So, last week I joined the bandwagon of exploring software-defined radio (SDR) via one of those super-cheap Chinese TV tuner USB sticks. In a nutshell, the idea of SDR is that, rather than the traditional approach of building dedicated radio receiver hardware for each possible RF band and modulation type (here’s your AM radio, here’s your FM radio, here’s your TV receiver…), each of which can only do one thing, we can simply make an extremely *wide* bandwidth receiver frontend that captures ALL the signals, shovel the raw waveform into a computer, and emulate all the desired radio receiver frontends and tuning in software via digital filtering. New type of radio scheme just got invented? You don’t have to buy/build a new radio receiver, just download this update! Historically, this ‘universal receiver’ has been somewhat hairy and expensive to build. The most well-known (and open-source!) is probably the Universal Software Radio Peripheral, most commonly associated with the gnuradio project. Recently though, Antti Palosaari and other clever folks discovered that a $20 USB TV tuner can be pressed into service as a ‘universal enough’ receiver for many purposes.
There are many ‘flavors’ of the sticks that work for this. These sticks consist of two parts (as far as you’re concerned): a frontend tuner chip, and the Realtek RTL2832U demodulator chip. The latter also includes the USB interface. RTL2832U-based sticks are popular because, while it is officially intended to output TV/FM signal data, it is easy to put this IC into a mode where it dumps the raw tuner output directly to the USB port at high speed. This allows user software to bend, fold, mutilate and decode arbitrary radio signals as it sees fit.
The ‘tuner’ part of this stick is somewhat interchangeable; they all do pretty much the same thing (although some are better or worse at the job for our purposes). A large list of tuners, and the products they appear in, is being maintained here. The Elonics E4000 tuner is regarded as the ‘best’ as it can tune over a wider range (64-1700MHz, with a small coverage gap in the middle) compared to the others. Note however, because of the ‘interchangeable’ nature of the tuners, the stick you receive is not at all guaranteed to contain the tuner you wanted – it will most likely contain whichever flavor was cheapest in China at the time this batch was manufactured. The Realtek IC is much less likely to be substituted with another part since all the USB drivers (or at least USB VID/PID codes) would have to be rewritten.
Case in point; the one I bought was the ezcap DVB-T/DAB/FM stick; upon cracking it open I found an FC0013 tuner rather than the E4000 others have reported.
Some Software
Several SDR software packages (other than, of course, gnuradio) have now been written or updated to accept data from the RTL2832U, and present it in a user-friendly manner. These consist generally of a frequency/tuning setting, spectral plot, waterfall plot (sort of a stripchart of the time-varying spectrum over the last 30 seconds or so), and various options for demodulating a user-specified portion of the spectrum (usually to the form of audio played back on the speakers).
Some that I have tested so far are:
Gqrx SDR receiver – For Linux; supports several common modulations including AM, FM (wide/narrow), and SSB. At the time of this writing, you have to pull an experimental source tree and compile it yourself to get the (very recently added) support for RTL dongles. Luckily, this (for me at least) went painlessly following this tutorial (Gqrx portion begins on page 2; warning: annoying float-over ads); it just takes a while.
HDSDR – For Windows; supports even more modulations (AM, FM, ECSS, single sideband (lower, upper), CW, DRM) and allows the filter bandwidth to be adjusted in most cases. This program is freeware, but not open-source.
SDR# (SDR-Sharp) – For Windows; supported modulations include AM, FM (narrow/wide), single (lower/upper) and dual sideband, CW (lower, upper). This is my personal favorite so far, as the filter bandwidth can be arbitrarily set and easily fine-tuned by simply clicking and dragging the filter envelope shown on the waterfall plot. Tuning can also be accomplished by dragging the spectrum plot as a ‘radio dial’ besides the usual typing/mousewheeling in the Frequency field.
Note that the RTL support in these programs (and in some cases the programs themselves) are very new; they may be much evolved from the anecdotes above by the time you read this.
Some Oddities
Heat issues
When my shiny new tuner stick arrived I wasted no time building gqrx and firing it up. I was rather dismayed to find that the tuner frequency set in the software seemed to have absolutely no correlation to the frequency actually tuned (confirmed by finding some local FM radio stations and comparing their spoken station identifications to the frequency displayed). Same story on other software. It turns out that these chips run pretty warm, and mine arrived on about the hottest day of the year – after a few minutes of being plugged in, the stick was overheating and the tuner IC was no longer responding to commands. This has been mostly solved by removal of the stick’s plastic case and cooler overall temperatures. It seems others have seen the same problem on similar sticks; this user (original Romanian) (English translation) solved it by cutting a hole in the case and bonding a small heatsink to the IC.
Aliasing and other ghosts
With the overheating issue sorted, I confirmed some ‘known’ FM radio stations were where they belonged… but noticed strong FM stations also popping up at truly bizarre locations on the dial. It turns out these sticks are prone to showing you aliased signals and other forms of ‘ghost’ signals. Aliasing occurs when a high-frequency signal is undersampled. As I understand it, these sticks ‘demodulate’ a signal by multiplying the incoming signal with a reference frequency (the ‘local oscillator’, or LO), causing it to be frequency-shifted down to something more manageable. (In most SDR software, the ‘center frequency’ adjustment for tuning adjusts the LO.) Poor filtering of strong signals can cause accidental demodulation of those signals even at far-away local oscillator frequencies, probably most noticeable at integer multiples of the signal’s carrier. The result is that a spurious alias of that signal will show up, ‘folded over’ to an unexpected frequency.
A sure giveaway that you are looking at an alias and not the real signal is that it moves in the ‘wrong’ direction if the tuner center frequency is altered slightly. That is, while authentic signals should appear at a consistent frequency regardless of small tuning changes, an alias will appear to change frequencies as the tuner center frequency (LO) is adjusted.
I have also noticed other ‘ghost’ signals repeated at multiple frequencies, but without the giveaway folding. I don’t have an explanation for these. However, the false-frequency copies seem to vary widely in amplitude, to the extent of appearing and disappearing, as the LO is adjusted.
NOTE: Specific alias/ghost behavior may be (and probably is) tuner IC specific; your results may vary depending on the type of tuner in your particular stick.
I/Q imbalance (DC Offset)
Another issue common to these cheap TV sticks is an imbalance between the I and Q components (we’ll get to that in a minute) of the returned signal. This typically manifests as a continuous false ‘signal’ peak always at the center (LO) frequency.
Primer on some digital RF basics (e.g. what is all this ‘I/Q’ stuff?)
This paper from Agilent is a good overview of how these tuner sticks and similar digital radios are implemented under-the-hood, as well as covering many basic digital modulation schemes and how to identify them.
What’s Out There?
Oh, the fun you can have. So far I have read the entire neighborhood’s pager messages, eavesdropped on bored rent-a-cops’ walkie-talkie chatter, gotten weather reports, and found many more things I can’t even begin to identify. Here is a quick link-dump for some specific cool stuff people have managed to find, and how to do it yourself.
Read pager messages
Plot the courses of aircraft via their radio identification messages
Acquiring GPS (scroll down a bit)
Receive weather satellite images
I might try to cobble together a visual identification guide (or links to same, if this already exists) as a Part 2.
PS. Action shot of sniffing pager data out of the air in my hometown. Click for fullsize:
Leave a Reply