SDR FM demodulation

SDR FM demodulation

[Antti Palosaari]

I have taken radio sniffs from FM capable Realtek DVB-T device. Looks 
like demodulator ADC samples IF frequency and pass all the sampled data 
to the application. Application is then responsible for decoding that. 
Device supports DVB-T, FM and DAB. I can guess  both FM and DAB are 
demodulated by software.

Here is 17 second, 83 MB, FM radio sniff:
http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
Decode it and listen some Finnish speak ;)

Could someone help to decode it? I tried GNU Radio, but I failed likely 
because I didn't have enough knowledge... GNU Radio and Octave or Matlab 
are way to go.

I smell very cheap poor man's software radio here :)

regards
Antti
-- 
http://palosaari.fi/

Re: SDR FM demodulation

[Patrick Boettcher]

On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
> I have taken radio sniffs from FM capable Realtek DVB-T device. Looks
> like demodulator ADC samples IF frequency and pass all the sampled
> data to the application. Application is then responsible for
> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
> FM and DAB are demodulated by software.
> 
> Here is 17 second, 83 MB, FM radio sniff:
> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
> Decode it and listen some Finnish speak ;)
> 
> Could someone help to decode it? I tried GNU Radio, but I failed
> likely because I didn't have enough knowledge... GNU Radio and
> Octave or Matlab are way to go.

For someone to decode it, you would need to give more information about 
the format of the stream. Like the sampling frequency, the sample-format 
and then the IF-frequency.

I never did something like myself, but from what I saw in gnuradio there 
should be everything to make a FM-demod based on the data.

regards,
--
Patrick Boettcher

Kernel Labs Inc.
http://www.kernellabs.com/

Re: SDR FM demodulation

[Antti Palosaari]

On 09.02.2012 17:11, Patrick Boettcher wrote:
> On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
>> I have taken radio sniffs from FM capable Realtek DVB-T device. Looks
>> like demodulator ADC samples IF frequency and pass all the sampled
>> data to the application. Application is then responsible for
>> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
>> FM and DAB are demodulated by software.
>>
>> Here is 17 second, 83 MB, FM radio sniff:
>> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
>> Decode it and listen some Finnish speak ;)
>>
>> Could someone help to decode it? I tried GNU Radio, but I failed
>> likely because I didn't have enough knowledge... GNU Radio and
>> Octave or Matlab are way to go.
>
> For someone to decode it, you would need to give more information about
> the format of the stream. Like the sampling frequency, the sample-format
> and then the IF-frequency.

You can see sampling format easily looking hexdump or open file in 
Audacity. It is 8bit unsigned samples, 2 channels (I & Q).

No knowledge about IF... For good guess is to try some general used IFs.

Sampling freq can be calculated using sample info and the fact it is 
about 17 sec. sample size = 86919168 Bytes, time 17 sec. 2 channels, 1 
byte sample => 2556446,11765 sample/sec (~2.5 MHz!)

> I never did something like myself, but from what I saw in gnuradio there
> should be everything to make a FM-demod based on the data.

Yes there was a lot of block and those were rather easy to connect using 
graphical interface (gnuradio-companion). But I don't know exactly what 
block are needed and what are parameters. I used file-sink => 
fm-modulator => audio-sink. Likely not enough :i

Without any earlier experience it is rather challenging. But if there is 
someone who have done that earlier using USRP SDR he could likely do it 
easier :)

regards
Antti
-- 
http://palosaari.fi/

Re: SDR FM demodulation

[Andy Walls]

Antti Palosaari <crope@iki.fi> wrote:

>On 09.02.2012 17:11, Patrick Boettcher wrote:
>> On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
>>> I have taken radio sniffs from FM capable Realtek DVB-T device.
>Looks
>>> like demodulator ADC samples IF frequency and pass all the sampled
>>> data to the application. Application is then responsible for
>>> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
>>> FM and DAB are demodulated by software.
>>>
>>> Here is 17 second, 83 MB, FM radio sniff:
>>> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
>>> Decode it and listen some Finnish speak ;)
>>>
>>> Could someone help to decode it? I tried GNU Radio, but I failed
>>> likely because I didn't have enough knowledge... GNU Radio and
>>> Octave or Matlab are way to go.
>>
>> For someone to decode it, you would need to give more information
>about
>> the format of the stream. Like the sampling frequency, the
>sample-format
>> and then the IF-frequency.
>
>You can see sampling format easily looking hexdump or open file in 
>Audacity. It is 8bit unsigned samples, 2 channels (I & Q).
>
>No knowledge about IF... For good guess is to try some general used
>IFs.
>
>Sampling freq can be calculated using sample info and the fact it is 
>about 17 sec. sample size = 86919168 Bytes, time 17 sec. 2 channels, 1 
>byte sample => 2556446,11765 sample/sec (~2.5 MHz!)
>
>> I never did something like myself, but from what I saw in gnuradio
>there
>> should be everything to make a FM-demod based on the data.
>
>Yes there was a lot of block and those were rather easy to connect
>using 
>graphical interface (gnuradio-companion). But I don't know exactly what
>
>block are needed and what are parameters. I used file-sink => 
>fm-modulator => audio-sink. Likely not enough :i
>
>Without any earlier experience it is rather challenging. But if there
>is 
>someone who have done that earlier using USRP SDR he could likely do it
>
>easier :)
>
>regards
>Antti
>-- 
>http://palosaari.fi/
>--
>To unsubscribe from this list: send the line "unsubscribe linux-media"
>in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html


Implement a phased locked loop (phase comparator, low pass filter, and VCO) that is centered reasonably close to the IF.  The output of the LPF of the PLL should be the demodulated signal, IIRC.

Maybe this matlab (octave) file will help you:
http://www.mathworks.com/matlabcentral/fileexchange/24167-simple-pll-demostration

Regards,
Andy

Re: SDR FM demodulation

[Andy Walls]

On Thu, 2012-02-09 at 17:21 +0200, Antti Palosaari wrote:
> On 09.02.2012 17:11, Patrick Boettcher wrote:
> > On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
> >> I have taken radio sniffs from FM capable Realtek DVB-T device. Looks
> >> like demodulator ADC samples IF frequency and pass all the sampled
> >> data to the application. Application is then responsible for
> >> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
> >> FM and DAB are demodulated by software.
> >>
> >> Here is 17 second, 83 MB, FM radio sniff:
> >> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
> >> Decode it and listen some Finnish speak ;)
> >>
> >> Could someone help to decode it? I tried GNU Radio, but I failed
> >> likely because I didn't have enough knowledge... GNU Radio and
> >> Octave or Matlab are way to go.
> >
> > For someone to decode it, you would need to give more information about
> > the format of the stream. Like the sampling frequency, the sample-format
> > and then the IF-frequency.
> 
> You can see sampling format easily looking hexdump or open file in 
> Audacity. It is 8bit unsigned samples, 2 channels (I & Q).
> 
> No knowledge about IF... For good guess is to try some general used IFs.
> 
> Sampling freq can be calculated using sample info and the fact it is 
> about 17 sec. sample size = 86919168 Bytes, time 17 sec. 2 channels, 1 
> byte sample => 2556446,11765 sample/sec (~2.5 MHz!)

Randomly checking some of the data with GNUplot, if 2.5 Msps is the
sampling rate, then the fastest freq I saw was about 50 kHz.

Maybe you have an FM compsite baseband signal:
http://en.wikipedia.org/wiki/FM_broadcast#Other_subcarrier_services

If you low pass filter with digital filter with (an equivalent to) a 17
kHz cutoff, you may just be left with the mono L+R channel.

I am assuming the I&Q channels in the data are 8 bit LPCM so

	x = (c-128)/128.0 

normalizes an usigned byte sample value c in 0 to 255 to a float value x
in -1.0 to 1.0.

Regards,
Andy

> > I never did something like myself, but from what I saw in gnuradio there
> > should be everything to make a FM-demod based on the data.
> 
> Yes there was a lot of block and those were rather easy to connect using 
> graphical interface (gnuradio-companion). But I don't know exactly what 
> block are needed and what are parameters. I used file-sink => 
> fm-modulator => audio-sink. Likely not enough :i
> 
> Without any earlier experience it is rather challenging. But if there is 
> someone who have done that earlier using USRP SDR he could likely do it 
> easier :)
> 
> regards
> Antti

Re: SDR FM demodulation

[David Hagood]

On Fri, 2012-02-10 at 21:08 -0500, Andy Walls wrote:
> 
> Randomly checking some of the data with GNUplot, if 2.5 Msps is the
> sampling rate, then the fastest freq I saw was about 50 kHz.
How'd you analyze the data - assume it was baseband I/Q and do an FFT?
If so, and if this was digitized baseband, you should have seen the FM
stereo pilot tone at 19kHz.

If it's digitized IF, you should be able to run it through a rectangular
to polar conversion (compute mag = I^2+Q^2 and phase = arctan(I/Q) (use
a proper 4 quadrant arctan), then compute frequency by the delta between
the phase samples. Mag should be constant, frequency would then be your
audio.

Re: SDR FM demodulation

[Andy Walls]

On Fri, 2012-02-10 at 20:29 -0600, David Hagood wrote:
> On Fri, 2012-02-10 at 21:08 -0500, Andy Walls wrote:
> > 
> > Randomly checking some of the data with GNUplot, if 2.5 Msps is the
> > sampling rate, then the fastest freq I saw was about 50 kHz.
> How'd you analyze the data - assume it was baseband I/Q and do an FFT?
> If so, and if this was digitized baseband, you should have seen the FM
> stereo pilot tone at 19kHz.

Well,  I was examining the data in the time-domain using 'od' to decode
the bytes to text and using gnuplot to visualize.  I looked for "high"
frequency contant envelope cycles.  Pretty lame, I know.

I did this in octave this morning and noted a carrier/pilot of some
sort:

fid = fopen('rtl2832u_fm_sample_FIXED.bin');
N=2^20;
fseek(fid, N*10, SEEK_SET);
[v, count] = fread(fid,[2,N],'unsigned char');
v = (v-128)/128;
w = v(1,:) + j*v(2,:);
f = fft(v(1,:),N);
fw = fft(v(1,:),N);
Fs = 2.5e6;

freqs = [1:(N/24)-1]*Fs/N;
bins = [2:N/24];
plot(freqs, abs(f(bins))/N, '.');
plot(freqs, abs(fw(bins))/N, '.');

[m,mi] = max(abs(fw)/N);
freqs(mi)
   ans =  9534.4
[m,mi] = max(abs(f)/N);
freqs(mi)
   ans =  9534.4
ans*2/1000
   ans =  19.069

I must have Fs wrong.

Anyway not much happens in the data above 100 kHz, but to see the whol
spectrum: 
bins = [2:N/2];
freqs = [1:(N/2)-1]*Fs/N;
semilogy(freqs, abs(f(bins))/N, '.');
semilogy(freqs, abs(fw(bins))/N, '.');


But it appears someone has now already solved the decoding problem.

Regards,
Andy


> 
> If it's digitized IF, you should be able to run it through a rectangular
> to polar conversion (compute mag = I^2+Q^2 and phase = arctan(I/Q) (use
> a proper 4 quadrant arctan), then compute frequency by the delta between
> the phase samples. Mag should be constant, frequency would then be your
> audio.
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: SDR FM demodulation

[Alistair Buxton]

On 9 February 2012 15:01, Antti Palosaari <crope@iki.fi> wrote:

> Decode it and listen some Finnish speak ;)

Done. grc and output.wav here: http://al.robotfuzz.com/~al/rtl2832/

The trick was realising that the UChar to Float converter does not
adjust it's output to the range -1.0,1.0 that the wideband FM
demodulator block expects as input. Once I figured that out the rest
was easy. Just set the quadrature rate to the samples per second in
the source file, and the decimation to quadrature rate/output sink
rate. The source file appears to be about 2 to 2.2 million samples per
second. Any higher than that and the person speaking sounds like a
chipmunk. Maybe 22050 * 1000 or 1024? Does any Finnish station
broadcast "pips" like the BBC does? That could be used to determine
the actual rate.

-- 
Alistair Buxton
a.j.buxton@gmail.com

Re: SDR FM demodulation

[Daniel Glöckner]

On Sat, Feb 11, 2012 at 07:00:16AM +0000, Alistair Buxton wrote:
> The source file appears to be about 2 to 2.2 million samples per
> second. Any higher than that and the person speaking sounds like a
> chipmunk. Maybe 22050 * 1000 or 1024? Does any Finnish station
> broadcast "pips" like the BBC does? That could be used to determine
> the actual rate.

The stereo carrier is at 19kHz and RDS is centered around 57kHz.
I'd say this is 2048kHz sampling rate.

  Daniel

Re: SDR FM demodulation

[Antti Palosaari]

On 11.02.2012 09:00, Alistair Buxton wrote:
> On 9 February 2012 15:01, Antti Palosaari<crope@iki.fi>  wrote:
>
>> Decode it and listen some Finnish speak ;)
>
> Done. grc and output.wav here: http://al.robotfuzz.com/~al/rtl2832/
>
> The trick was realising that the UChar to Float converter does not
> adjust it's output to the range -1.0,1.0 that the wideband FM
> demodulator block expects as input. Once I figured that out the rest
> was easy. Just set the quadrature rate to the samples per second in
> the source file, and the decimation to quadrature rate/output sink
> rate. The source file appears to be about 2 to 2.2 million samples per
> second. Any higher than that and the person speaking sounds like a
> chipmunk. Maybe 22050 * 1000 or 1024? Does any Finnish station
> broadcast "pips" like the BBC does? That could be used to determine
> the actual rate.

Cool!
I did that whole last night up to 6 am. I also ended up very similar 
blocks, but failed to convert bytes as UChar. I tried to add constant 
between Deinterleave and UChar To Float but it wasn't possible. So my 
first idea was to make Python script to make for the sample when I 
wake-up. But no need anymore :)

It was very good learning session and I am very impressed about GNU 
Radio capability. Idea tool for learning signal handling in practise. I 
see that device has big potential for students as it is very cheap SDR, 
everyone can get own!

Now someone should make Linux driver that can tune that device to 
different frequencies and look what it really can do.

What kind of driver architecture should be used? Use device 100% 
userspace or make it working as Kernel driver? I suspect making it as 
Kernel driver could be too limited since V4L/DVB API restrictions?

regards
Antti
-- 
http://palosaari.fi/

Re: SDR FM demodulation

[Daniel Glöckner]

On Sat, Feb 11, 2012 at 02:46:34PM +0200, Antti Palosaari wrote:
> I did that whole last night up to 6 am. I also ended up very similar
> blocks, but failed to convert bytes as UChar. I tried to add
> constant between Deinterleave and UChar To Float but it wasn't
> possible. So my first idea was to make Python script to make for the
> sample when I wake-up. But no need anymore :)

I ended up writing a FM demodulator in C before I found Alistair's
mail in my inbox. Using a 65536 element table for arc tangent and
integer arithmetics, it is pretty fast.

> Now someone should make Linux driver that can tune that device to
> different frequencies and look what it really can do.
> 
> What kind of driver architecture should be used? Use device 100%
> userspace or make it working as Kernel driver? I suspect making it
> as Kernel driver could be too limited since V4L/DVB API
> restrictions?

There is also the CX23880/1/2/3 series with two 10 bit ADCs (usually)
sampling at 28.7MHz. The video part can be switched to raw mode, where
it provides 8 bit samples at full or 16 bit samples at half the sampling
rate from the luma ADC.

In non-Y/C mode the chroma ADC is used by the audio part, where the data
can be fed through a configurable chain of filters, demodulatos, and sample
rate converters. Just grep 0x320 cx88-reg.h to get a glimpse of its
capabilities. There is absolutely no documentation to be found about most
of these registers.

A reconfigurable silicon tuner like the XC3028 again increases the number
of possibilities by a large factor.

BT87x aka CX2587x is used for SDR as well, but its video raw mode is
good just for analog tv signals, as it expects vsyncs and the audio ADC
usually just samples the tuner's baseband sound output at 448kHz.
Some variants claim to support FM stereo and BTSC decoding capabilities,
but AFAIR there is no support in the Linux driver and the public data
sheet just tells us there is a "DAP" between the decimation filter and
the DMA FIFO.

If only there was completely open documentation...

All in all, I don't think there can be one API that fits all devices
without limiting their functionality. Maybe a UVC or LabVIEW like interface
with blocks for tuners, ADCs, decimators, DMA sinks, etc. is suitable,
but then applications will end up being tailored to a small number
of topologies or require manual configuration. For most people the
only use would probably be to listen to FM radio.

  Daniel

Re: SDR FM demodulation

[Antti Palosaari]

On 11.02.2012 17:15, Daniel Glöckner wrote:
> All in all, I don't think there can be one API that fits all devices
> without limiting their functionality. Maybe a UVC or LabVIEW like interface
> with blocks for tuners, ADCs, decimators, DMA sinks, etc. is suitable,
> but then applications will end up being tailored to a small number
> of topologies or require manual configuration. For most people the
> only use would probably be to listen to FM radio.

For me I would like to see that more interesting SDR than FM radio :)
I should look how famous USRP/USRP2 are connected to the GNU Radio and 
maybe try similar approach. I think it is userspace interface but it 
fits fine. It is always possible load device us normal Kernel driven 
DVB-T and if user like to use it as SDR then user should blacklist just 
kernel driver.

I opened my device and there is Elonics E4000 [1] silicon tuner. That 
tuner seems to be a little crazy beast! Supports frequencies from 64 to 
1678 MHz and very many modulations. So for my eyes it is almost idea 
cheap SDR. No idea what is supported max bw ADC can sample...

DVB-T (174-240MHz, 470-854MHz)
ISDB-T (470-862MHz)
DVB-H (470-854MHz, 1672-1678MHz)
CMMB (470-862MHz)
D-TMB (470-862MHz)
T-DMB (174-240MHz, 1452-1492MHz)
DAB (174-240MHz, 1452-1492MHz)
MediaFLO (470-862, 1452-1492MHz)
GPS L1 band (1575MHz)
FM radio (64-108MHz)


[1] http://www.elonics.com/product.do?id=1


regards
Antti
-- 
http://palosaari.fi/

Re: SDR FM demodulation

[Daniel Glöckner]

On Sat, Feb 11, 2012 at 05:33:05PM +0200, Antti Palosaari wrote:
> I opened my device and there is Elonics E4000 [1] silicon tuner.
> That tuner seems to be a little crazy beast! Supports frequencies
> from 64 to 1678 MHz and very many modulations. So for my eyes it is
> almost idea cheap SDR. No idea what is supported max bw ADC can
> sample...

I just tried to find the XC3028 product brief.
It seems XCeive has recently been bought by a company called CrestaTech
that have a USB/PCIe chipset for a small universal receiver and a PC
based SDR suite for TV/radio/GPS decoding.

  Daniel

Re: SDR FM demodulation

[Steve Markgraf]

Hi,

On 11.02.2012 13:46, Antti Palosaari wrote:
> Now someone should make Linux driver that can tune that device to
> different frequencies and look what it really can do.

I sniffed the Windows driver and wrote a small libusb-based program
[1], which can tune to a given frequency and record the I/Q-samples to
a file.

So far FM radio reception with GNU Radio, as well as GMR-1 satellite
(Thuraya) reception [2] at 1,525GHz with 1,8MHz bandwidth have been
tested. Despite the 8 bit ADC, the stick seems to perform quite well.

The program so far supports the "ezcap USB 2.0 DVB-T/DAB/FM stick" with
the Elonics E4000 tuner, and the "Terratec NOXON DAB/DAB+ USB-Stick"
with the Fitipower FC0013 tuner.

The code is still somewhat hackish and experimental, since not all of
the demodulator registers are known, and especially the tuner setup has
room for improvement.

Regards,
Steve

[1] http://cgit.osmocom.org/cgit/rtl-sdr/
[2] http://gmr.osmocom.org/