Decoding the Entire DGPS Band At Once, Part 2

In my earlier post, I introduced a new program that decodes the entire DGPS band at once, from SDR recording files. This allows you to record the band overnight, then process the recordings in the morning, to see what stations were received.

I’ve since re-written the app, with a few additions.

The big change is the ability to decode from regular WAVE audio files, if you do not have an SDR. The app can decode from multiple DGPS channels in the same WAVE file, as many as fit in the bandwidth. So if, for example, your radio is tuned to 300 kHz USB with a bandwidth of 6 kHz, then 301 to 305 kHz fit inside and will be decoded. You could of course tune to say 299.5 kHz and squeeze in another channel. Or make the bandwidth wider. Or both!

The graph window now shows a red graph at the top, which indicates the total number of messages per minute being decoded. It can be handy as a rough guide as to how well band conditions are.

I have also added support for a few other formats of SDR recordings, Studio1, ELAD, and Sdr-Radio, in addition to SdrDx / RF Space and Perseus formats. Note that I do not have all of these programs, so testing was done with files provided by others. I think it is all working correctly, but you never know.

The app is still Mac only, but the changes to this version (which is close to a complete re-write) move me closer to being able to release a Windows version. It can be downloaded here:

A Low Pass Filter For Longwave

Recently, I have been DXing DGPS (Differential GPS) stations on the longwave band. They occupy the region from 285 to 325 kHz. I’ve been getting some pretty good results with some custom software I wrote that demodulates all of the DGPS channels (1 kHz apart) in parallel from I/Q recording files from my SDR. This lets me analyze the entire band from a set of overnight recordings. That itself is the subject of another post I am working on.

I decided to build a low pass filter that just passes the longwave band, attenuating medium wave and shortwave, in an attempt to improve reception of weak DGPS signals.

The filter is flat to about 400 kHz, then starts attenuating. It is down about 30 dB at the start of the MW band (530 kHz) and reaches about 45 dB by 700 kHz, then eventually reaches about 50 dB. My strongest local MW stations are on 1280 and 1320 kHz, so I felt this was sufficient. I did not want to attenuate signals on the longwave band itself.

Below is a schematic of the filter. I used what components I had on hand, hence the paralleling of some of the inductors and capacitors. (Click on any of the images to enlarge them to full size)

I previously wrote about Building an RF Noise Generator For Testing Filters and included some plots showing the noise spectrum taken with an AFE822x SDR running the SdrDx software. Below is a plot of the noise generator fed directly into the SDR over the range of 100 to 1700 kHz.

Next is the spectrum with the filter installed. You can see the dramatic attenuation starting above about 400 kHz. (You can see an RFI noise source around 1300 kHz from elsewhere in my lab, which I have not yet tracked down)

Below you can see the entire MW and LW bands, this is without the filter and using my 500 ft beverage antenna:

Next, with the filter installed. Most of MW is knocked out, except for a few locals and stations on the lower end of the band. 580 is WHP in Harrisburg PA with 50 kW. A few more stages on the filter might be able to attenuate that some more, but I’m pretty happy with things already.

Below is an image of the filter itself, mounted in an aluminum enclosure:

And all bundled up, ready for use:

Decoding the Entire DGPS Band At Once

DGPS stations transmit the difference between positions indicated by GPS satellite systems and the known fixed position of the station. This allows higher accuracy. DGPS transmissions are 100 or 200 baud and are transmitted on frequencies from 285 kHz to 325 kHz in the longwave band. Hundreds of these stations are operated by the Coast Guard and other agencies around the world, and they can be interesting DX targets. Each station transmits a continuous stream of messages containing correction data for GPS. These messages also contain the station ID code, so they can be used to directly ID the station.

The usual way to DX these stations is to tune your receiver to a particular frequency, run your DGPS software (which I have for Android , iPad/iPhone and Mac OS X) set for one baud rate, and wait to see what station(s) are heard on that frequency. Then change baud rates, tune to the next frequency, and try again.

Since SDRs are capable of recording a chunk of the RF spectrum directly to a disk file, I realized that a decoder could be written to demodulate all of the DGPS channels at the same time, at both baud rates. They write this data as a I/Q file, storing the complex representation of a portion of the RF spectrum. A 50 kHz bandwidth is slightly more than enough to cover the entire DGPS band. I set my SDR software up to record overnight, then in the morning I can run the recordings through the software, and see what stations are present.

The software sets up 82 SSB demodulators, two for each of the DGPS channels, one is for decoding 100 baud and the other for 200 baud, that allows me to use a more narrow filter for the 100 baud case. The output of each demodulator goes to a DGPS decoder that looks for valid messages. A message is considered valid if it starts with the correct preamble byte, is of message type 6 or 9 (the most common sent), has a z-count (which is a time code offset from the hour) that is within a few seconds of what it should be, and passes the 6 bit parity word test. This eliminates the vast majority of bad message decodes, although every so often one will sneak through. This is because you can get multiple bit errors on a message that corrupt both the data and parity word in such a way that the parity check still passes. It is still necessary to visually inspect the decodes, and decide if a seemingly amazing DX catch is realistic, or more likely just a bad decode.

Below is a screenshot showing the output of approximately 24 hours of recordings of the DGPS band.

The columns containing the following information:
• Count: the number of decodes of this station.
• ID: ID number of the station, stations transmit either the ID or one of the reference IDs.
• RefID1: The first reference ID of the station.
• RefID2: The second reference ID of the station.
• kHz: Frequency.
• Baud: The baud rate, 100 or 200.
• City: Station Location.
• Country: Station Location.
• Lat: Station latitude.
• Lon: Station longitude.
• km: The distance to the station from your location.
• deg: The bearing to the station from your location.

Below is a text copy of the data:

   Count   ID ref1 ref2  kHz Baud                           City              Country      Lat      Lon     km Deg
      22  918  310  311  286.0  200                    Wiarton, ON               Canada    44.75   -81.12    655 330
   94810  804    8    9  286.0  200                 Sandy Hook, NJ        United States    40.47   -74.02    267  70
     117  886  272  273  287.0  100               Fort Stevens, OR        United States    46.21  -123.96   3772 296
   17277  942  340  341  288.0  200                   Cape Ray, NL               Canada    47.64   -59.24   1667  52
     680  809   18   19  289.0  100             Cape Canaveral, FL        United States    28.47   -80.55   1288 195
   43711  806   12   13  289.0  100                     Driver, VA        United States    36.96   -76.56    306 172
    7955  869  168  169  290.0  200                 Louisville, KY        United States    38.02   -85.31    742 258
   22384  799   44   45  290.0  200                  Penobscot, ME        United States    44.45   -68.78    858  49
     318  836  112  113  292.0  200                  Cheboygan, MI        United States    45.66   -84.47    899 319
   22854  778  192  193  292.0  100                 Kensington, SC        United States    33.49   -79.35    721 197
   45542  803    6    7  293.0  100                   Moriches, NY        United States    40.79   -72.76    379  69
     255  814   28   29  293.0  200               English Turn, LA        United States    29.89   -89.95   1601 231
   44167  771  196  197  294.0  100                   New Bern, NC        United States    35.18   -77.06    502 180
   25472  929  312  313  296.0  200          St Jean Richelieu, QC               Canada    45.32   -73.32    693  24
    1519  830  100  101  296.0  100            Wisconsin, Point WI        United States    46.71   -92.03   1438 307
   50006  792  136  137  297.0  200                       Bobo, MS        United States    34.13   -90.70   1361 247
    2018  937  330  331  298.0  200              Hartlen Point, NS               Canada    44.58   -63.45   1237  59
    9872  831  102  103  298.0  100             Upper Keweenaw, MI        United States    47.23   -88.63   1252 315
   22843  866  162  163  299.0  200                   Sallisaw, OK        United States    35.37   -94.82   1635 258
   20580  926  318  319  300.0  200            Riviere du Loop, QC               Canada    47.76   -69.61   1072  31
     692  871  172  173  300.0  100                   Appleton, WA        United States    45.79  -121.33   3584 295
       1  828  246  247  301.0  100                   Angleton, TX        United States    29.30   -95.48   2035 241
   97637  847   58   59  301.0  200                  Annapolis, MD        United States    39.02   -76.61     82 156
      42  972  901  902  302.0  200                     Miraflores               Panama    8.99    -79.58   3384 184
      73  881  262  263  302.0  100                 Point Loma, CA        United States    32.68  -117.25   3613 270
      10  816   32   33  304.0  100               Aransas Pass, TX        United States    27.84   -97.07   2255 240
   43885  777  218  219  304.0  200                     Mequon, WI        United States    43.20   -88.07    998 296
      64  919  308  309  306.0  200                   Cardinal, ON               Canada    44.78   -75.42    579  12
   85388  772  198  199  306.0  200                   Acushnet, MA        United States    41.75   -70.89    562  64
    1196  934  336  337  307.0  200                 Fox Island, NS               Canada    45.36   -61.10   1440  58
     568  971  903  904  307.0  200                          Gatun               Panama    9.26    -79.94   3358 185
     899  927  316  317  309.0  200                     Lauzon, QC               Canada    46.82   -71.17    920  28
   88266  870  170  171  309.0  200                Reedy Point, DE        United States    39.57   -75.57    123  96
    3939  944  342  343  310.0  200                Cape Norman, NL               Canada    51.51   -55.83   2082  44
   33700  863  156  157  311.0  200                 Rock Island IL        United States    42.02   -90.23   1139 287
    3263  935  334  335  312.0  200               Western Head, NS               Canada    43.99   -64.67   1123  60
   18438  827  244  245  312.0  200                      Tampa, FL        United States    27.85   -82.54   1410 202
    7487  925  320  321  313.0  200                      Moise, QC               Canada    50.20   -66.12   1440  32
     269  764  210  211  314.0  200                    Lincoln, CA        United States    38.85  -121.36   3723 283
   28554  808   16   17  314.0  200                 Card Sound, FL        United States    25.44   -80.45   1613 192
    3502  940  338  339  315.0  200                  Cape Race, NL               Canada    46.66   -53.08   2068  60
   14236  864  158  159  317.0  200             St Paul [Alma], MN        United States    44.31   -91.91   1328 297
     115  936  332  333  319.0  200            Point Escuminac, NB               Canada    47.08   -64.80   1277  46
   66589  838  116  117  319.0  200                    Detroit, MI        United States    42.31   -83.10    587 301
   19514  865  160  161  320.0  200              Millers Ferry, AL        United States    32.10   -87.40   1258 231
   14448  862  154  155  322.0  200                   St Louis, MO        United States    38.62   -89.76   1104 267
    9262  839  118  119  322.0  100                 Youngstown, NY        United States    43.24   -78.97    426 337
   83262  844   94   95  324.0  200               Hudson Falls, NY        United States    43.27   -73.54    490  34

Most likely the Wiarton and Angleton decodes are corrupted messages, as the frequencies they use are both dominated by strong semi local signals.

Another way to look at the decoded data is with this graph, that shows the times that messages were received from each station (click to view full sized):

You can see the various times stations were decoded. There are cases where a single decode was received (just a thin line), which was possibly a garbled message. But there are also cases for DX stations where several messages in a row were received (a thicker line). It is quite improbable that many messages were garbled in a row, with exactly the necessary bit errors to change the ID of the station, but also preserve the parity word check.

It is interesting to observe how two stations on a given frequency will alternate reception, as one fades out and the other fades in.

A very preliminary beta version of this program, Amalgamated DGPS, is available for download for those who wish to try it. It is only for Mac OS X, and requires I/Q recording files made in either the RF Space or Perseus format (and note that I have only tested with the former, the latter should work, but you never know). While there is no Windows version available at present, I may have one available shortly, so stay tuned!

Building an RF Noise Generator For Testing Filters

It’s often handy to have an RF noise generator when testing various circuits, especially filters. I was working on a low pass filter for long wave, and wanted a way to measure the performance of the filter.

This is the noise generator I came up with. It’s a fairly simple circuit:

A zener diode as the noise source. Zener diodes, when conducting a very low current, produce a wide spectrum of noise. In this case I used a 6.8 volt zener diode, similar values should work as well.
A single NPN transistor used to amplify the noise form the zener diode.
A variable resistor to adjust the current through the zener diode for maximum noise.
Three resistors, four capacitors, and an inductor (to filter out noise you don’t want, from the power supply).

In my case, I powered the generator from a 12 volt DC power supply, you could use a 9 volt battery as well, if you wish.

Below is the schematic (you can click on any of the images to see them full sized):

The incoming DC power is filtered by the inductor and two capacitors.

Next it goes through the variable resistor as well as a fixed 10K resistor, so that the maximum current through the zener diode is limited to a safe value during adjustment. The noisy zener diode current is then applied to the base of the transistor, used as a common emitter amplifier. I used a 2N3904, other values should work as well, though you may need to adjust resistor component values. The 0.1 uF capacitor keeps the voltage on the zener diode relative constant.

The 680 and 1000 ohm resistors in parallel are values I had in my parts bin, suitable to use in parallel based on the current to the base of the transistor. The transistor output is the AC coupled through another 0.1 uF capacitor.

Below is a photograph of the circuit, build on the lid of a 1 pint paint can. I have a number of these from geiger tubes that I purchase for use in radiation detectors that you can plug into your computer for experiments as well as long term measurements and graphing. Hey, want to buy one of my geiger counters? Full details are here:

OK, back to the noise generator. The paint can lids are handy for prototyping RF circuits. You can built them dead bug style on the bottom side of the lid, test them out, then put them on the can for your RF shield, as shown below. The two connectors are a BNC jack for the RF output, as well as a standard DC power jack for the power supply.

For looking at the generated noise spectrum, I used the fabulous SdrDx SDR software by Ben, AA7AS, along with an AFE822x SDR.

Below is the noise level with the RF noise generator powered off (you can see an RFI noise source around 1300 kHz from elsewhere in my lab, which I have not yet tracked down):

And with it powered on:

The increase in noise level is about 50 dB, very suitable for testing filters and such.

Running an RTL SDR USB Dongle On Your Mac The Easy Way With Cocoa RTL Server

I’ve had a few of the RTL radio tuner dongles for a while. These are USB devices that were originally made for use as TV tuners overseas, but it turns out that you can access the I/Q data stream, and turn them into an SDR (Software Defined Radio). They can be tuned roughly over a range of 25 to 1700 MHz, and sometimes even higher, depending on the tuner IC chip inside the particular dongle.

I previously posted about how to get the RTL dongle working on the Mac here: An SDR for $17 – The R820T USB RTL-SDR DVB-T Dongle and here: An SDR for $17 – The R820T USB RTL-SDR DVB-T Dongle – Part 2. These posts were from 2013, and I did the installation on a Mac running OS X 10.6, using some pre-built libraries.

Fast forward to the present day. I got a new Mac running OS X 10.11 El Capitan, and I wanted to be able to use the RTL dongles with my favorite SDR software on the Mac, SdrDx. Enter Cocoa RTL Server.

Cocoa RTL Server is a stand alone app that interfaces with an RTL dongle. It does not require you to build or install any drivers or libraries. It just works. It’s based off of an open source app called SoftShell, that I heavily extended. Cocoa RTL Server also acts like a networked SDR, following the RF Space protocol. That means it works with SdrDx, as well as any other SDR app on the Mac that supports RF Space SDRs like the netSDR. You can download a copy of the app from the Cocoa RTL Server page. Source code is included, however I am not offering any support for the project or final app.

Here’s a screenshot of the app running:

Getting up and running is easy:

1. Plug in your RTL device
2. Run CocoaRTLServer 2.0
3. Select the device from the popup menu (usually it is already selected)
4. Change the rtl_tcp or tx_tcp port values if needed
5. Click Open
6. Configure your SDR app (set the correct TCP port) and run it

I’ve run it under Mac OS X 10.6, 10.10 and 10.11, It should run under 10.7-10.9 as well. It only works with RTL devices with an E4000 or R820T tuner IC.

Using SdrDx, I can tune a large portion of the FM broadcast band, click to view full size:

In this case I am tuned to 97.9 MHz. To the left of the signal meter, you can see it has decoded the station ID from the RDS data. Yes, SdrDx decodes RDS.

If you look at the lower right corner, you see the scope display of the demodulated FM audio. There are markers for the portions of interest:
You can see the main audio above the green marker to the left.
The stereo pilot at 19 kHz (red marker).
The stereo subcarrier (aquamarine)
The RDS data (orange)
The 67 kHz SCA subcarrier (purple)
The 92 kHz SCA subcarrier (yellow)

Cocoa RTL Server also includes a server that emulates rtl_tcp, so it works with Cocoa1090 which decodes aircraft transponders that transmit on 1090 MHz. It should also work with any other app that gets data from rtl_tcp. Here’s a screenshot of Cocoa1090 running:

Using an SDR-14 or SDR-IQ with Mac OS X 10.11 El Capitan (Also applies to 10.10 Yosemite)

If you use an SDR-14 or SDR-IQ with Mac OS X 10.10 or 10.11, you may run into issues due to Apple’s built in FTDI USB driver, which prevents the FTDI D2XX library from accessing it. Previously you could just unload the driver when you wanted to run your SDR software, but Mac OS X 10.11 El Capitan compounds the problem by making that impossible under normal conditions. This is part of Apple’s System Integrity Protection (SIP), also known as “rootless” mode.

SIP prevents any user, even those with system administrator (“root”) privileges, modifying a number of operating system directories and files.

Unfortunately this also prevents you from stopping the use of Apple’s built in FTDI driver, which you must do in order to run applications that use FTDI’s D2XX library. In our case, to stop the use of Apple’s built in driver, we need to install a codeless kernel extension (kext). This extension claims priority over Apple’s built in driver, but doesn’t actually do anything, leaving the device available for the D2XX library to access it. It should also work under 10.9 Mavericks, making it unnecessary to unload the Apple kext each time you want to use your SDR.

Before continuing, please note that you perform all these steps at your own risk. Guaranteed to blow up your Mac. blah blah blah.

To disable SIP on Mac OS X 10.11 El Capitan:
1. Restart your Mac.
2. As soon as you hear the startup chime, hold down Command-R and keep it held down until you see the Apple icon and a progress bar.
3. After you have booted into Recovery Mode, select Terminal from the Utilities menu.
4. At the prompt type: csrutil disable
5. You should see a message saying that SIP was disabled.
6. Select Restart from the Apple menu.

If you’re running Mac OS X 10.10 Yosemite, you can disable kernel extension code signing:

1. Open the Terminal application
2. Type the following: kext-dev-mode=1
3. Press return and enter your administrator password
4. Reboot.

The next step is to install a codeless kernel extension. It won’t actually do anything, other then prevent the built in Apple FTDI USB driver from being used with the SDR. You can download unsigned codeless kernel extension (kext) files, along with a copy of the SDR-xx Server app, here:

Under El Capitan and Yosemite, it needs to be installed in /Library/Extensions./
If you need to load an unsigned kext in Mavericks, it should be in /System/Library/Extensions/

For El Capitan and Yosemite, we would type the following at the Terminal prompt (assuming you’re in the directory containing the kext file):
sudo cp -r SDR14USBFTDICodelessKext.kext /Library/Extensions

In Mavericks:
sudo cp -r SDR14USBFTDICodelessKext.kext /System/Library/Extensions

For an SDR-IQ, you would use the file SDRIQUSBFTDICodelessKext.kext instead, as it has a different USB PID (Product ID).

You should then be able to plug in your SDR-14 or SDR-IQ, and see it is found by the SDR-xx Server app. Note that to run SDR-XX Server, libftd2xx.1.0.4.dylib needs to be installed in /usr/local/lib
cp libftd2xx.1.0.4.dylib /usr/local/lib

You can then run SdrDx or another SDR app that expects a networked SDR.

I can’t provide individual assistance with getting this to work, but feel free to post questions as comments, and maybe I or someone else can provide an answer.

Cocoa1090 Mode S (ADS-B) aircraft transponder decoder for Mac OS X

Cocoa1090 is a Mode S (ADS-B) aircraft transponder decoder for Mac OS X, written for use with RTL-SDR devices (RTL based USB tuner dongles). These transmissions are at 1090 MHz, and can be received at a distance of a few hundred miles, often even with a modest antenna.

Cocoa 1090 uses rtl_tcp, part of the free RTL-SDR package, to control the RTL device, and produce I/Q data.

Some tips for installing RTL-SDR are here:

Cocoa1090 displays all received aircraft, including the altitude, heading, speed, and flight number, as well as the tail number and aircraft model (if it is part of the included database, you can add your own tail numbers). Some transponders include position information, this is also displayed if received, and used to map those planes (Click on the image below to see it full size):

Cocoa 1090 is free, a copy can be downloaded from the website:

Measuring The Velocity Factor of Coax Using an SDR

Recently I had the need to measure the velocity factor of some coax. The velocity factor of a transmission line is ratio of the actual propagation of radio signals through the cable vs the speed of light in a vacuum.

Here’s the coax in question:

It’s RG-6U, for which I have seen published velocity factors ranging from 0.65 to 0.85, depending on the manufacturer and type of dielectric. This coax was laying in my junk box, and I have no idea who makes it, or what the claimed specifications are. The performance of a lot of lower cost coax often widely varies from published specs, as well.

One technique to measure the velocity factor of a transmission line is to use a piece of it as an open stub, which is a section of transmission line connected to another line via a Tee connector. The added transmission line is open at the other end, hence the term “open” stub. The open stub will act as a notch filter for frequencies with a wavelength close to four times the length, in other words the stub is 1/4 wavelength.

For this measurement, I used an SDR (Software Defined Radio) as the measurement device. In this case an SDR-14. To generate RF I used a noise bridge.

The output of the noise bridge is a good source of wide-band RF.

Here is the Tee. On the left is the RF signal, on the bottom is the connection to the SDR, on the right is the open stub.

With the noise bridge connected, but no stub, here is what the SDR spectrum looks like, click to enlarge:

As you can see it is relatively flat. Next, we’ll connect the 1/4 stub (again, click to enlarge):

You can see the dip in the signal level, caused by the stub.

In this case, the stub was 13 ft (4 meters) of cable. Iif the velocity factor was 1.00 the wavelength would be 16 meters, the frequency 18.75 MHz. The frequency of the center of the notch is 15.7 MHz, so the measured velocity factor is 15.7 / 18.75 = 0.84.

Next I used a 9 ft 3 inch (2.85 meter) cable. The wavelength for a velocity factor of 1.00 would be 11.38 meters, the frequency 26.35 MHz. The frequency of the center of the notch was 21.8 MHz, so the measured velocity factor is 0.83.

Using both cables, the total length is 6.85 meters, the wavelength for a velocity factor of 1.00 would be 27.4 meters, the frequency 10.95 MHz. The frequency of the center of the notch was 9.1 MHz, so the measured velocity factor is 0.83.

For this piece of coax, the velocity factor seems to be 0.83, which is a reasonable value.

Boom Box Radio Early Morning Propagation Analysis

Boom Box Radio had an early morning transmission on March 10, 2013, from 1044 until 1212 UTC. They were trying to reach a listener in Guatemala. The time of this transmission, starting just before to after sunrise, lets us examine the effects of sunrise on reception on the 43 meter band.

This first waterfall shows when Boom Box Radio signed on at 1044 UTC. You can see a very faint trace appear on the waterfall about a quarter of the way up from the bottom, at 6925 kHz. Remember that with a waterfall, time flows or falls down, like with a real waterfall, so the latest information is at the top:

This next waterfall shows what happened at 1107 UTC, when the signal went from just a faint trace of a carrier on the waterfall, and no audio, to a very good S7 to S9:

Note again that the oldest information as at the bottom of the waterfall. At that time, there is just barely a carrier. Then you start to see some modulation, and then finally, in a matter of seconds, the signal shoots up to armchair quality.

Below is a graph showing the signal strength of Boom Box Radio, in dBm, from 1044 UTC sign on, until 1212 UTC sign off. You can click on it to see a larger version:

An S9 signal corresponds to -73 dBm. Every S unit is 6 dBm, so S8 is -79 dBm, S7 is -85 dBm, etc.

I have annotated several important times: The 1044 UTC sign on, 1107 UTC when the signal went up, 1125 UTC which was local sunrise, and 1212 UTC when it went off the air.

You can see that there is a very slow increase in signal level after the sign on, but the signal remains extremely weak. Then suddenly at 1107 UTC, the signal shot up to S9. Then for the rest of the transmission it mostly stayed in a range between S7 and S9.

The sudden increase in signal was caused by the Sun increasing the ionization level of the F layer of the ionosphere. This increase needs to have occurred at the point in the ionosphere where the radio waves are being reflected, most likely roughly midway between the transmitter and receiver locations. Note that in my case, this occurred before my local sunrise. This could be due two at least two factors I can think of. First, the transmitter site could be to my east. Second, the ionosphere is several hundred miles up, so it experiences sunrise before a point directly below it (on the Earth’s surface) does.

I believe this graph shows the importance of selecting the correct time for transmissions, depending on your target area. Just before sunrise is when the ionosphere is the weakest, and is only able to reflect radio waves on 43 meters at low angles. Too early in the morning, and the band is not open for local (NVIS – Near Vertical Incidence Skywave) reception. The band is, however, open for reception to more distant locations, that is, more than many hundreds of miles away (well over 500, perhaps close to 1,000 miles). If you’re trying to get out to DX locations, this is a good time to do it. Sunrise varies throughout the year, so as we move into summer, and it occurs earlier, the band will likewise open up earlier for NVIS. Likewise in the middle of winter in December, it is somewhat later.

For reference, the operator of Boom Box Radio stated that this was a Heathkit DX-60 transmitter putting out 40 watts into a 40 meter band dipole that was about 15 feet high.

I thank Boom Box Radio for conducting this early morning test.

Update: The operator contacted me again to mention that his local sunrise was at exactly 1107 UTC.

Decoding ADS-B Aircraft Transponders: An SDR for $17 – The R820T USB RTL-SDR DVB-T Dongle – Part 3

Please be sure to read Part 1 and Part 2, if you’re new to this series of articles.

All aircraft contain a piece of avionics technology called a transponder. This contains a receiver, and a transmitter. When the signal from ground radar is received, the transponder transmits a short burst on 1090 MHz, encoded with information.

There are several possible replies from an aircraft transponder:

  • Mode A replies with a target ID code
  • Mode B replies with the barometric altitude of the plane
  • Mode S, also called the Extended Squitter, is the one we’re interested in.

Mode S, also called ADS-B allows a variety of types of data to be sent from the transponder, including:

  • ICAO aircraft code (the tail number of the plane can be obtained from this)
  • Flight Number
  • Altitude
  • Location (Longitude and Latitude)
  • Heading

There’s an online document called ADS-B for Dummies that goes through the various messages, and their format.

Since the RTL dongles can receive 1090 MHz at a wide bandwidth, it turns out to be possible to use them as low cost transponder decoders. Very low cost. You can pick them up for around $15 on eBay. Dedicated ADS-B receiver packages are more. Much more. As in hundreds of dollars.

There are quite a few packages out for the RTL dongles that decode ADS-B transmissions. For Windows, there’s ADSB#:

For linux and Mac OS X, there’s Dump1090

I compiled Dump1090 for Mac OS X, here is what the output looks like:

The columns across the screen:

  • Hex – the ICAO code for the plane
  • Flight – flight number
  • Altitude – altitude in feet
  • Speed – speed in mph
  • Lat – latitude of position
  • Lon – longitude of position
  • Track – heading in degrees
  • Messages – the number of messages from this plane that have been received
  • Seen – how long ago (in seconds) since the last message from the plane, that is, how long since it has been last seen (or heard from)

I’ve since ported the Dump1090 code over to Cocoa on Mac OS X, resulting in Cocoa1090:

Cocoa1090 uses the ICAO hex code to derive the tail number (and aircraft model) from a database in a text file, which are also displayed.

A beta version of Cocoa1090 can be downloaded here: