Ham Radio for Hackers

Over on Hackaday we've seen a post about Dan's (KB6NU) talk at the HOPE (Hackers of Planet Earth) conference about how Ham radio can be for hackers, and how hackers are the future of ham radio. Hackers in this context mean people who enjoy experimenting with electronics, building stuff, and understanding how things work.

Dan's slides have been uploaded on his blog. The slides emphasize how ham radio is not only about the traditional thought of making contacts which is probably in most people's heads, but also about hacking radios, antennas, microcontrollers, satellites, pico balloons, digital communications, GNU Radio and more. Dan mentions his goal is to promote ham radio to the much younger hacker crowd, where he believes it is underrepresented.

Ham radio for hackers
Ham radio for hackers

An Initial Review of the RFNM Software Defined Radio

Last year the RFNM (RF Not Magic) software-defined radio was announced and opened up for pre-orders. RFNM is an SDR based on the new 12-bit LA9310 baseband processor chip, and together with either a 'Granita' or 'Lime' daughter board it is capable of tuning from 10 - 7200 MHz or 5 - 3500 MHz respectively. It is also capable of wide bandwidth - up to 153.6 MHz on a host device like a PC. The RFNM is affordable, costing US$299 for the motherboard, US$179 for the Lime board, and US$249 for the Granita board. Currently, the second production batch is available for preorder.

Recently we received our RFNM order, with both Granita and Lime boards. This is a review of our initial impressions and tests on it. Note that while the RFNM is capable of transmitting, in this review we did not test that capability.

Physical Review

The RFNM motherboard comes as a PCB with a large heatsink on the bottom and a very quiet inline fan.  The daughterboards connect to the motherboard with a board-to-board connector and are secured in place via seven screws. There is another board-to-board connector for a second daughterboard to be connected, but in this review we did not test it. 

On the right side there is a 4-18V DC barrel power jack and USB-A, USB-C, HDMI and Ethernet connectors. There is also a SIM card and SD card slot on the side. On the left of the board are MMCX connectors for external reference clock, and clock out. There are also various header pinouts for PPS OUT/IN, UART, I2C, GPIO and PWM. On the heatsink side there is a JTAG connector, jumpers for resetting the firmware, and pads to solder on an OCXO. 

RFNM Motherboard and Daughterboards
RFNM bottom with heatsink, fan and rubber feet.

The device feels solid but there are a few exposed SMT components on the rear that have the potential to be knocked off with rough handling. All the main connectors are through-hole soldered and will not break off easily. During operation, the heatsink stays warm to the touch, and does not get too hot. The fan blades are exposed but should be safe from fingers and debris being on the bottom.

Initial Firmware Download

The device requires power from a 4 - 18V DC barrel jack and connects to a PC via a USB-C or USB-A port. According to the developer, it requires a 10-15W capable supply. In the tests below we used a 9V 2000mA switch mode supply, and a 12V 3000mA capable linear supply.

The device comes shipped without firmware, and the first setup step involves plugging in an internet-connected ethernet cable to automatically download and install the latest firmware. If you don't have an internet connected ethernet cable, an alternative is to plug in a USB stick with the latest firmware installed on it. The firmware installation took only a couple of minutes and went smoothly.

Initial Tests with SDR++

The easiest way to get something working with the RFNM is to use the custom SDR++ build included on the RFNM itself. When you plug in the RFNM it shows up on your PC as a disk drive, with an SDR++ folder. Getting started is as easy as running that SDR++ exe and clicking Play.

Initially, we encountered an issue where the RFNM wouldn't show up in SDR++, and wouldn't show up as a disk either. However, after flipping the USB-C connector it worked. This is an issue that continued throughout, and sometimes flipping wouldn't even work, but it always connected after a few reconnection attempts, and once the board was connected it was stable.

Lime Daughterboard Tests

We first tested the RFNM with the Lime daughter board. This is a board based on the Lime LMS7002 chip which is the same chip used in the LimeSDR. Here only the IQ output of the Lime chip is used, not the ADCs.

At this point, it's important to note that software support for the RFNM is still in the very early stages and SDR++ currently has no gain controls implemented. SDR++ is third-party software to RFNM so it's not any fault of the RFNM team. (NOTE: In the last few days after having already written this review, there have been several commits to SDR++ regarding RFNM, so this may already be resolved)

However, it is possible to SSH into the Linux OS system running on the RFNM system and change the gain setting through a bash command. To connect to SSH a network-connected ethernet cable needs to be connected to the board (alternatively you can use the UART port on the side of the board with an adapter). Once logged in via SSH we can browse to "/sys/kernel/rfnm_primary/rx0" and edit the value in the 'gain' text file. Then to activate the changes, simply set the value in the 'apply' text file to 1. This allowed us to optimize the gain settings for best reception.

cd /sys/kernel/rfnm_primary/rx0
echo 30 > gain && echo 1 > apply
RFNM with Lime daughterboard on the WiFi bands
RFNM with Lime daughterboard on the WiFi bands
RFNM with Lime daughterboard receiving mobile basestation signals.

With the ability to set the gain, the Lime board works great. Signals are strong in the VHF and UHF bands where sensitivity is approximately -135 dBm, and there is little sign of imaging with appropriate gain settings. In the 2.4 GHz band, the sensitivity remains good at around -130 dBm too. Although the advertised max frequency range is 3500 MHz, we were able to receive up to about  3.85 GHz with reduced sensitivity.

On HF, however, the Lime board performs very poorly. We start to see a drop off at around 50 MHz where the sensitivity is roughly -93 dBm, at 30 MHz about -58 dBm, and 15 MHz about -37 dBm.

Granita Daughterboard Tests

In the second test, we removed the Lime board from the RFNM motherboard and installed the Granita daughterboard. The Granita daughterboard is based on an Arctic Semiconductor 'Granita' chip, an RFFC2071A mixer, and several preselectors. 

Unfortunately, we are very disappointed in the performance of Granita as there is very significant imaging of signals, and this wipes out the ability to cleanly receive almost every band. According to Davide, this problem is a firmware issue with the Arctic Semiconductor Granita chip that can maybe be fixed in the future, but there is no guarantee that it is fixable, as any fix is at the mercy of the Arctic Semiconductor, who don't seem to be very responsive to the issue. Davide (creator of the RFNM) writes:

In the Lime board, the IQ LPF works properly. For granita, it doesn’t work at all, like the -3 dB point of the 20 MHz LPF option is 100 MHz+. The manufacturer of the RFIC kept saying that this is a firmware bug, so I gave them a devkit to replicate, but they never fixed it over the last month. I don’t know at this point if this is a software problem or if they discovered it’s something more.  

We confirmed that adjusting the gain settings on Granita did not help with the imaging problem either.

Heavy imaging experienced with Granita (compare to the true spectrum shown previously with the Lime board).
Heavy imaging was experienced with Granita (compare this to the true WiFi spectrum shown previously with the Lime board).

We also noticed that Granita was picking up or internally generating significant noise spikes. We initially assumed this was from the 9V SMPS, but even with a 12V linear power supply similar spikes were seen. The same noise was not visible with the Lime board.

Granita unknown noise spikes
Granita unknown noise spikes

Sensitivity in the bands above 600 MHz was good, at around -135 dBm. Below 600 MHz where the mixer is used, sensitivity was a bit poorer at around -123 dBm. The highest frequency we could receive was around 5900, but after about 5 GHz signals started to become very weak. The Granita board is advertised as receiving 10 - 6300 MHz, however, the documentation notes that the current batch is only capable of tuning to around 5 GHz. They note that the next batch should reach 6.3 GHz.

The Granita board was able to receive broadcast AM, shortwave, and ham frequencies with good signal strength. At 15 - 50 MHz the sensitivity is roughly -115 dBm.

Granita receiving the 0 - 15 MHz.

At the time of this review, we cannot recommend that anyone purchase the Granita board unless they are working in a very controlled environment. We hope that in the near future the IQ LPF problem can be fixed to make the Granita board usable.

GNU Radio Tests (Windows)

The file drive on the RFNM also comes with a Soapy driver available. We copied the RFNMSupport.dll file from the RFNM drive over to our GNU Radio radioconda installation's SoapySDR folder at C:\Users\proje\radioconda\Library\lib\SoapySDR\modules0.8. Then we opened GNU Radio and opened the gnuradio_example.grc file. This brings up a FFT and waterfall display like in SDR++ and with the Gain controls exposed. With the gain controls exposed the Lime + RFNM combination works great.

The daughterboards also have built-in antennas that can be switched in or out using a drop down box in the GNU Radio UI. The built-in antenna on both boards is a Pulse W3796 which has an advertised range of 698 MHz to 2.7 GHz. While the built-in antenna works well for nearby bench reception, we preferred to still use our outdoor dipole antenna for better reception.

153.6 MHz Bandwidth Mode

It's possible to set the RFNM to provide even more bandwidth by connecting two USB cables to the PC. That gives us up to 153.6 MHz of 12-bit data. Enabling this mode requires editing a variable via the terminal

echo 153 > /sys/class/i2c-dev/i2c-0/device/0-0050/rfnm_set_dcs_freq && reboot

Once this was set we were able to edit the samp_rate block in the GNU Radio example, and set it to 153.6 MHz. At the moment the current SDR++ does not support the 153.6 MHz sample rate.

RFNM Running 153.6MHz in GNU Radio.

Conclusion

It's clear that the RFNM is cutting edge, yet affordable, and has great potential and excellent features and specifications. The built-in processor, DSP and GPU capabilities on the RFNM could be game changers in the near future. However, at the time of this review, the software support is still in its very early stages, documentation is lacking, and it's not yet recommended for mainstream users who just want to plug in and get started with an SDR for listening and decoding signals.

Regarding the Granita daughterboard, we would probably hold off on purchasing this until there is some clarification on the IQ LPF fix.

If you are an advanced SDR user who is comfortable with GNU Radio, Linux and advanced applications like setting up and running mobile basestations, then the RFNM may be a good choice. We are looking forward to applications that make use of the onboard DSP and GPU capabilities.

SignalsEverywhere: Decoding the QO-100 Mid-Beacon with WebSDR and IZ8BLY’s Decoder

In one of her latest videos on YouTube, Sarah from the SignalsEverywhere channel shows how we can use a program called "IZ8BLY Phase 3D (AO-4) Satellite Decoder" to decode the 'Mid-Beacon' on the QO-100 satellite. QO-100 is a commercial geostationary communications satellite that also contains a popular transponder for amateur radio.

However, there is also an interesting beacon called the mid-beacon that can be decoded, which provides some information about the satellite. In the video, Sarah shows how this beacon can be decoded with the software from IZ8BLY. As QO-100 is only visible from Europe, the Middle East and Africa, Sarah uses a WebSDR to receive the signal from the USA, then pipes the audio into the IZ8BLY decoder via Virtual Audio Cable.

Decode QO-100's Mid-Beacon with Virtual Audio Cables and WebSDR

Reading Electric Meters with RTL-SDR and HomeAssistant

Over on his blog Jeff Sandberg has posted a writeup detailing how he combined RTL-SDR, rtl_amr, and HomeAssistant to decode wireless data from his Itron power meter, and create useful graphs showing his US home's power usage.

In the post, Jeff explains how he uses an RTL-SDR Blog V4, HomeAssistant, EMQX, and rtl_amr to receive and plot the data. The RTL-SDR and rtl_amr software receives and decodes the wireless Itron electricity meter data packets, and then EQTT passes the data to HomeAssistant for logging and plotting. Jeff also notes how he used NodeRed to correctly automate the summer and winter tariff price changes.

Finally, in an update to the post Jeff mentions that he was also able to receive and log data from his gas meter.

HomeAssistant energy dashboard with data received from an RTL-SDR and rtl_amr decoder.

Transmitting and Receiving Meshtastic with SDR

Last month we posted about Aaron's video on Meshtastic, and how it's possible to decode the Meshtastic protocol using an RTL-SDR and GNU Radio project called Meshtastic_SDR

If you weren't aware, Meshtastic is software that enables off-grid mesh network based communications and can run on cheap LoRa hardware. The mesh based nature of the system means that communications can be received over long distances, without any infrastructure, as long as there are sufficient Meshtastic nodes in an area that can route the message to the destination node. One example application of Meshtastic is to use it as a mesh-based text messaging system. This might be useful for teams of hikers, pilots, or skiers who operate in remote areas without cell phone coverage.

In his latest video, Aaron shows how Meshtatsic_SDR can also be used to transmit the Meshtastic Protocol using a transmit capable SDR like the HackRF. Aaron writes in the video description:

In this video, we take a deeper dive into the setup and usage of the meshtastic_SDR repository, which now enables the transmission and reception of Meshtastic using Software Defined Radios (SDRs). Recent updates have made this possible by partially leveraging GNU Radio flow graphs for both RX (receive) and TX (transmit), and integrating Python scripts that connect to ZMQ sources for message input and ZMQ outputs for message decoding.

I demonstrate the setup using a HackRF for the transmit side and an Airspy R2 for receiving. We also verify the results of TX and RX using a standard Meshtastic receiver to ensure accurate performance.

DragonOS FocalX Transmit and Receive Meshtastic w/ SDR (hackRF, Airspy R2, R36)

A Great Video Introduction to RTL-SDR

Over on YouTube Paul Lutus has recently posted a video that is a great introduction to software-defined radio, RTL-SDR, and some of the various signals that can be received with one. In the video he uses an RTL-SDR Blog V4, which has a built-in upconverter, allowing for good reception of HF signals.

Paul's video briefly explores SDR theory, before demonstrating various signals on both the HF and VHF+UHF bands that can be received with an RTL-SDR Blog V4. He also briefly touches on GNU Radio.

If you are a just getting started with RTL-SDR this might be a good overview video to watch. Paul has also set up a companion webpage for the video that outlines some of the software installation and usage steps mentioned in the video in greater detail.

Create Your Own Open-Source Software-Defined Radio

SignalsEverywhere: Monitoring Itron ERT Smart Meters on Android

Over on her YouTube channel SignalsEverywhere, Sarah has uploaded her latest video showing how it is possible to monitor Itron ERT smart meters on an Android device.  Smart meters are used to wirelessly monitor the usage of residential utilities such as water, gas, and electricity. With an RTL-SDR and some decoding software, it is possible to monitor the data coming from your own and your neighbours meters (at least for certain brands of meter).

In her video, Sarah shows how she compiled the rtl_amr decoder software for Android, and created her own Android app called "AndAMR" for displaying the data decoded by rtl_amr. The rest of the video shows how to set up and use the app.

Monitoring Itron ERT Smart Meters on Android?!

Tech Minds: Testing an Inmarsat L-Band Helix for Offset Satellite Dishes

In his latest video, Matt from the TechMinds YouTube channel tests out an LHCP L-band helix feed designed for receiving Inmarsat satellites. Matt pairs the feed with an 85cm satellite dish, an L-band LNA, and an Airspy Mini.

The L-band helix feed comes from a small German engineering company called nolle.engineering. The feed is priced at 94.70 Euros (incl. VAT) (~$102 USD), plus shipping costs. It is a passive antenna so it needs to be combined with an LNA to be usable with a typical SDR.

In the video Matt shows that the reception with the LHCP helix + dish setup is better than expected. He also compares it to a previous test he did with a longer RHCP helix antenna also produced by nolle.engineering. The RHCP antenna is used to be used without a dish, however, as expected the SNR is less than the dish + small LHCP feed setup. Matt then shows some Inmarsat signals being decoded including STD-C and Aero voice.

This L Band Helix Antenna Gives Amazing Performance