Video summary
The video introduces a compact and affordable Software Defined Radio (SDR) badge developed by the creator alongside his co-creator, Terence. The primary goal of this project was to construct a fully functional SDR using minimal external components, relying heavily on integrated solutions to keep costs low. The device features a small glass display that overlays an internal arc design, providing a modern aesthetic while displaying data such as waterfalls and signal information. Key functionalities include local FM modulation for playing audio, I2C sampling, and the ability to receive signals up to 400 MHz by utilizing third and fifth harmonics, although it is officially rated for up to 300 MHz. The hardware architecture centers around a data detector and a high-quality audio ADC, specifically a microphone-grade converter with 24-bit depth, which provides sufficient performance for demodulating FM radio without needing expensive super-low-noise alternatives.
To achieve its impressive capabilities within a limited budget, the design leverages specific tricks and component choices that simplify the analog front end. The system uses a BGA 2817 pre-amplifier suitable for HF frequencies and a TLV3204 ADC with a 2 kHz bandwidth, which is adequate for FM demodulation requiring only about 200 kHz. A significant portion of the engineering effort went into managing noise and signal processing; for instance, the team utilized a very cheap low-noise LDO regulator to keep power supply noise minimal. The clock generation relies on an MS5351 chip programmed via a continued fraction algorithm to approximate desired frequencies accurately. Furthermore, the device employs a 40 dB programmable gain amplifier (PGA) integrated into the ADC path, eliminating the need for external variable amplifiers and allowing for adjustable sensitivity from 20 dB to 60 dB without additional components.
On the software side, the development process involved overcoming various hardware limitations and optimizing performance for real-time signal processing. The team chose C++23 over Rust due to better support for specific peripherals like I2S on their chosen CH32 MCU, utilizing FreeRTOS for asynchronous tasks while keeping RAM usage low through constant evaluation at compile time. Significant challenges arose with Direct Memory Access (DMA) alignment and specific errata regarding the I2S word select pin, which required careful timing sequences to prevent data misalignment. The software also includes a Blackman-Harris window function using cosine approximations for spectral analysis and employs CORDIC algorithms for fast arctangent calculations in FM demodulation. Despite initial issues like a shorted reset button causing sparks due to microwelding, these were identified and fixed in subsequent revisions, ensuring the device is robust enough for both hobbyist use and Capture The Flag (CTF) competitions.
Looking toward the future, the creators express interest in expanding the project's capabilities, such as adding transmit functionality to make it a full transceiver, though they note that receiving-only modes are currently more legally safe. They also envision exploring wider bandwidths, potentially up to 6 GHz, and investigating high-speed USB 3 interfaces to stream hundreds of megabytes of raw data directly to a computer. The project successfully demonstrated that complex radio functionality can be achieved at a price point under $100 by removing unnecessary components and optimizing the design for efficiency. By selling units at events like Def Con, the team proved that affordable SDR badges are viable alternatives to expensive commercial options, opening up advanced radio experimentation to a broader audience of hobbyists and developers.
Read the full video transcript
This week, I want to I mean a lot of
batch which is a software defined radio
with my co-creator Terence down here.
Yeah.
So, I'll be describing that what I did
to make it work and how do you start.
Screens look bad.
>> Yeah, the screen's a bit dodge.
>> Yeah.
So, why? Because
I found a way to make a SDR without any
other components except the pre-amp. So,
and I wanted a screen. I wanted some
audio output. I wanted I2C sampling.
Basically, I wanted everything in a
batch.
And apparently like all the components
fit together
is like cheap enough to make it easy
enough that I can finally make a batch
out of it without like spending too much
money.
So, basically the architecture is a data
detector, a good audio ADC. And by good
audio ADC, I mean like
uh microphone ADC because they advertise
24 bits bit depth or something like
this. That's good enough for me.
Yeah.
So, the main functionality will be like
uh
It's quite portable. You can see it's
quite small down here. And then it's a
local FM modulation. You can play like
FM audio. I'll be passing this around.
Unfortunately, I brought the wrong one
without antenna connector. So, you need
to use a finger to find the capacitor.
Yeah. And then that will be your volume
antenna and you can listen to here.
Yeah. No, I think I didn't follow the
SMA.
>> So, so so you know the trick that is
normally used in classic receivers.
>> You have one also.
Yeah, yeah, one of you.
Yeah. You can also use yours to pass it
around if you wish to.
Yeah, so I think I just pass this
around.
>> Yeah. So, you know the trick that's
normally used in in classic receivers.
They use the the headphone receivers.
>> Yeah. That's why a lot of phones used to
do it too.
>> Was that not possible here or
>> Uh I wanted like a more professional SMA
connector so that you can like you know
connect the external antenna or stuff
stuff like this.
Yeah.
>> [laughter]
>> You can you can press the encoder and
then a few times and then it get you to
the waterfall.
I press down the encoder.
Yeah.
Uh so yes, so we can receive up to 300
MHz. Although I've actually received up
to 400 plus MHz before. By because it's
sensitive to third and fifth harmonic.
So I had some digital signal down there
that was definitely not moving
correctly. So every every 10 kHz was
moving like 30 kHz. That's why, you
know, 30 the third harmonic. And it's
592 kHz bandwidth. So I tested on FM
shortwave and it received some of those
very strong
shortwave stations on
like on short on shortwave and FM and
all your local all your local stations
do work. I already set the 92.4 now, so
you can try to like
the sudden listen to classical music or
the bass you really like.
And we have our web USB, so if you plug
it in, you can go to a web website and
the website communicate with your SDR
badge and you can like demodulate and do
IQ waterfall on the website. So it's
like
we spent quite a bit of time on the
software.
So this is how like the front works. So
we what we wanted is have sort of like a
glass display something. It It sort of
like have a arc
and then we just overlay it a screen on
top of it, so it looks like
Yeah, it it looks like the thing behind
is on on the screen in essence.
Yeah.
Uh the HDMI it doesn't like me.
Yeah.
Yeah, so yeah.
>> Okay.
All right.
So, there's actually a
There's a dark one color scheme and a
light color scheme. And you will press
it you press down a few times there's
actually a waterfall display. That's the
cool parts.
Well, also this like how this whole
thing is what is like there's a 3.5 mm
audio jack. There's a audio amplifier
here. There's a SMA connector down here.
You will have a battery charging down
here and this is where all the analog
magic happens.
How this works is that first the antenna
gets into a BGA 2817 which is just a
pre- amp which is
it's not like really low noise but it's
good enough for HF. It's not like super
low noise for like hundreds of megahertz
but it's good enough for it. And then it
feeds a quadrature taylor taylor
detector.
So, how it works is that if you have a
clock chip sort of like if you have a
one to four marks and you drive it in a
gray code manner it's like you're
dividing it into the four parts. And
then if you sort of like uh
difference the 90° and 0° and 270 180
you get I and Q out of it.
Now, the trick is that this outputs two
differential I and differential Q. And
microphone ADCs are differential so you
can just connect them together without
any like intermediate op amps or
differential amplifier. So, it was
really really easy to set up.
And the the thing about
we selected one more TLV 3204 ADC 612
I don't like 2 kHz bandwidth and it's
good enough you can you can
you need you need like 200 kHz to
demodulate FM radio so this is
just nice. Like you got 8 kHz short but
who's counting right? So,
uh
We actually tried to overclock it. Not
overclock it moved to a 384 kHz thing
but the thing is that apparently this is
sort of some sort of like
uh sigma delta ADC so you to get a lot
of noise at the high edges. So,
we are not going to spend software to
filter out the noise. So, we are just
going to let the ADCs filter out the
noise ourselves.
Uh to get this ADC filter out it
themselves instead of doing it in
software so we can free up some CPU. So,
we just keep it at 192.
I mean, technically, we could like mess
around the clock uh timing bit to make
it 200 kHz, but I'm not sure how the
internal PLL would behave. So, we just
kept it like this.
Right? And then there's a 40 dB PGA, so
you can get like variable amplifier from
like Okay, this is the 20 dB, so we can
get like 20 dB to 60 dB of amplification
variable without using any external
components. So, one ADC does
most of the analog part for us,
basically.
And the cool part is that this CH32 MCU
has USB high speed.
So, it's a full 480 Mbps high speed, so
you can stream like megabytes of data
from this raw without like dropping.
So, this is what like really made it
work because we wanted to sort of like
get the audio
to be uh we want we wanted to like
stream the audio raw without any like
without any like down sampling or stuff
like this. So, high speed was incredibly
useful for that.
And it was quite fast, 144 MHz, which is
good enough for
FFT
uh FM demodulation, SSB demodulation, AM
demodulation, and
uh almost working SD card recording
functionality.
Yeah. And some and outputting the audio
through the DAC. So, yeah, it does a lot
of stuff in 144 MHz.
So, about the power, right? So, for some
reason, I found a super cheap but really
good LDO. It was
really low low noise. It apparently this
metric like UV RMS is like 20 is
supposed to be really really low for
some reason.
And then it was like 10 cents each. So,
I just spam them uh for both for both
digital and analog.
So, this is somehow I made the noise low
enough by using this.
And for the clock chip, it was using
MS5351, which is uh arbitrary like 0 to
300 MHz clock chip. So, the idea is that
as long as you
program the frequency correctly
uh using some like continued fraction
algorithm, you you will be something
like
it will be correct. So, the idea of
continued fraction is that if it's just
like like 2 dots or something like this,
right? So,
uh the idea idea will be that
you want the best multiplier that will
that will have
because you have C and A and B are
somewhat like have some limited range.
So, the idea is that you want the best
numbers to approximate the the output
frequency you want. So, apparently
continued fraction algorithm was the
best way to do that. There was like a
lot of math in my It's like probably
it will give you the probably best one
below a certain range.
And up there's some other tricks like
some constraints. When you fulfill all
the constraints, you get a very nice
like sine cosine 0° and 90° output to uh
to feed inside the clock chip.
But, the issue is that for less than 3
MHz, the quadrature things stops
working. So,
the the trick will be to first you
program both outputs to the same
frequency. Then, you uh program the
second output to a slightly different
frequency. And then, you wait for a
certain amount of time for the phase to
drift to exactly 90°. Then, you switch
back to the first frequency.
So, there has to be like really
coordinated timers and low latency. So,
there's a whole bunch of stuff you have
to like you have to so you have to
basically sort of like control the
digital sources and make sure that it's
it's just nice.
Yeah.
And he drew that.
>> Yeah, I drew that.
>> Yeah.
>> No, he didn't. Peter, I think.
>> Yeah.
>> Open source on the board.
>> Oh, yeah.
>> So, there's also like we use a
four-layer PCB routing because
we wanted like a ground plane just to
center our RF thing.
And we keep the traces short. So, our
You'll see that our analog ends really
fast before everything becomes digital.
Uh yeah.
So, next thing we talk about is
software. So, software is kind of
standard. Tiny USB is the
uh Tiny USB is like the standard one to
implement a USB stack.
Uh I even contributed a few fixes for
the CH32V305.
So,
that made the sort of like that part
possible.
And we use NMSIS-DAP. It's like the
CMSIS-DAP, but the FFT functions. So,
someone already wrote like good FFT FFT
functions for RISC-V, so we don't have
to write it ourselves. That's good.
The screen is just ST7789 normal. And we
decided to just write everything in C++
23 because we can. Because
uh we don't want to use C, and we want
to use all the nice functions not nice
things of C++. So, we use a lot of
things like const eval, const expert to
uh generate the constants on compile
time. The code of compiler would
sort of like read our code,
read the const eval code, and then
you'll generate all the constants on
compile time.
And then
we don't we don't have to like have a
separate build step to like put the
constants in my dot C file or something.
So, this was really really
uh useful for us to like precompute
everything instead of doing it in run
time.
It saves RAM, too. Yeah.
Everything is just audio streaming,
quite normal.
And the real software development as
usual is clang tools.
>> [laughter]
>> But it's okay because
like as you know, embedded development
means that you have a lot of
boilerplate. So, most of the boilerplate
is done with this. And then the ones
that really need performance like FFT,
demod, that one is sort of like went
through by hand to make sure that
uh every It's like you get a kind of guy
to count instruction by hand so that if
it's really 144 megahertz. So that for
some reason it doesn't really give you
very optimized code. Just give you
really really slow code at first. Then
you have to sort of prompt it to give
you faster and faster and faster code
until we use like
CORDIC
to
do the arctangent for the FM demo.
And that was
kind of great because we had like two
different algorithms. One One is using
the What do you call it? The Remez
algorithm where we fit some fifth degree
polynomial over some range and you
compute.
But the thing is that apparently this
was less accurate than using the CORDIC,
which is some sort of a successive
halving sort of binary search like
algorithm.
So
this was very useful to get that part
optimized so that we can get 192
kilohertz of like arctangent on each
sample very very very fast.
Yeah, but
one bad thing is that
apparently it's very kind of got a
really bad with DMA. So
it likes to program the DMA as in like
program the DMA, wait for it to end,
then program DMA again. So we have these
very annoying gaps and then you have to
like get it done with it. I'm trying to
use
a ring buffer as a DMA, not trying to
like
program the DMA,
wait for it to end, and do it again.
So that's that's the annoying part. So
every single thing like display,
DAC, ADC, it made the same mistake. So
they also They have to make
They have to
like be very careful about
Yeah. Some
The whole thing is just
uh
software optimization. So the main thing
is the Blackman-Harris window. We use
cosine about for that.
We want to use Rust
because
we wanted the async.
So we have uh choice between free RTOS
or Rust. Well, but the thing is that it
doesn't seem to really do help. The Rust
doesn't really support the
uh our chip really well. Like it doesn't
support I2 it doesn't support I2S or
something and that's the most important
part of our board. So, we thought about
contributing support, but then it's like
a bit too annoying. So, we just we just
used C and C++ and add a free RTOS
to do the async part instead.
And RAM usage is always a constraint.
So, every time it's like we got up to
like 20 something KB
of RAM, we kind of shrink it down. Gets
back up to 8K 20 something KB of RAM, we
shrink it down. It happens a few times.
Yeah. So, this was run by you.
And one really annoying annoying thing
we found in errata with the MCU.
So,
apparently this happened in STM32. It's
like if your WS pin for the I2S is low
or high, one of those things, right?
Uh and then you start ascending your
data over,
it will sort of like you will be
misaligned. So, instead of like chunks
of 32 that you do, right? You will you
will slip by a few bits each time. They
were like completely random.
We don't know why it happened. So,
we decided to just keep resetting the
I2S peripheral until it has correct
alignment.
So, that will take like around 32 bus
resets. So, it's good enough.
Until we found the STM32 errata. It says
that WS has to be high before enabling
I2S peripheral. That is kind of
annoying.
So, what we did instead was to just
No, actually that was kind of annoying.
Yeah. So, we tried to find a way and
then didn't work. So, apparently you
have before apparently for CH32, the
errata's on the other way which said WS
has to be low for it to sync properly.
Yeah, that took us a while to figure
out. It's just it's just one line not
statement on the if. Then everything
just worked. This thing we did one or
two tries after we after we did the fix.
Yeah, so you can see that down here,
right? So,
this probably slipped by 8 bits. So, the
last
this byte is supposed to be from the
supposed to be from the previous
32-bit packet instead of the current
32-bit packet. So, it wasn't handling
the frame sync
transition properly for some reason. I
I don't know why, but this was really
annoying. It
So, the waterfall looks really weird
when that happens because, you know, the
top bit is like one. So, everything else
looks like really big numbers instead of
supposedly very small as you have 150 as
you have. It's like much more as you
have F2. Yeah.
As usual, some really
dumb stuff. We didn't see that our reset
button shorted 3.3 volts to 12.
So, apparently it's like we
when we press the boot button,
it was physically like shutting off the
audio and and you are previewing the
overcurrent in the audio and it was
restarting it back up instead of
properly resetting the microcontroller.
We found this out after it's like the
reset button got like real hot after I
pressed it.
>> [laughter]
>> I I I heard sparks.
>> So, something
>> I guess now that the reset button got
sticky.
Because I think that it got microwelded
or something like this. It got
or something like this.
It the metal contact microwelded
somehow. I think so. And then
it's just like this. So, good thing is
we fixed it in V3. Uh we forgot to put
pull up resistors for the SPI which is
the uh SD card thing, but it didn't
matter for some reason. Somehow like the
cranker worked past it somehow. So, good
for them.
Yeah.
Oh, we got it at the 36 megahertz
without pull up.
So, I was thinking that
there was no internal pull up. It's just
somehow the cranker made it work. We I
checked the code. It's some weird
combination of you keep the pins in pull
up mode until you are ready to switch it
to peripheral then you switch it to
peripheral.
>> Oh, yeah, yeah.
>> Yeah.
>> A bunch of like schematic magic so we
decided to just make
We so we So the idea is that apparently
like we can use the resistance of the
the antenna not really resistance of amp
is output impedance at 50 ohms.
So we can just use it as a R in a RC
filter.
Yeah, so we can save a few resistors not
really but the idea is that according to
some online sources that resistors
introduce noise somehow.
And you know this they say that you
should design this tail detector without
resistors and just say that hey you can
just use the output impedance as the R
and then the sweep resistance is like 4
to 8 ohms that's your R also since that
50 458 ohms as R then put a correct C
and then it's just nice.
Like I don't know around
like 50 kilohertz of LPF.
Don't forget the ADC itself has its own
like
low pass filters so hmm.
Yeah.
And we let the ADC the microchip to DC
bias the terminal instead of like making
a DC bias ourselves. So that's another
lazy part that we did.
Yeah.
Yes.
Some like 216 ohms of R and then just
pick a correct C which is 10 nanofarads.
It's good enough.
Yeah, so at at first we wanted to do
some IQ calibration but then it broke.
So the idea is that we have a very
strong 144 megahertz that's our CPU
clock.
It leaks into our analog front end.
So we'll tune it to like 144 megahertz
minus 20 kilohertz and I check the the
IQ the sideband suppression.
And you tune the delays and all the
phase delays so that there's a very good
sideband
sideband suppression but
halfway through the development it
broke. So
Yeah, we just we just took it out. We
didn't really have time to reintroduce
it. And it it took quite long like quite
10 seconds or something to calibrate it
properly.
And we were a bit
lazy to save the calibration data in
flash, so.
Yeah.
No, he ended up making it to
He ended up using it for a CTF. You want
to talk about it, Kenneth?
Okay.
>> It's just uh
Yeah, I just had I think one of the CTF
challenges just appeared and then also
So he says, I use this board
and I had another
and I had another setup that was just
like a spare RP2040 connector or wire
and that wire was outputting I think 8
MHz PWM.
>> Mhm.
>> So I just use this for one of the simple
CTF challenges.
>> And then we sold it in Def Con 34 back
side village. So we had a drop 1:30 p.m.
both days.
Yeah.
But it was pretty cool. A lot of people
were like
quite interested that there was even SDR
badge for quite affordable prices.
Because like most other SDRs you see are
like really really expensive, so.
Removing the like making the cost down
low enough was part of our
big
Yeah, so
Future SDR badges ideal 6 GHz maybe. But
with 20 MHz of bandwidth like extra wide
band SDRs.
Well, I'm not transmitting, so it's more
it's more legal that way.
>> Less illegal isn't it?
>> Yeah, less illegal.
Yeah, I'm looking at receive, but we are
thinking of transmit also.
We are thinking of transmit also. Okay,
there's a bunch of other stuff, like
okay,
by the transmit,
six is like less than 100 bucks, so.
Yeah.
So, I guess that HF direct sampling,
maybe you can sample the entire HF band
at once with a very fast ADC. That's
something I'm quite interested in.
And USB 3, like if you could get the ADC
to be like completely USB 3.
So, you have the ADC and then you stream
like hundreds of megabytes per second
over you to USB 3 to your computer, that
would be pretty cool.
Yeah. So, this is our
If anyone has like ideas, do let me
know, cuz we are interested in making
more SDRs. So,
yeah.