Decoding Reaktor Hello World

Reaktor Hello World is a 2U cubesat built by the Finnish company Reaktor Space Lab as a test of their cubesat platform and demonstration of the first miniature infrared hyperspectral imager. It was launched on November 29 by a PSLV from Satish Dhawan Space Centre, together with several other cubesats. It transmits 9k6 GFSK telemetry in the 70cm Amateur satellite band.

The satellite uses a Texas Instruments CC1125 FSK transceiver chip. This is very similar to the CC1101 that I used a few years ago in my 70cm Hamnet experiments, so I already knew the coding and features of this chip quite well. The satellite team has a Github repository with a GNU Radio decoder based on the gr-cc11xx decoder block for the CC11xx series of chips. Since gr-cc11xx doesn’t seem to be maintained anymore, I wanted to implement my own CC11xx decoder in gr-satellites and use it to decode Reaktor Hello World.

The figure below, taken from the CC112x User’s Guide, shows the format of the packets transmitted by the CC11xx chips. First, there is a preamble consisting of a repetition of 0xAA bytes. Then there is a syncword, which in Reaktor Hello World’s case is 0x352E352E (in big-endian notation). After this, the packet payload comes, with optional length and address fields. Finally, there is an optional CRC-16.

In the case of Reaktor Hello World, the length field is used. This field indicates the length of the payload, not including the length field and the CRC-16. The address field is not used by Reaktor Hello World.

As shown by the image above, the length and address fields, the data and the CRC-16 can be scrambled. This is the case in Reaktor Hello World. The scrambling algorithm is an additive (synchronous) scrambler that works by XORing the data against a PN9 sequence described in this document.

The CRC-16 used by the CC11xx chips is described in this document. Using the notation of this online calculator, the polynomial is 0x8005, the input and output is not inverted, the initial value is 0xFFFF and the final XOR value is 0.

The image below shows the blocks I have added to gr-satellites to decode the CC11xx packets. After bit slicing, we match against the syncword and generate PDUs of 255 bytes. These are first unscrambled by the PN9 scrambler. Then, the CC11xx packet crop block reads the length field and crops the packet to the correct size. After this, the CRC-16 is checked. Finally, the length field is removed.

I have implemented the PN9 scrambler by using the GNU Radio stock additive scrambler block in a hierarchical block. The settings to do this can be seen in the image below.

Mike Rupprecht DK3WN has sent me a recording of Reaktor Hello World. The packets I’ve been able to decode with correct CRC are shown in this gist. It seems that these packets do not match exactly the format listed in the satellite webpage. I still have to see how useful is the information listed there.

I have added a decoder for Reaktor Hello World to gr-satellites, together with a sample recording extracted from Mike’s recording.

Update 2020-11-27: note that the CC11xx packet crop has been deprecated in the latest versions of gr-satellites in favour of a new PDU Head/Tail block, which is more general. See this issue.