Daniel Estévez
LightNews LightNews
banner
destevez.net
Daniel Estévez
@destevez.net
650 followers 66 following 300 posts
Everything space & RF. Amateur radio operator (EA4GPZ / M0HXM). PhD in Mathematics from Univ. Autónoma de Madrid. he/him
Posts Replies Media Videos
destevez.net
New blog post: V16 beacon full uplink conversation. A follow up about my decoding of NB-IoT-connected car beacon warning lights (which is a thing starting this year in Spain). This time I have made a longer recording starting before the beacon is powered on.
A waterfall of the uplink transmissions of a beacon when it first begin transmitting. This is the message exchange that is needed to register the beacon in the cell network.
January 9, 2026 at 9:23 PM
destevez.net
In this post I analyze a recording of the B20 band NB-IoT uplink of a V16 beacon, showing how to decode the NPUSCH and obtain MAC PDUs that we can inspect in Wireshark.
The list of decoded MAC PDUs shown in Wireshark. The main interest is the RRC connection setup complete message, which contains a control plane service request NAS message that embeds the beacon message.
December 29, 2025 at 5:03 PM
destevez.net
New blog post: Decoding a V16 beacon. Starting in 2026, the V16 beacon mandatorily replaces the emergency triangles in road vehicles in Spain. This beacon has a strobe light and an NB-IoT connection to the cell network that it uses to send a message containing its GNSS location.
A waterfall of the uplink of a V16 beacon. We can see an m-FSK signal that is the NPRACH, and then some single-tone and multi-tone NPUSCH transmissions.
December 29, 2025 at 5:03 PM
destevez.net
Most of the recordings have a problem regarding a huge receiver frequency drift, as shown here. This limits the sensitivity of the acquisition algorithm.

Read more: destevez.net/2025/12/firs...
A plot of the cross ambiguity function of a GPS signal. We see a vertical streak that spans almost 700 Hz. This is caused by the receiver frequency drifting during the 300 ms integration that is used to make this plot.
December 10, 2025 at 11:27 AM
destevez.net
New blog post: First analysis of the Lunar GNSS Receiver Experiment data. I have developed a high-sensitivity GPS acquisition algorithm in CUDA and ran it on the experiment datasets. 1 to 3 satellites are detected in 60% of the recordings.
An image showing the cross ambiguity function of a GPS signal. The correlation peak has high SNR and is clearly visible.
December 10, 2025 at 11:27 AM
destevez.net
The telemetry packets contain many interesting strings with log messages, which appear to be generated by a Linux system running Rocket Lab's MAX flight software.

Read more: destevez.net/2025/11/deco...
Some log messages extracted from the telemetry: /mnt/mmc0/logs/compton/inv_sts/inv_sts-1763132730.mtc.gz /mnt/mmc0/logs/compton/inv_eps/inv_eps-1762763341.mtc.gz /mnt/mmc0/logs/compton/inv_cdh_spoc_misc/inv_cdh_spoc_misc-1762770516.mtc.gz E_CMD_HIST: [ OK ] EPS_SPOC_DIO_ST_OCP_EN ENABLE_STATE=[0, Off] E_CMD_HIST: [ OK ] CDH_SPOC_IO_GPIO_STATE_SET IDX=[109] STATE=[0, E_Low] E_CMD_HIST: [ OK ] FJ_ABORT, Proc: CommsFallback E_INFO: set_st_power_state: End sequence E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo 'WAIT(2)' >> /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: sed -i '$d' /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: rm /tmp/*_files_list.txt E_CMD_HIST: [ OK ] MISC_CONFIG_PARSE, String: tlm_master.set_apid_freq(620, 0.05); E_CMD_HIST: [ OK ] FJ_START_ABS, Time: 1763146080.000000, File: CommsFallback, Args: E_CMD_HIST: [ OK ] FJ_START_REL, Seconds: 3600.000000, File: DisableComponents, Args: STA E_CMD_HIST: [ OK ] FJ_START_REL, Seconds: 0.000000, File: BackorbInit, Args: E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo PROC BackorbDownload > /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo \'CMD "MISC_SYSTEM" ("gzip -c -f -k /tmp/BackorbDownload.fj > /tmp/BackorbDownload.gz")\' >> /tmp/BackorbDownload.fj E_WARNING: LoadProc (File: FJExecute.cpp Line: 1205): Procedure found in working directory, executing: /tmp/BackorbDownload.fj E_INFO: SetThermostatMode: Setting thermostat 'EESA' to mode ClosedLoop E_INFO: SetThermostatSetpointsClosedLoop: new setpoints for ON -35.000000 deg C. OFF -30.000000 deg C.
November 19, 2025 at 9:56 PM
destevez.net
New blog post: Decoding ESCAPADE. Here I decode a recording of the ESCAPADE spacecraft that I did with an Allen Telescope Array antenna the day after they were launched. The modulation is PCM/PSK/PM with rate=1/2 Turbo code. The telemetry uses CCSDS TM frames and Space Packets.
A waterfall of the ESCAPADE-Gold telemetry signal. It shows that there are significant changes in power over time. There is a gap caused by a problem with the recording. The signal resumes at a slower data rate after the gap.
November 19, 2025 at 9:56 PM
destevez.net
I have made a new release of the Maia SDR firmware. This is a maintenance release that updates dependencies and includes some USB Ethernet connectivity improvements to Android devices.
The release changelog. Update Maia SDR to v0.12.0. Updates dependencies. Update IQEngine to latest main. Add IPv6 link-local address fe80::1/64 to simplify connecting to the Pluto by ssh before the IPv4 network is configured (for instance this can be used in Android devices that use an address of the form 10.xxx.yyy.zzz/24, which is not covered by the ipaddrmulti feature) Include IP from fw_printenv ipaddr in the Subject Alternative Names of the maia-httpd SSL certificate.
November 9, 2025 at 7:21 PM
destevez.net
New blog post: sigmf-toolkit. I present a new Python package I've made and showcase one of its tools, which adds to a SigMF file annotations for each packet in a PCAP file. This is a good way of doing protocol analysis and debugging across the physical and upper layers. destevez.net/2025/11/sigm...
A screenshot of Inspectrum that shows a waterfall containing multiple packets. Each packet is bounded with an annotation. There are also annotations for reply packets, which are not visible in the waterfall. The mouse is hovered over one packet, and the tooltip shows a dump of an IPv4 ping packet generated with Scapy.
November 2, 2025 at 2:14 PM
destevez.net
New blog post: Non-coherent m-FSK BER. Another short post in which I derive the following formula for the symbol error rate of non-coherent m-FSK and validate it using simulations. destevez.net/2025/10/non-...
A formula of the symbol error rate for m-FSK. It is a summation with m - 1 terms that contains a binomial coefficient and an exponential term that depends on the Es/N0. A plot showing the BER versus Eb/N0 of m-FSK for m=2,4,8,16,32. The results using the closed-form formula and simulations are compared.
October 25, 2025 at 9:28 AM
destevez.net
When setup timing is violated, typically the output delay becomes much larger than the nominal one, increasingly more as the data transition approaches the clock edge. This goes somewhat against the usual idea that setup violations mainly cause metastability.

Read more: destevez.net/2025/09/flip...
A simulation of a setup timing violation. A data transition from zero to one is done increasingly close to the clock rising edge. We can see the corresponding outputs in traces of different colours. As the data transition approaches the clock edge, the output delay increases a lot, until the new data is no longer captured.
September 28, 2025 at 9:03 PM
destevez.net
Using ngspice, the timing properties of the flip-flop can be measured. Here is an output delay simulation, where the output for different process corners is shown in different colours.
A simulation of output delay. Two clock cycles are simulated, and the data input first is one and then is zero, so we can see how the input data propagates to the output after the clock rising edge. Different process corners are shown with different colours in the flip-flop output voltage trace, so we can see the difference between the fastest and slowest corners.
September 28, 2025 at 9:03 PM
destevez.net
New blog post: Flip-flop timing experiments. I design an ASIC flip-flop using Magic and play around with some ngspice timing simulations of output delay, setup and hold. I have made my flip-flop (top) as small as possible, so it is half the area as the standard cell (bottom).
Two ASIC cells. The one on the top, which is the flip-flop I have designed is half as tall as the one on the bottom, which is the equivalent cell from the standard library. My flip-flop is also slightly narrower. There is a large difference between the transistor size in both cells, and also the amount of room available to route all the signals. The standard cell can route everything in one metal layer, while my flip-flop needs three metal layers.
September 28, 2025 at 9:03 PM
destevez.net
New blog post: 10 GHz FMCW radar LO board. I've finished assembling and testing my ADF4158+HMC391 3.9-4.45 GHz LO board, for which I asked for reviews a few months ago. In the post I explain some aspects of the board design, and the software I've written and testing I've done.
A photo of an assembled PCB. It is a small board with an SMA connector, a few surface mount chips, a pin header, and tiny 0402 passives.
September 4, 2025 at 9:42 AM
destevez.net
In this post I dive into the 13 spectral bands captured by Sentinel-2 and explain how they can be used to measure vegetation health and fire affectance. This image shows SWIR in red, highlighting burnt areas, NIR in green, highlighting vegetation, and visible green in blue.
A false colour image that shows short wave infrared in red, near infrared in green and visible green in blue. Vegetation looks green or bright green, depending on density. The burnt area looks red, except for some surviving vegetation which can still be seen in green.
August 19, 2025 at 10:41 AM
destevez.net
New blog post: Multispectral analysis of the Tres Cantos wildfire with Sentinel-2 data. This image shows vegetation surviving the fire in green, vegetation lost by the fire in magenta, and areas affected by the fire but with less vegetation loss (dry grass) in blue.
A false colour image that shows vegetation surviving the fire in green, vegetation lost by the fire in magenta and burnt areas of low vegetation in blue. In green we can see the parks in Tres Cantos, and the creeks and forests highlighted. In magenta we see a large part of the Monte de Viñuelas woodland, which has been burnt severely, as well as some creeks badly affected by the fire. In blue there are areas of dry grass pastures that have burnt, mostly outside of Monte de Viñuelas and northeast of Tres Cantos. There are spotty blue-green areas in the eastern part of Monte de Viñuelas, showing partial fire affectation with trees surviving.
August 19, 2025 at 10:40 AM
destevez.net
There is now Sentinel-2 imagery for today that has no clouds and has data products that can be downloaded for free. This shows a comparison between 2025-08-10 and 2025-08-13.
August 13, 2025 at 8:17 PM
destevez.net
The above image was supposed to be an animated GIF comparing before and after the fire, but it looks like that doesn't work on Bluesky. Here are the two images.
A satellite image on a cloudless day a few days before the fire. It is shown for comparison. A satellite image of the day after the fire. There are some clouds, but most of the burnt area can be seen through a break in the clouds.
August 13, 2025 at 10:02 AM
destevez.net
On Monday there was a large wildfire in Tres Cantos, Madrid, Spain, which is where I live (my family, friends and I are all okay). Today I have found some Airbus Space Pléiades Neo imagery that shows the extent of the fire more accurately than all other source I've seen.
An animated GIF that toggles between two satellite images of the same area. One was taken on a cloudless day some days before the fire. The other one is from the day after the fire. There are some clouds, but most of the burnt area can be seen through a break in the clouds.
August 13, 2025 at 10:00 AM
destevez.net
I've made new releases of gr-satellites: 5.8.0 (GNU Radio 3.10), 4.15.0 (GNU Radio 3.9), 3.22.0 (GNU Radio 3.8). This will be the last release supporting GNU Radio 3.9 and 3.8. Maintainance for these branches will stop now.
The changelog of the release: Added Added callsign to deframer options Basic support for SigMF input CSP Address Filter block CSP ZMQ blocks Frame counter block Mobitex-NX deframer Support for JINJUSAT-1B Support for Hex20 Nila Support for NUSHSAT-1 Support for TEVEL2 satellites Telemetry decoder for TUBiX20 (TUBIN) Time-dependent delay block Time synchronization tag to Doppler correction block U482C encoder block Uplink argument to tle_to_doppler_file.py example Fixed Callsign '-' handling in Check AX.25 Address Packet size bug in AX100 deframer pybind11 bug in swap_header Timezone handling in PDU to KISS Changed Added callsign in SatYAML to BEESAT-1,-9, TUBIN, NanoFF-A,-B, and TechnoSat Improved version printout in gr_satellites CLI app Updated AX.25 packet radio examples Use GNU Radio crc_check in GNU Radio >= 3.10
August 1, 2025 at 12:08 AM
destevez.net
New blog post: n78 band 5G NR recordings. I comment on some recordings I have made that are representative of the current state of 5G deployment on this band in Spain (100 MHz cells for Movistar and Orange, 90 MHz cell for Vodafone).
An inspectrum waterfall that shows a 100 MHz 5G cell that is rather busy. We can see 7 SSB repetitions, and mostly empty uplink slots, since this is a TDD band.
July 17, 2025 at 10:32 AM
destevez.net
Some months ago I shared my design of a PCB with an ADF4158 PLL/waveform synth and HMC319 VCO intended as an LO source for an FMCW radar in the 10 GHz band. I have finished soldering all the components, and the HMC319 appears to be working. The next step is the ADF4158 config.
A photo of a small PCB with an SMA connector connected to an attenuator, two leads to supply power, a green LED, and a bunch of surface mount components, including three QFN chips. A screenshot of GQRX showing a signal at 3.786 GHz with significant phase noise. This is the output of the VCO without the PLL being configured.
July 13, 2025 at 11:33 AM
destevez.net
New blog post: Galileo OSNMA chain renewal. OSNMA is the Galileo open service navigation message authentication system, which authenticates cryptographically the navigation data broadcast by the satellites. Here I comment on a TESLA chain renewal test done on Tuesday.
A diagram taken from the ICD that shows how the TESLA chain renewal happens in two steps. In the first step, the KROOTs for both chains are transmitted alternatively and the chain and pubkey status is end-of-chain. In the second step, the system transitions to using the new chain.
July 12, 2025 at 3:49 PM
destevez.net
I compare the legacy loop filter in GNU Radio with a correct implementation of the loop filter, showing that when the bandwidths are adjusted for similar convergence time, the correct loop filter has less noise.

Read more: destevez.net/2025/07/abou...
A plot of the value of the FLL frequency accumulator during lock-in. The legacy GNU Radio loop filter and the new fixed loop filter are compared. Both converge almost at the same time, but the legacy filter has more noise after convergence.
July 2, 2025 at 10:58 AM
destevez.net
I calculate the discriminant gain and show how to design loop filter coefficients properly, pointing out what is wrong with the current GNU Radio implementation of the loop filter.
A plot of the discriminant curves of the GNU Radio and Remez band-edge filters obtained via simulation. They are compared with the slope given by the theoretical gain at zero error.
July 2, 2025 at 10:58 AM