[Hackrf-dev] The whole 20MHz LTE signal is decoded by HACKRF 19.2Msps!

[Jiao Xianjun]

Hi,

I have decode the whole 20MHz LTE signal by HACKRF board with 19.2Msps
sampling rate! See all Matlab codes and captured signal here:
https://github.com/JiaoXianjun/LTE-Cell-Scanner     (Thanks again to
hackrf.net for lending me a board to do experiment!)

Maximum sampling rate of HACKRF is about 20Msps, but 20MHz LTE needs
30.72Msps rate according to LTE spec. A sampling rate converter is designed
to get 30.72Msps signal from 19.2Msps HACKRF captured signal. (19.2*8/5 =
30.72)

By this way, those channels in the whole 20MHz LTE bandwidth are detected,
such as PBCH, PCFICH, PHICH, PDCCH, PDSCH(SIB1, SIB2, etc).

We are lucky for two reasons:
1. Most 20MHz LTE signals here in China are 100RB configuration. That means
actual bandwidth is 100*180kHz = 18MHz
2. USB transmission between HACKRF board and computer supports 19.2Msps
sampling rate without packets loss. Higher rate (for example 23Msps) may
lead to packets loss.

Some figures from Matlab are attached.

Figure 1 info: time-frequency resource grids of a TDD radio frame (Y:
sub-carrier; X OFDM symbol)

Matlab outputs and these match the Figure 1:

TDD SFN-310 ULDL-2-|D|S|U|D|D|D|S|U|D|D| CID-30 nPort-1 CP-normal
PHICH-DUR-normal-RES-1

SF5 PHICH1 PDCCH3 RNTI: SI-RNTI SI-RNTI
No.0 4CCE: Localized VRB from RB0 to RB6 MCS-2 HARQ-0 NEWind-0 RV-1 TPC-1
DAI-0
No.0 8CCE: Localized VRB from RB0 to RB6 MCS-2 HARQ-0 NEWind-0 RV-1 TPC-1
DAI-0


Figure 2 : Constellation of SIB1 in PDSCH of subframe 5 in above radio frame


Figure 3 info: time-frequency resource grids of another TDD radio frame (Y:
sub-carrier; X OFDM symbol)

Matlab outputs and these match the Figure 3:

TDD SFN-900 ULDL-2-|D|S|U|D|D|D|S|U|D|D| CID-216 nPort-2 CP-normal
PHICH-DUR-normal-RES-1
SF4 PHICH1 PDCCH1 RNTI: SI-RNTI SI-RNTI
No.0 4CCE: Localized VRB from RB0 to RB5 MCS-2 HARQ-0 NEWind-0 RV-0 TPC-1
DAI-0
No.0 8CCE: Localized VRB from RB0 to RB5 MCS-2 HARQ-0 NEWind-0 RV-0 TPC-1
DAI-0
SF5 PHICH1 PDCCH1 RNTI: SI-RNTI SI-RNTI
No.0 4CCE: Localized VRB from RB0 to RB5 MCS-2 HARQ-0 NEWind-0 RV-3 TPC-1
DAI-0
No.0 8CCE: Localized VRB from RB0 to RB5 MCS-2 HARQ-0 NEWind-0 RV-3 TPC-1
DAI-0

Videos:

in China:
http://v.youku.com/v_show/id_XNzE3NDYwMDgw.html

outside China:
http://youtu.be/2JH_EGdHyYE

Next step: decoding PDSCH and porting all these into C/C++ in
LTE-Cell-Scanner

BR
Jiao Xianjun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://nine.pairlist.net/pipermail/hackrf-dev/attachments/20140527/47cd735a/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: grids-50.png
Type: image/png
Size: 65749 bytes
Desc: not available
URL: <http://nine.pairlist.net/pipermail/hackrf-dev/attachments/20140527/47cd735a/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: SIB1-constellation (copy).jpg
Type: image/jpeg
Size: 35122 bytes
Desc: not available
URL: <http://nine.pairlist.net/pipermail/hackrf-dev/attachments/20140527/47cd735a/attachment-0002.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: grids-2585-50.jpg
Type: image/jpeg
Size: 77444 bytes
Desc: not available
URL: <http://nine.pairlist.net/pipermail/hackrf-dev/attachments/20140527/47cd735a/attachment-0003.jpg>