Introducing gr-satellites

This post is to present my gr-satellites project. The goal of this project is to make a collection of GNUradio decoders for the telemetry of different satellites. The decoders support submitting telemetry in real time to the PE0SAT telemetry server. Another goal is that the decoders are as easy to use as possible, to try to make more people interested in receiving digital telemetry from satellites and collaborating in online telemetry submission.

The decoders can be used with the Gqrx SDR software, using its UDP audio streaming capabilities. This is the easiest way to use the decoders. It is also possible to use the GNUradio frontends in the companion project gr-frontends. These support several different SDR hardware, WAV and IQ recordings, and conventional receivers connected through a soundcard. They are design to be flexible and to allow its use in headless and automated receiving configurations.

The long-term goal of this project is to provide an alternative software chain to the UZ7HO soundmodem, AGW packet engine and DK3WN telemetry forwarder. The use of GNUradio makes these decoders more configurable and flexible and eases programming decoders for non-AX.25 satellites, which usually employ strong forward error correction.

Currently, the satellites supported by gr-satellites are 3CAT-2, AAUSAT-4 and GOMX-3. I plan to continue adding support for more satellites in the future.

Telemetry format of 3CAT-2

The team from the NanoSat Lab in Universidad Politècnica de Catalunya have published a telemetry analyser for 3CAT-2. This analyser is designed to connect to a TCP server and get the AX.25 frames in KISS format.

The telemetry format is rather simple, as one can see by looking at the PrintBeacon() function in 3cat2_telemetry.c. As I imagined, the contents of each beacon are just the numerical values of several telemetry channels written in ASCII. For example:

3 7781 0245 07 06	1 0 3.5e-01 2.5e-01 1.6e-01 6.8e-09 1.2e-09 1.8e-08

All the fields are separated by a space, except the 5th and 6th fields, which are separated by a tab. The content of the first 7 fields is as follows:

  1. Mode. Possible values: 1 survival mode, 2 sun-safe mode, 3 nominal mode, 4 TX communication incoming (data downlink), 5 RX communications (command uplink), 6 and 7 payload mode.
  2. Battery voltage in mV. In the example 7.781V.
  3. Current consumption in mA. In the example 245mA.
  4. EPS temperature (probably in ºC). In the example 7ºC.
  5. Antenna temperature (probably in ºC). In the example 6ºC.
  6. Status of the ADCS system. 0 means detumbling enabled. 1 means SS-nominal.
  7. Control flag of the ADCS routine. Possible values: 0 automatic, 1 manual

The next 3 fields are floating point numbers. If detumbling is enabled, they correspond to magnetomer values in nT for the axes X, Y and Z respectively. If detumbling is not enabled, they correspond to the sun vector, axes X, Y and Z.

The last 3 fields correspond to the control voltages for axes X, Y and Z, regardless of whether detumbling is enabled or not.

Of course, the telemetry format is so easy that it can even be parsed with a "one-line" awk script:

 strings sats/3cat2-20160824-pe0sat.kiss | awk '{if ($1==1) printf "Survival"; if ($1==2) printf "Sun-safe"; if ($1==3) printf "Nominal"; if ($1==4) printf "TX"; if ($1==5) printf "RX"; if ($1>=6) printf "Payload"; printf "  %.2fV  %dmA  EPS: %2dºC  Ant: %2dºC  ", $2*1e-3, $3, $4, $5; if ($7==0) {printf "ADCS auto  "} else {printf "ADCS manual  "}; if ($6==0) {printf "Detumbling  (%f,%f,$f) nT", $8, $9, $10} else {printf "SS-nominal  Sun: (%.2f,%.2f,%.2f)", $8, $9, $10}; printf "  Control (%.1e,%.1e,%.1e)V\n", $11, $12, $13}'

which shows the following output:

Nominal  8.26V  233mA  EPS:  4ºC  Ant:  8ºC  ADCS auto  SS-nominal  Sun: (0.49,0.42,1.00)  Control (6.9e-09,1.7e-09,1.7e-08)V
Nominal  8.28V  221mA  EPS:  5ºC  Ant:  8ºC  ADCS auto  SS-nominal  Sun: (0.16,0.87,0.57)  Control (6.7e-09,1.4e-09,1.7e-08)V
Nominal  8.29V  245mA  EPS:  5ºC  Ant:  8ºC  ADCS auto  SS-nominal  Sun: (0.26,0.96,0.46)  Control (6.7e-09,1.4e-09,1.7e-08)V
Nominal  8.30V  257mA  EPS:  5ºC  Ant:  8ºC  ADCS auto  SS-nominal  Sun: (0.62,0.78,0.42)  Control (6.7e-09,1.4e-09,1.7e-08)V
Nominal  8.30V  257mA  EPS:  5ºC  Ant:  9ºC  ADCS auto  SS-nominal  Sun: (0.64,0.72,0.49)  Control (6.7e-09,1.4e-09,1.7e-08)V
Nominal  8.30V  245mA  EPS:  5ºC  Ant:  9ºC  ADCS auto  SS-nominal  Sun: (0.64,0.66,0.59)  Control (6.8e-09,1.5e-09,1.7e-08)V
Nominal  8.30V  245mA  EPS:  5ºC  Ant:  9ºC  ADCS auto  SS-nominal  Sun: (0.60,0.60,0.71)  Control (6.8e-09,1.5e-09,1.7e-08)V
Nominal  8.30V  245mA  EPS:  5ºC  Ant:  9ºC  ADCS auto  SS-nominal  Sun: (0.54,0.54,0.86)  Control (6.8e-09,1.6e-09,1.7e-08)V
Nominal  8.29V  245mA  EPS:  5ºC  Ant: 10ºC  ADCS auto  SS-nominal  Sun: (0.45,0.49,1.00)  Control (6.9e-09,1.7e-09,1.7e-08)V
Nominal  8.28V  245mA  EPS:  5ºC  Ant: 10ºC  ADCS auto  SS-nominal  Sun: (0.32,0.44,1.00)  Control (6.9e-09,1.7e-09,1.7e-08)V

The KISS file in question was obtained from the recording on 24/08/2016 at 10:54 by PE0SAT that I mentioned at the end of a previous post.

Many thanks to Juan Fran Muñoz and the rest of the NanoSat Lab team for publishing the telemetry analyser and sharing details about the satellite and the operations.

How hard is it to decode 3CAT-2?

In a previous post, I looked at the telemetry packets transmitted by the satellite 3CAT-2. This satellite transmits 9600bps AX.25 BPSK packets in the Amateur 2m band. As far as I know, it is the only satellite that transmits fast BPSK without any form of forward error correction. LilacSat-2 uses a concatenated code with a (7, 1/2) convolutional inner code and a (255, 223) Reed-Solomon outer code. The remaining BPSK satellites transmit at 1200bps, either using AX.25 without FEC (the QB50p satellites, for instance), or with strong FEC (Funcube, for example). Therefore, I remark that 3CAT-2's packets will be a bit difficult to decode without errors. But how difficult? Here I look at how to use the theory to calculate this, without resorting to simulations.

Continue reading "How hard is it to decode 3CAT-2?"

RS92-SGP: trying to change the frequency with an external reference

In a previous post, I talked about the possibility of changing the transmit frequency of a Vaisala RS92-SGP radiosonde by modifying the settings on its EEPROM. The lowest frequency you can achieve using this method is 400MHz and the highest probably depends on the particular unit, but it is somewhat between 410MHz and 423MHz. There are also reports of very low output power on the highest frequencies (I'll explain why below). Clearly, this can't be used to make the radiosonde transmit in 430MHz, inside the 70cm Amateur band. In fact, from what I've read online, the impression is that it's not possible to modify the radiosonde to make it transmit in 430MHz. However, I wanted to try to feed an external reference to see what happened. Short story: it doesn't work either. However, I discovered some interesting information about the RF section of the RS92-SGP along the way.

Continue reading "RS92-SGP: trying to change the frequency with an external reference"

Decoding packets from 3CAT2

On 15th August, a Chinese CZ-2D rocket launched three satellites from Juiuquan (Mongolia). The main payload was the Chinese satellite QSS, designed to do some experiments in quantum communications and entanglement. As anything that has the word quantum on it, this satellite even made it to the mainstream news in Spain. The rocket also launched Lixing 1, another Chinese satellite which will research the upper atmosphere, and 3CAT2, from the Universidad Politècnica de Catalunya (Spain).

3CAT2's main payload is a GNSS reflectrometer designed to measure the altitude of the Earth and map the oceans. This means that it uses reflections of satellite navigation signals off the surface of the earth and sea to perform mapping. It will mainly use the L1 and L2 signals from GPS, but it can also work with Galileo, GLONASS and BeiDou signals. It also carries a prototype of a magnetometer designed for the eLISA project. This project consists in setting up a laser interferometer in space to observe gravity waves. It is roughly the same as the Earth-based LIGO, that recently confirmed the first detections of gravity waves. However, since eLISA will be in space, its laser arms will much longer than LIGO's. This permits to study much lower frequencies than it's possible Earth-based interferometers.

3CAT2 has a downlink in the Amateur 2m band, at 145.970MHz, and transmits 9600bps BPSK. It also has a faster BPSK downlink in the S-band, presumably at 2401MHz (inside the Amateur 13cm band). The days following 3CAT2's launch I tried to receive its VHF signal, without any luck. I have been in contact with other Amateurs who also listened and didn't hear anything.

This morning, I've received email from Scott K4KDR telling me that he has heard the satellite for the first time and he has managed to do a recording, but he is unable to decode the data.

We where unsure about which encoding that 3CAT2 is using. It could be AX.25, or some custom protocol using FEC. As far as I know, the only other satellite that transmits 9k6 BPSK in the Amateur bands is LilacSat-2, which uses strong FEC. Nevertheless, I've taken a good look at Scott's recording and I've been able to decode one packet. This is, as far as I'm aware, the first decoding of 3CAT2 by an Amateur operator.

Continue reading "Decoding packets from 3CAT2"

RS92-SGP: Interfacing the EEPROM to a 5V microcontoller

I've started to experiment with the RS92-SGP radiosonde that I recovered some days ago. The radiosonde has a M95256-W 32KB SPI EEPROM where all the code and settings are stored, since the onboard CPU/DSP doesn't have any flash memory. Several parts of the firmware, including some of the settings have being reverse engineered. Thus, it is useful to interface the EEPROM to a microcontroller to rewrite some settings, perhaps to change the transmit frequency or the radiosonde's ID (the serial number which is also printed on the radisonde's box).

Continue reading "RS92-SGP: Interfacing the EEPROM to a 5V microcontoller"

Recovering an RS92-SGP radiosonde

A few days ago, I talked about the radiosondes that are launched every 12 hours from Madrid-Barajas Airport. Yesterday, I went with my mother on a trip to try to recover the radiosonde that was launched at 11:00UTC. This radiosonde managed to ascend to 31000m before bursting. This is quite high for a radiosonde of this kind, as they usually burst between 24000 and 28000m.

We left home at 13:00UTC, so the radiosonde was quite far from us by that time. The last telemetry we managed to decode was when the radiosonde was 3800m high and on its way down. It was flying over Sacedón, in Guadalajara, and slowly drifting eastwards along the road. We were still on our way to Guadalajara, more than 40km away.

Continue reading "Recovering an RS92-SGP radiosonde"

Receiving the Vaisala RS92-SGP radiosonde launched from Madrid-Barajas

Each day, at 01:00UTC and 11:00UTC a Vaisala RS92-SGP radiosonde is launched from Madrid-Barajas airport. This is a small electronics package tied to a helium balloon that ascends up to between 24 and 28km high before bursting and descending on parachute. It is designed to measure atmospheric parameters on its way up. It includes temperature, pressure and humidity sensors, as well as a GPS receiver. The launch on Wednesdays at 11:00UTC also includes a plug-in ozone sensor (which is a much larger and more expensive package). The data is transmitted at 403MHz using Manchester-encoded 4800bps GMSK and protected using Reed-Solomon. You can find more information about the RS92-SGP model in its technical datasheet and about the launches at Madrid-Barajas and other launches in Spain in the Spanish AIP Section 5.3 (other activities of a dangerous nature). Also, there is somebody who feeds the radiosonde data into the APRS network using SM2APRS, so you can track the launches by following OKER-11 on

Usually, the Sondemonitor software is used to receive and plot the parameters measured by the radiosonde and track the GPS data. Of course, this program is very nice and complete, but it is shareware, costs 25€ and runs only in Windows. I wanted to try if it is possible to track the GPS data in Linux using free software.

Continue reading "Receiving the Vaisala RS92-SGP radiosonde launched from Madrid-Barajas"

Concurso Nacional V-UHF

Today I've hiked up with my father to Siete Picos, SOTA summit EA1/SG-005 (2138m), to participate in this month's national V-UHF contest. We arrived and set up around 07:30UTC and worked until 11:30UTC, where activity became low, as most possible contacts were already done and people started to leave in order to prepare lunch. The equipment was a Yaesu FT-817ND and an Arrow yagi antenna (3 elements in 144MHz and 7 elements in 432MHz).

Below is the map of stations worked. My position is in red, stations worked both in 144MHz and 432MHz are in green and stations worked only in 144MHz are in blue. The black station is the odd one that I could only work in 432MHz. This can happen if you catch them first in 432MHz, then a big mess with several stations arises and you're unable to tell them to change to 144MHz to make the contact and decide that you'll catch them in 144MHz later, but you don't manage to find them later.

Continue reading "Concurso Nacional V-UHF"