 00:09:55,640 --> 00:10:00,520 feeding into digital to analog converters, 159 00:10:01,060 --> 00:10:04,240 and ultimately going through the rest of the DSP chain, 160 00:10:04,560 --> 00:10:10,600 and usually, I mean, you guys will probably run things 161 00:10:10,600 --> 00:10:13,380 like GQRX, so the processing side is kind of light 162 00:10:13,380 --> 00:10:17,160 on the FPGA, and what you're feeding into your programs 163 00:10:17,160 --> 00:10:19,400 is something like I and Q samples, 164 00:10:19,480 --> 00:10:23,360 and then seeing the raw spectrum in GQRX or GR phosphor. 165 00:10:24,760 --> 00:10:29,680 But some people do some additional things in the FPGA, 166 00:10:29,920 --> 00:10:34,860 such as having channelizers, having actual modems, 167 00:10:34,880 --> 00:10:38,600 having equalizers, and some other signal conditioning things, 168 00:10:38,740 --> 00:10:40,120 such as DC. 169 00:10:40,600 --> 00:10:43,380 You can see an IQ phase imbalance correction 170 00:10:43,380 --> 00:10:46,260 going on inside of the FPGA, 171 00:10:46,460 --> 00:10:49,000 and then those things get passed up instead of raw samples. 172 00:10:49,900 --> 00:10:54,940 So this is the LNA6's block diagram. 173 00:10:55,340 --> 00:10:57,700 We're gonna constantly kind of come back to this, 174 00:10:57,780 --> 00:11:00,640 because it's kind of important in designing 175 00:11:00,640 --> 00:11:03,940 an automatic gain control, because as you guys can see here, 176 00:11:04,140 --> 00:11:06,400 there's really no feedback loop. 177 00:11:06,760 --> 00:11:10,100 So RF comes in. 178 00:11:10,100 --> 00:11:10,320 So RF comes in. 179 00:11:10,320 --> 00:11:10,520 So RF comes in. 180 00:11:10,520 --> 00:11:10,580 So RF comes in. 181 00:11:10,600 --> 00:11:12,100 You have an LNA, you have your mixer, 182 00:11:12,220 --> 00:11:14,340 you have your VGAs, your LPFs, 183 00:11:14,360 --> 00:11:18,820 and kind of whatever you set those values to, 184 00:11:19,080 --> 00:11:21,540 they won't adjust based off of the signal that's coming in. 185 00:11:22,120 --> 00:11:27,180 So there's a reason for, yeah, here we go. 186 00:11:27,560 --> 00:11:29,860 So, give me just one second. 187 00:11:31,920 --> 00:11:36,400 Yeah, so incoming signals that you deal with regularly, 188 00:11:37,160 --> 00:11:40,140 kind of, when they hit the antenna, 189 00:11:40,140 --> 00:11:43,900 they come in anywhere between minus 25 dBm, 190 00:11:44,060 --> 00:11:45,860 which is pretty loud for something, 191 00:11:47,020 --> 00:11:50,120 and they can come in as low as minus 110 dBm. 192 00:11:50,200 --> 00:11:52,680 So that's 85 dB of range. 193 00:11:53,340 --> 00:11:56,460 As I said before, the Blade RF has a 12-bit A-to-D. 194 00:11:56,700 --> 00:11:59,060 So 12 bits only kind of gives you 195 00:11:59,060 --> 00:12:04,300 about 72 dB worth of static range. 196 00:12:04,560 --> 00:12:09,520 So your static range is how much range can you see 197 00:12:10,140 --> 00:12:12,820 at any one given moment without adjusting your gains. 198 00:12:13,060 --> 00:12:16,600 So what that means is with 85 dB of range, 199 00:12:16,800 --> 00:12:19,720 if you're tuned in to being able to hear a signal that's, 200 00:12:19,720 --> 00:12:22,520 or with 72 dB of range, if you're tuned in 201 00:12:22,520 --> 00:12:25,040 to something as hot as being able to hear something 202 00:12:25,040 --> 00:12:27,060 that comes in at like minus 5 dBm, 203 00:12:27,180 --> 00:12:29,700 the quietest thing that you'll be able to hear 204 00:12:29,700 --> 00:12:32,600 is something that comes at minus 65 dBm. 205 00:12:32,680 --> 00:12:34,620 But there's also a fair amount of signal 206 00:12:35,260 --> 00:12:37,560 that you're not gonna be able to see. 207 00:12:37,740 --> 00:12:39,860 So if you have like a 10 dB SNR signal 208 00:12:39,860 --> 00:12:42,540 that comes in like minus 65 dB, 209 00:12:42,920 --> 00:12:46,040 like you need your sensitivity to go down to minus 75 dB. 210 00:12:46,560 --> 00:12:49,120 So, yeah. 211 00:12:52,480 --> 00:12:56,080 So yeah, a 12-bit ADC does not have the ability 212 00:12:56,080 --> 00:12:58,660 to simultaneously listen to minus 25 dBm 213 00:12:58,660 --> 00:13:02,040 and minus 100 dBm signal without drowning one of them out. 214 00:13:02,220 --> 00:13:05,260 And generally, you can't drown out the louder signal 215 00:13:05,600 --> 00:13:08,360 because it's going to end up completely swapping 216 00:13:08,360 --> 00:13:09,860 your front end. 217 00:13:10,060 --> 00:13:12,460 So, again, this is known as static range. 218 00:13:12,660 --> 00:13:13,400 Oh, nothing. 219 00:13:13,740 --> 00:13:14,500 All right, it's good. 220 00:13:15,240 --> 00:13:20,080 So, what can we do to extend that 72 dB worth 221 00:13:20,080 --> 00:13:21,320 of static range? 222 00:13:21,780 --> 00:13:25,220 Well, going back to this, we see that there's 223 00:13:25,220 --> 00:13:26,460 a fair number of gain stages. 224 00:13:26,940 --> 00:13:28,960 I don't know, does this show up? 225 00:13:29,120 --> 00:13:30,680 Yeah, oh man. 226 00:13:31,200 --> 00:13:35,300 So yeah, there's the LNA stage, which there are three of. 227 00:13:36,460 --> 00:13:37,980 I'm having some difficulty. 228 00:13:38,880 --> 00:13:40,340 Figuring out where my pointer is. 229 00:13:40,540 --> 00:13:43,140 Right, so these are three different LNAs. 230 00:13:43,240 --> 00:13:46,080 The reason why the LMS chip has three different LNAs 231 00:13:46,080 --> 00:13:48,200 is because it has sort of like a low-band LNA 232 00:13:48,200 --> 00:13:50,900 and a high-band LNA, and then a wide-band LNA. 233 00:13:51,520 --> 00:13:56,240 The wide-band LNA has slightly worse noise figure performance 234 00:13:56,580 --> 00:13:59,220 than the banded LNAs. 235 00:13:59,460 --> 00:14:04,020 So, on the BladeRF, we use both LNA one and two 236 00:14:04,020 --> 00:14:06,980 and kind of just leave the wide-band LNA 237 00:14:08,360 --> 00:14:16,060 unpopulated, because it's 1.4 gigahertz. 238 00:14:18,580 --> 00:14:20,720 But then, once you go through the mixer, 239 00:14:20,780 --> 00:14:22,040 everything is at baseband. 240 00:14:22,280 --> 00:14:24,660 So, at this point, you are down at zero IF, 241 00:14:24,800 --> 00:14:27,480 which basically means that the frequency range 242 00:14:27,480 --> 00:14:29,400 of what you're looking has been mixed down 243 00:14:29,840 --> 00:14:32,660 and is now sitting right square at zero hertz. 244 00:14:32,920 --> 00:14:37,260 So, the RX VGA and the RX low-pass filter, 245 00:14:37,260 --> 00:14:41,940 and the RX VGA2 don't really have a requirement 246 00:14:41,940 --> 00:14:43,760 to be banded, because they're all basically working 247 00:14:43,760 --> 00:14:45,720 with signals that are lower than 50 megahertz. 248 00:14:48,580 --> 00:14:49,180 So. 249 00:14:51,920 --> 00:14:56,380 So, how can we have a device listen to things 250 00:14:56,380 --> 00:15:01,440 that might come in at minus 110 dBm, 251 00:15:01,960 --> 00:15:04,160 and also minus 25 dBm? 252 00:15:04,320 --> 00:15:07,240 Well, they can't, one assumption is that, you know, 253 00:15:07,240 --> 00:15:08,400 they can't occur simultaneously. 254 00:15:08,500 --> 00:15:09,520 Like, that's physically impossible, 255 00:15:09,800 --> 00:15:12,080 because if you adjust your gains 256 00:15:12,080 --> 00:15:15,480 so that you can hear the minus 110 dBm signal, 257 00:15:15,780 --> 00:15:18,200 when that minus 25 dBm signal is going to come in, 258 00:15:18,300 --> 00:15:19,780 it's going to blow out your front end. 259 00:15:19,940 --> 00:15:21,700 But if you tune your receiver 260 00:15:21,700 --> 00:15:25,280 so that you can hear the minus 25 dBm signal without clipping, 261 00:15:26,120 --> 00:15:30,220 you're just not going to hear that minus 110 dBm signal. 262 00:15:30,540 --> 00:15:32,240 So, how about packets? 263 00:15:32,420 --> 00:15:35,840 Because packets generally don't tend to have that great 264 00:15:35,840 --> 00:15:37,220 of a variation through them. 265 00:15:37,240 --> 00:15:41,480 So, if you're 100 kilometers away and transmitting something, 266 00:15:41,700 --> 00:15:44,440 your signals for the entire duration 267 00:15:44,440 --> 00:15:46,520 of one of your like 100 millisecond packets, 268 00:15:46,800 --> 00:15:49,980 or however long of a packet these point-to-point 269 00:15:49,980 --> 00:15:52,360 link systems use, won't change that much. 270 00:15:52,500 --> 00:15:55,940 So, it'll probably definitely come in at minus, 271 00:15:56,680 --> 00:16:00,320 say like 95 dBm for the duration of the entire packet. 272 00:16:00,620 --> 00:16:05,720 So, one thing that could be done is to change the gains 273 00:16:05,720 --> 00:16:09,320 of the amplifiers on a per packet basis 274 00:16:10,740 --> 00:16:14,800 by adjusting the RF front ends gains. 275 00:16:15,120 --> 00:16:18,380 So, the LNA has a 0 to 6 dB range. 276 00:16:19,020 --> 00:16:24,840 The RXVGA1 amplifier has a 5 dB to 30 dB amplification range. 277 00:16:25,100 --> 00:16:29,360 And RXVGA2 has a 0 dB to 30 dB amplification range. 278 00:16:30,140 --> 00:16:34,540 So, if you add all of these up, you have about 66 dB worth 279 00:16:34,540 --> 00:16:35,580 of dynamic range. 280 00:16:35,720 --> 00:16:38,640 Because you're able to adjust those knobs on the fly. 281 00:16:39,000 --> 00:16:41,600 As opposed to the static range, which is defined by the amount 282 00:16:41,600 --> 00:16:43,740 of bits that exist in your data converter. 283 00:16:44,160 --> 00:16:49,220 So, if you add the two up, the 66 dB worth of dynamic range. 284 00:16:49,640 --> 00:16:53,540 So, you can think of the dynamic range as centering 285 00:16:53,790 --> 00:16:56,820 or moving the static range up and down 286 00:16:57,290 --> 00:16:58,980 across different power levels. 287 00:16:59,320 --> 00:17:03,820 So, with the 66 dB of dynamic range and the 72 dB worth 288 00:17:03,820 --> 00:17:05,700 of static range. 289 00:17:05,700 --> 00:17:09,980 So, the static range from the A to D, you essentially have 138 dB 290 00:17:10,650 --> 00:17:12,520 worth of sensitivity. 291 00:17:16,120 --> 00:17:16,820 That's a lot. 292 00:17:20,220 --> 00:17:21,220 So, right. 293 00:17:21,480 --> 00:17:25,260 Going back to this thing, there's the LNA, there's the RXVGA, 294 00:17:25,380 --> 00:17:26,600 and there's the RXVGA2. 295 00:17:27,180 --> 00:17:29,720 The question is, which ones do we adjust first? 296 00:17:30,040 --> 00:17:33,000 Do we adjust the larger one because it gives us more control 297 00:17:33,000 --> 00:17:34,620 or do we adjust the smaller one 298 00:17:34,620 --> 00:17:35,680 because of something else? 299 00:17:35,700 --> 00:17:36,460 Is there some weird reason? 300 00:17:36,740 --> 00:17:40,200 Well, when looking at a signal that you're receiving, 301 00:17:40,500 --> 00:17:44,060 what will happen is that a signal will deflect 302 00:17:44,060 --> 00:17:47,180 from the noise floor by what I like to call the signal level. 303 00:17:47,400 --> 00:17:52,260 So, that's your minus say like 85 dBm when you read a signal. 304 00:17:53,200 --> 00:17:57,580 The thing is that on top of the pedestal, so like the noise floor, 305 00:17:58,520 --> 00:18:00,380 is something known as the SNR. 306 00:18:00,520 --> 00:18:03,140 But below that, there's a little bit of noise as well 307 00:18:03,140 --> 00:18:05,680 because transmitters don't perfectly transmit signal. 308 00:18:05,680 --> 00:18:07,020 They can't transmit signals without some additional noise. 309 00:18:07,140 --> 00:18:10,320 So, the deflection from the noise floor is not purely signal. 310 00:18:10,520 --> 00:18:12,080 There's also some noise in there. 311 00:18:12,140 --> 00:18:13,760 Generally though, transmitters are really good 312 00:18:13,760 --> 00:18:15,900 at transmitting signal as opposed to noise. 313 00:18:16,160 --> 00:18:20,480 But through different channels, through different mediums 314 00:18:20,480 --> 00:18:25,740 and even cosmic rays and whatnot, that SNR will shrink 315 00:18:26,260 --> 00:18:29,420 from what it was when it left the transmitter. 316 00:18:29,620 --> 00:18:32,080 And a bunch of the transmitted signal 317 00:18:32,080 --> 00:18:33,460 that it sends will turn into noise. 318 00:18:33,920 --> 00:18:34,440 So. 319 00:18:36,180 --> 00:18:39,880 So, what you want to do, oh, there's also another thing. 320 00:18:40,020 --> 00:18:42,740 In the receiver, once you start doing things to the signal, 321 00:18:42,940 --> 00:18:44,340 so like once you start amplifying it, 322 00:18:44,360 --> 00:18:45,580 once you start doing impedance matching, 323 00:18:46,360 --> 00:18:50,420 you're going to be moving this noise bar up more and more 324 00:18:50,420 --> 00:18:50,780 and more. 325 00:18:51,840 --> 00:18:55,220 So, what you want to do is as soon as the signal comes in, 326 00:18:55,280 --> 00:18:59,680 you want to move the signal level as far away 327 00:18:59,680 --> 00:19:03,280 from the thermal noise floor and from this noise level 328 00:19:03,280 --> 00:19:04,460 as quickly as possible. 329 00:19:04,460 --> 00:19:09,860 Because the more things, the more components you put your signal 330 00:19:09,860 --> 00:19:12,780 through, the more of the SNR you're going to lose. 331 00:19:12,980 --> 00:19:15,820 So, you can have an amplifier that gives you 10 dB of gain, 332 00:19:16,060 --> 00:19:18,780 but it has a 1 dB noise factor. 333 00:19:19,040 --> 00:19:23,560 So, that means that even though this thing moves up 10 spaces, 334 00:19:24,020 --> 00:19:27,280 this gap narrows by 1 dB. 335 00:19:27,520 --> 00:19:33,260 So, you could actually end up losing all your signal by going 336 00:19:33,260 --> 00:19:34,440 through a really poor signal. 337 00:19:34,460 --> 00:19:37,200 So, that's what LNAs are good for. 338 00:19:37,300 --> 00:19:41,780 The LNAs are good for moving the signal level or the SNR part 339 00:19:41,780 --> 00:19:44,340 of the signal level away from the noise floor and away 340 00:19:44,340 --> 00:19:47,260 from the noise by just like a tiny little amount. 341 00:19:47,500 --> 00:19:51,200 So, then all the subsequent amplification that occurs 342 00:19:51,200 --> 00:19:56,780 in an RF chain don't take away from the SNR part of the signal. 343 00:19:58,820 --> 00:20:02,400 So, I kind of clued you guys in as like what the strategy here is. 344 00:20:03,640 --> 00:20:04,440 What you want to do is you want to have a signal that's, like, 345 00:20:04,440 --> 00:20:09,620 So, what you want to do is to first turn the gain up on the LNA. 346 00:20:09,780 --> 00:20:13,360 So, once your LNA is no longer able, so assume that you cut, 347 00:20:13,400 --> 00:20:15,180 you have, like, a really weak signal coming in 348 00:20:15,180 --> 00:20:15,840 and you know it's there. 349 00:20:16,080 --> 00:20:18,820 What you want to do is you want to tune the LNA all the way up 350 00:20:19,520 --> 00:20:21,420 and see if your signal is within range. 351 00:20:21,580 --> 00:20:25,080 If it's not within range, then you go to the next amplifier 352 00:20:25,080 --> 00:20:28,800 in the chain, which in this case is the RXVGA1. 353 00:20:29,580 --> 00:20:34,420 Once you've saturated your RXVGA1, you can go on to RXVGAT1, 354 00:20:34,440 --> 00:20:37,720 RXVGAT2, and by that point you have, if you max all those out 355 00:20:37,720 --> 00:20:40,220 and there's no signal there, you are basically sampling 356 00:20:41,660 --> 00:20:43,980 the thermal noise floor of the universe. 357 00:20:44,200 --> 00:20:48,200 Because with 138 dB, there's, your signal has now gone 358 00:20:48,200 --> 00:20:49,140 below the noise floor. 359 00:20:52,320 --> 00:20:54,840 So, these are LIME's recommendations 360 00:20:54,840 --> 00:21:00,240 for how you should implement an AGC, or implement a gain strategy 361 00:21:00,240 --> 00:21:04,420 for depending, depending on where your signal is, 362 00:21:04,420 --> 00:21:05,200 where your signal comes in. 363 00:21:06,160 --> 00:21:09,620 They kind of give a table of about six different gain settings, 364 00:21:09,880 --> 00:21:12,980 but AGCs should be fast. 365 00:21:13,240 --> 00:21:15,200 Like, an AGC shouldn't have to, like, 366 00:21:15,260 --> 00:21:18,640 go through four different stages writing three different registers 367 00:21:18,920 --> 00:21:21,100 for every single gain setting. 368 00:21:21,340 --> 00:21:23,860 Because if you do that, you're wasting precious time on a signal. 369 00:21:24,080 --> 00:21:29,780 So, 802.11, for example, only has a, about eight microseconds 370 00:21:29,780 --> 00:21:31,620 in which time your AGC has to lock. 371 00:21:31,880 --> 00:21:34,400 So, if you have, you know, 372 00:21:34,400 --> 00:21:36,960 if your gains are on the opposite end 373 00:21:36,960 --> 00:21:39,420 of where the signal is actually coming in, 374 00:21:39,620 --> 00:21:43,760 you're going to spend a long time traversing that gain table 375 00:21:44,170 --> 00:21:46,680 to figure out which gain setting works. 376 00:21:47,100 --> 00:21:49,980 So, I kind of decided to not follow this table just 377 00:21:49,980 --> 00:21:53,240 because it was kind of tedious, and I'm not quite sure 378 00:21:53,240 --> 00:21:55,180 that the linearity was all that great. 379 00:21:55,620 --> 00:21:57,520 So, I came up with my own gains. 380 00:21:57,620 --> 00:22:02,520 I came up with a gain setting, which I dubbed high gain, 381 00:22:02,660 --> 00:22:04,380 which is the LNA being set 382 00:22:04,400 --> 00:22:06,680 to maximum, which is 6 dB of gain. 383 00:22:07,720 --> 00:22:10,380 The RXVGA1 being set to 30 dB of gain, 384 00:22:10,540 --> 00:22:13,780 and the RXVGA2 being set to 15 dB of gain. 385 00:22:14,900 --> 00:22:16,180 Actually, I probably should have started this 386 00:22:16,180 --> 00:22:16,700 on the other end. 387 00:22:16,880 --> 00:22:20,900 So, the low gain starts with an LNA gain of 3, 388 00:22:21,520 --> 00:22:26,840 an RXVGA gain of 12, and an RXVGA gain 2 of 0. 389 00:22:27,900 --> 00:22:30,680 So, that's for the lowest gain setting required. 390 00:22:30,920 --> 00:22:32,960 That means, like, these signals are incredibly hot 391 00:22:33,760 --> 00:22:34,380 because they have to be set to maximum. 392 00:22:34,380 --> 00:22:39,540 They range from minus 30 dBm to minus 17 dBm, 393 00:22:39,620 --> 00:22:42,120 which essentially is like what you would expect 394 00:22:42,120 --> 00:22:45,300 if you had a Wi-Fi transmitter sitting on top of a Blade RF. 395 00:22:46,340 --> 00:22:49,720 So, you don't really need much amplification to be able 396 00:22:49,720 --> 00:22:52,480 to hear a signal that's being transmitted by something that's 397 00:22:52,480 --> 00:22:54,620 sitting directly on top of your SDR. 398 00:22:55,020 --> 00:22:58,960 But, say for example, you start moving the Wi-Fi transmitter 399 00:22:58,960 --> 00:23:02,200 away from the device, and you're about 50 feet away. 400 00:23:02,380 --> 00:23:04,260 Now, your signal probably will come in at 401 00:23:04,260 --> 00:23:06,100 around like minus 40 dBm. 402 00:23:06,280 --> 00:23:10,060 So, in that scenario, you want to compensate for the loss 403 00:23:10,060 --> 00:23:17,020 of received signal strength by bumping RXVGA1 from 12 to 30 dB. 404 00:23:17,260 --> 00:23:19,520 So, that gives you an additional 18 dB of gain. 405 00:23:20,040 --> 00:23:23,500 Ultimately, if you move the transmitter so far away 406 00:23:23,500 --> 00:23:26,760 that it's now coming in at minus 70 dBm, you might want to bump 407 00:23:26,760 --> 00:23:31,260 all of your gains up quite a bit. 408 00:23:31,460 --> 00:23:33,940 But, the thing that I decided to come up with, 409 00:23:34,260 --> 00:23:37,980 is, so this table has an interesting quality to it. 410 00:23:38,080 --> 00:23:42,320 It's that out of the three gain settings, only two change 411 00:23:43,020 --> 00:23:45,420 between each of the gain settings. 412 00:23:45,700 --> 00:23:48,800 So, the reason why this is important is because the LMS6 413 00:23:48,800 --> 00:23:52,960 has a spy controller that is used to control the gains with. 414 00:23:53,380 --> 00:23:58,940 So, changing any of the gains requires you 415 00:23:58,940 --> 00:24:00,260 to issue a spy command. 416 00:24:00,480 --> 00:24:03,940 So, that spy command takes some amount of time. 417 00:24:04,260 --> 00:24:06,960 And, because I wanted my AGC to be fast, I decided to come up 418 00:24:06,960 --> 00:24:10,260 with a strategy where just only two registers were being written 419 00:24:10,260 --> 00:24:13,960 to every time you went from like low to mid, or mid to high, 420 00:24:14,060 --> 00:24:15,640 or in any other direction. 421 00:24:23,640 --> 00:24:28,160 The group delay is like about three microseconds. 422 00:24:28,920 --> 00:24:33,000 And, that's sort of what I decided to have. 423 00:24:33,760 --> 00:24:34,240 Okay. 424 00:24:34,260 --> 00:24:37,920 So, that's what I calibrated the IIR to. 425 00:24:41,280 --> 00:24:41,720 Yeah. 426 00:24:41,800 --> 00:24:44,840 So, now that we know the gains, how do we make this automatic? 427 00:24:45,360 --> 00:24:49,900 Well, as I said, the starting condition, or the starting 428 00:24:49,900 --> 00:24:52,760 configuration for a device should be maximum gain. 429 00:24:52,980 --> 00:24:56,900 Because if you have a weak signal that's coming in, and your 430 00:24:56,900 --> 00:24:58,640 gains are turned down low, you're going to miss it. 431 00:24:58,740 --> 00:25:02,860 So, you can't have your AGC start out with a low gain setting. 432 00:25:03,740 --> 00:25:04,240 But, you can. 433 00:25:04,240 --> 00:25:05,780 But, you can start out with a high gain setting. 434 00:25:06,060 --> 00:25:09,460 So, what happens in that case is if you need to adjust your gains, 435 00:25:09,620 --> 00:25:12,180 you will end up having a signal that comes in that's very hot 436 00:25:12,180 --> 00:25:14,960 that will end up clipping your front end. 437 00:25:15,380 --> 00:25:18,480 So, it's much easier to detect a front end that's been clipped 438 00:25:18,960 --> 00:25:21,720 than to detect a signal that you don't have the proper amplification 439 00:25:21,720 --> 00:25:22,320 to see. 440 00:25:22,940 --> 00:25:27,740 So, the AGC puts the transceiver into a very high gain state, 441 00:25:27,960 --> 00:25:31,820 and then adjusts the gains depending on an algorithm that I'm going to 442 00:25:31,820 --> 00:25:32,380 discuss in a bit. 443 00:25:32,380 --> 00:25:40,440 So, the AGC calculates an instantaneous power of the incoming signal. 444 00:25:40,680 --> 00:25:45,620 So, power with quadrature is basically the square root of I squared plus Q squared. 445 00:25:46,240 --> 00:25:55,360 The problem, though, is if you kind of decide to make a decision based off of, like, one 446 00:25:55,360 --> 00:26:00,540 sample's power, you're going to be changing gains all the time. 447 00:26:01,040 --> 00:26:02,360 So, you're going to be changing gains all the time. 448 00:26:02,380 --> 00:26:06,900 So, this is kind of synonymous with, like, a home thermometer. 449 00:26:07,240 --> 00:26:10,900 So, if, like, a home thermometer doesn't have something known as hysteresis, 450 00:26:12,100 --> 00:26:17,620 which is once you go past a certain level, you don't want to turn the AC off 451 00:26:17,620 --> 00:26:20,200 as soon as it hits, like, 70.1 degrees. 452 00:26:21,960 --> 00:26:26,400 Yeah, you don't want the AC to turn off as soon as it hits 69.9 degrees 453 00:26:26,400 --> 00:26:31,420 and then turn back on as soon as it hits 70.01 degrees because it will continue going 454 00:26:31,420 --> 00:26:32,360 between the two very quickly. 455 00:26:33,480 --> 00:26:34,040 And... 456 00:26:34,040 --> 00:26:34,640 Yeah. 457 00:26:35,700 --> 00:26:36,260 Yeah. 458 00:26:36,740 --> 00:26:37,300 Exactly. 459 00:26:37,460 --> 00:26:46,300 So, what you want to do is potentially lower the temperature at which the AC turns off 460 00:26:46,300 --> 00:26:51,680 and turns on again, so then you have a bigger window of time in between when you need to 461 00:26:51,680 --> 00:26:53,180 turn the AC off and on. 462 00:26:54,040 --> 00:26:57,300 So, the same thing applies to soft-refined radios. 463 00:26:57,420 --> 00:27:01,480 So, the best way to not make a quick rash judgment call on... 464 00:27:01,480 --> 00:27:04,600 What gain you should be at based off of one sample, 465 00:27:04,800 --> 00:27:08,380 you will probably want to do a bit of averaging. 466 00:27:08,640 --> 00:27:13,400 And an IIR is probably the cheapest way of doing averaging in FPGAs 467 00:27:13,400 --> 00:27:17,380 because basically what you do is you take the last sum, you divide it in half, 468 00:27:17,580 --> 00:27:20,080 and then you add half of the new power. 469 00:27:20,360 --> 00:27:26,080 So, in HDL or in synthesized HDL, this is not that many gates. 470 00:27:26,520 --> 00:27:27,080 Uh... 471 00:27:27,760 --> 00:27:28,320 . 472 00:27:29,260 --> 00:27:29,820 . 473 00:27:29,820 --> 00:27:30,720 . 474 00:27:30,720 --> 00:27:33,000 So how vaguely do we want that? 475 00:27:36,620 --> 00:27:37,500 Uh... 476 00:27:37,500 --> 00:27:40,400 So, some things that AGC will miss. 477 00:27:40,700 --> 00:27:44,060 So, you can adjust the IIR... 478 00:27:44,060 --> 00:27:44,740 . 479 00:27:46,340 --> 00:27:46,780 . 480 00:27:46,780 --> 00:27:48,140 You can do it because... 481 00:27:48,720 --> 00:27:49,420 . 482 00:27:49,420 --> 00:27:50,600 . 483 00:27:50,600 --> 00:27:51,000 That looks nice. 484 00:27:52,700 --> 00:27:53,140 . 485 00:27:54,760 --> 00:27:55,640 . 486 00:27:55,640 --> 00:27:56,140 . 487 00:27:56,140 --> 00:27:56,920 . 488 00:27:56,920 --> 00:27:57,120 . 489 00:27:57,120 --> 00:27:57,700 . 490 00:28:03,340 --> 00:28:10,380 Um, right, there is no perfect AGC, so you will, yeah, those are configurable and the source code 491 00:28:10,380 --> 00:28:15,980 is available, so you can put in different numbers, but I found empirically that these things happen 492 00:28:15,980 --> 00:28:23,580 to work the best. So some of the other problems that occur with AGCs is, I mentioned group delay. 493 00:28:23,580 --> 00:28:33,380 Group delay basically means that because the speed of electricity is finite, if you adjust the LNA 494 00:28:33,380 --> 00:28:40,180 settings, it still takes some amount of time for the RF signal that was amplified with the new gain 495 00:28:40,180 --> 00:28:46,580 settings to propagate all the way through the chain. So the total group delay for the LMS6 chip is 496 00:28:46,580 --> 00:28:52,440 about three microseconds. So that's basically going from the RF antenna all the way to the digital 497 00:28:52,440 --> 00:28:53,560 INQ signal. So that's basically going from the RF antenna all the way to the digital INQ signal. 498 00:28:53,580 --> 00:28:56,940 If you add two LNA signals to the RF signal, which were digitized by the AGC, it's actually not that 499 00:28:56,940 --> 00:29:03,500 bad, but it adds a little bit to the amount of time that you have to, oh, I'm sorry. The group delay 500 00:29:03,500 --> 00:29:09,360 is one microsecond, because the settling time of the AGC is three microseconds. So, it still, the 501 00:29:09,360 --> 00:29:14,420 group delay makes it so that AGC works a little bit more slowly. So, essentially the way that you 502 00:29:14,420 --> 00:29:20,320 implement this in HDL is by just waiting for a certain number of cycles and samples to pass before 503 00:29:20,800 --> 00:29:23,560 you start up your IIR again, and those cycles come up before even your IIR and you're back on your 504 00:29:23,560 --> 00:29:25,960 again, because once you switch your gain settings, 505 00:29:26,180 --> 00:29:29,220 you want to wipe away the previous average 506 00:29:29,220 --> 00:29:30,480 and start with a new average, 507 00:29:30,680 --> 00:29:34,260 and then very quickly converge on a new average 508 00:29:34,260 --> 00:29:38,300 and figure out if that did anything for the gain. 509 00:29:39,980 --> 00:29:42,020 One interesting thing that can be done, though, 510 00:29:42,100 --> 00:29:45,580 is generally the group delay has 511 00:29:45,580 --> 00:29:48,260 like a sort of an exponential decay function to it 512 00:29:48,260 --> 00:29:52,340 once you update the amplifier settings. 513 00:29:52,340 --> 00:29:56,240 So that means that if you're in the highest gain setting 514 00:29:56,240 --> 00:29:58,940 and you have a signal that's very close to you 515 00:29:58,940 --> 00:30:00,860 and you only go to the mid setting, 516 00:30:01,040 --> 00:30:02,600 you don't need to wait for the group delay 517 00:30:02,600 --> 00:30:05,060 to completely settle before you can realize that, 518 00:30:05,120 --> 00:30:08,120 oh, this thing will continue blowing at my front end 519 00:30:08,120 --> 00:30:10,680 transceiver even in the mid setting. 520 00:30:10,840 --> 00:30:14,380 So halfway through the group delay and settling time 521 00:30:14,380 --> 00:30:18,520 of going from the high gain setting to the mid gain setting, 522 00:30:18,700 --> 00:30:20,660 you can kind of make a decision like, 523 00:30:20,740 --> 00:30:22,320 this is still way, way too high. 524 00:30:22,340 --> 00:30:23,560 This is way too hot, and go straight 525 00:30:23,560 --> 00:30:25,580 to the lowest gain setting. 526 00:30:28,520 --> 00:30:30,800 So, yeah, that's the signal is very hot 527 00:30:30,800 --> 00:30:33,620 and shortcut settling time that I was just talking about. 528 00:30:34,260 --> 00:30:35,920 And how do you test this? 529 00:30:37,720 --> 00:30:39,820 I guess you can kind of test it over the air 530 00:30:39,820 --> 00:30:42,060 and maybe have some like Wi-Fi access point 531 00:30:42,060 --> 00:30:44,080 or some Bluetooth transceiver 532 00:30:44,080 --> 00:30:45,320 that you bring close to your radio, 533 00:30:45,440 --> 00:30:48,160 but then you don't know exactly what the received strength is. 534 00:30:48,260 --> 00:30:50,000 You don't know what a number of different things are. 535 00:30:50,160 --> 00:30:52,100 So the best way to test this 536 00:30:52,340 --> 00:30:56,180 is using a vector signal generator. 537 00:30:56,880 --> 00:30:59,560 Some vector signal generators have the ability 538 00:30:59,560 --> 00:31:01,800 to sweep both amplitude and frequency 539 00:31:01,800 --> 00:31:03,600 and all sorts of other things in between. 540 00:31:03,980 --> 00:31:09,320 So with this vector signal generator, 541 00:31:09,500 --> 00:31:13,380 I basically had it sweep from, what is it, 542 00:31:13,420 --> 00:31:16,400 from minus 25 dBm or from minus 100 dBm 543 00:31:16,400 --> 00:31:18,660 to minus 25 dBm at 3 dBm increments. 544 00:31:18,840 --> 00:31:22,200 So I can capture this on a host computer, 545 00:31:22,340 --> 00:31:24,640 and kind of just see what happens 546 00:31:25,080 --> 00:31:28,040 to the BladeRF's front end 547 00:31:28,040 --> 00:31:31,720 as this VSG is sweeping through the whole range. 548 00:31:32,360 --> 00:31:36,080 And, oh, this is, so this is what happens 549 00:31:36,080 --> 00:31:39,340 when you run this through GQRX. 550 00:31:40,060 --> 00:31:43,060 Basically, somewhere at around this point, 551 00:31:43,180 --> 00:31:44,040 you are clipping. 552 00:31:44,180 --> 00:31:48,440 So your sine waves will look sort of more like square waves. 553 00:31:48,560 --> 00:31:49,660 And by the end here, 554 00:31:49,840 --> 00:31:51,560 you are basically dealing with 555 00:31:52,340 --> 00:31:53,100 an analog square wave, 556 00:31:53,240 --> 00:31:56,320 which is not at all what's being transmitted. 557 00:31:56,660 --> 00:31:58,800 And that's sort of what's causing this 558 00:32:00,240 --> 00:32:03,560 splattered spectrum to show up, up at the top. 559 00:32:03,720 --> 00:32:05,640 So if you're not familiar with GQRX, 560 00:32:05,740 --> 00:32:08,720 this sort of like dull line that exists at the top 561 00:32:08,720 --> 00:32:11,640 is the highest peak that GQRX has seen. 562 00:32:11,760 --> 00:32:14,660 So it holds the peak of the highest signal 563 00:32:14,660 --> 00:32:16,780 that it has seen at that frequency. 564 00:32:18,100 --> 00:32:22,080 So what happens if you run this same setup 565 00:32:22,340 --> 00:32:24,980 through the BladeRF's AGC? 566 00:32:25,680 --> 00:32:26,860 That's what it looks like. 567 00:32:27,300 --> 00:32:31,800 So you might notice a couple of differences. 568 00:32:32,160 --> 00:32:35,200 One of them is that the spectrum no longer splatters. 569 00:32:35,440 --> 00:32:37,540 So what, at around this point, 570 00:32:38,250 --> 00:32:40,280 started being spectrum splattering 571 00:32:40,280 --> 00:32:44,660 is now sort of no longer existent. 572 00:32:44,760 --> 00:32:46,340 But an interesting thing that you will notice 573 00:32:46,340 --> 00:32:48,140 is that the background color 574 00:32:48,140 --> 00:32:50,580 kind of does change between the gain settings. 575 00:32:50,780 --> 00:32:51,760 So just, 576 00:32:52,640 --> 00:32:53,640 as a heads up, 577 00:32:54,180 --> 00:32:55,980 this gain setting is the highest gain setting 578 00:32:55,980 --> 00:32:57,900 because that's what the AGC starts off at. 579 00:32:58,100 --> 00:33:01,340 As the gain increases from the VSG, 580 00:33:01,980 --> 00:33:03,560 it causes the BladeRF 581 00:33:04,180 --> 00:33:06,120 to go into the medium gain state. 582 00:33:06,340 --> 00:33:08,360 And once the medium gain state's 583 00:33:09,340 --> 00:33:11,040 received range is exceeded, 584 00:33:11,300 --> 00:33:13,860 the BladeRF then goes into the lowest gain setting. 585 00:33:14,080 --> 00:33:16,280 So as it's tuning down its gains, 586 00:33:16,340 --> 00:33:17,720 depending on the signal that comes in, 587 00:33:17,840 --> 00:33:20,340 you actually notice that the background noise floor 588 00:33:20,340 --> 00:33:21,700 is actually decreasing as well. 589 00:33:21,700 --> 00:33:24,200 Because when you have your LNA gain, 590 00:33:25,820 --> 00:33:27,560 RXVGA1 and RXVGA2 591 00:33:28,180 --> 00:33:29,720 turn all the way high, 592 00:33:29,820 --> 00:33:32,140 you're also amplifying a lot of thermal noise. 593 00:33:32,380 --> 00:33:34,040 So that's sort of what you see here. 594 00:33:34,280 --> 00:33:36,220 This deeper blue that you see 595 00:33:36,220 --> 00:33:37,300 on the peripheral here 596 00:33:37,300 --> 00:33:38,360 is actually from 597 00:33:40,020 --> 00:33:41,780 the thermal noise floor. 598 00:33:41,960 --> 00:33:43,420 So as you turn the gains down, 599 00:33:43,580 --> 00:33:45,820 you actually start getting a much higher 600 00:33:46,360 --> 00:33:47,760 difference between the peak 601 00:33:47,760 --> 00:33:48,480 of the signal 602 00:33:48,480 --> 00:33:53,740 and the bottom of the pedestal. 603 00:33:56,060 --> 00:33:58,300 So this is another demonstration 604 00:33:58,300 --> 00:34:00,260 of sweeping both frequency 605 00:34:00,260 --> 00:34:03,080 and power 606 00:34:03,080 --> 00:34:04,640 with the VSG. 607 00:34:04,840 --> 00:34:07,300 So basically, I configured the VSG 608 00:34:07,300 --> 00:34:09,060 so at 827 MHz, 609 00:34:09,280 --> 00:34:12,120 it outputs a minus 70 BBM tone. 610 00:34:12,400 --> 00:34:15,460 And then at 830 MHz, 611 00:34:15,620 --> 00:34:17,740 it outputs a minus 25 BBM tone. 612 00:34:18,480 --> 00:34:19,340 So it just kind of helps 613 00:34:20,260 --> 00:34:22,220 visualize which signal it's sending. 614 00:34:22,480 --> 00:34:24,020 Because sometimes it's kind of hard to figure out 615 00:34:25,960 --> 00:34:28,280 what fundamental tone is being sent 616 00:34:28,280 --> 00:34:30,160 when you're clipping kind of like this. 617 00:34:30,660 --> 00:34:34,180 So in the waterfall here, 618 00:34:34,340 --> 00:34:36,620 in GQRX, 619 00:34:36,760 --> 00:34:39,480 the Y coordinate is essentially time 620 00:34:39,480 --> 00:34:41,280 and then the X coordinate is frequency. 621 00:34:41,620 --> 00:34:43,540 So at some point, 622 00:34:43,580 --> 00:34:45,960 I just decided to click hardware AGC 623 00:34:45,960 --> 00:34:47,580 and enable the hardware AGC 624 00:34:47,580 --> 00:34:49,040 and all of a sudden, 625 00:34:49,120 --> 00:34:51,840 the Blade RF was no longer clipping 626 00:34:51,840 --> 00:34:54,320 when a minus 25 BBM signal came in. 627 00:34:54,420 --> 00:34:55,920 Because remember at minus, 628 00:34:56,100 --> 00:34:58,000 or at 830 MHz, 629 00:34:58,280 --> 00:35:00,680 you have minus 25 BBM signal coming in. 630 00:35:00,820 --> 00:35:03,560 And prior to the AGC being enabled, 631 00:35:04,780 --> 00:35:06,020 there's just a lot of 632 00:35:08,100 --> 00:35:09,800 frequency splattering going on. 633 00:35:10,260 --> 00:35:11,740 So at this point, 634 00:35:11,780 --> 00:35:14,580 I kind of want to cut to a short video demo 635 00:35:15,100 --> 00:35:16,740 because I could not bring 636 00:35:16,740 --> 00:35:19,580 a 80 pound VSG with me to Vegas 637 00:35:19,580 --> 00:35:21,760 in one piece for cheap. 638 00:35:23,940 --> 00:35:25,640 Give me just one second. 639 00:35:36,320 --> 00:35:37,080 Whoops. 640 00:35:37,700 --> 00:35:39,300 One second. 641 00:35:44,400 --> 00:35:44,780 Oh. 642 00:35:47,600 --> 00:35:48,160 . 643 00:35:53,900 --> 00:35:56,020 Yeah, so this is the VSG. 644 00:35:56,440 --> 00:35:58,900 It was configured to go from minus 25 BBM 645 00:35:58,900 --> 00:35:59,820 to minus, 646 00:35:59,980 --> 00:36:02,000 or from minus 100 BBM 647 00:36:02,000 --> 00:36:04,640 to minus 25 BBM at... 648 00:36:05,320 --> 00:36:06,120 No visual? 649 00:36:06,300 --> 00:36:06,700 Oh, shit. 650 00:36:10,440 --> 00:36:11,000 Uh... 651 00:36:13,560 --> 00:36:14,740 I don't know what happened. 652 00:36:14,740 --> 00:36:15,700 Just in one sec. 653 00:36:17,520 --> 00:36:17,640 . 654 00:36:24,040 --> 00:36:24,580 Uh... 655 00:36:27,520 --> 00:36:28,460 Oh, okay. 656 00:36:28,540 --> 00:36:28,740 Cool. 657 00:36:28,800 --> 00:36:29,200 There we go. 658 00:36:30,560 --> 00:36:31,100 Right. 659 00:36:31,220 --> 00:36:32,160 So this is, again, 660 00:36:32,180 --> 00:36:33,300 the same picture of the VSG 661 00:36:33,300 --> 00:36:35,320 that's configured from minus 100 BBM 662 00:36:35,320 --> 00:36:36,600 to minus 25 BBM 663 00:36:36,600 --> 00:36:40,620 with three BBM steps. 664 00:36:40,980 --> 00:36:41,840 So essentially, 665 00:36:41,840 --> 00:36:43,960 that's 26 step points 666 00:36:43,960 --> 00:36:45,840 with two-second dwell time. 667 00:36:46,040 --> 00:36:47,220 So that means that every two seconds, 668 00:36:47,240 --> 00:36:50,340 the VSG is going to go up about 3 dB of power. 669 00:36:51,140 --> 00:36:54,760 And here's sort of what the... 670 00:36:54,760 --> 00:36:55,040 Oops. 671 00:36:55,260 --> 00:36:57,440 That is not what it should have jumped to. 672 00:36:58,760 --> 00:37:00,940 And here's sort of what a side-by-side comparison 673 00:37:00,940 --> 00:37:02,340 between the two looks like. 674 00:37:02,620 --> 00:37:05,980 So two Blade RFs running side-by-side 675 00:37:05,980 --> 00:37:07,940 with the same signal being split to both of them. 676 00:37:08,560 --> 00:37:10,120 And the one on the left, 677 00:37:11,260 --> 00:37:13,320 well, the one on the left did not have the AGC, 678 00:37:13,340 --> 00:37:14,860 and the one on the right does have the AGC. 679 00:37:14,980 --> 00:37:15,820 But it'll become apparent. 680 00:37:16,200 --> 00:37:18,340 I mean, you can kind of see the signal deflecting 681 00:37:19,440 --> 00:37:20,660 from the pedestal. 682 00:37:20,780 --> 00:37:22,360 So just a quick note. 683 00:37:25,300 --> 00:37:28,040 This pedestal thing that you see here 684 00:37:29,860 --> 00:37:33,760 is the filtered bandwidth of the device. 685 00:37:34,020 --> 00:37:36,320 So when you saw the different bandwidth on Blade RF, 686 00:37:36,500 --> 00:37:38,640 it actually has analog filters, 687 00:37:38,640 --> 00:37:40,160 like LPF filters, 688 00:37:40,420 --> 00:37:43,560 that will filter the incoming signal. 689 00:37:43,720 --> 00:37:45,340 So even though you're sampling at 40 mega samples, 690 00:37:45,700 --> 00:37:48,200 you won't have 40 megahertz worth of bandwidth, 691 00:37:48,400 --> 00:37:51,500 because if you're using a 28 megahertz LPF, 692 00:37:51,660 --> 00:37:53,900 you're basically going to have the 28 megahertz 693 00:37:53,900 --> 00:37:56,620 centered around zero. 694 00:37:56,960 --> 00:37:59,360 So that means that on either end, 695 00:37:59,400 --> 00:38:01,720 you're going to have about 6 megahertz 696 00:38:01,720 --> 00:38:03,900 worth of additional oversampling, 697 00:38:04,040 --> 00:38:05,540 where the interesting thing is 698 00:38:05,540 --> 00:38:07,860 you can actually see the thermal noise floor, 699 00:38:07,860 --> 00:38:14,100 because this noise is from the gain stages 700 00:38:14,100 --> 00:38:17,000 adding their own noise into the incoming signal. 701 00:38:17,600 --> 00:38:20,260 This is what I had mentioned when I had said 702 00:38:20,260 --> 00:38:22,480 there's a noise factor being added 703 00:38:22,480 --> 00:38:24,300 by amplifiers in the chain. 704 00:38:25,220 --> 00:38:28,100 So one other interesting thing to keep in mind 705 00:38:28,100 --> 00:38:30,980 is that in signal processing and in telecom, 706 00:38:31,180 --> 00:38:32,910 what is important isn't the strength 707 00:38:33,680 --> 00:38:34,720 of the incoming signal. 708 00:38:34,840 --> 00:38:35,980 What is important, however, 709 00:38:35,980 --> 00:38:38,340 is the SNR of the signal. 710 00:38:38,500 --> 00:38:41,300 So a quick visual in this whole thing 711 00:38:41,300 --> 00:38:44,580 to kind of gauge what the SNR of a signal is, 712 00:38:44,700 --> 00:38:48,880 is what the difference between the noise floor 713 00:38:48,880 --> 00:38:51,120 and the peak of the incoming signal is, 714 00:38:51,260 --> 00:38:55,440 because this difference is a rough indicator of SNR, 715 00:38:55,460 --> 00:38:57,540 minus some additional noise 716 00:38:57,540 --> 00:38:59,020 that I mentioned about before. 717 00:38:59,320 --> 00:39:01,380 So as this demo, 718 00:39:02,720 --> 00:39:04,580 or once I resume this demo, 719 00:39:04,580 --> 00:39:06,160 just kind of take a look 720 00:39:06,160 --> 00:39:07,900 at both the left side and the right side 721 00:39:07,900 --> 00:39:10,160 and compare the difference 722 00:39:10,160 --> 00:39:12,940 between the peak of the pedestal 723 00:39:12,940 --> 00:39:14,140 and the peak of the signal, 724 00:39:14,260 --> 00:39:17,580 and see what happens between a capture 725 00:39:18,120 --> 00:39:19,600 that is done with the AGC 726 00:39:19,600 --> 00:39:21,520 versus one that is done without the AGC. 727 00:39:22,660 --> 00:39:25,500 And let me just go back to the beginning real quick. 728 00:39:25,800 --> 00:39:27,600 Oh yeah, so the left is no AGC 729 00:39:27,600 --> 00:39:29,380 and the right is with the AGC. 730 00:39:39,380 --> 00:39:40,580 Probably should have sped this up a bit. 731 00:39:45,300 --> 00:39:46,320 So yeah, at the moment, 732 00:39:46,340 --> 00:39:47,380 they still kind of look identical, 733 00:39:47,560 --> 00:39:48,500 and in like about, 734 00:39:48,760 --> 00:39:49,200 oh, there we go. 735 00:39:51,260 --> 00:39:53,260 The right side is now in the mid stage. 736 00:39:55,700 --> 00:39:57,400 And the left side is now starting to see clipping. 737 00:39:58,120 --> 00:39:59,880 And yeah, you can kind of see the difference 738 00:39:59,880 --> 00:40:01,960 between the left side and the right side. 739 00:40:02,040 --> 00:40:02,920 The right side still maintains 740 00:40:02,920 --> 00:40:06,120 a very healthy distance 741 00:40:06,120 --> 00:40:07,300 between the top of the signal 742 00:40:07,300 --> 00:40:09,140 and the top of the pedestal, 743 00:40:09,200 --> 00:40:11,040 whereas the left side is just completely washed. 744 00:40:11,420 --> 00:40:13,980 Basically, the left side has no signal remaining. 745 00:40:14,200 --> 00:40:16,420 There might be like a couple of dB 746 00:40:16,420 --> 00:40:18,160 worth of SNR left on the left side, 747 00:40:18,240 --> 00:40:19,600 but the right side is kind of looking at 748 00:40:19,600 --> 00:40:22,520 about 60, 70 dB worth of SNR. 749 00:40:23,320 --> 00:40:25,180 So that there is, whoops. 750 00:40:27,080 --> 00:40:30,360 That there is a visual representation 751 00:40:30,360 --> 00:40:32,020 of what it means to have an AGC. 752 00:40:32,920 --> 00:40:36,500 And let me just finish this up real quick. 753 00:40:46,020 --> 00:40:46,540 Yeah. 754 00:40:50,520 --> 00:40:53,120 So the AGC is actually written on, 755 00:40:53,800 --> 00:40:55,820 is written in VHDL, 756 00:40:55,940 --> 00:40:57,200 and it runs on the FPGA 757 00:40:57,200 --> 00:40:58,420 just because of the timing requirement 758 00:40:58,420 --> 00:41:00,180 that is needed to make these quick decisions 759 00:41:00,180 --> 00:41:01,820 of when to adjust gains. 760 00:41:03,400 --> 00:41:05,940 So the AGC source code 761 00:41:05,940 --> 00:41:07,540 is available in the Git repo, 762 00:41:07,760 --> 00:41:09,140 and you can compile it yourselves. 763 00:41:09,600 --> 00:41:11,320 You can download the Core to 16, 764 00:41:11,680 --> 00:41:13,280 and now 17, web edition. 765 00:41:13,980 --> 00:41:15,140 It's basically free, 766 00:41:15,260 --> 00:41:17,040 and it compiles BladeRF code 767 00:41:17,040 --> 00:41:18,920 pretty quickly and pretty easily. 768 00:41:19,760 --> 00:41:22,900 Some of the things that had to be implemented in HDL 769 00:41:22,900 --> 00:41:24,780 to make this whole core work 770 00:41:24,780 --> 00:41:26,840 is a spy bus arbiter. 771 00:41:27,000 --> 00:41:29,020 So because the AGC core is separate 772 00:41:29,020 --> 00:41:32,900 from the NEOS core, 773 00:41:32,900 --> 00:41:34,600 which is this little embedded processor 774 00:41:34,600 --> 00:41:37,220 that libUSB and the host processor 775 00:41:37,900 --> 00:41:41,180 communicate with to honor your gain settings 776 00:41:41,180 --> 00:41:43,360 and your sampling rate settings, 777 00:41:44,340 --> 00:41:47,080 there needs to be a way of having the two synchronize 778 00:41:47,500 --> 00:41:50,580 on who is able to communicate with the LMS6 chip. 779 00:41:50,880 --> 00:41:54,100 So this is a standard use case 780 00:41:54,100 --> 00:41:55,980 for something known as a bus arbiter. 781 00:41:56,140 --> 00:42:00,440 So a bus arbiter is sort of a little core 782 00:42:00,440 --> 00:42:02,720 that listens to who has requests 783 00:42:02,720 --> 00:42:03,820 to use a resource, 784 00:42:03,980 --> 00:42:06,360 and then only grants one of the requesters 785 00:42:06,360 --> 00:42:07,960 access to that resource. 786 00:42:08,340 --> 00:42:11,040 So I implemented a priority round robin 787 00:42:12,500 --> 00:42:14,680 bus arbiter for the spy bus 788 00:42:14,680 --> 00:42:16,700 that both the NEOS processor 789 00:42:16,700 --> 00:42:18,200 and the AGC use, 790 00:42:18,480 --> 00:42:21,340 giving the AGC a higher priority. 791 00:42:21,660 --> 00:42:23,360 So if you're in BladeRF command line 792 00:42:23,360 --> 00:42:26,740 doing something like peak LMS6 something, 793 00:42:27,640 --> 00:42:30,380 that command will stall 794 00:42:30,380 --> 00:42:32,700 until the AGC 795 00:42:32,720 --> 00:42:35,540 finishes its whatever it's doing. 796 00:42:35,640 --> 00:42:36,900 It's very unlikely that the two 797 00:42:36,900 --> 00:42:39,060 will ever happen at the same time, 798 00:42:39,160 --> 00:42:40,920 but every so often they will happen, 799 00:42:41,080 --> 00:42:43,560 and that's what the bus arbiter protects against. 800 00:42:44,140 --> 00:42:47,680 So I wonder if there's enough resolution 801 00:42:47,680 --> 00:42:48,720 to see what's going on here, 802 00:42:48,920 --> 00:42:50,660 but basically the left side, 803 00:42:53,100 --> 00:42:55,480 that over there is the request column. 804 00:42:55,800 --> 00:42:58,740 So when there's a request coming in, 805 00:42:58,860 --> 00:43:00,620 the arbiter then acts it, 806 00:43:00,760 --> 00:43:01,560 or wait, no, 807 00:43:02,100 --> 00:43:02,620 yeah, 808 00:43:02,720 --> 00:43:04,640 the arbiter gives it permission to proceed there, 809 00:43:04,860 --> 00:43:06,460 and then the requester, 810 00:43:06,600 --> 00:43:07,900 so in this case like the AGC, 811 00:43:08,060 --> 00:43:09,420 would hold the request line high 812 00:43:09,420 --> 00:43:11,740 all the way through the time that it's done, 813 00:43:11,960 --> 00:43:13,120 and then it would release 814 00:43:14,420 --> 00:43:16,380 the resource back to the arbiter 815 00:43:16,380 --> 00:43:18,260 by indicating that it had finished 816 00:43:19,220 --> 00:43:20,760 doing what it needed to do. 817 00:43:20,840 --> 00:43:21,340 In this case, 818 00:43:21,380 --> 00:43:23,700 issuing spy commands to the LMS6. 819 00:43:25,860 --> 00:43:27,680 So just to quickly go through this, 820 00:43:27,880 --> 00:43:30,080 a couple of interesting things that popped up 821 00:43:30,080 --> 00:43:31,280 in implementing this 822 00:43:33,320 --> 00:43:34,760 AGC is the fact that 823 00:43:34,760 --> 00:43:36,360 as you're changing gains, 824 00:43:39,500 --> 00:43:41,100 the amplification units, 825 00:43:41,280 --> 00:43:43,780 so like the RXVGA2 and RXVGA1 826 00:43:43,780 --> 00:43:46,820 will have like their own bias voltages 827 00:43:46,820 --> 00:43:50,580 and analog signal conditioning 828 00:43:50,580 --> 00:43:52,120 that they need to be able to work 829 00:43:52,120 --> 00:43:53,800 the way that they're intended to work. 830 00:43:53,960 --> 00:43:56,620 So that kind of leaks into the ADC. 831 00:43:56,760 --> 00:43:59,120 So if you change RXVGA2, 832 00:43:59,120 --> 00:44:01,960 the center mean value 833 00:44:01,960 --> 00:44:04,600 of I and Q will change 834 00:44:04,600 --> 00:44:06,000 based off of your 835 00:44:06,000 --> 00:44:08,860 primarily RXVGA2 settings, 836 00:44:09,060 --> 00:44:11,280 then secondarily based on your 837 00:44:12,200 --> 00:44:13,260 RXVGA1 settings, 838 00:44:13,460 --> 00:44:15,480 and also a little bit 839 00:44:15,480 --> 00:44:16,560 based off of your LNA 840 00:44:17,360 --> 00:44:18,420 gain settings. 841 00:44:18,760 --> 00:44:22,080 So the problem that this causes 842 00:44:22,080 --> 00:44:24,620 is that that DC mean error, 843 00:44:24,840 --> 00:44:26,360 or that, yeah, that DC mean error 844 00:44:27,380 --> 00:44:29,100 can trick an ADC 845 00:44:29,120 --> 00:44:31,620 into thinking that there's actually 846 00:44:31,620 --> 00:44:32,220 a signal there. 847 00:44:32,320 --> 00:44:33,640 Because if you adjust your gain, 848 00:44:33,820 --> 00:44:37,120 and now you've adjusted RXVGA2, 849 00:44:37,900 --> 00:44:40,200 and RXVGA2 introduces a DC spike 850 00:44:40,700 --> 00:44:41,940 into your signal, 851 00:44:42,160 --> 00:44:44,040 you now think that that's an incoming signal, 852 00:44:44,240 --> 00:44:45,840 and that'll cause you to think that 853 00:44:46,340 --> 00:44:48,380 there's still a very hot signal coming in. 854 00:44:48,560 --> 00:44:50,400 So if you go from your high gain setting 855 00:44:50,400 --> 00:44:52,000 to your mid gain setting, 856 00:44:52,040 --> 00:44:53,140 and you see a DC spike, 857 00:44:53,340 --> 00:44:54,440 you might be tempted to go into 858 00:44:54,440 --> 00:44:55,340 the lowest gain setting 859 00:44:55,340 --> 00:44:56,520 because there's something there. 860 00:44:57,440 --> 00:44:59,060 Fortunately though, DC gain setting 861 00:44:59,120 --> 00:45:01,280 settings are kind of easy to characterize, 862 00:45:01,420 --> 00:45:02,540 and we've already done that 863 00:45:03,120 --> 00:45:04,520 with libblade RF. 864 00:45:04,800 --> 00:45:07,640 But in version one of the DC cal table, 865 00:45:07,940 --> 00:45:10,440 we only calibrated gains at a very specific, 866 00:45:10,600 --> 00:45:13,260 or we calculated DC corrections 867 00:45:13,260 --> 00:45:14,600 and DC mean errors 868 00:45:15,120 --> 00:45:16,540 for one specific gain setting. 869 00:45:16,800 --> 00:45:19,400 So for the AGC to work well, 870 00:45:20,080 --> 00:45:22,580 I decided to calculate the mean error 871 00:45:22,900 --> 00:45:24,660 at all three points, 872 00:45:24,760 --> 00:45:26,740 the low, the mid, and the high gain settings. 873 00:45:26,920 --> 00:45:28,960 So by being able to know 874 00:45:29,120 --> 00:45:30,800 what those gain settings are, 875 00:45:30,920 --> 00:45:33,240 you can kind of come up with a strategy 876 00:45:33,240 --> 00:45:36,900 of creating something known as a DC, 877 00:45:37,100 --> 00:45:38,040 or something that I dubbed 878 00:45:38,040 --> 00:45:40,640 the DC lookup table mux. 879 00:45:40,860 --> 00:45:43,780 So the AGC will tell the rest of the FPGA fabric 880 00:45:43,780 --> 00:45:46,060 which gain setting it's in, 881 00:45:46,160 --> 00:45:48,300 be it high, mid, or low. 882 00:45:48,500 --> 00:45:50,620 And then based off of what you found out 883 00:45:50,620 --> 00:45:52,140 when you calibrated the blade RF 884 00:45:52,140 --> 00:45:53,400 using the command line, 885 00:45:53,520 --> 00:45:56,260 or libblade RF's DC calibration utility, 886 00:45:57,460 --> 00:45:59,100 libblade RF loads in, 887 00:45:59,120 --> 00:46:03,100 the appropriate gain settings, 888 00:46:03,360 --> 00:46:07,700 and also loads the appropriate mean error values, 889 00:46:07,940 --> 00:46:11,080 and then lets the FPGA subtract out 890 00:46:11,080 --> 00:46:13,240 the error that exists 891 00:46:13,240 --> 00:46:15,140 based off of which gain setting 892 00:46:15,140 --> 00:46:18,940 the AGC has moved the LMS6 to. 893 00:46:19,180 --> 00:46:21,900 So then the AGC works in collaboration 894 00:46:21,900 --> 00:46:25,480 with libblade RF and the LMS6 895 00:46:25,480 --> 00:46:26,840 to figure out exactly 896 00:46:26,840 --> 00:46:28,940 what it should be subtracting out, 897 00:46:29,120 --> 00:46:32,260 so that it can understand what the real signal is 898 00:46:32,260 --> 00:46:36,860 as opposed to sort of just a random DC spike. 899 00:46:39,000 --> 00:46:41,360 And this is signal tap capture. 900 00:46:41,580 --> 00:46:43,800 If you guys have used signal tap, 901 00:46:43,940 --> 00:46:44,940 or if you haven't used signal tap, 902 00:46:45,040 --> 00:46:45,800 this is what it looks like. 903 00:46:46,540 --> 00:46:49,180 These are raw HDL signals that exist 904 00:46:49,180 --> 00:46:52,080 in a live FPGA that you can pull out via JTAG. 905 00:46:52,300 --> 00:46:55,400 So when I mentioned the gain lookup table, 906 00:46:55,600 --> 00:46:59,100 there's a I and Q tuple corrective 907 00:46:59,120 --> 00:47:02,960 for the high, mid, and the low gain settings, 908 00:47:03,180 --> 00:47:06,160 and these are loaded by libblade RF 909 00:47:06,160 --> 00:47:08,340 from a calibration file, 910 00:47:08,540 --> 00:47:10,520 and they're sent over into the FPGA. 911 00:47:10,620 --> 00:47:12,380 The FPGA caches this value, 912 00:47:12,640 --> 00:47:17,000 and then the AGC tells the FPGA's correction block 913 00:47:17,000 --> 00:47:19,540 which gain setting it's currently at. 914 00:47:19,700 --> 00:47:22,300 So in this case, the FPGA is telling the DC, 915 00:47:22,560 --> 00:47:24,320 or it's telling the rest of the FPGA 916 00:47:24,320 --> 00:47:26,700 that it is in the, what is it, 917 00:47:26,800 --> 00:47:28,140 in the mid gain setting. 918 00:47:28,140 --> 00:47:31,000 So in this case, the DC lookup table, 919 00:47:31,240 --> 00:47:33,940 or the MUX for the DC lookup table, 920 00:47:34,140 --> 00:47:36,540 picks the mid value correction, 921 00:47:36,840 --> 00:47:38,220 which is two and 21, 922 00:47:38,540 --> 00:47:40,980 and puts that into the DC correction block. 923 00:47:41,320 --> 00:47:44,940 So the DC mean error is subtracted out 924 00:47:44,940 --> 00:47:45,740 from the incoming signal, 925 00:47:45,940 --> 00:47:51,920 and the AGC is able to get its best understanding 926 00:47:51,920 --> 00:47:52,740 of the incoming signal. 927 00:47:52,980 --> 00:47:53,860 And that's it. 928 00:47:55,100 --> 00:47:55,700 Questions? 929 00:47:58,340 --> 00:47:58,900 What's up? 930 00:48:04,380 --> 00:48:08,280 Oh yeah, so it's not only for the AGC now, 931 00:48:08,400 --> 00:48:08,960 it's for everything. 932 00:48:09,240 --> 00:48:11,940 So I kind of made sort of like interpolating function. 933 00:48:12,380 --> 00:48:15,300 Actually, I extended John's interpolating function 934 00:48:15,300 --> 00:48:19,520 so that it works across settings 935 00:48:19,520 --> 00:48:21,200 that haven't exactly been calibrated. 936 00:48:21,520 --> 00:48:25,480 But yeah, your blade RF's DC spikes 937 00:48:25,480 --> 00:48:26,800 should be a thing of the past now. 938 00:48:27,520 --> 00:48:31,140 Well, actually, they should be reduced by about 50%, 939 00:48:31,140 --> 00:48:32,080 but they're still kind of there. 940 00:48:33,880 --> 00:48:36,720 But that's the case with all zero IF SDRs. 941 00:48:36,740 --> 00:48:37,900 Like, there's no SDR out there 942 00:48:37,900 --> 00:48:40,220 that doesn't have a DC spike. 943 00:48:43,260 --> 00:48:43,760 All right. 944 00:48:44,640 --> 00:48:45,040 Yeah. 945 00:48:46,160 --> 00:48:46,560 . 946 00:48:51,240 --> 00:48:52,840 It's not the best LNA out there. 947 00:48:52,960 --> 00:48:54,440 It's kind of high. 948 00:48:54,660 --> 00:48:56,780 So that LNA by itself has like a, you know, 949 00:48:56,780 --> 00:48:59,040 like about a two to three BB noise figure. 950 00:48:59,660 --> 00:49:00,660 It's on chip. 951 00:49:00,820 --> 00:49:02,320 It's a single integrated MMIC. 952 00:49:02,780 --> 00:49:05,280 You kind of get what you pay for. 953 00:49:06,460 --> 00:49:07,500 So, yep. 954 00:49:19,140 --> 00:49:21,420 So yeah, it's like about three microseconds 955 00:49:21,420 --> 00:49:23,840 when the FPGA is doing everything. 956 00:49:24,880 --> 00:49:26,640 If you were to do it on the host side, 957 00:49:26,780 --> 00:49:28,920 I don't know if you could even do it, 958 00:49:28,960 --> 00:49:31,920 because some of these packets that come in over the air 959 00:49:31,920 --> 00:49:32,940 are so short, 960 00:49:33,820 --> 00:49:36,000 you would not be able to close the feedback loop 961 00:49:36,000 --> 00:49:37,560 by sending USB packets, 962 00:49:37,900 --> 00:49:39,880 going into a user mode program, 963 00:49:40,140 --> 00:49:41,160 doing some calculation, 964 00:49:41,380 --> 00:49:43,020 and then sending back the appropriate things. 965 00:49:43,600 --> 00:49:47,900 Like, the turnaround time to go over USB 966 00:49:47,900 --> 00:49:50,900 is probably on the order of several tens of milliseconds. 967 00:49:51,380 --> 00:49:52,620 So you're already looking at something 968 00:49:52,620 --> 00:49:54,280 that's like tens of thousands 969 00:49:54,280 --> 00:49:56,700 to potentially even 100 times slower 970 00:49:56,780 --> 00:49:58,880 than doing things in the FPGA. 971 00:50:10,760 --> 00:50:13,300 Yeah, so generally, 972 00:50:14,200 --> 00:50:16,880 telecom engineers will come up with a synchronization 973 00:50:16,880 --> 00:50:18,660 and preamble section of a packet 974 00:50:18,660 --> 00:50:23,400 that allows AGCs to lock on to the incoming packet. 975 00:50:23,580 --> 00:50:25,640 So you will end up missing part of your packet 976 00:50:25,640 --> 00:50:27,840 while the AGC comes in 977 00:50:27,840 --> 00:50:29,540 and locks into the incoming signal. 978 00:50:30,760 --> 00:50:33,380 So protocols just have that factored in. 979 00:50:33,540 --> 00:50:34,540 You're not going to pick... 980 00:50:34,540 --> 00:50:35,780 You're not going to be able to pick up 981 00:50:35,780 --> 00:50:37,060 the very first incoming sample, 982 00:50:37,340 --> 00:50:38,660 but you're going to be able to pick up, 983 00:50:38,720 --> 00:50:41,220 like, the 17th incoming sample. 984 00:50:41,940 --> 00:50:43,360 But there's enough redundancy, 985 00:50:43,520 --> 00:50:45,420 purposely built-in redundancy there, 986 00:50:45,520 --> 00:50:46,780 that you're not actually missing data. 987 00:50:46,960 --> 00:50:49,720 You're just missing parts of a preamble 988 00:50:49,720 --> 00:50:50,620 that were inserted there 989 00:50:51,180 --> 00:50:53,060 for you to purposely have time 990 00:50:53,060 --> 00:50:54,740 to have your AGC lock onto it. 991 00:50:59,700 --> 00:51:01,000 All right. Cool. 992 00:51:02,180 --> 00:51:02,760 Thanks, everyone. 993 00:51:02,980 --> 00:51:04,740 I'm going to give this back to Rick.