Sunday, August 29, 2021

Going after radiosondes with a Portapack H2 / HackRF

For those who know me, it is nothing new that among other things I am somewhat of a radio technologies enthusiast as well.

In the current state of affairs, it is an even more interesting field, considering how much it can be done without a significant financial investment. Radio technologies have evolved tremendously in a short time span. Some of that evolution can be directly attributed to the large demand caused by the mobile communications industry, but also by the computer and digital broadcast industry. All of these called for the development of highly integrated semiconductors capable of many functions, from the analog frontend and digital processing, to applications.

With an increased supply of generic digital radio components, it became possible for RF enthusiasts to think of designing low cost Software Defined Radios (SDR), and repurposing certain radio devices by taking advantage of the underlying SDR architecture. 

But until a certain time, SDRs were a niche product, and among the first devices made available to the public at large, was the USRP (Universal Software Radio Peripheral). This was in fact a family of devices created by Ettus Research (a subsidiary of National Instruments), and these had (and still have) a modular design, where the user can select which TX and RX frontends are best suited for his application. These devices have very impressive specs, but its price range makes these somewhat inaccessible for some of the hobbyist community.

Soon after, digital video broadcast became a ubiquitous reality, leading to the appearance of cheap hardware designed for receiving and decoding such transmissions. The DVB-T USB dongles were among these devices. Serving primarily for capturing the DVB-T broadcasts in the personal computer, these became a precursor platform for much of the RF hacking and development activities that are present today:

Soon the RF hobbyist/hacking community realized how versatile these devices were, because of the broad spectral range (it can span from 15 MHz to 1766 MHz - not bad for a device which costs around 10 or 20 Euros).

By using a modified device driver, it became possible for applications to have full control of the tuner and ADC chip parameters. While the DSP heavy lifting has to be done on the host computer, these dongles provide the RF frontend and digital conversion required for the rest of the radio implementation to be fully done on the software side.

Some HAM oriented versions of these dongles have since popped up in the market. These share the same core hardware components, such as the popular Realtek RTL2832U chip and the R820T2 tuner, but add better frequency stability and some features such as a built-in bias tee (a circuit that enables power to be provided to external devices connected to the RF path, i.e. between the antenna and the RTL-SDR), and a switch allowing the tuner to be bypassed, and signals between DC and 30 MHz to be directly fed to the RTL-SDR chip. This in practice extends the band coverage to HF, albeit without any preselection and limited sensitivity.

This is however just an example, and today there are multiple projects and products providing equivalent or better SDR functions.

One example is the HacRF One. This is a device that gained some traction and popularity, and was developed as a fully open source project:

One of its main characteristics is the fact that it is also capable of transmission, albeit at relatively low TX levels (it can reach at most about 30 mW in some bands). Even though TX power varies greatly depending on the band, it can transmit in virtually all of the covered frequency bands (which spans from about 10 MHz to 6000 MHz - a reasonably impressive range).

It does have its shortcomings as well. The unimpressive TX output limits its use without additional hardware. Also (and more importantly) given its poor dynamic range (partly attributed to its 8-bit DAC/ADC chip) and filtering, it produces harmonics which become particularly relevant when an amplifier is used in front of the device. For RX, image rejection is also a thing, and sensitivity can be relatively poor - not because of insufficient RF amplification, but because of the lack of preselection which will easily saturate the amplifier stages with signals outside of the tuned frequency.

Nevertheless it is still a very practical device, given its feature set, and the fact that it is currently not very expensive. Depending on the site, it can be purchased for under 100 Euros.

Alternatively it can also be found as part of another product - the portapack:

In the form of a daughterboard, this device allows the HackRF to be used independently of a host computer. Taking advantage of the HackRF relatively powerful NXP LPC4320 MCU chip (which has some DSP features), many SDR functions can be implemented without requiring additional hardware. This board adds an LCD screen, an audio codec chip and buttons, allowing independent operation of the SDR:

Portapack started as a opensource hardware design, but some chinese companies took the original design and built several variations of this board, so today the market is swamped with slightly different versions that have "stolen" some of the original design and added new features without contributing with the schematics, CAD files, Gerber files or any other asset.

Unlike what would be expected at first, after deriving work from another opensource project, in this case the improvements were not contributed back to the community.

Also, because some of the hardware differences require changes to the portapack software, these chinese companies were shameless to the point of making drivers to the new audio chip they have selected, link with the rest of the portapack software, and share just the binaries. This is a complete cocktail of opensource malpractice.

Because of the abundance of rogue boards with the new audio chip (WM8731 instead of the AK4951), the portapack project ended up "bending over" to these circumstances and support the chip and these alternate boards, without any support or documentation provided by the chinese manufacturers.

I ended up buying one of these alternate bundles, known as Portapack H2. Besides the different audio chip, the board features a battery charger circuit, a 3 Watt amplifier for a speaker, and the bundle includes a 2500 mAh 3.7 Volt LiPo battery.

All of this is packed in a very robust aluminium enclosure, with a structure for holding the boards, and an outer casing, all kept together by screws.

Because the set didn't include a speaker, it was relatively easy to source a 3 watt speaker from scrap parts and attach it to the casing. It had to be a slim enough speaker due to the limited space available between the pcb and the aluminium case:

Being portable, this device allowed me to enter a new hobby - going after weather ballons, also known as radiosondes.

Normally at least once a day (in many countries twice a day), weather institutes launch a radiosonde. In spite of the effectiveness of satellites and its role in observing weather patterns from a vantage point above the upper atmosphere, the weather balloon is still the only instrument for directly measuring important weather parameters such as the wind speed and direction at several altitudes, along with temperature, humidity and air pressure. Each weather balloon flight is important as it provides information that will update a computer model, and allow for more accurate predictions. While weather prediction may be a convenience for most civilians, it is of crucial value for other activities such as the aviation, sea navigation, civil protection, military, to name a few.

Launching one or two disposable radiosondes every day is not a cheap task: while the electronics device (the radiosonde) that is carried in these flights is relatively inexpensive (probably between 10 and 20 euros each unit bought in bulk), what curiously comprises most of the cost is the latex balloon and the gas required to fill it  - either helium or hydrogen. The latter is often a cheaper option - one third the price, but is more dangerous to handle due to its flammability. Normally these radiosondes require a 200 or 350 gram latex balloon filled with close to 1 cubic meter of gas (depending on the desired flight profile). If helium gas is selected, the price of the balloon and gas can be in the ballpark of 60 Euros or more. So even though weather institutes buy the balloons, parachutes, radiosondes and lift gas in bulk, likely the total price per launch is in the ballpark of 100 Euros, considering the average cost of these items based on some sources found online.

Assuming that we don't add too much in carbon emissions by going after used radiosondes (i.e. by not having to cover large distances to find these), it is in general beneficial to collect these from the natural environment where these end up falling. Although the batteries are said to be less impacting to the environment, because Lithium primary cells are used:

Still there are heavy metals along with the plastic materials from other parts of the balloon which are not really beneficial for the ecosystem.

So, it sounded like a good idea to attempt to find these, and do a tiny contribution to keep the ecosystem clean. And so I went. 

One of the great things about this hobby is what the community have been able to build and provide in order to facilitate the chase. There are a few sites where users are able to setup their receiving gear as base stations (eventually using SDR's), and share the messages sent by the radiosondes with the site, as these are received and decoded. The following sites are very useful resources in this respect:

Besides showing the data sent by the sonde (which includes the path and current GPS position), these also have the capability of showing the predicted landing site, which is particularly useful to better plan the chase and take the correct routes to the destination.

There is also a site which provides the full predicted path ahead of the flight taking place. It is adequate not just for radiosondes but for obtaining an estimated path for every type of balloon:

While these sites are useful, there is the caveat that as the balloon falls below 200 or 300 meters of altitude, it is difficult for the signal to be able to reach the base stations due to the ground obstacles. But at such altitude the balloon may still cover a substantial horizontal range (potentially in the scale of hundreds of meters), which makes the search virtually impossible if we consider only the last received coordinate available on the site.

As such it is in most cases essential to carry a receiving device while searching for the radiosonde. The chances of being able to listen to the signal are high if we get close to the point where the last position data was received from the base stations (and published to sondehub). Even at a 500 meter distance there is a good chance of successfully receiving the radiosonde frames from a portable receiver.

That is where the portapack comes into play. Given that it has a built in app capable of receiving and decoding the radiosonde messages, this makes it quite powerful as a tool for receiving the last position of the radiosonde:

As I had the chance to experiment and use the Portapack for achieving a successful find, I immediately thought of improving it, and as such contributed to the project with the addition of the beep function (it beeps every time a frame is received from the radiosonde, and the tone varies according to the RSSI). This function makes the direction finding a bit easier, because it limits the need to look at the display during the "fox hunt".

This app is implemented as part of the Mayhem firmware:

Another challenge is that even after having the current GPS position of the radiosonde, it is not always obvious where it actually is. In some situations the dense vegetation may make it difficult to visually locate the radiosonde or any of its parts. Or sometimes it might just be hanging in a tree. 

As such instead of relying on the omnidirectional antenna, I have decided to build a relatively compact directional antenna that is suitable for the UHF signals such as these from the radiosonde. Given the narrow radiation pattern of the directional antenna, the idea is that is should be easier to determine the direction of the signal this way, where during the hunt the user sweeps multiple directions and follows the direction where the intensity of the signal is greater. Because a regular Yagi antenna would still require at least 3 elements (one reflector, the radiator element, and a director), I decided to experiment with an alternative design, namely the HB9CV antenna:

It was not too difficult to assemble, it has a decent front to back ratio, which is ideal for this activity. And to make it a little more compact, I used telescopic elements instead.

In order to calculate the exact dimensions for the desired frequency, a calculator such as this one was used:

The antenna should be fed in series with an air capacitor. I used a 0-10 pF air capacitor suited for RF applications. Then with the help of a nanoVNA, I tuned it so that the performance (impedance and return loss) is optimized for the radiosonde frequency (405 MHz).

In a later post I will explain more about the radiosonde itself and some of the finding around its analysis.

No comments: