Posted on

RF penetration demonstration

During infantry training, soldiers are shown firsthand the impact of different weapons upon different materials to help them make better decisions about good cover versus bad cover. Spoiler: The railway sleeper doesn’t make it 🙁

As tactical radios have moved several hundred megahertz up the spectrum from their cold-war VHF roots, material attenuation is a serious issue which needs demonstrating to enable better route selection and siting. Unlike shooting at building materials it’s hard to visualise invisible radio signals, and therefore teach good siting, but equally important as ground based above-VHF signals are easily blocked in urban environments.

This blog provides a visual demonstration of the physical relationship between different wavelengths and attenuating obstacles only. It does not compare modulation schemas, multi-path, radios or technologies.

Bricks and wavelengths

Clutter data refers to obstacles above the ground such as trees and buildings. Cloud-RF has 9 classes of clutter data within the service which you can use and build with. Each class (Bricks +) has a different attenuation rate measured in decibels per metre (dB/m). This rate is a nominal value based upon the material density and derived from the ITU-R P.833-7 standard and empirical testing with broadcast signals in European homes.

A signal can only endure a limited amount of attenuation before it is lost into the noise floor. In free space attenuation is minimal but with obstacles it can be substantial. This is why a Wi-Fi router in a window can be hard to use within another room in the house but the same router is detectable from a hill a mile away.

The attenuation rate is an average based upon a hollow building with solid walls.

Common building materials attenuate signals to different amounts based on their density and the signals wavelength.

A higher wavelength signal such as L band (1-2GHz) will be attenuated more than VHF (30-300MHz) for example.

A long wavelength signal like HF will suffer minimal attenuation making it better suited to communicating through multiple brick walls.

The layer cake house

A brick house is not just brick. It’s bricks, concrete blocks, glass, insulation, stud walls, furniture and surfaces of varying absorption and reflection characteristics. Modelling every building material and multi-path precisely, is possible, given enough data and time due to the exponential complexity of multi-path but wholly impractical.

A trade-off for accurate urban modelling is to assign a local attenuation value. It’s local since building regulations vary by country and era so a 1930s brick house in the UK has different characteristics to a 1960s timber house in Germany. Taking the brick house we can identify the nominal value by adding up the materials and dividing it by the size.

For example, 2 x solid 10dB brick walls plus a 5 dB margin for interior walls and furniture would be 25dB. Divide this by a 10m size and you have 2.5dB/m. Using some local empirical testing you can quickly refine this for useful value for an entire city (assuming consistent architecture) but in reality the *precise* value will vary by each property, even on a street of the same design, due to interior layouts and furniture.

Range setup

We created nine 4 metre tall targets using each of the 9 clutter classes in attenuation order from left-to-right, measuring 10x10m and fired radio-bulletsTM at them from a distance of 300m using the same RF power of 1W.

The following bands were compared: HF 20MHz, VHF 70MHz, UHF 700MHz, UHF 1200MHz, UHF 2.4GHz. SHF 5.8GHz.

The ITU-R P.525 model was used to provide a consistent reference.

Only the stronger direct-ray is modelled. Multipath effects mean that reflections will reach into some of the displayed null zones, with an inherent reflection loss for each bounce, but these are nearly impossible to model accurately and in a practical time.

Here are the results.

HF 20MHz

VHF 70MHz

UHF 700MHz

UHF 1200MHz

UHF 2.4GHz

SHF 5.8GHz

Findings

  • Dense materials, especially concrete, attenuates higher frequency signals more than natural materials like trees
  • Lower UHF signals perform much better than SHF with the same power
  • Higher frequencies with low power can be blocked by a single house, even after only 300m
  • HF eats bricks for breakfast!

Summary

Modern tactical UHF radios, and their software eco-systems, are unrecognisable from their cold-war VHF ‘voice only’ ancestors in terms of capabilities but have an Achilles heel in the form of material penetration. To get the best coverage the network density must be flexed to match the neighbourhood.

This is obvious when comparing rolling terrain with a urban environment but the building materials and street sizes in the urban environment will make a significant difference too. Ground units which communicated effectively in a city in one country may find the same tactics and working ranges ineffective in another city with the same radios and settings. Understanding the impact of material penetration will help planning and communication.

Posted on

Simulating Jamming

George square wifi Jamming is a form of electronic attack which uses a stronger signal to disrupt target wireless devices. DISCLAIMER: It is an offence to intentionally interfere with someone else’s use of the wireless spectrum in the UK. The mention of its name also disrupts rational thinking amongst otherwise intelligent people and its common for spectrum planners and event managers to ignore signal theory when discussing its impact and revert to hollywood instead. Originally used in warfare, it’s now commonly used in civil emergencies such as event protection, bomb disposal or hostage negotiation. This blog uses modelling evidence to demonstrate the impact of jamming in a city and in the process, debunk popular jamming myths. The target band in all models is the 2.4GHz ISM band which is easily the busiest unlicensed band in the world and home to WiFi, Bluetooth, CCTV, Locks, Sensors, Drones and phones. The chosen location is George Square in Glasgow which is a large open surrounded by tall stone buildings. The antenna used is Omni-directional to visualise the effect in all directions.

Jamming thresholds

IEEE standard protocols such as 802.11 have defined thresholds for Energy Detection (ED) above which they will not transmit. If you can hit this threshold then devices will refuse to transmit and can be considered ‘jammed’. For 802.11 the energy detection threshold is -62dBm which is a strong wireless signal. You would need to be in the same room as the wireless router to see a signal this strong so to be effective you must be close or just be very very powerful like a military airborne jammer.

Power limits

In Europe the power limit for 2.4GHz is 0.1 Watt or 20dBm which is what a domestic Wi-Fi router radiates. This is low by design to minimise interference, conserve battery and enhance privacy against eavesdropping. In the US it’s higher at a generous 1 Watt / 30dBm which still works since everyone is even when competing for channel access, just on a bigger scale. Jamming someone within this limit is hard. You either need to get very close (~10m) or use a directional antenna. For jamming of a wide area like the whole square and beyond you would need hundreds of watts of power. You can deliver this efficiently with a directional antenna and reduce collateral damage in the process but jamming a wide area with a ground based jammer requires an enormous amount of power. Siting the jammer above the clutter is much more efficient.

Simulating jamming

The key setting for simulating the effect of jamming is the receiver threshold. Creating a radio coverage map with a ‘normal’ threshold like -90dBm would not be useful unless you were intent on producing a misleading result to support an argument against using jamming. For an accurate map of jamming ‘effect’ you need to see the coverage at the ED threshold (-62dBm). Within the web interface this is under the ‘Receiver’ menu and in the api it is the ‘rxs’ parameter.

10 Watts

Using a 2.4GHz frequency and an omni-directional antenna the protection “bubble” covers the square at ~200m radius but not much else due to building attenuation. A value of 3.0 dB/m was used the neighbouring stone buildings.

George square wifi
George square wifi

100 Watts…

Increasing the power by a factor of 10 does little to the bubble due to the way power decays logarithmically. The stone buildings are still blocking the signal so the bubble extends out to ~400m now with a gain toward a piece of high ground to the north east and down straight streets where there’s line of sight.

1000 Watts?…

If you were higher than the buildings, 1KW would jam devices at 7km according to the Friis path loss model. Down on the street however it’s a different story and the bubble is extending only a few hundred metres beyond the square and further down streets with line of sight.

Summary

Antenna siting, not RF power is how to get the best out of a jammer and urban modelling is essential for maximum effect and to minimise collateral damage, especially in the ISM and cellular bands.

People won’t die, but they will get confused

The greatest fear with collateral damage is disruption to ISM medical devices such as wireless implants. If you jammed inside a hospital where ISM band equipment is used, you could disrupt medical equipment but to influence it from beyond the hospital walls would require several kilowatts of RF delivered very nearby to penetrate the walls with enough power to still exceed the ED level. Wireless medical devices are designed for failure. They are after all used in the busiest spectrum in the busiest cities in the world and have back-off and interference coping mechanisms built in to the standard, like 802.11’s -62dBm ED level and random back-off timer to manage channel contention.

Vehicles won’t crash, but they might stop playing music

The 2.4GHz band is a healthy distance from 1.5GHz where GPS resides. Jamming one to target data communications does not influence the other unless your equipment is really poor. Even if you did interfere with vehicles navigation systems, they are distinct, again by design, from control systems since the spectrum is shared and prone to interference. The most likely impact would be on Bluetooth which uses the entire 2.4GHz band and is commonly used in vehicle infotainment systems which would suffer interference.