Time-based interference avoidance using a software defined radio platform

Transcription

1 Time-based interference avoidance using a software defined radio platform Peter De Valck Promotoren: prof. dr. ir. Ingrid Moerman, prof. dr. ir. Piet Demeester Begeleiders: Opher Yaron, Wei Liu, ir. Lieven Tytgat Masterproef ingediend tot het behalen van de academische graad van Master in de ingenieurswetenschappen: elektrotechniek Vakgroep Informatietechnologie Voorzitter: prof. dr. ir. Daniël De Zutter Faculteit Ingenieurswetenschappen en Architectuur Academiejaar

2

3 Time-based interference avoidance using a software defined radio platform Peter De Valck Promotoren: prof. dr. ir. Ingrid Moerman, prof. dr. ir. Piet Demeester Begeleiders: Opher Yaron, Wei Liu, ir. Lieven Tytgat Masterproef ingediend tot het behalen van de academische graad van Master in de ingenieurswetenschappen: elektrotechniek Vakgroep Informatietechnologie Voorzitter: prof. dr. ir. Daniël De Zutter Faculteit Ingenieurswetenschappen en Architectuur Academiejaar

4 Preface This book is the result of a process that evolved during the last year of my studies as an electrical engineer. It already started more than a year ago with the decision on the subject of my thesis. Over the course of my bachelor studies and two summer jobs I had already become aquainted with the sensor network research group at IBCN and came away with a great impression. So for my last year I was more than glad that I got the opportunity to research an interesting topic in this group. During the course of this year, my knowledge and skills evolved to a more advanced level. When I started the subject at hand was a complex and daunting matter. Little by little I explored this subject and started to understand more and more. While it still remains complex I can now say that I have gained a firmer grasp and comprehension of the subject, resulting in the practical results persented in this thesis. Before I start this voluminous work, I would like to use this opportunity to thank all the people withouth whom it would have been impossible to realise this thesis. First and foremost I would like to thank my supervisor Lieven Tytgat for all the time and effort he put in the guidance of this thesis. I would also like to thank the wireless networks research group for providing the advanced hardware used in this thesis, as well as the people from the office for the great athmosphere and the free apples. My parents should definitly be on this list as well, not only for the support during my studies, but also for kindling my intrests in technology since a young age. Along with my family and friends they have made me who I am today and in their own way each of them contributed to this work. Special thanks go to my girlfriend Elenore, whose support and love helped me through many problems. I am no doubt forgetting many people who contributed to this thesis, but I would like to thank them nonetheless. Peter De Valck, june 2012

5 The author gives permission to make this master dissertation available for consultation and to copy parts of this master dissertation for personal use. In the case of any other use, the limitations of the copyright have to be respected, in particular with regard to the obligation to state expressly the source when quoting results from this master dissertation. Peter De Valck, june 2012

6 Time-based interference avoidance using a software defined radio platform door Peter De Valck Masterproef ingediend tot het behalen van de academische graad van Master in de ingenieurswetenschappen: elektrotechniek Academiejaar Promotoren: prof. dr. ir. Ingrid Moerman, prof. dr. ir. Piet Demeester Begeleiders: Opher Yaron, Wei Liu, ir. Lieven Tytgat Faculteit Ingenieurswetenschappen en Architectuur Universiteit Gent Vakgroep Informatietechnologie Voorzitter: prof. dr. ir. Daniël De Zutter Summary Due to strict regulations, many wireless technologies are forced to coexist in a fairly limited frequency band. While most technologies support the use of a single channel, problems arise when different technologies try to use the same frequency bands. This thesis focuses on the interference caused by Wi-Fi signals on a Zigbee signal and proposes a time-based interference avoidance method to reduce the detrimental effect of the Wi-Fi communication. This method was implemented on a software defined radio platform and the resulting effects on the Zigbee communication were measured. Keywords Software defined radio, SDR, Wi-Fi, Zigbee, coexistence, wireless interference

7 Tijdsgebaseerde interferentie ontwijking met behulp van een software gedefinieerd radio platform Peter De Valck Supervisor(s): Ingrid Moerman, Piet Demeester, Lieven Tytgat, Opher Yaron, Wei Liu Abstract In dit artikel wordt een eenvoudige manier ontwikkeld en geïmplementeerd om de invloed van Wi-Fi communicatie op Zigbee communicatie te verlagen. De implementatie van het tijdsgebaseerde systeem gebeurt op een software gedefinieerde radio. Sleutelwoorden Software gedefinieerde radio, FPGA, coëxistentie, signaaldetectie, Wi-Fi, Zigbee I. INLEIDING WEGENS de strikte regulering op het gebruik van het radio spectrum zijn er slechts een beperkt aantal banden die vrij gebruikt kunnen worden voor draadloze telecommunicatie, namelijk de ISM banden (Industrial, Scientific en Medical. Mits het verkrijgen van een licentie is het ook mogelijk andere banden te gebruiken, maar het gros van de consument gerichte draadloze technologieën (Wi-Fi, Zigbee, Bluetooth) maken gebruik van de 2.4 GHz ISM banden. Het gevolg is een zeer sterke overbezetting van deze band. Gelukkig zijn de standaarden achter deze technologiën ontwikkeld met dit probleem in het achterhoofd en als gevolg bevatten zij voorzieningen om deze band te delen met andere gebruikers van dezelfde technologie. Problemen treden echter op wanneer verschillende technologieën door elkaar gebruikt worden: in het beste geval zal de performantie van de communicatie afnemen, in het slechtste geval kan zij gewoon onmogelijk worden. In dit abstract wordt de interactie tussen Wi-Fi en Zigbee van naderbij bekeken en wordt het ontwijkingsmechanisme van de Wi-Fi standaard (IEEE g) uitgebreid om zo de coëxistentie met Zigbee te verbeteren. A. Methoden II. INTERFERENTIE ONTWIJKING Er bestaan verschillende methoden om interferentie tussen twee radiosignalen te vermijden: A.1 Frequentiegebaseerd De eenvoudigste manier om interferentie te vermijden is het gebruiken van twee verschillende frequentiebanden die voldoende ver uit elkaar liggen. Dit is het principe waarop de FMradio band ingedeeld is: elke zender heeft zijn eigen frequentie en zal onder normale omstandigheden niet interfereren met een andere zender. A.2 Tijdsgebaseerd Bij tijdsgebaseerde interferentie ontwijking wordt een frequentieband opgedeeld volgens de tijdsas. Wanneer twee gebruikers gelijktijdig gebruik willen maken van het kanaal zal één van hen wachten tot het kanaal weer vrij is. Hiertoe zal hij eerst luisteren of het kanaal beschikbaar is en pas zenden als er niemand anders aan het zenden is. Dit vereist complexere hardware dan de vorige methode aangezien de radio nu ook moet kunnen ontvangen en bovendien snel moet kunnen overschakelen tussen ontvangen en zenden, zodat een andere zender weinig kans heeft om te beginnen zenden tijdens het overschakelen. B. IEEE g standaard In de IEEE g standaard zijn zowel frequentie- als tijdsgebaseerde ontwijkingsmechanismen ingebouwd om interferentie met andere g gebruikers te ontwijken. In principe zouden beide methoden dus aangepast kunnen worden om ook de interferentie met Zigbee gebruikers te ontwijken, maar wegens het statische karakter van de frequentiekeuze bij het opzetten van een Wi-Fi netwerk is het veel eenvoudiger om de tijdsgebaseerde ontwijking aan te passen. Vooraleer de radio begint te zenden zal deze volgens de standaard gedurende 4 µs luisteren of het kanaal beschikbaar is. Teneinde nog steeds compatibel te zijn zal ook de nieuwe methode in deze korte tijdsspanne moeten kunnen bepalen of er een Zigbee signaal aanwezig is. III. DETECTIE Er zijn drie courante manieren om de aanwezigheid van een signaal te detecteren die wat verder toegelicht worden. A. Energiedetectie Bij energiedetectie wordt de energie aanwezig in het kanaal berekend en vergeleken met een vooraf bepaalde waarde. Wanneer de energie zich onder deze waarde bevindt is het kanaal vrij, anders wordt het bezet beschouwd. Deze methode is onafhankelijk van het type signaal en kan dus ook gebruikt worden om andere signalen dan Zigbee te detecteren. B. Matched filter Wanneer het ontvangen signaal eerst gefilterd wordt met het correcte ontvangstfilter en nadien vergeleken wordt met de detectiedrempel levert dit het best mogelijke resultaat. Nadeel is dat dit enkel zal werken voor signalen die voldoen aan de karakteristieken van het ontvangstfilter, maar aangezien het hier specifiek om Zigbee communicatie gaat is dit geen probleem. C. Cyclostationaire detectie Cyclostationaire detectie maakt gebruik van de periodieke kenmerken van de meeste radiosignalen om deze te detecteren. Hoewel deze methode ook in staat is om verschillende signalen

8 te detecteren vergt zij een hoge rekencomplexiteit en werkt pas efficiënt bij langere periodes. Daarom werd deze detectiemethode achterwege gelaten. D. Simulatie Zowel energiedetectie als de matched filter methode werden in Matlab geïmplementeerd en gebruikt om de detectie te testen op gegenereerde signalen. Zoals in figuur 1 kan gezien worden levert de matched filter methode inderdaad de beste resultaten, maar kan ook energiedetectie gebruikt worden. De twee detectiemethoden werden geïmplementeerd in hardwareblokken die samen met reeds beschikbare blokken gecombineerd werden om het systeem weergegeven in 3 te realiseren. De software laat toe om heel het systeem van op afstand te besturen van op een standaard computer. Fig. 3. WARP A. SDR Fig. 1. Simulatieresultaten IV. PLATFORM Aangezien standaard Wi-Fi apparatuur slechts zeer beperkte modificaties toelaat, werd gekozen voor een meer flexibele oplossing, namelijk een software gedefinieerd radio platform. Dit is een radio waarbij alle dataverwerking softwarematig gedefinieerd wordt. Dit is ideaal voor het implementeren van deze nieuwe detectiemethoden. B. WARP De gekozen SDR is het WARP (Wireless open-access Radio Platform, figuur 2). Dit platform ondersteunt 1 tot GHz radios met elke twee 64 MS/s 14-bits ADC s end twee 160 MS/s 16-bit DAC s. De verwerking gebeurt door een Virtex 4 FPGA met configureerbare slices en 2 ingebedde PowerPC processoren. Een volledige Wi-Fi implementatie was niet beschikbaar voor het WARP. Om toch te kunnen interfereren met de Zigbee signalen werd ook een kleine zender geïmplementeerd die een vooraf opgenomen signaal uit kan zenden. VI. METINGEN Deze implementatie werd gebruikt om detectiekans van de nieuwe detectiemethodes te testen. Het WARP werd via een variabele attenuator verbonden met een Zigbee node die continu pakketten verstuurt. De resultaten kunnen gezien worden in figuur 4. Fig. 4. Meetresultaten Net zoals de simulatie voorspelde is de gematchte filter de meest performante detector, maar ook de energiedetector is performant genoeg om gebruikt te worden: volgens de standaard zou een standaard Wi-Fi radio in het geteste bereik niets detecteren. Fig. 2. WARP V. IMPLEMENTATIE De implementatie van de aangepaste detectiemethode bestaat uit twee onderdelen: de configureerbare logica van de FPGA (hardware) wordt gebruikt voor de tijdskritische en rekenintensieve taken, terwijl de software op de ingebedde processor de minder kritische controletaken voor zijn rekening neemt. VII. CONCLUSIES Wegens de beperkte tijd en de hoge complexiteit van een Wi- Fi systeem was het niet mogelijk om testen uit te voeren met een complete Wi-Fi implementatie. Dit neemt echter niet weg dat de huidige resultaten al aantonen dat het volstrekt mogelijk is om op een relatief eenvoudige manier de coëxistentie tussen Zigbee en Wi-Fi gebruikers kan verbeterd worden zonder hiervoor ver van de standaard af te wijken.

9 Time-based interference avoidance using a software defined radio platform Peter De Valck Supervisor(s): Ingrid Moerman, Piet Demeester, Lieven Tytgat, Opher Yaron, Wei Liu Abstract In this article a simple method to reduce the influence of Wi-Fi communication on Zigbee communication is developed and implemented. The implementation of this time-based system is done on a software defined radio platform. Keywords Software defined radio, FPGA, coexistence, signal detection, Wi-Fi, Zigbee I. INTRODUCTION DUE to the strict regulations concerning the usage of the radio spectrum, only a few frequency bands can be used for wireless telecommunication without obtaining a special license, the so called Industrial, Scientific and Medical bands. Most of the consumer grade wireless technology (Wi-Fi, Zigbee, Bluetooth,... ) uses these band, especially the 2.4 GHz band is heavily used. The result of this concentration is an overpopulated frequency band. Luckily the standards behind these technologies were specially designed for this problem and contain provisions to avoid interfering with other users using the same technology in the same band. Some standards also provide methods to avoid interference with other technologies, but often a combination of different technologies will cause the performance of the communication to drop significantly. In this abstract the interaction between Wi-Fi and Zigbee is studied and the interference avoidance mechanism of the Wi-Fi standard (IEEE g) is extended to avoid Zigbee communication. A. Methods A.1 Frequency-based II. INTERFERENCE AVOIDANCE The simplest way to avoid interference is by using two different frequency-bands that are separated by a large enough distance. This is the principle behind static frequency allocation: each transmitter has its own frequency and under normal circumstances they should not interfere with each other. A.2 Time-based With time-based interference avoidance a frequency-band is divided along the time-axis. When two users want to use the same channel, one of them will wait until the first one has finished before starting its own transmission. To accomplish this the radio will listen if the channel is available before starting a transmission. This avoidance method requires more complex hardware than the frequency-based method. Not only must the radio be able to receive as well as transmit, it must also be able to quickly switch between receiving and transmitting to reduce the chance of another sender starting transmission during the switch. B. IEEE g standard The IEEE g standard contains both frequency and time-based avoidance mechanisms to avoid interfering with other Wi-Fi users. In principle, it should be possible to modify both methods in order to avoid interfering with Zigbee users, but the static frequency choice when setting up a Wi-Fi network means that it is much simpler to modify the time-based avoidance method. According to the standard, a 4 µs period is available before each transmission to determine the occupation of the channel. In order to remain compatible with the standard, the new detection method should be able to detect a Zigbee signal within this same short period. III. DETECTION There are three popular methods to detect the presence of a signal. Each method is discussed briefly. A. Energy detection Energy detection is the most straightforward way to detect the presence of a signal. The energy present in the channel of interest is calculated and compared to a predetermined threshold. If the energy is above this threshold, the channel is considered busy, otherwise it is free. This method is independent of the signal type and can also be used to detect signals other than a Zigbee signal. B. Matched filter With matched filtering the received signal is filtered with the correct receive filter. The energy of the resulting signal is compared to a detection threshold to determine the channel occupancy. This method has the best performance, but will only work with signals that correspond with the receive filter. Since we only want to detect Zigbee signals, this is not a problem. C. Cyclostationary detection Cyclostationary detection uses the periodic characteristics of most radio signals to detect them. While this method is also capable of detecting any arbitrary signal, it has a very high computational complexity and only works efficiently when used on long signals. For these reasons this detection method was not used.

10 D. Simulatie Both the energy detection and the matched filter method were implemented in Matlab and used to simulate the detection with generated signals. As can be seen in figure 1, the matched filter does indeed deliver the best results, but the energy detection also provides usable information. system shown in figure 3. The software running on the embedded processor controls all the hardware cores and makes remote usage over the ethernet connection possible. A. SDR Fig. 1. Simulation results IV. PLATFORM Since standard Wi-Fi devices allow only very limited modifications, a more flexible solution was chosen, more specifically a software defined radio platform. This is a radio platform where all processing is done in software, which is ideal for implementing the new detection methods. B. WARP The chosen SDR is the WARP (Wireless open-access Radio Platform, figure 2). This platform can support up to GHz radios each containing two 64 MS/s 14-bits ADC s and two 160 Ms/s 16-bit DAC s. The processing is done on a Virtex 4 FPGA containing configurable logic slices and two embedded PowerPC processors. Fig. 3. WARP A complete Wi-Fi implementation was not available for the WARP. In order to simulate some sort of Wi-Fi traffic to interfere with the Zigbee signals, a simple transmitter core was also added to the system. This core simply replays a recorded signal when necessary. VI. MEASUREMENTS This implementation was used to test the detection rate of the new detection methods. The WARP was connected to a continuously transmitting Zigbee node via a variable attenuator. The resulting detection rates can be seen in 4. Fig. 4. Measurement results As the simulation predicted, the matched filter is the most sensitive detector, but even the energy detector could be used to improve the current situation: according to the standard, a standard Wi-Fi radio would not detect anything in the range fo signal strengths tested here. Fig. 2. WARP V. IMPLEMENTATION The implementation of the modified detection methods consists of two parts: the configurable logic of the FPGA is used for the time-critical and computationally intensive tasks. The software running on the embedded processor run the less critical control tasks. Both detection methods were implemented in hardware cores. These cores were then used together with standard cores provided by the FPGA vendor and the WARP project to form the VII. CONCLUSIONS Due to time constraints and the high complexity of a Wi-Fi system, it was not possible to implement a complete Wi-Fi system and perform test using this system. This does however not detract from the fact that the current results already show that it is perfectly possible to improve the coexistence between Wi-Fi and Zigbee using fairly simple methods, without breaking the standard compliance.

11 CONTENTS i Contents 1 Introduction 1 2 Wireless communication Regulation Interference avoidance Time based Frequency based Code based Space based Conclusion Wireless standards IEEE IEEE g Conclusion Detection Methods Energy detection Matched filtering Cyclostationary detection Conclusion Simulation Overview Generated signal Real signal

12 CONTENTS ii 3.3 Conclusion Platform Requirements Low level access Low latency Wi-Fi support Platforms Wi-Fi card SDR Conclusion Implementation Partitioning Hardware Cores Complete system Software Embedded software Host software Conclusion Measurements Setup Measurements Standard interference Detection rate Modified system Conclusion Future work A Software installation 49 A.1 Xilinx software A.1.1 Driver installation

13 A.1.2 WARP cores A.2 Matlab B Simple FPGA project 54 B.1 Hardware B.1.1 Blinking core B.1.2 Embedded system B.2 Software B.3 Running C Bonus SDR 63 C.1 FM-receiver C.2 Mode-S transponder

14 List of abbreviations Abbreviation AGC ADC API AWGN BIPT CCA Coax CPU DAC DCM DDR DMA DSP DVB-T EEPROM ERP FPGA IEEE IO ISM ITU-R JTAG LED LNA LSB MAC MF Meaning Automatic Gain Control Analog -to-digital Converter Application Programming Interface Additive White Gaussian Noise Belgisch Instituur voor Postdiensten en Telecommunicatie Clear Channel Assessment Coaxial cable Central Processing Unit Digital-to-Analog Converter Digital Clock Manager Double Data Rate Direct Memory Access Digital Signal Processing Digital Video Broadcasting - Terrestrial Electrically Erasable Programmable Read-Only Memory Extended Rate Physical layer Field-programmable gate array Institute of Electrical and Electronics Engineers Input-Output Industrial, Scientific and Medical International Telecommunication Union Radio-communication sector Join Test Action Group Light Emitting Diode Low Noise Amplifier Least Significant Bit Medium Access Control Matched Filter

15 Abbreviation MGT MSB MSPS NDA O-QPSK OFDM OPB PER PHY PLB PN RAM RF RX SNR TCXO TX UART USB USRP VGA VHDL VHSIC WARP XPS XSDK Meaning Multi-Gigabit Transceiver Most Significant Bit Mega Samples Per Second Non Disclosure Agreement Offset Quadrature Phase Shift Keying Orthogonal Frequency-Division Multiplexing On-chip Peripheral Bus Packet Error Rate Physical layer Processor Local Bus Pseudo-random Noise Random Access Memory Radio-Frequency Receive Signal-to-Noise Ratio Temperature Controlled Oscillator Transmit Universal Asynchronous Receiver/Transmitter Universal Serial Bus Universal Software Radio Peripheral Variable Gain Amplifier VHSIC Hardware Description Language Very High Speed Integrated Circuits Wireless open Access Research Platform Xilinx Platform Studio Xilinx Software Development Kit

16 INTRODUCTION 1 Chapter 1 Introduction The goal of this thesis is to study and implement methods that allow the coexistence of different wireless technologies, more specifically Wi-Fi and Zigbee. Both technologies use the same spectrum and contain techniques to avoid interfering with devices using the same technologies, but interference avoidance between the two technologies occurs only under very specific circumstances. Zigbee devices are already capable of detecting most Wi-Fi signals, but the detection of Zigbee signals by a Wi-Fi device happens only if the Zigbee signal is strong enough to influence the Wi-Fi detection. As Zigbee devices use a low transmit power, this is very unlikely to happen. The result is a complete breakdown of the Zigbee communication when a Wi-Fi device is active. A more specific avoidance method is therefore needed to make both technologies cooperate. To gain a better understanding of the problem the next chapter gives a short overview of the interference problems inherent in wireless communication as well as the existing techniques used to avoid this interference. This will be followed by an overview of the relevant parts in the Zigbee and Wi-Fi standards. While different methods can be used to avoid interference (as described in chapter 2), the presence of a signal must be detected before they can be avoided. In chapter 3 different methods to accomplish this are discussed and analyzed. Two of the these methods are implemented in Matlab and tested using both simulated data as well as captured data. This allows verification of the methods before implementing them in hardware.

17 INTRODUCTION 2 Chapter 4 starts with listing the requirements for the platform used in the implementation. Several hardware platforms are considered and the best platform is chosen. The actual implementation of the detection methods is explained in chapter 5. In the final chapter the test results of this implementation are presented.

18 WIRELESS COMMUNICATION 3 Chapter 2 Wireless communication Wireless communication can be defined as the exchange of information between parties that are not physically connected. As this definition is rather broad, it also includes flag semaphores and lighthouses. This thesis however only concerns itself with digital communication using the radio-spectrum. This spectrum is a shared and scarce resource and therefore requires special regulations and techniques when used. 2.1 Regulation Propagation of radio waves can not be completely controlled and will often not stop on the border of properties, countries or even continents (depending on the frequency that is used). Therefore the use of the radio-spectrum is regulated heavily on both national and international level. On the international level the ITU-R is responsible for allocating the scarce spectrum. It is made up of over 190 member states and over 700 commercial and academic partners. This consortium allocates and keeps track of the radio spectrum to make sure it is used efficiently and interference between countries and services is avoided. The recommendations and rules developed by the ITU-R are implemented and enforced on a national level by country specific organizations. In Belgium this is the BIPT. One of the services provided by the BIPT is a frequency allocation table that lists all uses of the regulated frequency band. Table 2.1 contains a short excerpt of this table and clearly shows that each band has only a limited amount of uses.

19 2.1 Regulation 4 Band Allocation Application MHz FIXED Tactical radio relay MHz MOBILE Radio microphone MHz MOBILE Wireless audio applications MHz MOBILE CT MHz MOBILE RFID MHz MOBILE Non-specific Short Range Devices MHz MOBILE Alarms MHz MOBILE Non-specific Short Range Devices MHz MOBILE Alarms MHz MOBILE Non-specific Short Range Devices MHz MOBILE Intercom MHz MOBILE Non-specific Short Range Devices Table 2.1: Frequency allocation table [1] The use of a frequency band is not only limited by the applications that can be used, the number of users is also limited. To ensure that frequency bands don t get overcrowded and degrade overall performance, the BIPT is also responsible for creating and managing licenses that allow companies and individuals to use specific frequency bands. These licenses often impose additional requirements on the holder of this license. As an example, ham-radio amateurs must take an exam organized by the BIPT and pay a yearly fee for a license. This allows them to operate on the so called ham-band, while still bound by strict regulations concerning transmit power, used protocols and even the subject of conversation. Another example are the cellular licenses that have been auctioned of by the BIPT. Recently a fourth GSM-license has been sold for the price of 71.5 million euros. Besides the high price of these licenses, they also include a clause that requires the license holder to utilize the bought spectrum within a certain time or risk losing the license.

20 2.2 Interference avoidance 5 Technology Company Price (millions $) 3G Mobistar G KPN group Belgium G Proximus G Belgacom G KPN group Belgium G Mobistar G BUCD BVBA Table 2.2: Auction results of mobile licences [2] It should be clear from the examples above that it would be very difficult for an individual to obtain a license to set up a private wireless network. There are however certain frequency bands that require no license at all. Originally intended for industrial, scientific and medical use, these so called ISM-bands are used more and more for digital communication. Since these bands can be used freely, this creates a situation where a lot of users and technologies use the same spectrum. It is not uncommon to find over 20 Wi-Fi access points within range of each other in an urban environment. This calls for very efficient interference avoidance methods. 2.2 Interference avoidance As previously discussed, interference avoidance is a very important part of wireless communication [3]. Without it it is nigh on impossible to operate reliably in a busy part of the spectrum. There are four methods to avoid interference. While only the first two are directly applicable here, the other two methods are mentioned for completeness Time based When using time based interference avoidance all users share the same part of the spectrum, but at any one time only one user is allowed access to the medium. This can be accomplished by sensing the medium and waiting until it is free before transmitting. In a more complex scheme time is divided in slots and a user can only transmit during the time-slots assigned to him. This requires additional synchronization between all users and thus more complex hardware.

21 2.2 Interference avoidance 6 Figure 2.1: Time based interference avoidance The first method is used by several protocols: examples include the Wi-Fi [4] and Zigbee [5] protocols. Both protocols sense the channel before they start transmission. The second method is used by the GSM standard: it uses time-slots of 577 µs Frequency based Frequency based interference avoidance is the most straightforward method and has been used since the beginning of radio-communication. In its simplest form the required hardware the least complex compared to other methods. With a frequency based approach each user gets its own part of the spectrum. Figure 2.2: Frequency based interference avoidance

22 2.2 Interference avoidance 7 An example of static frequency based interference avoidance is the frequency allocation for commercial radio stations. Each station has it s own frequency so they do not interfere with each other. A dynamic example can be found in the Bluetooth stack: by default Bluetooth will use the full spectrum allocated to it, but if interference is detected it will avoid certain parts of the spectrum Code based When using a code based approach the signal from each user is encoded with orthogonal codes. These codes are chosen so that decoding a signal with the incorrect code results in a random signal, while the correct code yields the original signal. This allows for simultaneous transmission on the same frequency. Figure 2.3: Code based interference avoidance The most well known system to use this method is the GPS-system [6]: all satellites transmit on the same frequency but use a different code. This reduces the required spectrum and greatly simplifies the design of a GPS-receiver Space based The final method is space based. When two devices are unable to receive signals from each other, they will not interfere with each other. This can be done by simply putting enough distance between the devices, by using a directional antenna or even with electronic beam-forming. A nice example of this method is the so called cantenna[7], a can-formed antenna that can be used to increase the directivity of the Wi-Fi signals of an AP (or any other radio signal). Devices

23 2.3 Wireless standards 8 Figure 2.4: Space based interference avoidance in front of the antenna will receive a stronger signal, while devices located elsewhere will have less problems with interference from this AP Conclusion Of the above mentioned interference avoidance methods, the time and frequency based are the most relevant methods. However, due to the static nature of the frequency allocation of Wi- Fi devices, changing the channel during operation is rather difficult. Time based avoidance is already integrated in the Wi-Fi technology and would require very little modification to support Zigbee. Instead of only detecting other Wi-Fi signals, the Wi-Fi device should also detect Zigbee devices, but the rest of the standard can remain unchanged. As mentioned before the two final methods are of no use here. Using a code based approach would require the Wi-Fi and Zigbee devices to use a completely different physical layer. The space based approach is very simple, but due to the mobility of wireless devices, it is impossible to determine the optimal setup beforehand, rendering this method useless. Electronic beamforming on static access points can be used to reduce the interference from this access point, but this is far beyond the scope of this thesis. 2.3 Wireless standards This thesis focuses on the interaction between Wi-Fi and Zigbee devices. In order to gain a better understanding of this interaction, the following sections will explore these wireless standards. While these standards are quite comprehensive, only the modulation format of the Zigbee signals and the channel assessment are relevant, so the discussion will be limited to these parts of the standard.

24 2.3 Wireless standards IEEE The Zigbee technology is a collection of high level protocols based on the IEEE standard [5]. This standard is available online for free and contains all the relevant information about the physical layer. Modulation The modulation process of the 2.4 GHz physical layer is shown in figure 2.5. Figure 2.5: IEEE modulation process The first step converts the data bits into symbols. Each data-byte is split in half and each half is mapped onto one of 16 symbols. The four LSBs map onto the first symbol, while the four MSBs map onto the next symbol. Each data symbol is then mapped onto a 32-chip pseudorandom noise sequence to spread the signal. The symbol rate of 62.5 ksymbols/s leads to an effevtive chip rate of 2 Mchips/s. This increases the required bandwidth for the modulated signal, but it will reduce the required SNR for successful demodulation. Figure 2.6: Example of O-QPSK modulation

25 2.3 Wireless standards 10 Symbol Bits Chip sequence Table 2.3: Symbol to chip mapping In the final step the chip sequence is modulated onto the the carrier using O-QPSK with halfsine pulse shaping. The QPSK modulation means that even-indexed chips are modulated on the in-phase component and the odd-indexed chips are modulated on the quadrature component. The offset modulation indicates that the quadrature component is delayed by one chip period (0.5 µs). This reduces the possible phase shift of the signal as only one bit will change at a time. CCA The IEEE standard includes three ways to determine wheter the channel is available: Mode 1: Energy above threshold In this mode the CCA will report the channel as busy if the measured energy is above a certain threshold. This energy is measured over an 8 symbol period (128 µs).

26 2.3 Wireless standards 11 Mode 2: Carrier sense only When sensing the carrier, the CCA will only report the channel as busy if a valid IEEE signal is detected. This means different wireless signals will not influence the transmission. Mode 3: Carrier sense with energy above threshold The final mode is a logical combination of the two previous modes. This can mean that both conditions must be met, or that any condition is sufficient. Coexistence Appendix E of the IEEE standard considers the influence of the and standards. Of particular interest is the graph showing a simulated PER versus the distance between a b transmitter and a receiver. Figure 2.7: PER for an receiver interfered by an b transmitter 1 As this plot clearly shows, interference from a standard Wi-Fi device within a 50 m radius can have a very detrimental effect on the Zigbee communication. Hopefully the work done in this thesis will be able to reduce this effect IEEE Standard for Local and metropolitan area networks Part 15.4: Low-Rate Wireless Personal Area Networks (LR-WPANs) Amendment 1: MAC sublayer. Reprinted with permission from IEEE, 3 Park Avenue, New York, NY USA, Copyright 2012 by IEEE.

27 2.3 Wireless standards IEEE g There are several IEEE standards, but we will focus on the IEEE g standard [4]. This standard is quite similar to the IEEE a standard but is intended for the 2.4 GHz ISM band. It is fully backwards compatible with the older 2.4 GHz standard (IEEE b) but adds an extended rate PHY (ERP). Only a network where all devices are ERP capable will be able to support the highest possible bit rate. This type of network is the configuration targetedted in this thesis, but it should also support mixed networks as these a have less strict timing requirement. Due to the higher transmit power of a Wi-Fi device, the Wi-Fi signal will often interfere with the Zigbee communication instead of the other way around. So the most important specification here is the clear channel assessment. CCA Before transmission the CCA specified in the IEEE g has a short period during which the channel is sensed. If during this period a valid signal above -76 dbm is detected the channel is considered busy. The duration of this sensing period depends on the network configuration: in a pure g network, this period is 4 µs, while in a mixed network it is 15 µs. This is a result of the increased slot time (see table 2.4). Parameter Mixed network Pure network Slot time 20 µs 9 µs Rx/Tx Turnaround 5 µs 5 µs CCA Time 15 µs 4 µs Table 2.4: IEEE g CCA parameters [, WIFI] In order not to break the standard, any modification to the CCA should fit within this 4 µs window. This is a very strict requirement and it is in fact the most limiting factor in this thesis.

28 2.4 Conclusion Conclusion This chapter started with a short description of the regulatory problems inherent in wireless communication and the resulting interference problems. The next section discussed the possible ways to avoid this interference and time-based interference avoidance was chosen as the method to be used. In the final section the relevant parts of the wireless standards were discussed and it was concluded that any modification to the Wi-Fi device has to be able to detect the presence of a Zigbee signal within 4 µs.

29 DETECTION 14 Chapter 3 Detection As the previous chapter explained, there are several methods to avoid interference on a wireless channel. In order to use these methods, the occupation of the channel must be determined. The first part of this chapter will discuss several methods to detect a signal and list the merits of each method. The goal is to use these detection methods instead of the standard Wi-Fi channel assessment without breaking the standard, so the short detection period also has to be taken into account. In the second part of this chapter, the selected detection methods are simulated in Matlab and the results are presented. 3.1 Methods The most common methods to detect the presence of a signal are energy detection, matched filtering and cyclostationary detection [8]. The following sections will give a short explanation of each method and highlight their relevant properties Energy detection Energy detection [9, 10] is the simplest detection technique, the architecture of which is shown in figure 3.1. The energy of all signals on the channel is calculated and accumulated. The obtained value is then compared to a predetermined threshold to decide whether the channel is available. The simplicity of this detection process has two significant advantages: first, the processing requirements are very low (and introduces almost no delay) and secondly, the detector will detect all signals in the channel, independent of the modulation.

30 3.1 Methods 15 Figure 3.1: Energy detection The downside of this detection method is the limited sensitivity: while the sensitivity increases when the energy is averaged over a longer period, the detector will be unable to detect any signals below a certain SNR [11] even when averaging over long periods of time. To avoid this problem more advanced detection methods can be used, but these will have their own drawbacks Matched filtering In the case of energy detection, no signal specific information was used to perform the detection. When using matched filtering, the received samples are filtered by a known receiver filter that is derived from the transmit filter (figure 3.2). Figure 3.2: Matched filtering This detection method has the highest possible sensitivity [12] and is a part of most demodulation schemes since it maximizes the SNR. In this case the actual demodulation is not necessary, but the only the energy of the resulting signal is required. Just like energy detection, the energy level is compared to a threshold to make the decision. The increased sensitivity is the biggest benefit of this method. Compared to energy detection, the additional filtering will introduce a small delay, but this will not pose a significant problem.

31 3.2 Simulation Cyclostationary detection The final detection method uses the cyclostationary nature of a signal to detect its presence [8, 13]. A signal is cyclostationary if its mean and autocorrelation exhibit periodic characteristics. Due to the modulation of wireless signals, almost all wireless signals are cyclostationary. Figure 3.3: Cyclostationary detection To detect the presence of a cyclostationary signal, the cyclic autocorrelation function is calculated (see figure 3.3): this consists of an FFT followed by a spectral correlation. Depending on the exact format of the detected signals, this function will exhibit certain characteristics that allow detection and even classification of the signal. This method will perform well when used over a sufficiently long period of time [13], but in this case the detection period is too short to obtain the full advantage of this method. Additionally the computational complexity of this method is very high due to the correlation calculations Conclusion Due to the very short detection time (4µs), cyclostationary detection was discarded as a detection method. While it can detect arbitrary signals, the signal to be detected is known to be a Zigbee signal. This means that matched filtering can be implemented to provide optimal results while having a lower computational complexity. Since the use of energy detection is basically free, this method will also be implemented. 3.2 Simulation In order to test the performance of energy detection and matched filtering, both methods were implemented in Matlab and used to simulate the detection rates. The simulations were performed with signals generated according to the IEEE PHY specification (see chapter 2). In a second test, actual Zigbee signals were used to test both methods.

32 3.2 Simulation Overview The Matlab simulation starts by mapping a random bit-sequence to the corresponding chips and modulates this chip-sequence. The modulated signal is transmitted over a channel that is assumed to be an AWGN channel. On the receiving end, the detectors process the noisy signal and decide whether the channel is occupied or not. The results of the detection process is then compared to the realy channel occupancy and the resulting detection rates were calculated. The detection threshold was set so the percentage of false positives (channel idle but detected as busy) was below 5% Generated signal To test the sensitivity of the detectors, the simulation was run for different SNR values. The percentage of false negatives (detection failures) is shown in 3.4. As expected, the matched filtering has the best performance and beats energy detection by about 5 db, but energy detection also produces viable results. Figure 3.4: Simulation results Real signal Sample data from a Zigbee device connected to the WARP was recorded using a stock WARPLab configuration [14] provided by the WARP project. This configuration captures raw samples on the WARP and imports them in Matlab (figure 3.5).

33 3.3 Conclusion 18 Figure 3.5: Signal recorded with WARPLab At this point it was not possible to change the attenuation between the Zigbee device and the WARP, so measurements for different SNR values are not available. It was however possible to verify the functionality of the detection methods (figure 3.6). Figure 3.6: Detection of the recorded signal 3.3 Conclusion In this chapter an overview of three detection methods was given. Two of these methods, energy detection and matched filtering were implemented in Matlab and a simulation showed that both methods could be used to detect Zigbee signals in a 4µs period.

34 PLATFORM 19 Chapter 4 Platform The goal of this thesis is to have an actual implementation of the detection methods. This chapter starts by listing the requirements of the platform, followed by a discussion of the possible platforms. It ends with a decision on the platform that will be used. 4.1 Requirements The platform must allow for the detection of a Zigbee signal in a short timeframe as well as be able to act as a regular Wifi device. This leads to the following main requirements Low level access To implement the detection methods from the previous chapter access to the raw samples is required. Since Zigbee signals use the same spectrum as Wi-Fi devices, any radio capable of receiving Wi- Fi signals should also suffice to receive Zigbee signals (given a strong enough signal). The most limiting factor will be the processing of the samples: if the hardware performs fixed processing of the signal (demodulation,... ) before any custom processing can be done, it is impossible to implement the detection methods. It should also be possible to delay the transmission of a packet when a Zigbee signal is detected, otherwise the detection itself can t be used to avoid interference. If the CCA happens automatically when starting a transmission, this might not be possible.

35 4.2 Platforms Low latency As mentioned in chapter 2, the channel assessment time in the g standard is only 4 µs. After this period the radio switches from receive mode to transmit mode. When it has finished the results of the detection should be available. This leaves a very small time frame in which the detection has to be performed. As a result the processing should happen in real-time and the latency should be as low as possible. This automatically excludes straight software solutions running on a standard pc. While powerful PCs are certainly capable of processing data in real time, the operating system and communication overhead will cause a significant delay that makes it nearly impossible to meet the strict deadline Wi-Fi support This last requirement is not strictly necessary to implement the detection methods, but it would allow for additional tests measuring the influence of the different detection methods on actual Wifi and Zigbee traffic. Without a Wifi implementation it possible to measure the detection rate and calculate the Zigbee packet error rate. While this is already useful information, a complete Wi-Fi implementation would allow measuring the effects on real Wifi and Zigbee traffic. 4.2 Platforms Wi-Fi card The most obvious candidate is a commercial Wi-Fi card. A card like this would be a cheap and readily available solution, but also has quite a lot of drawbacks. Since low level and low latency is required, modifying available drivers running on the host PC is not an option, as raw samples are not available at this level. On a lower level the firmware running on the card can be modified, but even on this level, access to the raw samples is not possible since the physical layer is often implemented in hardware. For example a standard Intel Pro/Wireless 2200BG card contains a controller that runs the firmware and a separate transceiver chip that handles the physical layer. The source code for

36 4.2 Platforms 21 (a) Front - transceiver (b) Back - controller (c) Antenna Figure 4.1: Intel Pro/Wireless 2200BG card the firmware running on this chip is not available without an NDA, but looking at the open source broadcom firmware confirms that only a couple of PHY parameters can be changed. A Wi-Fi card already includes a working Wi-Fi implementation and the results could be used in common consumer devices, but the previous problems mean that it is simply not possible to use this platform SDR While Wi-Fi cards are designed specifically for a single purpose, software defined radio (SDR) platforms are the complete opposite and can be used to receive and transmit any wireless signal, as long as it fits within the bandwidth of the system. As the name suggests, most of the processing in a SDR is done in software and can easily be changed. This makes for a very flexible platform but also requires more powerful and thus more expensive hardware that can handle the high speed processing. The general architecture of a SDR contains three parts. The analog frontend is very similar to the one of a regular radio and contains the analog hardware. The receiver chain amplifies, filters and mixes the incoming RF signal so it fits within the bandwidth and range of the ADC. The transmitter chain is responsible to amplify and mix the signal from the DAC for transmission. The second part converts between the analog frontend and the digital backend. The bandwidth

37 4.2 Platforms 22 Figure 4.2: Architecture of a simple SDR of the system is determined by the bandwidth of the ADC and DAC, while the dynamic range is determined by the resolution of ADC. Finally the digital backend is responsible for processing the samples from the ADC and generating the waveforms for the DAC. Depending on the bandwidth this requires quite a lot of processing power, so this is often done by a specialized DSP processor or an FPGA, but a general purpose CPU is also possible. Figure 4.3: A Softrock SDR that connects to a line-in input The audio card in a generic PC together with a RF-frontend (like a Softrock receiver) can be used to create a very simple SDR. The frontend converts the signal of interest so it can be recorded using the microphone input and then processed by the CPU. This places no restrictions on the signals, as long as they fit within the bandwidth of the audio card. This is of course insufficient

38 4.2 Platforms 23 to receive Wi-Fi signals, but a very good example of the flexibility of a SDR. There are quite a lot of SDR platforms available at different price points. sections two popular platforms are discussed. In the following USRP USRP stands for Universal Software Radio Peripheral and is produced by Ettus Research. Figure 4.4: USRP product line A USRP consists of a motherboard that contains the generic hardware parts combined with a daughterboard that contains the frequency specific hardware. There are several daughterboards available for different frequency bands (table 4.1). This design allows the analog frontend to be changed for a relatively low price.

39 4.2 Platforms 24 Name Band Bandwidth TVRX MHz 10 MHz RFX MHz 30 MHz RFX MHz 30 MHz RFX GHz 30 MHz RFX GHz 30 MHz WBX 50 MHz GHz 40 MHz SBX 400 MHz GHz 40 MHz XCVR GHz 33 MHz DBSRX GHz 60 MHz LFTX DC 30 MHz 60 MHz LFRX DC 30 MHz 60 MHz BasicTX MHz 100 MHz BasicRX MHz 100 MHz Table 4.1: List of USRP daughterboards The motherboard of the high end USRP has the following specifications: Xilinx Spartan 3A-DSP 3400 FPGA Dual 100 MSPS ADC Dual 400 MSPS DAC Gigabit ethernet The bandwidth of this SDR is certainly high enough to receive Wi-Fi signals, but the FPGA embedded is fairly limited. The default configuration is to use the FPGA to stream samples over a gigabit ethernet link to a host PC that does most of the processing. This communication overhead makes it impossible to meet the short deadline, so this configuration cannot be used for the purpose of this thesis. It is possible to reconfigure this FPGA, but since it s original purpose is just to stream the samples, it is not a very powerful FPGA.

40 4.2 Platforms 25 WARP WARP stands for Wireless open-access Research Platform and is an SDR platform developed at Rice University to prototype wireless networks. Along with the hardware they also provide an open-access repository to exchange designs based on the WARP. The WARP has the following specifications: Xilinx Virtex-4 FPGA Dual 65 MSPS 14-bit ADC Dual 160 MSPS 16-bit DAC Up to 2 GB DDR2 SDRAM Gigabit ethernet, USB UART, RS-232 UART, User IO (LEDs, buttons), digital IO,... Figure 4.5: A WARP Just like the USRP, the WARP consists of a motherboard containing the digital hardware combined with up to four daughtercards that contain the analog hardware. Unlike the USRP however, only one type of daughtercard is available for the WARP, covering the 2.4 GHZ and 5 GHz ISM bands. This makes for a less flexible platform than an USRP, but since only the 2.4 GHz ISM band is of interest in this thesis, this is not a problem here.

41 4.3 Conclusion 26 As can be seen in the specifications the WARP contains a more powerful FPGA that allows for more advanced processing on the board itself. Furthermore, the WARP repository already includes an OFDM implementation. While this is not a full Wi-Fi implementation, this indicates that the platform should be capable of supporting Wi-Fi communication. 4.3 Conclusion The first part of this chapter discussed the necessary requirements of the platform in order to be able to implement the detection methods. The next section described several platforms that were considered for the implementation: although using a commercial Wi-Fi card would have many benefits, the restricted hardware prevents using them as a platform for the implementation of the detection methods. Both the USRP and the WARP are good candidates and could both be used for this thesis. The WARP is however more powerful than the USRP and has more support for modifiying the configuration of the FPGA, therefore this platform was chosen.

42 IMPLEMENTATION 27 Chapter 5 Implementation The actual implementation of the detection methods consists of a hardware part (configuration of the FPGA) and a software part (controlling the hardware). While the biggest part of the hardware is already determined by the choice of the WARP, the actual functionality of the platform is determined by the configuration of the FPGA. 5.1 Partitioning The FPGA contains both re-configurable hardware, as well as two embedded processors. The hardware can be reconfigured to perform very specific tasks, while the processors can be used in a more flexible way. One of the more important decisions in the implementation is deciding what to implement in hardware and what to implement in software. Software is more flexible and is easier to write and test, but it is only capable of executing sequential tasks. The hardware however can be configured for a very specific task and perform this task in parallel and at high speeds. Since the detection methods are cleanly defined and the processing needs to happen at a fairly high speed, it is only logical to implement them in actual hardware. The interfaces with external peripherals will also need to be implemented in the hardware fabric. The software can then be used to control these hardware modules.

43 5.2 Hardware Hardware The most basic way to configure the hardware inside the FPGA is using a hardware description languages like VHDL or Verilog that can describe the signals and interactions on an abstract level. These descriptions are processed by vendor specific tools and generate a bit-stream that can configure the actual hardware inside the FPGA to behave as described. While it is possible to design complete systems using this method, it is a fairly low level approach and several tools exist to simplify this design. The first tool is the system generator from Xilinx. This tool allows designers to use the Simulink platform to create and simulate their designs. It is especially suited to model the data-path of an application, but it can also model complete systems. In this thesis the system generator was used to create cores that were then used by the following tool. To simplify the high level design of a system an FPGA containing both custom hardware and the embedded processors, Xilinx provides the Xilinx Platform Studio. This tool allows the specification of the system by listing the hardware cores and connecting them using shared buses. It will also generate required signals like reset and clock signals. It greatly reduces the complexity of the design by sacrificing some low level control, but this trade off is not a problem Cores Xilinx already provides several hardware cores that can be used to interface with common peripherals. The WARP project also provides several cores to interface with the radio and clock boards, as well as some cores that implement various PHY and MAC layers. The only cores that still need to be implemented are the cores performing the two detection methods. Both of them are implemented using the System Generator. Energy detection The implementation of the energy detection is fairly straightforward: the signals are sourced from a block representing the ADC, the energy is calculated and fed to an accumulator. A counter keeps track of the number of samples accumulated and stops the accumulator when enough samples have been received. The output of the accumulator is compared with a threshold to determine whether a signal is present or not. Both the number of samples accumulated and the

44 5.2 Hardware 29 threshold are controlled by shared registers and can be changed in software. This makes it easy to change the parameters of the detection without re-synthesizing the hardware. Figure 5.1: Model of the energy detection The start signal is generated by a rising edge on the start register and keeping it high. This resets the accumulator, counter and ready register and starts a new detection cycle. When it is finished, the ready register will go high and the contents of the detection register will be valid. It can then be used to decide whether to start transmitting or not. Matched filtering The core for matched filtering is more complicated: since each Wi-Fi channel contains four Zigbee channels. It is possible to use a band-pass filter to filter each channel, but this would require a complex filter for each Zigbee channel. This requires quite a lot of hardware resources and it is easier to mix the signal so the Zigbee channel is located at 0 Hz. The required matched filter is now a symmetric real filter, greatly reducing the hardware requirements. The first stage of the matched filtering code contains four complex multipliers and eighth look-

45 5.2 Hardware 30 up tables that contain the signals required to correctly mix the Zigbee channels. This results in eight 40 MHz signals. Figure 5.2: Model of the matched filtering Since the Zigbee channels only occupy a small portion of this 40 MHz signal, the hardware requirements of the following stages could be reduced by filtering and down-sampling. However, the hardware is capable of directly processing these signals, so this step was not implemented. The Virtex 4 FPGA contains specific DSP slices that can perform certain DSP operations at a

46 5.2 Hardware 31 Figure 5.3: The four mixers very high rate. To take advantage of this, the eight 40 MHz signals are multiplexed into two 160 MHz signals. These signals are passed through two matched filters and multiplexed again. The final stage is very similar to the energy detection, the only difference being the number of channels. In the case of energy detection there is only one channel, now there are four. Each channel has its own accumulator and comparator. The results of each channel are then combined into a single detection signal. As is the case with the energy detection, the detection is started by a rising edge on the start register. This resets the whole system and begins a new detection cycle.

47 5.2 Hardware 32 Transmitter The initial goal of this thesis was to modify a Wi-Fi implementation so it would detect Zigbee signals, but a full Wi-Fi implementation is not available for the WARP. There are a couple of SDR Wi-Fi implementations available [15, 16], but these only use the SDR as a front-end and do all processing on a host PC. This introduces quite a lot of latency and is not acceptable. One of the reasons a powerful SDR was chosen was exactly to avoid this latency. The WARP project provides a hardware core that is capable of OFDM modulation or demodulation, but it is far from a complete Wi-Fi transceiver. While it would be very useful to have a complete Wi-Fi implementation, there was unfortunately not enough time to do this. A simpler approach was chosen by simply recording an actual Wi-Fi transmission and replaying this data to emulate Wi-Fi traffic. In order to do this, a simple transmitter core was designed. It consists of a large memory block holding the samples and a counter to address this memory. The start of transmission is controlled from software. Figure 5.4: Model of a simple transmitter Complete system The above cores are combined with the standard Xilinx cores to form the complete system. Figure 5.5 is an abstract overview of the system containing the most important parts, while figure 5.6 gives the complete overview from Xilinx Platform Studio. The ed6 plbw 0 and mf plbw 0 are the cores that have been explained in the previous section. The other cores are either provided by Xilinx or the WARP project and will be discussed briefly in the following pages.

48 5.2 Hardware 33 Figure 5.5: Schematic of the system with the most important components Processor The ppc 0 core represents one of the two PowerPC s on the Virtex 4. It runs all code controlling the other peripherals and is connected to all of them using the Processor Local Bus (PLB) or a direct connection. Memory Memory is required to store the instructions for the processor as well as the data generated by other peripherals. There are three types of memory available: Block RAM : the Virtex 4 FPGA contains special hardware RAM blocks. blocks are static, using this memory uses no other resources besides routing. Since these Distributed RAM : the re-configurable fabric of the FPGA can be configured to behave as RAM. Since it is spread around in the logic fabric, it is called distributed. Synthesizing this RAM uses the re-configurable parts of the FPGA, so care should be taken to make it as small as possible as it will reduce the area available for other purposes. External RAM : the third kind of memory is external memory. It is completely up to the designer to choose the type and size of this memory, as long as an FPGA interface is available for it. As expected this memory has the highest latency.

49 5.2 Hardware 34 Figure 5.6: System Assembly View Since the WARP includes 2 GB of external memory, this will be the main memory. A small block RAM is also used to hold the interrupt vectors. The block ram is instantiated by the bram block 0 and controlled by the block RAM controller xps bram if cntlr 0. This controller is connected to the shared PLB. The external RAM on the WARP is a 2 GB DDR2 SDRAM. This RAM is supported by the Xilinx Multi-Port Memory Controller, mpmc sdram. It is connected to the processor using two separate PLBs. Buses The communication between the processor and the peripherals is handled by several PLBs. The main PLB plb 80MHz is used transfer control commands to the peripherals. Two separate PLBs, iplb mpmc and dplb mpmc, are used to transfer data to and from memory. The former is used for instructions, while the latter is used for data. Communication There are several interfaces available on the WARP to communicate with other computers. For low speed communication a standard serial port is provided by rs232 usb. For high speed communication a gigabit link is supported by the ethernet core. To increase the throughput of this core, it is directly connected to the memory controller using a DMA controller and a LocalLink connection.

50 5.2 Hardware 35 User IO The WARP contains several buttons and LEDs to interact with the user and display information. The cores user io is responsible for controlling the buttons and some of the LEDs, while io extender controls the remaining LEDs and the hex-displays. Radio specific The WARP project provides several cores to control the radio board: rad cntlr: the radio controller contains all logic to control the radio boards. This includes resetting the radio, starting and stopping the transmitter or receiver, setting the gains,... rad bridge 2 : to abstract the radio boards, the radio controller is not directly connected to the radio boards, but instead to a radio bridge that forms a bridge between the controller and the actual hardware. eeprom contr: the radio boards contain an EEPROM chip that stores calibration data. In order to access this data, the radio controller uses an EEPROM controller. Clocking Two cores are responsible for the clocking of the board. The first core controls the clocking external to the FPGA, while the second core controls the clocking on the FPGA itself. clk brd cfg: this core controls the clock board installed on the WARP. It contains two temperature controlled oscillators that generate a 20 MHz reference clock for the radio, as well as a 40 MHz sampling and logic clock. This core cannot be clocked by a clock coming from the clock board, so it uses the uncompensated 100 MHz oscillator from the main board. clk gen: this core uses the 40 MHz logic clock produced by the clock board and synthesizes the following clocks: 240 MHz: this is the clock used by the processor. While it is capable of running at speeds of up to 300 MHz, it must run at an integer multiple of the PLB frequency. This means that the maximum frequency is 240 MHz. 200 MHz: this is one of the clocks used by the SDRAM controller.

51 5.2 Hardware 36 Figure 5.7: External clocking on the WARP 160 MHz: both the SDRAM controller and the LL connection between the memory controller and the ethernet controller require a 160 MHz clock. 125 MHz: the ethernet controller requires a reference clock of 125 MHz 80 MHz: this clock is used by the three PLBs. Some peripherals directly source their clock from the bus and can only operate at 40 or 80 MHz, so the maximum frequency that can be used is 80 MHz. 40 MHz: the radio boards have a sample rate of 40 MHz so all cores that process these samples use a 40 MHz clock. Since it is the slowest clock in the system it is also used by the reset generator. Miscellaneous There are several cores that are not directly related, but are required for the system to operate correctly. xps timer 0 : a timer is required by the TCP/IP software stack in order to detect timeouts. xps intc 0 : this interrupt controller collects the interrupt signals from the ethernet and timer core. jtag cntrl: the JTAG controller is used to debug programs running on the processor.

52 5.3 Software 37 Figure 5.8: Internal clocking on the FPGA reset gen: the reset generator generates the required reset signals to bring up the system in the correct state. mgt prot: due to a hardware fault in the Virtex 4, performance of the MGTs will deteriorate over time if they are not instantiated. This core is a dummy core that takes care of this problem. 5.3 Software As mentioned previously, the software running on the embedded processor is responsible for controlling the hardware peripherals. Due to the limited direct input and output methods of the WARP, some PC software was also written to control the WARP remotely Embedded software The embedded software consists of several drivers for the peripherals and the main application. Drivers Drivers for the Xilinx and WARP cores are automatically generated by the tools, but the drivers provided for the custom cores only contain very low level functionality (accessing addresses on the bus). To simplify the development a higher level wrapper was written containing mostly get

53 5.3 Software 38 and set functions to modify the registers of the cores. Since both detection methods have a very similar interface, the APIs provided by the drivers are identical: initialize: initializes the low level driver and resets the core. start detection: starts the detection process. stop detection: stops the detection process. set threshold: sets the threshold for detection. set duration: sets the number of samples accumulated is valid: determines wheter the detection and value outputs are valid. get value: returns the actual measurement (before comparison). detected: returns the detection state. Application The main application starts by initializing all peripherals and starting the UDP/IP stack (a TCP/IP stack is also available, but the use of TCP has no real benefit here). It will then wait for a command from the host PC to perform one of the following tasks: Change parameters There are several parameters that can be changed in software: the gain setting of both the LNA and VGA, the threshold and duration of the detection process and the time between attempted transmissions. Perform AGC Instead of manually setting the gain of the analog front-end, this can also be done automatically. A AGC core is available from the WARP project, but this core was designed specifically for their OFDM implementation and is not really suitable for this application. Furthermore, this core was developed under an NDA, which means the source is not available.

54 5.3 Software 39 To overcome this problem, a simple AGC was implemented in software. When invoked this AGC will sample the results of the detection cores and adjust the gain of the analog front-end accordingly, until the values for an empty channel reach a predetermined level. Since this simple AGC does not run continuously, the results will only be valid if the conditions remain the same. Since all testing is done under controlled circumstances and for reasonably short amounts of time, this is not a problem. The process could be changed to operate continuously, but this would provide no benefit in this case. Stream detection samples One of the most important parameters in the detection process is the detection threshold. This value determines at what level the channel is considered busy, so it should not be set to high or the detection will not work, while a low value will mean a lot of false positives. To simplify the process of determining the threshold, the actual values from the detection cores can be streamed to the host PC where the threshold can be calculated and visually inspected. Just as is the case with the AGC, this threshold will only remain valid under static conditions, but again this is not a problem. Start testing When all parameters have been set the actual tests can be run. A test consists of running the detection methods for a while at set intervals and starting a transmission if the channel is free. When a test is finished, the results are reported back to the host PC Host software As mentioned in the previous section the software running on the FPGA executes tasks based on instructions from a host PC. Since the PC to FPGA communication happens over a serial port and an ethernet connection, any language that supports these standards can be used to create the host software. Since most processing is done on the FPGA, the speed of the PC software is not critical. For this reason the PC software was implemented in Python. Besides the simplicity and flexibility of Python, it is also very easy to create a visual interface and plot graphs (see figure 5.9).

55 5.4 Conclusion 40 Figure 5.9: Screen-shot of the host software 5.4 Conclusion In this chapter the actual implementation of the detection methods was described. In the first part, the hardware part of the implementation is explained, followed by a second part briefly explaining the software.

56 MEASUREMENTS 41 Chapter 6 Measurements 6.1 Setup The test setup used for these measurements is based on the Wilab Qosmotec setup. This setup consists for four RF-shielded boxes that can contain any wireless device. All boxes are connected to each other by a splitter and a variable attenuator. As can be seen in figure 6.1, this setup alows for a full mesh configuration with a variable attenuation between each pair. In the original configuration, three of the boxes contained both a Wi-Fi and Zigbee device while the fourth one only contained a Zigbee device. Figure 6.1: Original Qosmotec configuration

57 6.1 Setup 42 Since the Qosmotec setup is used for other experiments as well, the integration of the WARP had to done in a way that would not interfere with the current setup. To achieve this, the WARP was placed in the fourth box and directly connected to a free attenuator. This allows someone to effectively isolate the WARP from another experiment by using the highest possible attenuation for this link. The signal from the attenuator is then fed to a three way splitter together with the original signal coming from the fourth box. The output of this splitter is then used in this new configuration like the signal from the fourth box was used in the old configuration. When performing experiments withouth the WARP, the only noticeable difference will be an increased attenuation of the signal from the fourth box due to the extra splitter. Figure 6.2: New Qosmotec configuration All cables, splitters and attenuators cause a minimal attenuation that cannot be reduced. The minimal attenuation from the WARP to another device is calculated in table 6.1. Type # Attenuation (db) Short coax Long coax 2 3 1:2 Splitter 2 6 1:4 Splitter 2 10 Attenuator 2 14 Total 69.6 Table 6.1: Minimal attenuation

58 6.2 Measurements 43 In this worst case scenario the minimal attenuation that can be achieved by this setup is around 70 db. Simple measurements indicate that this is an overestimation and the real attenuation is approximately 65 db (depending on the measured path). While this is still a fairly high number, it still leaves a comfortable margin since the region of interest is located below -76 db (this is the standard IEEE detection threshold [4]). The WARP inside the Qosmotec is controlled by an embedded Zotac PC running linux. A gigabit ethernet link provides a direct link with a desktop PC to process data. During the first tests the embedded PC controlling the WARP crashed several times, each time requiring manual intervention to reboot. It turned out that the cooling inside the Qosmotec box was insufficient and caused the PC to overheat. Re positioning the PC in front of one of the ventilation holes solved this problem and prevented it from happening again. The remaining hardware (both Zigbee and Wi-Fi devices) are controlled by the standard WiLab interface. An overview of this configuration is shown in figure 6.3. Figure 6.3: Experiment control setup 6.2 Measurements Standard interference A first test was performed to validate the assumption that Wi-Fi signals have a much bigger influence on Zigbee communication than Zigbee signals have on Wi-Fi devices. To measure this interference, the one-way throughput between two Wi-Fi and two Zigbee devices was recorded.

59 6.2 Measurements 44 The scenario can be seen in figure 6.4. Both device pairs are set up to transmit at the highest possible speed: the Zigbee transmitter is continuously sending the same packet as fast as possible, while the Wi-Fi client is running an iperf speed test on the server. This includes overhead from the MAC layer, but since only relative speeds are of interest here, this is not a problem. The strength of the interfering signal is controlled by a variable attenuator (all other attenuators are set for minimal attenuation). Figure 6.4: Configuration for the first test The results of this test can be seen in figure 6.5. The throughput (relative to the maximum throughput) is plotted with respect to the attenuation of the interfering signal. Due to the minimal attenuation in this setup, the interfering Zigbee signal was not strong enough to have any effect on the Wi-Fi communication so the Wi-Fi signal itself had to be attenuated. This is the reason for the negative numbers on the x-axis. It should be noted that these numbers do not include the static attenuation.

60 6.2 Measurements 45 Figure 6.5: Results of the interference measurement These results clearly show that the Zigbee communication is more prone to the interference from a Wi-Fi signal than the other way around. This can be attributed to the higher transmit power of the Wi-Fi device Detection rate In this test the actual detection rate of the various detection methods was measured. This scenario (figure 6.6)consists only of a Zigbee-device and the WARP, connected through a variable attenuator (all other attenuators set at minimal attenuation). Figure 6.6: Configuration for the second test

61 6.2 Measurements 46 A direct digital connection between the two devices is also made. When its radio is turned on, the Zigbee device will pull this line high, indicating to the WARP that the medium is busy. This allows the WARP to accurately calculate the detection rate by comparing the output of the detection cores with this signal. The data gathered in a region of 10µs around a transition on the line will be discarded, as exact synchronization between the Zigbee radio and the microprocessor controlling this line is not possible. Figure 6.7 presents the results of this test. The detection rate is plotted against the received signal strength. For each signal strength value, the detection threshold value was calculated on the host PC to have the highest possible detection rate while keeping the false posives under 5% Using this threshold value, one million detection cycles were performed and the results reported back to the host PC. Figure 6.7: Detection rate As expected the matched filtering performs better than the energy detection method. While the gain is not as big as expected from the simulation results in chapter 3, it is still an improvement of around 4.5 db. Compared to the standard Wi-Fi detection threshold of -76 dbm, this system performs significantly better.

62 6.2 Measurements Modified system In the final test, the transmission core is used to interfere with the Zigbee communication. This time, the WARP only uses the output of the detection cores and starts a transmission if the channel is empty. This is done to emulate actual Wi-Fi traffic, but since a complete Wi-Fi implementation is not available, a recorded Wi-Fi frame is replayed. The setup is shown in figure 6.8. Figure 6.8: Configuration for the third test Since the WARP must be able to receive the signal from the Zigbee transmitter, it is impossible to isolate both devices from each other. To make sure the transmitter was not influenced by the replayed Wi-Fi packets, the CCA on the Zigbee device was completely disabled. The results are shown in figure 6.9. The results confirm those obtained in the previous test: around -80 dbm the energy detection method can no longer reliably detect the Zigbee signal so the throughput starts to degrade. In the case of the matched filtering, this happens around -84 dbm. Figure 6.9: Results of the detection system in action

63 6.3 Conclusion Conclusion This chapter started of with a description of the setup used to test the implemented detection methods. Several tests were performed to test the performance of the detection methods and the results confirm that it is possible to improve the coexistence between Zigbee and Wi-Fi devices, while still following the relevant standards. Testing the influence of the new detection methods was only possible for the Zigbee communication, since no complete Wi-Fi implementation is available, but these tests already show promising results. 6.4 Future work While the results presented in this chapter already prove that improved coexistence between Zigbee and Wi-Fi devices is possible, there are some ways that were not explored in this thesis due to time constraints but would provide even better and more reliable results. The first is a complete Wi-Fi implementation on the WARP. In this thesis, the Wi-Fi traffic was emulated by replaying a recorded Wi-Fi frame, but this is rather unrealistic. It completely ignores the upper layers and thus not represent realistic traffic patterns. A second improvement would be to modify the CCA of a Zigbee device. Using matched filtering, reliable detection of Zigbee detection is possible in a 4 µs period. Using this method, the duration of the channel assessment period for Zigbee devices can be reduced greatly, increasing the possible throughput. The ultimate goal would be a hybrid implementation of both Zigbee and Wi-Fi on the WARP. This would make for a very flexible solution that combines the best of both worlds. This is however quite complicated and could easily take another year.

64 SOFTWARE INSTALLATION 49 Appendix A Software installation In order to develop applications for the WARP, both the Xilinx design studio and Matlab must be installed. After installation, some modifications are required to use the WARP supplied tools. To obtain the installers for Matlab and Xilinx design studio a valid license has to be obtained. The warp tools have to be downloaded from the WARP subversion repository: svn export WARP A.1 Xilinx software The first and most important tool to install is the Xilinx design studio. When installing the Xilinx tools, care should be taken to select the Embedded or System Edition. This will install all required Xilinx tools (this installation will require more than 12 GB of free space). The version used in this thesis was A.1.1 Driver installation The development machine for this thesis was linux-based desktop PC. High quality linux drivers are available for the Xilinx cables, but they need to be installed manually. This can be done by performing the following tasks: 1. Install the fxload utility. On Fedora this can be done by running the command: su -c yum install fxload

65 A.1 Xilinx software Copy all usb*.hex files from <xilinx dir>/ise DS/common/bin/lin/ to /usr/share/: su -c cp <xilinx dir>/ise_ds/common/bin/lin/usb*.hex /usr/share 3. Add the following udev rules (in /etc/udev/udev.rules/): ATTRS{idVendor}=="03fd", ATTRS{idProduct}=="0008", MODE="666" SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd", \ ATTRS{idProduct}=="0007", RUN+="/sbin/fxload -v -t fx2 \ -I /usr/share/xusbdfwu.hex -D $tempnode" SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd", \ ATTRS{idProduct}=="0009", RUN+="/sbin/fxload -v -t fx2 \ -I /usr/share/xusb_xup.hex -D $tempnode" SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd", \ ATTRS{idProduct}=="000d", RUN+="/sbin/fxload -v -t fx2 \ -I /usr/share/xusb_emb.hex -D $tempnode" SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd", \ ATTRS{idProduct}=="000f", RUN+="/sbin/fxload -v -t fx2 \ -I /usr/share/xusb_xlp.hex -D $tempnode" SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd", \ ATTRS{idProduct}=="0013", RUN+="/sbin/fxload -v -t fx2 \ -I /usr/share/xusb_xp2.hex -D $tempnode" SUBSYSTEMS=="usb", ACTION=="add", ATTRS{idVendor}=="03fd", \ ATTRS{idProduct}=="0015", RUN+="/sbin/fxload -v -t fx2 \ -I /usr/share/xusb_xse.hex -D $tempnode"

66 A.1 Xilinx software After connecting the WARP, the output of the command lsusb should contain the following line: Bus 001 Device 006: ID 03fd:0008 Xilinx, Inc. If the device ID is not 0008, the firmware did not get loaded and the driver will not work. Try restarting the PC to make sure the udev rules get loaded or execute the command manually. A.1.2 WARP cores To make the WARP cores available follow the next steps: 1. Start XPS:. <xilinx dir>/ise_ds/settings64.sh xps 2. Go to Edit Preferences Set the global search path to <warp dir>/edk user repository (figure A.1) Figure A.1: Set the global search path

67 A.2 Matlab Restart XPS for the changes to take effect. The WARP cores should now be available when designing a system (figure A.2) Figure A.2: WARP cores in the XPS catalog A.2 Matlab A Matlab version compatible with the installed Xilinx version should be used. (see http: // for details). In this thesis version R2011a was used. This installation must include simulink in order to use the Xilinx System Generator. To add the WARP blockset, run the following matlab commands: addpath <warp dir>\platformsupport\warp_toolbox\warp Blockset savepath rehash toolboxcache rehash toolbox clear all functions Opening simulink should show the newly installed blocks (figure A.3)

68 A.2 Matlab 53 Figure A.3: WARP Simulink blocks

69 SIMPLE FPGA PROJECT 54 Appendix B Simple FPGA project Designing an FPGA system can be a very daunting task and a large amount of time of this thesis was spent working out this process. The easiest way to explain this process is by example, so this appendix will explain the development of a simple system that blinks a LED with a variable frequency. B.1 Hardware The hardware design of this system will consist of designing a core that toggles a single signal with a variable frequency. This core is integrated in an embedded system and the toggled signal is connected to a LED so the result can be verified visually. B.1.1 Blinking core This simple core will be implemented using the Xilinx System Generator. Start the System Generator by running sysgen. Create a new model and copy the setup shown in figure B.1.

70 B.1 Hardware 55 Figure B.1: Simple blinker model There are a couple of blocks that need additional configuration: System Generator: This block tells the system generator tools how the model should be compiled. To generate a core that can be used in the next step, the compilation target must be set correctly, along with the FPGA type (figure B.2). Figure B.2: System generator configuration

71 B.1 Hardware 56 EDK processor: Compilation into a hardware core requires additional information like the memory map. To update this information, open up the block and add all found registers (it should look like figure B.3). Figure B.3: EDK processor block - memory map Counter: The standard counter only has an 8-bit output precision, but this will overflow easily. Changing this to 32 avoids this problem. Period Register: The standard register size is only 16 bits. Increase this to 32 bits to allow longer periods. The final step is compiling the model. This is done by opening the System Generator block and clicking the Generate button. For this simple model the compilation should complete in under 5 minutes, but for more complicated models it can take hours. B.1.2 Embedded system The embedded system is created using Xilinx Platform Studio. Start this program by running the xps command and create a new project using the BSB wizard. Follow the instructions and

72 B.1 Hardware 57 make sure the following options are correct: On the first page, select a PLB system When specifying the board, do not pick the predefined WARP board. On newer Xilinx versions the resulting configuration will not work and would add unneeded complexity to this example. Choose the same configuration as shown in figure B.1.2. On the processor page, change the reference clock frequency to 100 MHz, as this example will use the 100 MHz clock on the FPGA board. On the peripheral page, increase the size of the block ram. Figure B.4: Board selection The result of the BSB wizard is a basic system that can be used for this project (figure B.5).

73 B.1 Hardware 58 Figure B.5: Result of the BSB wizard To make the designed blinker core available in XPS copy the contents of the pcore folder generated by sysgen into the pcore folder located at the XPS project root. In XPS click Project, Rescan User Repositories. The blinker core should now be available under Project Local PCores. Figure B.6: Blinker core in XPS To add the blinker core to the project, simply drag it onto the system assembly view and click the yellow orb next to it to connect it to the PLB. In the Ports tab, navigate to the blinker core and select the clock generator 0::CLKOUT0 as the source for the sysgen clk signal. Right click the output x0 signal and make it external. Figure B.7: Port configuration for the new core

74 B.2 Software 59 In the Addresses tab press the Generate Addresses button in the upper right corner to generate an address range for the new core. This will allow it to be accessed over the PLB. Figure B.8: Updated address mapping With all internal signals connected, it is time to connect the external signals. These connections are specified in the.ucf file. The rules in this file tell the synthesizing software what pins of the FPGA the external nets are connected to. Add the following lines to this file: Net fpga_0_clk_1_sys_clk_pin LOC = AM21 IOSTANDARD = LVTTL; Net fpga_0_rst_1_sys_rst_pin LOC = L23 IOSTANDARD = LVCMOS25; Net blinker_plbw_0_output_x0_pin LOC = N24 IOSTANDARD = LVCMOS25; This completes the hardware design part. B.2 Software Launch the Xilinx SDK by clicking Project, Export hardware design to SDK. This will synthesize the hardware so it might take a while. When it is finished, the SDK will start. Create a new Xilinx C Project and accept the default values. The first step is to add the XPS project path to the local search repository. This can be done in Xilinx Tools, Repositories and will make sure that the SDK can find the drivers for the blinker core.

75 B.2 Software 60 Figure B.9: Local search repository The next step is selecting the correct driver for the blinker core. By default the SDK will use the generic driver for the core, but it should use the driver generated by sysgen. Click the Modify this BSP s Settings button and go to drivers. Make sure the correct driver is selected for the blinker core. Figure B.10: Driver selection The SDK is now set up correctly and can be used to compile the software that will run on the embedded processor.

76 B.2 Software 61 Open helloworld.c in the projects src folder and replace the content with the following code: #include <stdio.h> #include "platform.h" #include <xparameters.h> #include <blinker_plbw.h> #define PERIOD // Variables holding the blinker driver data static xc_iface_t *iface; static xc_to_reg_t *blinker_period_reg; int main() { //Initialize the platform init_platform(); //Initialize the blinker driver XC_CfgInitialize(&iface, &BLINKER_PLBW_ConfigTable[0]); //Get a reference to the Period register XC_GetShmem(iface, "Period", (void **)&blinker_period_reg); //Set the value of the Period register XC_Write(iface, blinker_period_reg->din, PERIOD); //Keep looping while(1); //Clean up the platform cleanup_platform(); return 0; }

77 B.3 Running 62 B.3 Running Before running the program, the logic of the FPGA needs to be programmed. This is done by running Xilinx Tools, Program FPGA and clicking the Program button. Now we are finally ready to test the system: click the Run button. If the LED starts blinking you have succeeded in creating a simple FPGA project. The project created in this thesis is much more complicated, but this should be a good introduction to get a feel of designing for the WARP board.

78 BONUS SDR 63 Appendix C Bonus SDR In this thesis the SDR was only used for a very specific case. To demonstrate the real flexibility of an SDR platform, two examples of widely different applications using the same hardware are given. The hardware used for these was a cheap DVB-T USB dongle (<12 $) that can stream raw samples to the host PC. C.1 FM-receiver Figure C.1 shows a waterfall plot of the spectrum around 105 MHz. This frequency band is used by commercial FM stations and thanks to the high bandwidth of the SDR, up to 6 FM stations can be received and decoded at the same time. Figure C.1: Waterfall plot around 105 MHz

79 C.2 Mode-S transponder C.2 64 Mode-S transponder All airplanes are required to have a mode-s transponder installed [6]. When queried, this transponder responds with the call sign, location, speed and heading of the aircraft. The querying is done by air traffic control, but the response can be received and decoded by anyone. Thanks to the high altitude of most airplanes, it is possible to receive these replies up to km away, depending on the location of the antenna. Using a stock FM antenna placed on the windowsill, the SDR was able to receive the signal from several airplanes. The resulting positions were plotted using google earth (figure C.2). Figure C.2: Aircraft locations