C Band LNB Ext Ref Mod » History » Version 8

« Previous - Version 8/12 (diff) - Next » - Current version
horiz0n, 02/28/2016 07:39 PM

C Band PLL LNB External reference modification

Interest in C band reception has risen recently because of projects like

  • JAERO (reception of Inmarsat aeronautical services)
  • osmo-gmr (reception of Thuraya 2 & 3, Morelos III)

and the availability of decently priced consumer LNBs offered by Titanium Satellite

Since being consumer products these LNBs provide only moderate frequency accuracy and stability. Below we will describe how to modify these LNBs to achieve superior accuracy and stability with relatively little effort.

Titanium Satellite C Band LNBs

These LNBs are availble in single or dual channel in narrowband (3.7-4.2 GHz) or wideband (3.4-4.2 GHz) variants. They are using the RDA3570 CMOS Integrated C band to L band downconverter

Some information on the internal design of the LNB is available in the patent for RDA3570:

The LNBs have the usual 13V/18V V/H polarization selection and come with a dielectric plate to achieve circular polarization.

Let's take a look inside...

C1WPLL - Single channel LNB with one RDA3570 and one crystal. Yes, some screws are missing and the holes are going through to the feed, which will allow moisture to enter the LNB!

Single channel LNB with one RDA3570 and one crystal

C2WPLL - Dual channel LNB with two RDA3570 sharing one crystal. Better to buy this one since it has all screws in place!

Dual channel LNB with two RDA3570 sharing one crystal

On both pictures we see a 25 MHz crystal providing reference to the microwave PLL running at 5150 MHz inside the RDA chip. The resulting IF range is between 1650-950 and 1450-950 MHz. Please note, the high LO design inverts the baseband, so you have to swap the I and Q signals before further processing.

To check the frequency error we lock the signal generator and spectrum analyzer to a 10MHz GPSDO source and inject 3500 MHz at very low level into the LNB's feed opening while observing the down converted signal at 1650 MHz (5150 MHz LO - 3500 MHz RF).

In the picture below we see how the moderate frequency accuracy of the cheap crystal results in a carrier offset of almost 70 kHz.

Freq. stab. with stock XTAL

Now with 25MHz reference (after the hardware mod. described below) locked to 10MHz provided by the same GPSDO source which is used by the signal generator and spectrum analyzer. Now the carrier appears exactly where we would expect it.

Freq. stab. with 25 MHz ext. ref.

For comparison: in the picture below only a cheap PLL frequency multiplier was used, so you can clearly see the effect of the bad phase noise of the reference also having a huge impact on the noise floor around the signal of interest.

Freq. stab. with NB3N502 mult.

Adding reference input to the LNB

The modification comes down to removing the stock crystal and feed 25 MHz from a stable frequency source into the LNB.

We have at least the following options:

  1. Drill a hole and provide the reference signal via a dedicated coaxial cable
  2. Use the same coax for reference clock as being used for IF and DC power

In both cases, don't forget to seal the connector(s) against moisture.

Since the first option is trivial, lets discuss the second option below.

The original IF connector also carries the LNB supply voltage (DC, 13 or 18V). We have to isolate the 25 MHz signal while blocking DC and IF signals at the same time. The proposed approach is using a simple narrow bandpass made of a series capacitor and inductor. Here we've chosen the following values to achieve resonance at 25MHz: 82pF + 500nH. Any other reasonably selected value pairs which are resonant at 25 MHz might be used as well.

Carefully remove the crystal without destroying the PCB pads. Proceed as shown on the picture below.

Ext Ref Mod annotated

With this modification, experiments have shown that reference level must be maintained between -20 to 10 dBm for best SNR. The PLL does not lock below -40dBm and the SNR degrades above 10dBm. Best reference level appears to be around -10 dBm.

To inject the 25 MHz signal on to the coax going to the LNB, we use a Mux Tee from Orbital Research, which essentially is a bias-t with additional BNC connector for injection of a reference signal for a block up converter (BUC).

Let's take a look inside. You see a bunch of highpass and lowpass filters with the 10 MHz signal being injected into the DC lowpass.

Mux Tee block diagram Mux Tee photo inside

Measurements show approx 0.4dB attenuation at 10MHz, 1.8dB at 25MHz, 3dB at 50MHz. The 433MHz path of this specific model used for communication with the BUC has at least 22 dB of attenuation.

Of course you can use any other SAT bias-t and modify it to inject the 25 MHz signal using same capacitor & inductor values we've used before inside of the LNB in order to extract the reference signal.

To design your own bias-t, you might use the methodology described at

25 MHz reference source

Here we have multiple options

Signal generator at 25 MHz

+ usualy good phase noise
+ might be locked to external reference
- likely required for other tasks in the lab

TCXO, OCXO at 25 MHz

+ very cheap (TCXO)
- not cheap (OCXO)
+ excellent phase noise
- free running (somewhat unstable)

GPSDO (10 MHz) + PLL (25 MHz)

+ excellent phase noise
+ very high accuracy & stability
- requires outdoor GPS antenna
- external PLL required to produce 25 MHz

In the following examples we've used G3RUH GPSDO, which provides a very clean square wave output signal at 5V amplitude.

To be able to lock the LNB to the GPSDO, we have to produce a clean 25 MHz signal from the 10 MHz provided by GPSDO. Of course we might build an external PLL board, but let's see first what else we can use.


Since firmware 2016.01-rc1 bladeRF has the ability to lock to an external reference as well as produce arbitrary frequency signal (25 MHz here) on its clock output.

Use GrOsmoSDR source with the following arguments to produce 25 MHz on the SMB connector:

osmocom_fft -a bladerf,smb=25e6

To lock the bladeRF itself to an external GPSDO reference, use additional arguments tamer=external for 10MHz or tamer=external_1pps for 1PPS GPSDO signals.

osmocom_fft -a bladerf,smb=25e6,tamer=external

The described method requires and gr-osmosdr from 28.2.2016 or later

Carefully read the instructions for external reference locking (especially max allowed voltage levels) on Nuand's blog


Let's see how we can use our HackRF Jawbreaker with serial number 1 (Thanks Michael!).

The HackRF SDR transceiver has a clock input, which allows it to be locked to an external 10 MHz reference (must be present when switching on HackRF) and a clock output which by default outputs 10 MHz. To let the output produce 25 MHz instead of 10 MHz, in hackrf_core.c replace the line

si5351c_configure_multisynth(&clock_gen, 3, 80*128-512, 0, 1, 0); /* 800/80 = 10MHz */


si5351c_configure_multisynth(&clock_gen, 3, 32*128-512, 0, 1, 0); /* 800/32 = 25MHz */

Rebuild the firmware, flash it and you should have 25 MHz appearing at the clock output.


Since AirSpy is using the same clock distribution IC as hackrf (si5351c) and has just like the hackrf a 10 MHz external reference input as well as 3 clock outputs (not used at the moment), the approach used above might work as well, but this has not been tried yet.


You can reach us in #osmocom channel on freenode or #hearsat in starchat network.

Add picture from clipboard (Maximum size: 48.8 MB)