SDR (Software Defined Radio)

h1. 5G NTN

In 3GPP release 17, the so-called _non-terrestrial networks_ were introduced.  NTN is a generic term that encompasses satellites (GEO, LEO) as well as high-altitude vehicles.

h2. Frequencies

The two initial frequency band groups specified by 5G NTN are called FR1 and FR2.

h3. 5G NTN FR1

There are two specified 5G NR bands in NTN FR1: n255 (L-Band) and n256 (S-Band).

|_.Band|_.Common name|_.Uplink|_.Downlink|_.Duplex spacing|

|n255|L-Band|1626.5-1660.5|1525-1559|-101.5|

|n256|S-Band|1980-2010|2170-2200|190|

h2. Deployed networks

h3. Skylo / Bullitt

One of the first commercial NTN deployments appears to be "Bullitt Sattelite":https://bullitt.com/en-gb/coverage/ who is using network provided by "Skylo":https://www.skylo.tech/ .

It is using rented transponder capacity on existing Echostar 21 (S-Band, Europe) and Inmarsat (L-Band) GEO sattelites. Given that those (Like Echostar XXI) are in orbit for many years, they presumably are just traditional "bent pipe" satellites.

Echostar also appears to be in the process of setting up a separate 28-LEO-sattelite constellation just for NTN, where the actual gNB (or at least part of it) is in the sattelite itself.  That's not deployed as of now (2023).

h4. Peek at the network in July 2023

@tnt had a quick look at the network in July 2023.

Receiver setup:

* "RFSpace":http://rfspace.com/ "TSA-600":http://rfspace.com/RFSPACE/Antennas_files/TSA600.pdf Vivaldi antenna

* "sysmocom":https://sysmocom.de/ "cf2235-kt30":https://shop.sysmocom.de/S-Band-cavity-filter-2170-2300-MHz/cf2235-kt30 S-band cavity filter

* "Mini-Circuits":https://www.minicircuits.com/ "ZRL-2400LN+":https://www.minicircuits.com/WebStore/dashboard.html?model=ZRL-2400LN%2B LNA

* "Ettus Research":https://www.ettus.com/ "B205mini":https://www.ettus.com/all-products/usrp-b205mini-i-board/ SDR receiver hardware

* "GNURadio":https://www.gnuradio.org/ + "fosphor":https://projects.osmocom.org/projects/sdr/wiki/Fosphor Spectrum display software

The setup was not ideal since the antenna was not the most appropriate (linear polarization while the sat should be LHCP) and the view is also partially obstructed. A good setup should be able to provide higher signal strength.

Here's what the spectrum in the upper part of `n256` looks like :

!{width:640px}screenshot_spectrum_echostar21_20230712.png!

There seems to be 4 carriers that look like 4G/LTE NBIoT.

RF Recordings :

* https://people.osmocom.org/tnt/ntn/nbiot-f2.199200e+09-s3.840000e+06-t20230712220429.cfile

* https://people.osmocom.org/tnt/ntn/nbiot-f2.199200e+09-s3.840000e+06-t20230712231322.cfile

Using "SRS":https://srs.io/ "4G suite":https://github.com/srsran/srsRAN_4G/  (more specifically @cell_search_nbiot@ and @npdsch_ue@ examples), it was possible to sync and decode some information from the strongest signal. 

@cell_search_nbiot@ find a cell :

<pre>

NSSS with peak=2.118723, cell-id: 11, partial SFN: 0

[INFO]: CELL SEARCH: Found peak PSR=9.212, Cell_id: 11

Found CELL ID 11.

</pre>

And then we can decode it with `npdsch_ue` which will also save the MIB/SIB into a pcap : {{collapse

<pre>

RF device 'UHD' successfully opened

Set RX gain: 65.0 dB

Set RX freq: 2198.400000 MHz

Setting sampling rate 1.92 MHz

Actual sampling rate 1.92 MHz

[INFO]: Stopping RF and flushing buffer...

[INFO]: Generating NRS for n_id_ncell=11

[INFO]: 

Entering main loop...

[INFO]: Realigning frame, reading 13591 sampleste: 0

[INFO]: Successfully decoded NPBCH sfn_offset=0te: 1

[INFO]: Time offset adjustment: -1 samples (-0.09), mean SFO: -1.80 Hz, -0.00900 samples/10-sf, ema=0.100000, length=10

[INFO]: Successfully decoded NPBCH sfn_offset=0

[INFO]: MIB-NB decoded: 1 with offset 0

MIB received (CFO:  +1.19 kHz)

 - N_id_ncell:           11

 - Release:              r14

 - Nof ports:            1

 - SFN:                  64

 - HFN (2 LSB):          0

 - Sched. Info SIB1      0

   - First frame         48

   - #repetitions        4

   - TBS                 208

 - System Info Val       0

 - AC barring            No

 - Operating mode        Standalone

[INFO]: Init NPDCCH: Max bits: 336, 0 ports.

[INFO]: Init NPDSCH: max_re's: 1600

[INFO]: Generating NRS for n_id_ncell=11

[INFO]: NPDSCH: Cell config n_id_ncell=11, 1 ports, 1 PRBs base cell, max_symbols: 1600

[INFO]: 16 DL SIB1-NB SFNs: 

[48, 112, 176, 240, 304, 368, 432, 496, 560, 624, 688, 752, 816, 880, 944, 1008, ];

[INFO]: 64.x: Activated SIB1 decoding in sfn=304

[INFO]: Time offset adjustment: -1 samples (-0.10), mean SFO: -2.56 Hz, -0.01282 samples/10-sf, ema=0.100000, length=10

[INFO]: Time offset adjustment: -1 samples (-0.09), mean SFO: -3.41 Hz, -0.01707 samples/10-sf, ema=0.100000, length=10

[INFO]: 304.4: NPDSCH processing sf_idx=1/8 rep=1/4 tot=1/32

[INFO]: 306.4: NPDSCH processing sf_idx=2/8 rep=1/4 tot=2/32

[INFO]: 308.4: NPDSCH processing sf_idx=3/8 rep=1/4 tot=3/32

[INFO]: 310.4: NPDSCH processing sf_idx=4/8 rep=1/4 tot=4/32

[INFO]: 312.4: NPDSCH processing sf_idx=5/8 rep=1/4 tot=5/32

[INFO]: 314.4: NPDSCH processing sf_idx=6/8 rep=1/4 tot=6/32

[INFO]: 316.4: NPDSCH processing sf_idx=7/8 rep=1/4 tot=7/32

[INFO]: 318.4: NPDSCH processing sf_idx=8/8 rep=1/4 tot=8/32

[INFO]: 318.4: Trying to decode NPDSCH with 8 subframe(s).

[INFO]: 318.x: Decoding NPDSCH: RNTI: 0xffff, Mod QPSK, TBS: 208, NofSymbols: 8 * 160, NofBitsE: 8 * 320

[INFO]: Decoded Message: 

[40 50 80 c8 0a 62 1f 56 02 1b 11 60 00 ff 0e 05 60 55 88 4c 80 00 00 00 00 00 ];

SIB1 received

[INFO]: 318.x: Activated SIB2 reception in hfn=32, sfn=512

[INFO]: Time offset adjustment: -1 samples (-0.10), mean SFO: -3.55 Hz, -0.01775 samples/10-sf, ema=0.100000, length=10

[INFO]: Time offset adjustment: -1 samples (-0.10), mean SFO: -3.60 Hz, -0.01799 samples/10-sf, ema=0.100000, length=10

[INFO]: 512.1: NPDSCH processing sf_idx=1/8 rep=1/1 tot=1/8

[INFO]: 512.2: NPDSCH processing sf_idx=2/8 rep=1/1 tot=2/8

[INFO]: 512.3: NPDSCH processing sf_idx=3/8 rep=1/1 tot=3/8

[INFO]: 512.4: NPDSCH processing sf_idx=4/8 rep=1/1 tot=4/8

[INFO]: 512.6: NPDSCH processing sf_idx=5/8 rep=1/1 tot=5/8

[INFO]: 512.7: NPDSCH processing sf_idx=6/8 rep=1/1 tot=6/8

[INFO]: 512.8: NPDSCH processing sf_idx=7/8 rep=1/1 tot=7/8

[INFO]: 513.1: NPDSCH processing sf_idx=8/8 rep=1/1 tot=8/8

[INFO]: 513.1: Trying to decode NPDSCH with 8 subframe(s).

[INFO]: 513.x: Decoding NPDSCH: RNTI: 0xffff, Mod QPSK, TBS: 440, NofSymbols: 8 * 160, NofBitsE: 8 * 320

[INFO]: Decoded Message: 

[00 42 40 3e 7f ca 69 50 f0 cc bb 81 00 5d 88 50 40 61 96 ee c0 1c 1a 00 e0 42 8d 81 f3 31 91 4b 04 37 8f 34 45 d4 00 6b 00 1c 40 86 1f c6 ac 7b fe 25 00 01 d1 30 00 ];

SIB2 received

[INFO]: 513.x: Activated SIB1 decoding in sfn=560

[INFO]: Time offset adjustment: -1 samples (-0.07), mean SFO: -2.97 Hz, -0.01487 samples/10-sf, ema=0.100000, length=10DSCH-Rate:  0.12 kbit/ss

[INFO]: 560.4: NPDSCH processing sf_idx=1/8 rep=1/4 tot=1/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 2), NPDSCH-Rate:  0.12 kbit/s

[INFO]: 562.4: NPDSCH processing sf_idx=2/8 rep=1/4 tot=2/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.12 kbit/s

[INFO]: 564.4: NPDSCH processing sf_idx=3/8 rep=1/4 tot=3/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.11 kbit/s

[INFO]: 566.4: NPDSCH processing sf_idx=4/8 rep=1/4 tot=4/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.11 kbit/s

[INFO]: 568.4: NPDSCH processing sf_idx=5/8 rep=1/4 tot=5/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.11 kbit/s

[INFO]: 570.4: NPDSCH processing sf_idx=6/8 rep=1/4 tot=6/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.11 kbit/s

[INFO]: 572.4: NPDSCH processing sf_idx=7/8 rep=1/4 tot=7/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.11 kbit/s

[INFO]: 574.4: NPDSCH processing sf_idx=8/8 rep=1/4 tot=8/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.11 kbit/s

[INFO]: 574.4: Trying to decode NPDSCH with 8 subframe(s).

[INFO]: 574.x: Decoding NPDSCH: RNTI: 0xffff, Mod QPSK, TBS: 208, NofSymbols: 8 * 160, NofBitsE: 8 * 320

[INFO]: Decoded Message: 

[40 50 80 c8 0a 62 1f 56 02 1b 11 60 00 ff 0e 05 60 55 88 4c 80 00 00 00 00 00 ];

[INFO]: 574.x: Activated SIB1 decoding in sfn=816

[INFO]: Time offset adjustment: -1 samples (-0.06), mean SFO: -2.24 Hz, -0.01118 samples/10-sf, ema=0.100000, length=10DSCH-Rate:  0.14 kbit/s

[INFO]: Time offset adjustment: -1 samples (-0.09), mean SFO: -2.76 Hz, -0.01380 samples/10-sf, ema=0.100000, length=10DSCH-Rate:  0.12 kbit/s

[INFO]: 816.4: NPDSCH processing sf_idx=1/8 rep=1/4 tot=1/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 3), NPDSCH-Rate:  0.10 kbit/s

[INFO]: 818.4: NPDSCH processing sf_idx=2/8 rep=1/4 tot=2/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: Time offset adjustment: -1 samples (-0.05), mean SFO: -2.07 Hz, -0.01035 samples/10-sf, ema=0.100000, length=10DSCH-Rate:  0.10 kbit/s

[INFO]: 820.4: NPDSCH processing sf_idx=3/8 rep=1/4 tot=3/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: 822.4: NPDSCH processing sf_idx=4/8 rep=1/4 tot=4/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: 824.4: NPDSCH processing sf_idx=5/8 rep=1/4 tot=5/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: 826.4: NPDSCH processing sf_idx=6/8 rep=1/4 tot=6/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: 828.4: NPDSCH processing sf_idx=7/8 rep=1/4 tot=7/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: 830.4: NPDSCH processing sf_idx=8/8 rep=1/4 tot=8/32 NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: 830.4: Trying to decode NPDSCH with 8 subframe(s).

[INFO]: 830.x: Decoding NPDSCH: RNTI: 0xffff, Mod QPSK, TBS: 208, NofSymbols: 8 * 160, NofBitsE: 8 * 320

[INFO]: Decoded Message: 

[40 50 80 c8 0a 62 1f 56 02 1b 11 60 00 ff 0e 05 60 55 88 4c 80 00 00 00 00 00 ];

[INFO]: 830.x: Activated SIB1 decoding in sfn=48

[INFO]: Time offset adjustment: -1 samples (-0.05), mean SFO: -1.72 Hz, -0.00861 samples/10-sf, ema=0.100000, length=10DSCH-Rate:  0.12 kbit/s

CFO:  +1.32 kHz, RSRP: -3.2 dBm SNR:  7.8 dB, RSRQ: -3.9 dB, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 4), NPDSCH-Rate:  0.10 kbit/s

[INFO]: Time offset adjustment: -1 samples (-0.10), mean SFO: -2.90 Hz, -0.01450 samples/10-sf, ema=0.100000, length=10DSCH-Rate:  0.00 kbit/s

[INFO]: 48.4: NPDSCH processing sf_idx=1/8 rep=1/4 tot=1/32, NPDCCH detected: 0, NPDSCH-BLER:  -nan% (0 of total 0), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 50.4: NPDSCH processing sf_idx=2/8 rep=1/4 tot=2/32, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 52.4: NPDSCH processing sf_idx=3/8 rep=1/4 tot=3/32, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 54.4: NPDSCH processing sf_idx=4/8 rep=1/4 tot=4/32, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 56.4: NPDSCH processing sf_idx=5/8 rep=1/4 tot=5/32, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 58.4: NPDSCH processing sf_idx=6/8 rep=1/4 tot=6/32, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 60.4: NPDSCH processing sf_idx=7/8 rep=1/4 tot=7/32, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 62.4: NPDSCH processing sf_idx=8/8 rep=1/4 tot=8/32, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.00 kbit/s

[INFO]: 62.4: Trying to decode NPDSCH with 8 subframe(s).

[INFO]: 62.x: Decoding NPDSCH: RNTI: 0xffff, Mod QPSK, TBS: 208, NofSymbols: 8 * 160, NofBitsE: 8 * 320

[INFO]: Decoded Message: 

[40 50 80 c8 0a 62 1f 56 02 1b 11 60 00 ff 0e 05 60 55 88 4c 80 00 00 00 00 00 ];

[INFO]: 62.x: Activated SIB1 decoding in sfn=304

[INFO]: Time offset adjustment: -1 samples (-0.07), mean SFO: -2.52 Hz, -0.01262 samples/10-sf, ema=0.100000, length=10DSCH-Rate:  0.22 kbit/s

SIGINT received. Exiting... dBm SNR: 10.8 dB, ^CRSRQ: -3.6 dB, NPDCCH detected: 0, NPDSCH-BLER:  0.00% (0 of total 1), NPDSCH-Rate:  0.19 kbit/s

Saving PCAP file

</pre>

}}

The resulting PCAP and associated decode are attached:

* attachment:npdsch.pcap

* attachment:npdsch_decode.txt

In the decoding, you can see for instance that the PLMN is 901/98 which is indeed assigned to Skylo Technologies.