Calibrating HackRF One with LTE Scanner

Warning

The PPM setting here refers to frequency uncertainty with a default of 120, which is fine to evaluate the frequency correction.

Once you’ve got some correction value, use --correction instead and eventually reduce PPM uncertainty down to 10 or something.

Grab & build LTE-Cell-Scanner

LNA is hardcoded at 40 and you can only lower VGA, here down to 20.

apt install libitpp-dev liblapack-dev fftw-dev librtlsdr-dev
# sfftw-dev

#git clone git://github.com/Evrytania/LTE-Cell-Scanner.git
#git clone https://github.com/rxseger/LTE-Cell-Scanner.git
git clone https://github.com/JiaoXianjun/LTE-Cell-Scanner.git
cd LTE-Cell-Scanner/
mkdir build/
cd build/
cmake ../ -DUSE_HACKRF=1
echo $MAKEFLAGS
make

Define freq correction

Watch GQRX and find some LTE channels up there, which can be differenciated from 3G/UMTS pretty easily (see links in Resources section). Then look at a precise range and target center frequency.

best w/o ppm range (default is 120) e.g.

src/CellSearch --gain=40 --freq-start 816e6 --freq-end 816e6

Calculate PPM

then calculate the PPM out of the correction factor

>>> 1e6 * (1 - 1.0000098318703387612)
-9.831870338761206
>>> 1e6 * (1 - 1.0000103059578131504)
-10.305957813150357
>>> 1e6 * (1 - 1.000010467505859646)
-10.467505859645954

>>> 1e6 * (1 - 1.0000086352199331063)
-8.635219933106342
>>> 1e6 * (1 - 1.0000087700957334125)
-8.770095733412475
>>> 1e6 * (1 - 1.0000086206153795398)
-8.620615379539842

Ready to go

we give a larger PPM range e.g. 11 (default is 120).

src/LTE-Tracker --gain 40 --freq 816e6
src/LTE-Tracker --gain 40 --freq 816e6 --correction $corr
src/LTE-Tracker --gain 40 --freq 816e6 --correction $corr --ppm 11

Resources

LTE Cell Scanner http://www.evrytania.com/lte-tools/lte-tracker/77-lte-cell-scanner

LTE Cell Scanner http://www.evrytania.com/lte-tools/lte-cell-scanner

how to fix CMake Error at cmake/Modules/FindITPP.cmake:62 (MESSAGE): Could not find ITPP library #28 https://github.com/Evrytania/LTE-Cell-Scanner/issues/28