In recent years GPS spoofing and jamming have become quite commonplace. Recently popular YouTuber Scott Manley uploaded a video explaining exactly what GPS spoofing and jamming is and explains a bit about who is doing it and why.

In the video Scott explains how aircraft now routinely use GPS as a dominant navigational sensor and how some commercial flights have been suspended due to GPS jamming. Scott explains how ADS-B data can be used to determine the source of GPS jamming (via gpsjam.org) and shows hotspots stemming from Russia. He goes on to show how drone shows have also failed in China either due to GPS jamming by rival companies or due to Chinese military warship jamming. Scott then explains a bit about GPS and how jamming and spoofing work.

Thank you to RTL-SDR.COM reader Lee. who found a recently released program called "gypsum" which enables an RTL-SDR or HackRF to be used as a GPS Receiver when combined with a GPS antenna. Phillip Tennen, the author of Gypsum notes that Gypsum can obtain a fix within 60 seconds from a cold start and that it has no dependencies apart from numpy. We want to note that it appears that Gpysum has no live decoding ability yet, as it works from pre-recorded GNU Radio IQ files.

In the past, we've shown in a tutorial how GPS can be received and decoded with GNSS-SDRLIB and RTKLIB on Windows. The new Gypsum software should work on Linux and MacOS too.

What's more, Phillip has written an incredible 4-part writeup on how Gypsum was implemented from scratch. In the write-up, Phillip introduces GPS and explains how it can even work with such weak signals that appear below the thermal noise floor. He then goes on to explain how the detected signal is decoded and turned into positional information, and how challenging it was to propagate the accurate timing information that calculating a solution requires. The write-up is presented with clear visualizations to help readers intuitively gain an understanding of the advanced concepts involved.

It should not have escaped your attention - at least if you live in North America - there there have been/will be two significant solar eclipses occurring in recent/near times:  One that occurred on October 14, 2023 and another eclipse that will happen during April, 2024.  The path of "totality" of the October eclipse happened to pass through Utah (where I live) so it is no surprise that I went out of my way to see it - just as I did back in 2012:  You can read my blog entry about that here.

Figure 1: The eclipse in progress - a few minutes before "annularity". (Photo by C. L. Turner)

The October eclipse was of the "annular" type meaning that the moon is near-ish apogee meaning that the subtended angle of its disk is insufficient to completely block the sun owing to the moon's greater-than-average distance from Earth:  Unlike a solar eclipse, there is no time during the eclipse where it is safe to look at the sun/moon directly, without eye protection.

The sun will be mostly blocked, however, meaning that those in the path of "totality" experienced a rather eerie local twilight with shadows casting images of the solar disk:  Around the periphery of the moon it was be possible to make out the outline of lunar mountains - and those unfortunate to stare at the sun during this time will receive a ring-shaped burn to their retina.

From the aspect of a radio amateur, however, the effects of a total and annular solar eclipse are largely identical:  The diminution of the "D" layer and partial recombination of the "F" layers of the ionosphere causing what are essentially nighttime propagation conditions during the daytime - geographically limited to those areas under the lunar shadow.

In an effort to help study these sort of effects - and to (hopefully) better-understand the propagation effects, a number of amateurs went (and are) going out into the field - in or near the path of "totality" - and setting up simultaneous, multi-band transmitters.

Producing usable data

Having "Eclipse QSO Parties" where amateur radio operators make contacts during the eclipse likely goes back nearly a century - the rarity of a solar eclipse making the event even more enigmatic.  In more recent years amateurs have been involved in "citizen science" where they make observations by monitoring signals - or facilitate the making of observations by transmitting them - and this happened during the October eclipse and should also happen during the April event as well.

While doing this sort of thing is just plain "fun", a subset of this group is of the metrological sort (that's "metrology", no "meteorology"!) and endeavor to impart on their transmissions - and observations of received signals - additional constraints that are intended to make this data useful in a scientific sense - specifically:

• Stable transmit frequencies.  During the event, the perturbations of the ionosphere will impart on propagated signals Doppler shift and spread:  Being able to measure this with accuracy and precision (which are NOT the same thing!) adds another layer of extractable information to the observations.
  

• Stable receivers.  As with the transmitters, having a stable receiver is imperative to allow accurate measurement of the Doppler shift and spread.  Additionally, being able to monitor the amplitude of a received signal can provide clues as to the nature of the changing conditions.
  

• Monitoring/transmitting at multiple frequencies.  As the ionospheric conditions change, its effects at different frequencies also changes.  In general, the loss of ionization (caused by darkness) reduces propagation at higher frequencies (e.g. >10 MHz) and with lessened "D" layer absorption lower frequencies (<10 MHz) the propagation at those frequencies is enhanced.  With the different effects at different frequencies, being able to simultaneously monitor multiple signals across the HF spectrum can provide additional insight as to the effects.
  

To this end, the transmission and monitoring of signals by this informal group have established the following:

• GPS-referenced transmitters.  The transmitters will be "locked" to GPS-referenced oscillators or atomic standards to keep the transmitted frequencies both stable, accurate - and known to within milliHertz.
  

• GPS referenced receivers.  As with the transmitters, the receivers will also be GPS-referenced or atomic-referenced to provide milliHertz accuracy and stability.

With this level of accuracy and precision the frequency uncertainties related to the receiver and transmitter can be removed from the Doppler data.  For generation of stable frequencies, a "GPS Disciplined Oscillator" is often used - but very good Rubidium-based references are also available, although unlike a GPS-based reference, the time-of-day cannot be obtained from them.

Why this is important:

Not to demean previous efforts in monitoring propagation - including that which occurs during an eclipse - but unless appropriate measures are taken, their contribution to "real" scientific analysis can be unwittingly diminished.  Here are a few points to consider:

• Receiver frequency stability.  One aspect of propagation on HF is that the signal paths between the receiver and transmitter change as the ionosphere itself changes.  These changes can be on the order of Hertz in some cases, but these changes are often measured in 10s of milliHertz.  Very few receivers have that sort of stability and the drift of such a receiver can make detection of these Doppler shifts impossible.
  

• Signal amplitude measurement.  HF signals change in amplitude constantly - and this can tell us something about the path.  Pretty much all modern receivers have some form of AGC (Automatic Gain Control) whose job it is to make sure that the speaker output is constant.  If you are trying to infer signal strength, however, making a recording with AGC active renders meaningful measurements of signal strength pretty much impossible.  Not often considered is the fact that such changes in propagation also affect the background noise - which is also important to be able to measure - and this, too, is impossible with AGC active.
  

• Time-stamping recordings.  Knowing when a recording starts and stops with precision allows correlation with other's efforts.  Fortunately this is likely the easiest aspect to manage as a computer with an accurate clock can automatically do so (provided that one takes care to preserve the time stamps of the file, or has file names that contain such information) - and it is particularly easy if one happens to be recording a time station like WWV, WWVH, WWVB or CHU.

In other words, the act of "holding a microphone up to a speaker" or simply recording the output of a receiver to a .wav file with little/no additional context makes for a curious keepsake, but it makes the challenge of gleaning useful data from it more difficult.

One of our challenges as "citizen scientists" is to make the data as useful as possible to us and others - and this task has been made far easier with inexpensive and very good hardware than it ever has been - provided we take care to do so.  What follows in this article - and subsequent parts - are my reflections on some possible ways to do this:  These are certainly not the only ways - or even the best ways - and even those considerations will change over time as more/different resources and gear become available to the average citizen scientist. 

* * *

How this is done - Receiver:

The frequency stability and accuracy of MOST amateur transceivers is nowhere near good enough to provide usable observations of Doppler shift on such signals - even if the transceiver is equipped with a TCXO or other high-stability oscillator:  Of the few radios that can do this "out of the box" are some of the Flex transceivers equipped with a GPS disciplined oscillator.

To a certain degree, an out-of-the-box KiwiSDR can do this if properly set-up:  With a good, reliable GPS signals and when placed within a temperature-stable environment (e.g. temperature change of 1 degree C or so during the time of the observation) they can be stable enough to provide useful data - but there is no guarantee of such.

To remove such uncertainty a GPS-based frequency reference is often applied to the KiwiSDR - often in the form of the Leo Bodnar GPS reference, producing a frequency of precisely 66.660 MHz.  This combination produces both stable and accurate results.  Unfortunately, if you don't already have a KiwiSDR, you probably aren't going to get one as the original version was discontinued in 2022:  A "KiwiSDR 2" is in the works, but there' no guarantee that it will make it into production, let alone be available in time for the April, 2024 eclipse. 

Figure 2: The RX-888 (Mk2) - a simple and relatively inexpensive box that is capable of "inhaling" all of HF at once. Click on the image for a larger version.

The RX-888 (Mk2)

A suitable work-around has been found to be the RX-888 (Mk2) - a simple direct-sampling SDR - available for about $160 shipped (if you look around).  This device has the capability of accepting an external 27 MHz clock (if you add an external cable/connector to the internal U.FL connector provided for this purpose) in which it can become as stable and accurate as the external reference.

This SDR - unlike the KiwiSDR, the Red Pitaya and others - has no onboard processing capability as it is simply an analog-to-digital coupled with a USB3 interface so it takes a fairly powerful computer and special processing software to be able to handle a full-spectrum acquisition of HF frequencies.

Software that is particularly well-suited to this task is KA9Q-Radio (link).  Using the "overlap and save" technique, it is extraordinarily efficient in processing the 65 Megasamples-per-second of data needed to "inhale" the entire HF spectrum.  This software is efficient enough that a modest quad-core Intel i5 or i7 is more than up to the task - and such PCs can be had for well under $200 on the used market.

KA9Q-Radio can produce hundreds of simultaneous virtual receivers of arbitrary modes and bandwidths which means that one such virtual receiver can be produced for each WSPR frequency band:  Similar virtual receivers could be established for FT-8, FT-4, WWV/H and CHU frequencies.  The outputs of these receivers - which could be a simple, single-channel stream or a pair of audio in I/Q configuration - can be recorded for later analysis and/or sent to another program (such as the WSJT-X suite) for analysis.

Additionally, using the WSPRDaemon software, the multi-frequency capability of KA9Q-Radio can be further-leveraged to produce not only decodes of WSPR and FST4W data, but also make rotating, archival I/Q recordings around the WSPR frequency segments - or any other frequency segments (such as WWV, CHU, Mediumwave or Shortwave broadcast, etc.) that you wish.

Comment:  I have written about the RX-888 in previous blog posts:

• Improving the thermal management of the RX-888 (Mk 2) - link 
• Measuring signal dynamics of the RX-888 (Mk 2) - link
  

Full-Spectrum recording

Yet another capability possible with the RX-888 (Mk2) is the ability to make a "full spectrum" recording - that is, write the full sample rate (typically 64.8 Msps) to a storage device.  The result are files of about 7.7 gigabytes per minute of recording that contain everything that was received by the RX-888, with the same frequency accuracy and precision as the GPS reference used to clock the sample rate of the '888.  

What this means is that there is the potential that these recordings can be analyzed later to further divine aspects of the propagation changes that occurred during, before and after the eclipse - especially by observing signals or aspects of the RF environment itself that one may not have initially thought to consider:  This also can allow the monitoring of the overall background noise across the HF spectrum to see what changes during the eclipse, potentially filling in details that might have been missed on the narrowband recordings.

Because such a recording contains the recordings of time stations (WWV, WWVH, CHU and even WWVB) it may be possible to divine changes in propagation delay between those transmit sites and the receive sites.  If a similar GPS-based signal is injected locally, this, too, can form another data point - not only for the purposes of comparison of off-air signals, but also to help synchronize and validate the recording itself.

By observing such a local signal it would be possible to time the recording to within a few 10s of nanoseconds of GPS time - and it would also be practical to determine if the recording itself was "damaged" in some way (e.g. missed samples from the receiver):  Even if a recording is "flawed" in some way, knowing the precise location an duration of the missing data allows this to be taken into account and to a large extent, permit the data "around" it to still be useful.

Actually doing it:

Up to this point there has been a lot of "it's possible to" and "we have the capability of" mentioned - but pretty much everything mentioned so far was used during the October, 2023 eclipse.  To a degree, this eclipse is considered to be a rehearsal for the April 2024 event in that we would be using the same techniques - refined, of course, based on our experiences.

While this blog will mostly refer to my efforts (because I was there!) there were a number of similarly-equipped parties out in the fields and at home/fixed stations transmitting and receiving and it is the cumulative effort - and especially the discussions of what worked and what did not - that will be valuable in preparation for the April event.  Not to be overlooked, this also gives us valuable experience with propagation monitoring overall - an ongoing effort using WSPRDaemon - where we have been looking for/using other hardware/software to augment/improve our capabilities.

In Part 2 I'll talk about the receive hardware and techniques in more detail.

Stolen from ka7oei.blogspot.com

[END]

I cloned the software and modified it in two simple ways:

1. EU option

This is a backwards compatible version which can be Europeanized with formats for date and units. It also has possibility for removing the display of the battery icon, when running from a USB supply.

New boolean variables to set:

• US_UNITS - if false: m, kmh, Little-endian date with '.', if true: feet, mph, Middle-Endian date with '/'
• BATTERY_DISPLAY - true: as original code, false: no display of battery icon and status

• There is now a new way of initializing Serial1 (used for GPS input signal) as the original one didn't compile in Arduino IDE 1.8.13. See https://github.com/stm32duino/wiki/wiki/API#hardwareserial
• The satellite count in the upper right corner is more agile so it now drops to 0 whenever the GPS signal is lost, rather than stay forever at last satellite count.

Finally, over the last few weeks I managed to adapt lunarCycle.c to Arduino and get it to work as shown in the display here. My ambition is now eventually to publish this project on GitHub as I’ve had several requests for it.

The display here shows local time and date, moon phase on line 2, present moon elevation and moon azimuth on line 3, and the next rise time of the moon and at which position on the final line. Follow label ‘Arduino clock’ below for more posts about this clock.

Quick demonstration of Time Difference of Arrival (TDoA) technique to correlate a common transmitted signal on multiple receivers to find the transmitter's location.

The post Demo of TDoA using the SDR.hu network appeared first on Ham Radio . Magnum Experimentum.

As noted in a previous entry of this blog where I discussed the "Raspberry Kiwi" SDR - a (near) clone of the KiwiSDR - there is also the "FlyDog" receiver - yet another clone - that has made the rounds.  As with the Raspberry Kiwi, it would seem that the sources of this hardware are starting to dry up, but it's still worth taking a look at it.

I had temporary loan of a FlyDog SDR to do an evaluation, comparing it with the KiwiSDR - and here are results of those tests - and other observations.

Figure 1: The Flydog SDR.  On the left are the two "HF" ports and the port for the GPS antenna.  Note the "bodge" wires going through the shielded area in the upper left. The dark squares in the center and to its right are the A/D converter and the FPGA.  The piece of aluminum attached to the oscillator is visible below the A/D converter. Click on the image for a larger version.

How is this different from the Raspberry Kiwi?

Because of its common lineage, the FlyDog SDR is very similar to the Raspberry Kiwi SDR - including the use of the same Linear Technologies 16 bit A/D converter - and unlike the Raspberry SDR that I reviewed before, it seems to report a serial number, albeit in a far different range (in the 8000s) than the "real" KiwiSDRs which seem to be numbered, perhaps, into the 4000s.

The most obvious difference between the FlyDog and the original KiwiSDR (and the Raspberry Kiwi) is the addition of of a second HF port - which means that there is one for "up to 30 MHz" and another that is used for "up to 50 MHz" - and therein lies a serious problem, discussed below.

Interestingly, the FlyDog SDR has some "bodge" wires connecting the EEPROM's leads to the bus - and, unfortunately, these wires, connected to the digital bus, appear to run right through the HF input section, under the shield!  Interestingly, these wires might escape initial notice because they were handily covered with "inspection" stickers. (Yes, there were two stickers covering each other - which was suspicious in its own right!)  To be fair, there's no obvious digital "noise" as a result of the unfortunate routing of these bodge wires.

Why does it exist?

One would be within reason to ask why the FlyDog exists in the first place - but this isn't quite clear.  I'm guessing that part of this was the challenge/desire to offer a device for a the more common, less-expensive and arguably more capable Raspberry Pi (particularly the Pi 4) - but this is only a guess.

Another reason would have been to improve the performance of the receiver over the KiwiSDR by using a 16 bit A/D converter - running at a higher sampling rate - to both improve dynamic range and frequency coverage - this, offering usable performance up through the 6 meter amateur band.  

Unfortunately, the Flydog does neither of these very well - the dynamic range problem being the same as the Raspberry Kiwi in the linked article compounded by the amplitude response variances, choice of amplifier device and frequency stability issues discussed later on.

Observations:

Getting immediately to one of the aspects of this receiver, I'll discuss the two HF ports. Their basic nature can be stated in two words:  Badly implemented.

When I first saw the FlyDog online with its two HF ports, I wondered "I wonder how they selected between the two ports - with a small relay, PIN diodes, or some sort of analog MUX switch, via hardware?" - but the answer is neither:  The two ports are simply "banged" together at a common point.

When I heard this, I was surprised - not because of its simplicity, but because it's such a terrible idea.  

As a few moments with a circuit simulator would show you, simply paralleling two L/C networks that cover overlapping frequency ranges does not result in a combined network sharing the features/properties of the two, but a terrible, interacting mess with wildly varying impedances and the potential for huge variations of insertion loss.

The result of this is that the 30 MHz input is, for all practical purposes, unusable, and its existence seriously compromises the performance of the other (0-50 MHz) port.  Additionally, if one checks the band-pass response of the receiver using a calibrated signal generator against the S-meter reading, you will soon realize that the resulting frequency response across the HF spectrum is anything but flat.

For example, one will see a "dip" in response (e.g. excess loss) around 10 MHz on the order of 20 dB if you put a signal into the 50 MHz port, effectively making it (more or less) unusable for the 30 meter amateur band and the 31 meter shortwave broadcast band.  Again, there is nothing specifically wrong with the low-pass filter networks themselves - just the way that they were implemented:  You can have only one such network connected to the receiver's preamplifier input at a time without some serious interaction!

Work-around:

Having established that, out-of-the-box, that the FlyDog has some serious issues when used as intended on HF, one might be wondering what can be done about it - and there are two things that may be done immediately:

• Do microsurgery and disconnect one of the HF input ports.  If you have the skills to do so, the shield over the HF filter may be unsoldered/removed and the circuit reverse-engineered enough to determine which component(s) belong to the 30 MHz and 50 MHz signal paths - and then remove those component(s).  If you wish to retain 6 meter capability, disconnect the 30 MHz port.  Clearly, this isn't for everyone!
  

• Terminate the unused port.  A less-effective - but likely workable alternative - would be to attach a 50 ohm load to the unused port.  On-bench testing indicated that this seemed to work best when the 50 MHz port was used for signal input and the 30 MHz port was connected to a 50 ohm load:  The frequency of the most offensive "null" at about 10 MHz shifted down by a bit more than 1 MHz into the 9 MHz range and reduced in depth, allowing still-usable response (down by only a few dB) at 10 MHz, and generally flattening response across the HF spectrum:  Still not perfect, but likely to be adequate for most users.  (In testing, the 30 MHz port was also shorted, but with poorer results than when terminated.) 

In almost every case, the performance (e.g. sensitivity) was better on the 50 MHz port than the 30 MHz port, so I'm at a loss to find a "use case" where its use might be better - except for a situation where its lower performance was outweighed by its reduced FM broadcast band rejection.

This issue - which is shared with the RaspberryKiwi SDR - is that the low-pass filter (on the 50 MHz port) is insufficient to prevent the incursion of aliases of even moderately strong FM broadcast signals which appear across the HF spectrum as broad (hundreds of kHz wide) swaths of noise with a hint of distorted speech or music.  This is easily solved with an FM broadcast band filter (NooElec and RTL-SDR blog sell suitable devices) - and it is likely to be a necessity.

Other differences:

• Lower gain on the FlyDog SDR:  Another difference between the FlyDog and KiwiSDR is the RF preamplifier.  On the KiwiSDR and Raspberry Kiwi, a 20 dB gain amplifier (the LTC6401-20) is used, but a 14 dB gain amplifier (LTC6400-14) is used instead - a gain reduction of about 6 dB, or one S-unit - and the effects of this are evident in the performance as described below.  Was this intentional, a mistake, or was it because the 14 dB version was cheaper/more available?
  

Clock (in)stability:

The Flydog SDR uses a 125 MHz oscillator to clock the receiver (A/D converter) - but there is a problem reported by some users:  It's a terrible oscillator - and it's bad enough that it is UNSUITABLE for almost any digital modes - particularly WSPR, FT-8, and FT-4 - to name but a few unless the unit is in still air and in an enclosure that is very temperature-stable.

Figure 2: Stability of the "stock" oscillator in the Flydog at 125 MHz in "still" air, on the workbench.  The amount of drift - which is proportional to the receive frequency - makes it marginally usable for digital modes and is too fast/extreme to be GPS-corrected. Click on the image for a larger version.

Figure 2, above, is an audio plot from a receiver (a Yaesu FT-817) loosely coupled and tuned to the 125 MHz oscillator on the Flydog's receive board:  Due to the loose coupling (electrical and acoustic), other signals/noises are present in the plot that are not actually from the Flydog.  The horizontal scale near the top has 10 Hz minor divisions and the red has marks along the left side of the waterfall represent 10 seconds.

From this plot we can see over the course of about half a minute the Flydog's main receiver clock moved well over 50 Hz, representing 5 Hz at 12.5 MHz or 1 Hz at 2.5 MHz.  With this type of instability, it is probably unusable for WSPR on any band above 160 meters much of the time - and it is likely only marginally usable on that band as WSPR can tolerate only a slight amount of drift, and that's only if its change occurs in about the same time frame as the 2 minute WSPR cycle.  The drift depicted above would cause a change of 1 Hz or more on bands 20 meters and above within the period of just a few WSPR - or FT8 - symbols, rendering it uncopiable.

"The Flydog has GPS frequency correction - won't this work?"

Unfortunately not - this drift is way too fast for that to possibly work as the GPS frequency correction works over periods of seconds. 

What to do?

While replacing the 125 MHz clock oscillator with another device (I would suggest a crystal-based oscillator rather than a MEMs-based unit owing to the former's lower jitter) or apply a stabilized, external source (e.g. a Leo Bodnar GPS-stablized signal source) are the best options, one can do a few things "on the cheap" to tame it down a bit.

While on the workbench, I determined that this instability appeared to be (pretty much) entirely temperature-related, so two strategies could be employed:

• Increase the thermal mass of the oscillator.  With more mass, the frequency drift would be slowed - and if we can slow it down enough, large, fast swings might be damped enough to allow the GPS frequency correction to compensate.  With a slow enough drift, the WSPR or FT-8 decoders may even be able to cope without GPS correction.
  

• Thermally isolate the oscillator.  Because it's soldered to the board, this is slightly difficult so our goal would be to thermally isolate the mass attached to the oscillator.
  

To test this idea I added thermal mass:  I epoxied a small (12x15mm) piece of 1.5mm thick aluminum to the top of the oscillator itself.  The dimensions were chosen to overlap the top of the oscillator while not covering the nearby voltage regulator, FPGA or A/D converter and the thickness happens to be that of a scrap piece of aluminum out of which I cut the piece:  Slightly thicker would be even better - as would it being copper.

The epoxy that I used was "JB Weld" - a metal-filled epoxy with reasonable thermal conductivity, but "normal" clear epoxy would probably have been fine:  Cyanoacrylate ("CA" or "Super" glue) is NOT recommended as it is neither a good void filler or thermal conductor.

Comment:  If one wishes to remove a glued-on piece of metal from the oscillator during experimentation, do not attempt to remove it physically as this would likely tear it from and damaging the circuit board, but slowly heat it with a soldering iron:  The adhesive should give way long before the solder melts.

The "thermal isolation" part was easy:  A small piece of foam was cut to cover the piece of aluminum - taking care to avoid covering either the FPGA or the A/D converter, but because it doesn't produce much heat - and is soldered to the board itself - the piece of foam also covered the voltage regulator.

The result of these two actions may be seen in the plot below:

Figure 3: The stability of the oscillator after the addition of the thermal mass and foam.  Still not great, but more likely to be usable.  (The signal around 680-700 Hz is the one of interest.) Click on the image for a larger version.

Continue reading "GPS Data for Icom IC-9700"