Drone Busters
Test Results
Accurate RF Signal Detection
The HackRF One was loaded with software to detect the emission of radio frequencies from local radio stations. A frequency slider was utilized to tune through various stations. The detected radio stations were played through computer speakers. The detected frequencies matched the radio stations that were broadcasting in Santa Rosa, proving the SDR is accurately detecting RF signals.
Characterize Drone Communication
Characterizing the drone signal is an important step to ensure detection. Using an Agilent Technologies L4600A Radio Test Set in an environment isolated from other 2.4 GHz interference, the drone transmission signal was captured. The drone communicates via FSK over four 20 MHz bandwidth channels centered at 2.413 GHz, 2.433 GHz, 2.451 GHz and 2.472 GHz.
Detection of Drone Signal with Device
The Raspberry Pi 3 is a 1.2GHz embedded board that will run the HackRF One SDR hardware using GNURadio software. The image to the left is the output of the Pi while running the HackRF One SDR. The graphs are of radio signals within the 2.4GHz range. The left green line on the top waterfall plot is the center frequency of our device, 2.43GHz. The small signal to the right of it is the signal transmitted from the remote to the drone while they are paired. This is occurring at 2.433GHz. This entire test was conducted while the SDR and SBC were battery powered, proving that our device can be portable and still function correctly.
Yagi Antenna Test Results
We tested the beam width of the Yagi antenna and the results from the data can be seen in the figure. We conducted the test in two degree steps which allows for a relatively accurate test. From the test we have a 30 degree beam-width and although the test theorized approximately 26 dBi, through more testing we saw 0dBi. The antenna was cheap and came with no spec-sheet.
SNR of Receiver
Our receiving radio must be programmed to the optimal SNR for detection of the drone signal. Four factors will influence our SNR in the HackRF One. The first is the bandwidth at which we observe the spectrum with and three gain amplifiers. The amplifiers offer their own unique contribution to the SNR. The RF gain amplifier is located in the front end of the receiver, after the antenna before the mixer. This amplification offers the best signal gain to noise floor increase. The IF gain amp, occurring after the mixer, offers the second best SNR benefit. Lastly, the Base Band gain amp occurs directly before the ADC. While offering a large signal increase, this amp also greatly increases our noise floor.
Drone Signal Characterization Part II
At this point we already saw the FSK communication protocol which the drone communicates with using the Agilent L4600A Radio Test Set analyzer. To further understand the timing and power distribution of the signal, we conducted two more tests. The first test utilized the Keysight N9030A PXA signal analyzer to observe power levels of the four channels in real-time. We can see that each channel has around 20 MHz bandwidth and the majority of the signal is occurring in the center 3 MHz of the channel. The second test utilized a Keysight MSOS804A oscilloscope to trigger our signal and capture the rate of transmission. From the results we see the signal transmits in a single channel every 1ms, sends its entire transmission in 4ms and repeats the signal every 8 ms. This knowledge will help us capture the signal through sample timing and averaging correctly.
First Field Test
After optimizing our receiver settings, the first field test was conducted. The test took place in an isolated location with little to no 2.4GHz frequency interference. Our device was capable of sensing the drone pilot up to 100 feet away. The picture on the left is a clickable link to a video of the device detecting the drone pilot 50 feet away.
Computational Limits
A huge tradeoff of our system is the computational resolution vs. the time of computation. The majority of the computation power is consumed by the Fast Fourier Transform performed on the incoming time domain data at the SDR. With a higher point FFT we are able to lower our noise floor, by limiting the bandwidth of each point, and better detect our drone at farther distances. However, there came a point where the better SNR was not worth the time it took to compute it. Notifying the user of the correct direction too late rendered the device useless. Therefore, a test was conducted using the datetime python function to time the speed of the program over one iteration with various FFT sizes. The most beneficial size for our device was a FFT of 512 points. To assure the user is notified in real time within 5 seconds, a known signal was fed into the SDR. The signal was turned off and on and the rise and fall of the user notifying LED arrays were timed. We have two LED arrays, one in real time and the other with high persistence. The fall time of the high persistence array is the slowest reaction time of our system. The average time it took to react was 2.74 seconds, almost half the time our requirements set.
Detecting Drone With WiFi Interference
Our drone operates in the unlicensed 2.4GHz ISM band along with many other devices such as Bluetooth and WiFi. While not a requirement for our customer, we looked into the ability to detect the drone while WiFi was present. The 802 standard set by Institute of Electrical and Electronics Engineers' LAN committee (IEEE 802) governs all WLAN communication in the 2.4GHz range. This standard reserves 11 channels ranging from 2.412GHz - 2.472GHz that can be chosen for WLAN communication. WiFi will occupy one of these channels for its communication with a maximum of a 22MHz bandwidth. By viewing WiFi network signals with a signal analyzer, it became apparent that the WiFi channel is random and independent of each router. This means that in order to overcome WiFi interference our SDR must know which channel the WLAN is centered on and test a drone channel outside of that range. Since the WiFi channels are limited to 22MHz, another approach would involve checking all 4 drone FSK channels for a matching SNR. If 3 of the channels are matching and the fourth has a higher SNR, we can conclude the fourth channel has WiFi present and that the drone is present. The allotted time for this project limited our focus on this dilemma. However, eliminating WiFi interference is a future improvement we have planned for this device.
Bandwidth of Radio Receiver
The Propel Mini Drone communicates using frequency shift keying over 4 channels centered at 2.412GHz, 2.433GHz, 2.451GHz and 2.472GHz. In this test we measured the bandwidth these individual channels operate in. We can see that one channel is about 18.87MHz wide. Looking at the RF spectrum using a bandwidth window of 20MHz will ensure we capture all the communication occurring within a channel. The second image is the 20 MHz bandwidth window seen by our device. Using this 20MHz window we can determine the peak of the signal as well as the noise floor.
Field Test #2
On April 20, 2018 we took our device out for a second successful field test at Galvin Park in Santa Rosa. Armed with a new directional Yagi antenna and optimized software, our device was more than capable of satisfying the engineering requirement of 3 dB SNR at 75 feet away. In fact our 3 dB requirement was achieved at a distance of 105 feet. We saw an SNR increase of 6 dB at the previous 75 foot limit of our device. The directionality of the antenna led us to the pilot well within the 10 foot requirement. You can view a video of our test through the clickable image to the left.
