NR and LTE Cellular PSS Band Scanner

This example uses:

This example shows how to scan for 5G NR and 4G LTE cellular activity using a software-defined radio (SDR) and preamble detection. The example scans over LTE and NR bands and uses an SDR preamble detector to detect and capture the primary synchronisation signals (PSS). The example uses helper wireless signal descriptor objects to configure the SDR preamble detector for each center frequency, then plots the detected activity across each band.

Introduction

In this example, you use hNRPSSDescriptor and hLTEPSSDescriptor helper objects to describe 5G NR and 4G LTE PSS that you want to detect and capture. Using the configureDetector helper function, you then configure an SDR preamble detector for each signal by setting the following parameters:

Center frequency
Sample rate
Preamble
Trigger offset

After you detect the signals, you postprocess them for visualisation and analysis. This diagram shows the workflow.

Cellular band scanner example workflow

Describe Wireless Signals

Describe the 5G NR and 4G LTE cellular signals to look for using the hNRPSSDescriptor and hLTEPSSDescriptor helper objects. Use the checkboxes to select the cellular standards and the edit fields to specify the bands to scan. The helper objects generate a descriptor object for each frequency where a PSS is expected. For 5G NR, these are the global synchronization channel numbers (GSCN). For 4G LTE, these frequencies are the E-UTRA absolute radio frequency channel numbers (EARFCN).

wsds = []; % Descriptions of wireless signals to search for
if false% Select to scan for NR
    % Specify bands according to 3GPP 38.104 v17.6 Table 5.4.3.3-1 [1] as a
    % string array, e.g. ["n25","n78"]
    nrBands = "n78"; 
    for nrBand = nrBands
        wsds = [wsds, hNRPSSDescriptor(Band=nrBand)];
    end
end
if false% Select to scan for LTE
    % Specify bands according to TS 36.104 Table 5.7.3-1 v18.1 [2] as a
    % string array, e.g. ["band1","band20"]
    lteBands = "band20";
    for lteBand = lteBands
        wsds = [wsds, hLTEPSSDescriptor(Band=lteBand)];
    end
end

Create and Configure Radio as Preamble Detector

Set Up Radio

Call the radioConfigurations function. The function returns all available radio setup configurations that you saved using the Radio Setup wizard.

savedRadioConfigurations = radioConfigurations;

To update the dropdown menu with your saved radio setup configuration names, click Update. Then select the radio to use with this example.

savedRadioConfigurationNames = [string({savedRadioConfigurations.Name})];
radio = savedRadioConfigurationNames(1) ;

Configure Preamble Detector

Create a preambleDetector object with the specified radio. Because the object requires exclusive access to radio hardware resources, before running this example for the first time, clear any other object associated with the specified radio. In subsequent runs, to speed up the execution time of the example, reuse your new workspace object.

if ~exist("pd","var")
    pd = preambleDetector(radio);
end

To update the dropdown menu with the antennas available for capture on your radio, call the hCaptureAntennas helper function. Then select the antenna to use with this example.

captureAntennaSelection = hCaptureAntennas(radio);
pd.Antennas = captureAntennaSelection(1);

Tune Preamble Detector

Set the adaptive threshold gain, the adaptive threshold offset, and the radio gain values of the preamble detector for the local environment. Calibrating these values requires manual tuning by exploring the trigger points provided by the plotThreshold function. For more information on tuning these values, see Triggered Capture Using Preamble Detection.

pd.ThresholdMethod = "adaptive";
pd.AdaptiveThresholdGain = 0.35;
pd.AdaptiveThresholdOffset = 0.01;
pd.RadioGain = 30;

Scan for Wireless Signals

Use the configureDetector helper function to configure the preamble detector with an appropriate preamble, trigger offset, sampling rate and center frequency. Set the detection timeout to 20 milliseconds which is the expected periodicity of a 5G NR synchronization signal block (SSB). Then use the capture function to detect and capture the described NR or LTE signal. If the detection is successful, save the captured signal and metadata. For large bands, the scan takes several minutes.

capturedPSSignals = [];
wb = hCaptureWaitBar(length(wsds));
for wsd = wsds
    hUpdateCaptureWaitBar(wb,wsd)
    pd = configureDetector(wsd,pd,OversamplingFactor=2);
    [data,timestamp,~,status] = capture(pd,length(pd.Preamble), milliseconds(20));
    if status
        % Save to structure
        capturedPSSignals = [capturedPSSignals,struct(Data=data, Timestamp=timestamp, SampleRate=pd.SampleRate, Descriptor=wsd)];
    end
end
close(wb)

Tabulate and Plot Detections

Calculate Power

Calculate the power of the captured PSS sequences.

fullscale = single(intmax('int16'));
for ii = 1:length(capturedPSSignals)
    % Calculate the power of the IQ samples in the detected PSS
    power = mean(abs(single(capturedPSSignals(ii).Data)).^2);
    % Calculate the dBFS value for the power    
    powerDBFS = 10*log10(power/fullscale^2);
    capturedPSSignals(ii).Power = powerDBFS;
end

Tabulate Detected Signals

Display the detections in a table.

if isempty(capturedPSSignals)
    disp("No wireless signals were detected.")
    return
end
detectedWirelessSignals = [capturedPSSignals.Descriptor]';
nrlteDetectionTable = table;
for ii = 1:length(capturedPSSignals)
    nrlteDetectionTable(ii,:) = table(...
        string(class(detectedWirelessSignals(ii))),...
        strjoin(string(detectedWirelessSignals(ii).Band)),...
        detectedWirelessSignals(ii).CenterFrequency/1e6,...
        detectedWirelessSignals(ii).NID2,...
        capturedPSSignals(ii).Power,...
        VariableNames=["Detected Wireless Signal","Bands","Center Frequency (MHz)","NID2","PSS Power (dBFS)"]);
end
disp(nrlteDetectionTable)

    Detected Wireless Signal        Bands        Center Frequency (MHz)    NID2    PSS Power (dBFS)
    ________________________    _____________    ______________________    ____    ________________

      "hNRPSSDescriptor"        "n48 n77 n78"            3554.4             1          -19.966     
      "hNRPSSDescriptor"        "n48 n77 n78"            3694.1             1          -18.894     
      "hLTEPSSDescriptor"       "20"                        806             0          -20.921     
      "hLTEPSSDescriptor"       "20"                        806             1          -20.974     
      "hLTEPSSDescriptor"       "20"                        816             1          -19.795

Plot Detected Signals

For each band, plot the power of the detected signals.

bands = unique(nrlteDetectionTable.Bands)';
for band = bands
    figure();
    detectionsInBand = nrlteDetectionTable(nrlteDetectionTable.Bands==band,:);
    baseVal = floor(min(detectionsInBand.("PSS Power (dBFS)")/10))*10;
    s = stem(detectionsInBand,"Center Frequency (MHz)","PSS Power (dBFS)",BaseValue=baseVal);
    s.DataTipTemplate.DataTipRows(3)=dataTipTextRow("NID2",detectionsInBand.NID2');
    type = extractAfter(extractBefore(detectionsInBand(1,:).("Detected Wireless Signal"),"PSS"),"h");
    title(type+" PSS detections in band(s) "+band)
    axis([min(detectionsInBand.("Center Frequency (MHz)"))-1,max(detectionsInBand.("Center Frequency (MHz)"))+1,...
        baseVal, ceil(max(detectionsInBand.("PSS Power (dBFS)")/10))*10]);
end

Further Exploration

Consider using the NR Cell Search and MIB and SIB1 Recovery (5G Toolbox) example and the Cell Search, MIB and SIB1 Recovery (LTE Toolbox) example to synchronize, demodulate, and decode the NR and LTE cellular signals you detected. To capture the MIB and SIB, capture a wider bandwidth by specifying a greater sampling rate. You can save the captures to baseband files, which are compatible with the examples.

if false% Save captures to baseband files
    for pssCapture = capturedPSSignals
        wsd = pssCapture.Descriptor;
        pd = configureDetector(wsd,pd,SampleRate=15.36e6);
        [data,timestamp,~,status] = capture(pd,milliseconds(10), milliseconds(20));
        if status
            bbw = comm.BasebandFileWriter(extractAfter(extractBefore(class(wsd),"PSS"),"h")+...
                string(wsd.CenterFrequency)+"_NID"+string(wsd.NID2)...
                +"_"+string(datetime(timestamp,"Format","yyyyMMddHHmmssSSS"))+".bb",...
                pd.SampleRate,wsd.CenterFrequency,...
                struct(WirelessSignalDescriptor=class(wsd),CenterFrequency=wsd.CenterFrequency,...
                Band=char(wsd.Band),NID2=wsd.NID2,Timestamp=char(timestamp)));
            bbw(data);
            release(bbw);
        end
    end
end

References

3GPP TS 38.104. "NR; Base Station (BS) radio transmission and reception." 3rd Generation Partnership Project; Technical Specification Group Radio Access Network.
3GPP TS 36.104. “Evolved Universal Terrestrial Radio Access (E-UTRA); Base Station (BS) Radio Transmission and Reception.” 3rd Generation Partnership Project; Technical Specification Group Radio Access Network.