OpenCL accelerated TDD FDD LTE-Cell-Scanner is coming.

Discussion:

Jiao Xianjun

2014-03-29 11:24:21 UTC

Hello there,

New features coming:

1. Now MATLAB isn't needed. All in C/C++. All you need are rtl-sdr dongle
and Linux computer. TDD and FDD are both supported. External LNB/Mixer
(allow mixer and A/D use non-coherent clock sources) is also supported.

2. OpenCL parallel computation is supported! It searches per frequency
point in

0.5s (desktop i7-3930K 6 ***@3.2GHz) 22x faster!
or 2~3s (ThinkPad T410 i5 CPU ***@2.40GHz).

Intel, AMD and Nvidia OpenCL SDK are tested. Acceleration ratio is gotten
by Intel SDK.

Nvidia GPU hasn't reached so amazing acceleration ratio. It maybe because
of slow PCI-E and memory. I haven't found time to optimize on that.

Another open source OpenCL lib pocl - Portable Computing Language (
https://github.com/pocl/pocl) is also tested, and it seems as fast as
Intel's! (See video I attached in the end.)

3. Some improvements on algorithm. Higher sensitivity and more robust.

video:

(in china) http://pan.baidu.com/s/1o6qbLGY

Have fun with LTE. Have fun with OpenCL!

BR

Jiao Xianjun (Ryan)

Hi there,
https://github.com/Evrytania/LTE-Cell-Scanner
https://github.com/JiaoXianjun/LTE-Cell-Scanner
(Not reviewed by James Peroulas, so it is just experimental currently.)
It works fine with rtl-sdr E4k tuner dongle below 2.2GHz, but doesn't work
in 2.5~2.7GHz even with external MMDS-LNB.
Because the algorithm assumes analytic relationship between carrier and
sampling frequency error.
I write some matlab scripts (https://github.com/JiaoXianjun/rtl-sdr-LTE )
to separate carrier and sampling processing in algorithm. Aided by
MMDS-LNB, the scripts can detect TDD&FDD LTE cell in 2.5~2.7GHz now!
12 LTE Cells information are decoded. 2 are FDD LTE, the rest are TD-LTE.
Because here is China! (Partly because that TD-LTE is announed earier than
FDD by government)
Hope that in the future these features can be merged to original
LTE-Cell-Scanner.
Scanning results and video are attached.

Jiao Xianjun

2014-03-29 11:29:09 UTC

Permalink

forget to insert repo address:
https://github.com/JiaoXianjun/LTE-Cell-Scanner

Jiao Xianjun (Ryan)

Post by Jiao Xianjun
Hello there,
1. Now MATLAB isn't needed. All in C/C++. All you need are rtl-sdr dongle
and Linux computer. TDD and FDD are both supported. External LNB/Mixer
(allow mixer and A/D use non-coherent clock sources) is also supported.
2. OpenCL parallel computation is supported! It searches per frequency
point in
Intel, AMD and Nvidia OpenCL SDK are tested. Acceleration ratio is gotten
by Intel SDK.
Nvidia GPU hasn't reached so amazing acceleration ratio. It maybe because
of slow PCI-E and memory. I haven't found time to optimize on that.
Another open source OpenCL lib pocl - Portable Computing Language (
https://github.com/pocl/pocl) is also tested, and it seems as fast as
Intel's! (See video I attached in the end.)
3. Some improvements on algorithm. Higher sensitivity and more robust.
video: http://youtu.be/SxZzEVEKuRs
(in china) http://pan.baidu.com/s/1o6qbLGY
Have fun with LTE. Have fun with OpenCL!
BR
Jiao Xianjun (Ryan)

Hi there,
https://github.com/Evrytania/LTE-Cell-Scanner
https://github.com/JiaoXianjun/LTE-Cell-Scanner
(Not reviewed by James Peroulas, so it is just experimental currently.)
It works fine with rtl-sdr E4k tuner dongle below 2.2GHz, but doesn't
work in 2.5~2.7GHz even with external MMDS-LNB.
Because the algorithm assumes analytic relationship between carrier and
sampling frequency error.
I write some matlab scripts (https://github.com/JiaoXianjun/rtl-sdr-LTE) to separate carrier and sampling processing in algorithm. Aided by
MMDS-LNB, the scripts can detect TDD&FDD LTE cell in 2.5~2.7GHz now!
12 LTE Cells information are decoded. 2 are FDD LTE, the rest are TD-LTE.
Because here is China! (Partly because that TD-LTE is announed earier than
FDD by government)
Hope that in the future these features can be merged to original
LTE-Cell-Scanner.
Scanning results and video are attached.
http://youtu.be/4zRLgxzn4Pc

Dimitri Stolnikov

2014-03-29 12:08:38 UTC

Permalink

Jiao Xianjun

2014-03-29 12:17:38 UTC

Permalink

Hi,

Very thanks!

I think one possible reason is that I narrow the frequency offset searching
range from about -200:5:200kHz to -50:5:50 kHz. Because the scanner now use
.1MHz step, why not get rid of extra searching?

You may try "--freq-start 1814.9e6 --freq-end 1815.1e6" to verify that.

But the sample is definitely useful. Would you please capture the bin file
for me? (You may find the method in README).

And,

Would you please also try to use "-t" option for the new Scanner (without
--freq-start and --freq-end) and try again? ("-t" force the scanner into
original mode).

BR

Jiao Xianjun(Ryan)

Hi Jiao,
first of all, thanks a lot for sharing your work!
LTE-Cell-Scanner/build/src$ ./CellSearch -s 1815e6 --opencl-device=1
Search frequency: 1815 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 1 PROFILE: FULL_PROFILE
Platform 0 Device 1 LOCAL_MEM_SIZE: 32768
Platform 0 Device 1 MAX_CLOCK_FREQUENCY: 3399
Platform 0 Device 1 MAX_COMPUTE_UNITS: 4
Platform 0 Device 1 PREFERRED_VECTOR_WIDTH_FLOAT: 8
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.00318098s
PSS XCORR cost 0.833934s
No LTE cells were found...
LTE-Cell-Scanner/build/src$ ./CellSearch -s 1815e6
Search frequency: 1815 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 0 NAME: Tahiti
Platform 0 Device 0 PROFILE: FULL_PROFILE
Platform 0 Device 0 LOCAL_MEM_SIZE: 32768
Platform 0 Device 0 MAX_CLOCK_FREQUENCY: 975
Platform 0 Device 0 MAX_COMPUTE_UNITS: 24
Platform 0 Device 0 PREFERRED_VECTOR_WIDTH_FLOAT: 1
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.0368459s
PSS XCORR cost 3.36666s
No LTE cells were found...
./CellSearch -s 1815e6
LTE CellSearch v1.0.0 (release) beginning
Search frequency: 1815 MHz
PPM: 120
correction: 1
Found Elonics E4000 tuner
Examining center frequency 1815 MHz ...
Detected a cell!
cell ID: 263
RX power level: -15.8443 dB
residual frequency offset: -68142.8 Hz
Detected a cell!
cell ID: 261
RX power level: -17.8496 dB
residual frequency offset: -68142.3 Hz
A: #antenna ports C: CP type ; P: PHICH duration ; PR: PHICH resource type
CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
263 2 1815M -68.1k -15.8 N 100 N one 0.99996245719114640327
261 2 1815M -68.1k -17.8 N 100 N one 0.99996245745901013446
How can i help you to debug this? Do you require a capture of this cell?
Best regards,
Dimitri
Hello there,

Post by Jiao Xianjun
1. Now MATLAB isn't needed. All in C/C++. All you need are rtl-sdr dongle
and Linux computer. TDD and FDD are both supported. External LNB/Mixer
(allow mixer and A/D use non-coherent clock sources) is also supported.
2. OpenCL parallel computation is supported! It searches per frequency
point in
Intel, AMD and Nvidia OpenCL SDK are tested. Acceleration ratio is gotten
by Intel SDK.
Nvidia GPU hasn't reached so amazing acceleration ratio. It maybe because
of slow PCI-E and memory. I haven't found time to optimize on that.
Another open source OpenCL lib pocl - Portable Computing Language (
https://github.com/pocl/pocl) is also tested, and it seems as fast as
Intel's! (See video I attached in the end.)
3. Some improvements on algorithm. Higher sensitivity and more robust.
video: http://youtu.be/SxZzEVEKuRs
(in china) http://pan.baidu.com/s/1o6qbLGY
Have fun with LTE. Have fun with OpenCL!
BR
Jiao Xianjun (Ryan)
Hi there,

https://github.com/Evrytania/LTE-Cell-Scanner
https://github.com/JiaoXianjun/LTE-Cell-Scanner
(Not reviewed by James Peroulas, so it is just experimental currently.)
It works fine with rtl-sdr E4k tuner dongle below 2.2GHz, but doesn't work
in 2.5~2.7GHz even with external MMDS-LNB.
Because the algorithm assumes analytic relationship between carrier and
sampling frequency error.
I write some matlab scripts (https://github.com/JiaoXianjun/rtl-sdr-LTE)
to separate carrier and sampling processing in algorithm. Aided by
MMDS-LNB, the scripts can detect TDD&FDD LTE cell in 2.5~2.7GHz now!
12 LTE Cells information are decoded. 2 are FDD LTE, the rest are TD-LTE.
Because here is China! (Partly because that TD-LTE is announed earier than
FDD by government)
Hope that in the future these features can be merged to original
LTE-Cell-Scanner.
Scanning results and video are attached.
http://youtu.be/4zRLgxzn4Pc

Dimitri Stolnikov

2014-03-29 12:29:48 UTC

Permalink

Jiao Xianjun

2014-03-29 12:37:33 UTC

Permalink

Thanks a lot.

I didn't care about "-c" option for a long time.... There may be an issue.

I will check it later. (Or, if you want, maybe you can contribute?).

BR

Jiao xianjun (Ryan)

Jiao,
-t works
./CellSearch -s 1815e6 -t
Search frequency: 1815 MHz
PPM: 120
correction: 1
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 0 NAME: Tahiti
Platform 0 Device 0 PROFILE: FULL_PROFILE
Platform 0 Device 0 LOCAL_MEM_SIZE: 32768
Platform 0 Device 0 MAX_CLOCK_FREQUENCY: 975
Platform 0 Device 0 MAX_COMPUTE_UNITS: 24
Platform 0 Device 0 PREFERRED_VECTOR_WIDTH_FLOAT: 1
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.0367889s
PSS XCORR cost 9.71848s
Detected a FDD cell! At freqeuncy 1815MHz, try 0
cell ID: 261
PSS ID: 0
RX power level: -13.6741 dB
residual frequency offset: -69682.9 Hz
k_factor: 1.00004
Detected a FDD cell! At freqeuncy 1815MHz, try 0
cell ID: 263
PSS ID: 2
RX power level: -14.2563 dB
residual frequency offset: -69682.9 Hz
k_factor: 1.00004
DPX:TDD/FDD; A: #antenna ports C: CP type ; P: PHICH duration ; PR: PHICH
resource type
DPX CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
FDD 261 2 1815M -69.7k -13.7 N 100 N one 0.99996160866444450122
FDD 263 2 1815M -69.7k -14.3 N 100 N one 0.99996160870007821941
as does the scan mode
./CellSearch --freq-start 1814.9e6 --freq-end 1815.1e6 --opencl-device=1
Search frequency range: 1814.9-1815.1 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 1 PROFILE: FULL_PROFILE
Platform 0 Device 1 LOCAL_MEM_SIZE: 32768
Platform 0 Device 1 MAX_CLOCK_FREQUENCY: 3199
Platform 0 Device 1 MAX_COMPUTE_UNITS: 4
Platform 0 Device 1 PREFERRED_VECTOR_WIDTH_FLOAT: 8
Examining center frequency 1814.9 MHz ... try 0
6RB filter cost 0.00319004s
PSS XCORR cost 0.845281s
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 261
PSS ID: 0
RX power level: -15.553 dB
residual frequency offset: 31977.3 Hz
k_factor: 1.00004
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 263
PSS ID: 2
RX power level: -16.3697 dB
residual frequency offset: 31976.5 Hz
k_factor: 1.00004
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.00298405s
PSS XCORR cost 0.826245s
Examining center frequency 1815.1 MHz ... try 0
6RB filter cost 0.00295711s
PSS XCORR cost 0.827149s
DPX:TDD/FDD; A: #antenna ports C: CP type ; P: PHICH duration ; PR: PHICH
resource type
DPX CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
FDD 261 2 1814.9M 32k -15.6 N 100 N one 1.0000401594555023976
FDD 263 2 1814.9M 32k -16.4 N 100 N one 1.0000401594555023976
./CellSearch --freq-start 1814.9e6 --freq-end 1815.1e6 --opencl-device=0
Search frequency range: 1814.9-1815.1 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 0 NAME: Tahiti
Platform 0 Device 0 PROFILE: FULL_PROFILE
Platform 0 Device 0 LOCAL_MEM_SIZE: 32768
Platform 0 Device 0 MAX_CLOCK_FREQUENCY: 975
Platform 0 Device 0 MAX_COMPUTE_UNITS: 24
Platform 0 Device 0 PREFERRED_VECTOR_WIDTH_FLOAT: 1
Examining center frequency 1814.9 MHz ... try 0
6RB filter cost 0.0368021s
PSS XCORR cost 3.31654s
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 261
PSS ID: 0
RX power level: -15.6869 dB
residual frequency offset: 32106.7 Hz
k_factor: 1.00004
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 263
PSS ID: 2
RX power level: -16.3225 dB
residual frequency offset: 32106.2 Hz
k_factor: 1.00004
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.0158181s
PSS XCORR cost 3.32913s
Examining center frequency 1815.1 MHz ... try 0
6RB filter cost 0.0158079s
PSS XCORR cost 3.27762s
DPX:TDD/FDD; A: #antenna ports C: CP type ; P: PHICH duration ; PR: PHICH
resource type
DPX CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
FDD 261 2 1814.9M 32.1k -15.7 N 100 N one 1.0000398256225293547
FDD 263 2 1814.9M 32.1k -16.3 N 100 N one 1.0000398256225293547
But single frequency detection seems to be broken even if i provide the
freq correction via -c.
Capture attached.
Best regards,
Dimitri
Hi,

Post by Jiao Xianjun
Very thanks!
I think one possible reason is that I narrow the frequency offset searching
range from about -200:5:200kHz to -50:5:50 kHz. Because the scanner now use
.1MHz step, why not get rid of extra searching?
You may try "--freq-start 1814.9e6 --freq-end 1815.1e6" to verify that.
But the sample is definitely useful. Would you please capture the bin file
for me? (You may find the method in README).
And,
Would you please also try to use "-t" option for the new Scanner (without
--freq-start and --freq-end) and try again? ("-t" force the scanner into
original mode).
BR
Jiao Xianjun(Ryan)
Hi Jiao,

first of all, thanks a lot for sharing your work!
LTE-Cell-Scanner/build/src$ ./CellSearch -s 1815e6 --opencl-device=1
Search frequency: 1815 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 1 PROFILE: FULL_PROFILE
Platform 0 Device 1 LOCAL_MEM_SIZE: 32768
Platform 0 Device 1 MAX_CLOCK_FREQUENCY: 3399
Platform 0 Device 1 MAX_COMPUTE_UNITS: 4
Platform 0 Device 1 PREFERRED_VECTOR_WIDTH_FLOAT: 8
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.00318098s
PSS XCORR cost 0.833934s
No LTE cells were found...
LTE-Cell-Scanner/build/src$ ./CellSearch -s 1815e6
Search frequency: 1815 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 0 NAME: Tahiti
Platform 0 Device 0 PROFILE: FULL_PROFILE
Platform 0 Device 0 LOCAL_MEM_SIZE: 32768
Platform 0 Device 0 MAX_CLOCK_FREQUENCY: 975
Platform 0 Device 0 MAX_COMPUTE_UNITS: 24
Platform 0 Device 0 PREFERRED_VECTOR_WIDTH_FLOAT: 1
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.0368459s
PSS XCORR cost 3.36666s
No LTE cells were found...
./CellSearch -s 1815e6
LTE CellSearch v1.0.0 (release) beginning
Search frequency: 1815 MHz
PPM: 120
correction: 1
Found Elonics E4000 tuner
Examining center frequency 1815 MHz ...
Detected a cell!
cell ID: 263
RX power level: -15.8443 dB
residual frequency offset: -68142.8 Hz
Detected a cell!
cell ID: 261
RX power level: -17.8496 dB
residual frequency offset: -68142.3 Hz
A: #antenna ports C: CP type ; P: PHICH duration ; PR: PHICH resource type
CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
263 2 1815M -68.1k -15.8 N 100 N one 0.99996245719114640327
261 2 1815M -68.1k -17.8 N 100 N one 0.99996245745901013446
How can i help you to debug this? Do you require a capture of this cell?
Best regards,
Dimitri
Hello there,

https://github.com/Evrytania/LTE-Cell-Scanner
https://github.com/JiaoXianjun/LTE-Cell-Scanner
(Not reviewed by James Peroulas, so it is just experimental currently.)
It works fine with rtl-sdr E4k tuner dongle below 2.2GHz, but doesn't work
in 2.5~2.7GHz even with external MMDS-LNB.
Because the algorithm assumes analytic relationship between carrier and
sampling frequency error.
I write some matlab scripts (https://github.com/
JiaoXianjun/rtl-sdr-LTE)
to separate carrier and sampling processing in algorithm. Aided by
MMDS-LNB, the scripts can detect TDD&FDD LTE cell in 2.5~2.7GHz now!
12 LTE Cells information are decoded. 2 are FDD LTE, the rest are TD-LTE.
Because here is China! (Partly because that TD-LTE is announed earier than
FDD by government)
Hope that in the future these features can be merged to original
LTE-Cell-Scanner.
Scanning results and video are attached.
http://youtu.be/4zRLgxzn4Pc

Jiao Xianjun

2014-04-02 09:17:15 UTC

Permalink

Hi Dimitri,

Now I have committed a new revision: commit
9a143636288f573fd93e1ca0feb4876b7d75dedd
In which I think -c option is working now. at least for your captured file.
(please pull all captured file from git, because header information is
added to those files)

works:

./CellSearch --loadbin ../../test/1815e6.bin
./CellSearch --loadbin ../../test/1815e6.bin -c 0.99996313297134364895

Other improvements:
0. frequency offset searching range is changed automatically (to the same
with original range of twist mode) when there is only one carrier frequency
specified.

1. add header information (mainly frequency information currently) into
captured bin files, then frequency can be recognized when captured file is
used (needn't specify explicitly).

2. now --loadbin --recbin -r -l and their cross usages are supported much
better (I think).

If you want, you may test this revision. Any issues, would you please tell
me? Appreciate!

BR

Jiao Xianjun

Post by Jiao Xianjun
Thanks a lot.
I didn't care about "-c" option for a long time.... There may be an issue.
I will check it later. (Or, if you want, maybe you can contribute?).
BR
Jiao xianjun (Ryan)

https://github.com/Evrytania/LTE-Cell-Scanner
https://github.com/JiaoXianjun/LTE-Cell-Scanner
(Not reviewed by James Peroulas, so it is just experimental currently.)
It works fine with rtl-sdr E4k tuner dongle below 2.2GHz, but doesn't work
in 2.5~2.7GHz even with external MMDS-LNB.
Because the algorithm assumes analytic relationship between carrier and
sampling frequency error.
I write some matlab scripts (https://github.com/
JiaoXianjun/rtl-sdr-LTE)
to separate carrier and sampling processing in algorithm. Aided by
MMDS-LNB, the scripts can detect TDD&FDD LTE cell in 2.5~2.7GHz now!
12 LTE Cells information are decoded. 2 are FDD LTE, the rest are TD-LTE.
Because here is China! (Partly because that TD-LTE is announed earier than
FDD by government)
Hope that in the future these features can be merged to original
LTE-Cell-Scanner.
Scanning results and video are attached.
http://youtu.be/4zRLgxzn4Pc

Jiao Xianjun

2014-06-02 02:58:58 UTC

Permalink

Hi Administrator,

May I apply that if you can add my improved LTE Cell Scanner (
https://github.com/JiaoXianjun/LTE-Cell-Scanner) to the list of APPs at
http://sdr.osmocom.org/trac/wiki/rtl-sdr

You may have found track of improvement in this mail-list. The main new
features are:
1. TD-LTE support; (Original one only support FDD mode Cell)
2. external LNB support. Just like the method of "NRF24-BTLE-Decoder",
external LNB can be added to extend band of rtl-sdr because most of TD-LTE
frequencies here are above 2GHz. But external LNB breaks strict
relationship of carrier-timing offset which is a basic assumption in the
algorithm of the original one. Algorithm is improved to support this
feature which make it work in many TDD bands locally.
3. OpenCL acceleration which accelerates speed of Cell Scanner much.
4. Capture and reload rtl-sdr raw uint8 bin file
5. Multiple tries at one frequency point to increase detection probability.
6. manual gain mode
7. ...

So many changes have been made, I think it is hard or heavy time cost for
James Peroulas (https://github.com/Evrytania/LTE-Cell-Scanner)
to review and merge back. TDD is an important feature for Chinese users.
Most released system here are TDD, FDD even hasn't been released officially
here. So I think it would be good to mention this improved Cell Scanner
somewhere, and it would be useful and interesting for people who wants to
scan TD-LTE.
( Now I have decoded LTE SIB1 successfully in the same repo by HACKRF. Some
time in the future maybe SIB decoding will be made also for rtl-sdr dongle,
because I found that some SIBs are narrow band also (6RB, similar/like
PBCH) and located in fixed frequency)

BR

Jiao Xianjun

Post by Jiao Xianjun
Hi Dimitri,
Now I have committed a new revision: commit
9a143636288f573fd93e1ca0feb4876b7d75dedd
In which I think -c option is working now. at least for your captured
file. (please pull all captured file from git, because header information
is added to those files)
./CellSearch --loadbin ../../test/1815e6.bin
./CellSearch --loadbin ../../test/1815e6.bin -c 0.99996313297134364895
0. frequency offset searching range is changed automatically (to the same
with original range of twist mode) when there is only one carrier frequency
specified.
1. add header information (mainly frequency information currently) into
captured bin files, then frequency can be recognized when captured file is
used (needn't specify explicitly).
2. now --loadbin --recbin -r -l and their cross usages are supported much
better (I think).
If you want, you may test this revision. Any issues, would you please tell
me? Appreciate!
BR
Jiao Xianjun

Jiao,
-t works
./CellSearch -s 1815e6 -t
Search frequency: 1815 MHz
PPM: 120
correction: 1
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 0 NAME: Tahiti
Platform 0 Device 0 PROFILE: FULL_PROFILE
Platform 0 Device 0 LOCAL_MEM_SIZE: 32768
Platform 0 Device 0 MAX_CLOCK_FREQUENCY: 975
Platform 0 Device 0 MAX_COMPUTE_UNITS: 24
Platform 0 Device 0 PREFERRED_VECTOR_WIDTH_FLOAT: 1
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.0367889s
PSS XCORR cost 9.71848s
Detected a FDD cell! At freqeuncy 1815MHz, try 0
cell ID: 261
PSS ID: 0
RX power level: -13.6741 dB
residual frequency offset: -69682.9 Hz
k_factor: 1.00004
Detected a FDD cell! At freqeuncy 1815MHz, try 0
cell ID: 263
PSS ID: 2
RX power level: -14.2563 dB
residual frequency offset: -69682.9 Hz
k_factor: 1.00004
PHICH resource type
DPX CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
FDD 261 2 1815M -69.7k -13.7 N 100 N one 0.99996160866444450122
FDD 263 2 1815M -69.7k -14.3 N 100 N one 0.99996160870007821941
as does the scan mode
./CellSearch --freq-start 1814.9e6 --freq-end 1815.1e6 --opencl-device=1
Search frequency range: 1814.9-1815.1 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 1 PROFILE: FULL_PROFILE
Platform 0 Device 1 LOCAL_MEM_SIZE: 32768
Platform 0 Device 1 MAX_CLOCK_FREQUENCY: 3199
Platform 0 Device 1 MAX_COMPUTE_UNITS: 4
Platform 0 Device 1 PREFERRED_VECTOR_WIDTH_FLOAT: 8
Examining center frequency 1814.9 MHz ... try 0
6RB filter cost 0.00319004s
PSS XCORR cost 0.845281s
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 261
PSS ID: 0
RX power level: -15.553 dB
residual frequency offset: 31977.3 Hz
k_factor: 1.00004
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 263
PSS ID: 2
RX power level: -16.3697 dB
residual frequency offset: 31976.5 Hz
k_factor: 1.00004
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.00298405s
PSS XCORR cost 0.826245s
Examining center frequency 1815.1 MHz ... try 0
6RB filter cost 0.00295711s
PSS XCORR cost 0.827149s
PHICH resource type
DPX CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
FDD 261 2 1814.9M 32k -15.6 N 100 N one 1.0000401594555023976
FDD 263 2 1814.9M 32k -16.4 N 100 N one 1.0000401594555023976
./CellSearch --freq-start 1814.9e6 --freq-end 1815.1e6 --opencl-device=0
Search frequency range: 1814.9-1815.1 MHz
Found Elonics E4000 tuner
OpenCL: number of platforms 1
Platform 0 NAME: AMD Accelerated Parallel Processing
Platform 0 PROFILE: FULL_PROFILE
OpenCL: number of devices 2
Platform 0 Device 0 NAME: Tahiti
Platform 0 Device 0 PROFILE: FULL_PROFILE
Platform 0 Device 0 LOCAL_MEM_SIZE: 32768
Platform 0 Device 0 MAX_CLOCK_FREQUENCY: 975
Platform 0 Device 0 MAX_COMPUTE_UNITS: 24
Platform 0 Device 0 PREFERRED_VECTOR_WIDTH_FLOAT: 1
Examining center frequency 1814.9 MHz ... try 0
6RB filter cost 0.0368021s
PSS XCORR cost 3.31654s
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 261
PSS ID: 0
RX power level: -15.6869 dB
residual frequency offset: 32106.7 Hz
k_factor: 1.00004
Detected a FDD cell! At freqeuncy 1814.9MHz, try 0
cell ID: 263
PSS ID: 2
RX power level: -16.3225 dB
residual frequency offset: 32106.2 Hz
k_factor: 1.00004
Examining center frequency 1815 MHz ... try 0
6RB filter cost 0.0158181s
PSS XCORR cost 3.32913s
Examining center frequency 1815.1 MHz ... try 0
6RB filter cost 0.0158079s
PSS XCORR cost 3.27762s
PHICH resource type
DPX CID A fc foff RXPWR C nRB P PR CrystalCorrectionFactor
FDD 261 2 1814.9M 32.1k -15.7 N 100 N one 1.0000398256225293547
FDD 263 2 1814.9M 32.1k -16.3 N 100 N one 1.0000398256225293547
But single frequency detection seems to be broken even if i provide the
freq correction via -c.
Capture attached.
Best regards,
Dimitri
Hi,

https://github.com/Evrytania/LTE-Cell-Scanner
https://github.com/JiaoXianjun/LTE-Cell-Scanner
(Not reviewed by James Peroulas, so it is just experimental currently.)
It works fine with rtl-sdr E4k tuner dongle below 2.2GHz, but doesn't work
in 2.5~2.7GHz even with external MMDS-LNB.
Because the algorithm assumes analytic relationship between carrier and
sampling frequency error.
I write some matlab scripts (https://github.com/
JiaoXianjun/rtl-sdr-LTE)
to separate carrier and sampling processing in algorithm. Aided by
MMDS-LNB, the scripts can detect TDD&FDD LTE cell in 2.5~2.7GHz now!
12 LTE Cells information are decoded. 2 are FDD LTE, the rest are TD-LTE.
Because here is China! (Partly because that TD-LTE is announed earier than
FDD by government)
Hope that in the future these features can be merged to original
LTE-Cell-Scanner.
Scanning results and video are attached.
http://youtu.be/4zRLgxzn4Pc