From RevSpace
Jump to navigation Jump to search
Project FMCWRadar
Experimenting with inexpensive FMCW radar modules
Status In progress
Contact bertrik
Last Update 2024-04-09


This project is about experimenting with inexpensive FM-CW radar modules as can be found on AliExpress:

  • gaining experience with the hardware
  • gaining experience on what kind of compensation/calibration is needed
  • apply it in a fun project, e.g. pedestrian speed indicator, or detect bats with it

Perhaps start a collection of inexpensive "software-defined" radar projects?

The current generation of inexpensive radar modules (around E40,-) has these typical features:

  • operates on 24 GHz
  • has quadrature outputs (I and Q) so it can not just detect movement (through Doppler) but also distinguish direction
  • has a modulation input that allows a subtle change of the radar operating frequency
  • often combined with a cortex M0 or M3/M4 microcontroller,
  • pre-configured with firmware to do detection of object speed and direction

External links:


An FM-CW radar is a few steps more advanced than the very basic Doppler radars (like the HB-100), typically:

  • I and Q outputs as described above
  • Modulation input, that allows you to quickly sweep the radar frequency

The basic idea behind an FM-CW radar is that the frequency is sweeped, at some continuous rate. A signal that is reflected by an object in the view of the radar, will arrive back at the radar with some delay. Because of the delay, the outgoing signal will have already changed in frequency compared to the incoming reflected frequency. At the radar, the delayed reflected signal is "mixed" with the outgoing signal, resulting in a low-frequency I+Q output of the difference frequency. The difference frequency at the output of the radar is therefore linearly related to the time delay, so also linearly related to the object distance.


The IVS-362 from Innosent is a tunable 24 GHz radar module, with the following typical specifications

  • tuning voltage range about 0.7 - 2.5 V = 1.8V
  • modulation sensitivity = 720 MHz/V


  • mentions a sweep time of 1024 us, supporting the typical 1 ms sweep time assumed in the calculation below
  • mentions a bandwidth of 177 MHz, comparable with the assumption as used in the calculation below


I have very little to go on, so making a couple of assumptions:

  • radar works at 24 GHz, therefore wavelength = 12.5 mm
  • suppose the range of a full FM sweep is 150 MHz
  • object distance d is 1 meter, so time-of-flight = 2 * d / c = 6.67 ns
  • to get a 1 kHz difference frequency at this range, we need a chirp rate of delta_f / delta_t = 1 kHz / 6.67 ns = 150 GHz/s
  • the FM sweep therefore has to be done in 150 MHz / 150 GHz/s = 1 ms, or 1000 sweeps/s
  • suppose the FM sweep consists of 100 individual steps, we need 100,000 steps/s

So the modulation output needs to be updated at 100 kHz, and the IQ inputs needs to be sampled at (say) 10 kHz. Quite challenging, but not necessarily impossible.


  • Hardware:
    • do the available radar modules actually use the FM modulation input of the radar? -> I will assume that unless it's specifically advertised, this is NOT the case (even though it uses a frontend that could)
    • how is the FM modulation input wired to the CPU? The STM32 processors typically used don't have a DAC output! -> is the ramp perhaps generated with help of an opamp circuit (e.g. current source charging a capacitor)
    • some STM32 MCUs *do* have a DAC, see this application note
  • Software:
    • can we find source code of existing firmwares? -> probably NO at this point
    • can we reprogram the microcontroller -> SWD-signals are generally brought out to a header -> might be flash locked, might be possible to physically replace with an unlocked STM32
      • This application note describes the levels: in short 0 = fully unlocked, 1 = flash locked but JTAG/SWD/etc still works, unlock erases flash, 2 = fully locked, JTAG/SWD/etc disabled
  • How to cope with real-world inaccuracies, like IQ inbalance -> I guess now that a linear correction matrix can fix most of it, but how to determine the coefficients, preferably automatically
    • I-Q outputs are not exactly 90 degrees apart
    • I-Q outputs have an amplitude inbalance
    • I-Q outputs have a bias
    • dynamic range: this needs to be high, since the radar equation has a 4th-power dependency on distance -> maybe not so critical, range detection relies on measuring a frequency, not an amplitude
  • Get some rough idea of
    • inaccuracies a described above
    • Frequency change per m/s
    • Typical modulation index: MHz / V on the modulation input, and the corresponding sweep rate > 150 MHz / ms doesn't seem unreasonable
  • Choose signal processing properties
    • choose an appropriate sample rate
    • can we calculate an FFT fast enough, fixed point or floating point
    • what properties should the FFT have, obviously complex->complex, window function?
    • can we stack multiple FFTs for increased sensitivity? -> yes probably, stack them in IQ (not power)

Available FMCW radar modules

Ai Thinker


aithinker rd-03
aithinker rd-03



  • radar chip: S3KM1110
  • controller chip: F003F17 / 2L6T13B, PY32F003F17U

This thing outputs ASCII strings over a serial port at 115200, for example:

Range 46

That appears to be all.



Hardware markings:

  • E230K8 / BSK4KM / JJ 2331 / GD ARM
  • should contain an S3KM111L, this chip has an internal FMCW waveform generator (up to 8 kHz sweep rate)


DF robot:

Acconeer radars:

From Yanwu Tech:

  • FMK24-A series, a range of FMCW modules which appear identical in hardware at least, a.k.a. as "FM24-NP100".
  • FM24-NP100 on Aliexpress.

AliExpress 24 GHz radar with FMCW, no CPU:

AliExpress 24 GHz radar with FMCW, with CPU:

-> claimed to support FMCW, outputs for divided signal, temperature, for about E15,- . See also!!2207378167020.jpg . Appears to suggest that the IMD2411A2 uses 3.0V and the IFL2411A2 uses 3.3V. Both have "ADC DAC" interface.

  • RD2411A has a review claiming it actually works for distance measurement up to 5m: "The seller sended a datasheet of the unit, so I was able to read out the unit. measurements till 5 meters are no problem, I did not test greater distances. The measurement speed is very low, and needs 600ms. The current stays at 150mA, so it is not very usable in battety equipment "

This series appears to use the Infineon radar chip BGT24LTR11 see also their application note 472.

AliExpress 24 GHz radar, DM-series:

Even though the front-end used can be modulated, no mention is made of FMCW or ranging application!

AliExpress 24 GHz radar, FM-series:

AliExpress 24 GHz radar, other:


Hi-link radars, available on AliExpress, typically separate analog frontend + CPU for processing, serial output:

Analog front-end

Analog front-end for many of the radar modules above seems to be SRK1101A:

  • this page claims it has an SPI interface, but I doubt that
  • 250 MHz bandwidth
  • 25 dB receive gain
  • run at 3.3V, 58 mA current typical
  • 16 pins



Expimental software to communicate with this module, running on ESP8266:



  • radar-side: S3KM111L / 1540101D1 / 2209H
  • electronics side: BPCK234-23A2


Apparently, the device has two kinds of responses:

  • ACK, in response to a command, starting with bytes FD FC FB FA
  • measurement report, sent unsollicited, starting with bytes F4 F3 F2 F1

Next steps:

  • add function to configure the module for a more reasonable bit rate (e.g. 9600 bps) instead of 256000 bps


Information at manufacturer:

Can't find a proper datasheet, but found some info here:

It mainly outputs two messages:

  • occ, for occupancy (or small movement)
  • mov, for movement (or large movement)




I have an YH-K24-G01.

It works as a Doppler sensor.

I could not get the modulation input to have any effect on the detection. Tried it with a couple volts at 1 kHz, 10 kHz, 100 kHz. No effect. A review at AliExpress complains about the modulation input having no effect. Maybe I accidentally destroyed it (have been careful though). I measure about 150 ohm from the tune-input to both ground and Vcc, so at least the tune input is not completely isolated.



Ordered an HLK-LD303-24G module, on AliExpress. Inexpensive, combines a 24 GHz radar module with a microcontroller (STM32 or compatible).

More info:


Components on this board:

  • An "CKCA32" STM32-compatible in LQFP-48 pinout
  • MV324, quad opamp
  • 8 MHz crystal
  • HT50 (5V regulator?) plus two 3.3V regulators (probably)
  • radar is an Infineon BGT24LTR11N16 (package says "LTR11" "2020")

The PCB has two pads, marked I and Q near the opamp. So probably at least two of the opamps in the quad-opamp are dedicated to amplification/buffering of the I and Q signals. Signal I goes to pin PA2/ADC12_IN2. Signal Q goes to pin PA3/ADC12_IN3. Perhaps there are two opamps for generation of the FMCW modulation signal?

Oddly enough, I cannot find a signal going from the I and Q signals to the opamp, so perhaps the opamp has nothing to do with the I and Q signals at all! Possibly only used for generation an FMCW ramp?

There is a blue LED connected to pin PB9.

STM32 pinout

Pin Name Function
12 PA2/ADC12_IN2 radar-I
13 PA3/ADC12_IN3 radar-Q
26 PB13/SPI2_SCK ???
30 PA9/USART1_TX serial TX?
31 PA10/USART1_RX serial RX?
46 PB9 blue LED


Arduino Module Remark
D2 red wire Arduino TX
D3 yellow wire Arduino RX
GND black wire ground
5V white wire power

NOTE: the pinout as shown on the PCB *does not* match the header!


Internal parameters of the HLK-LD303, partially inferred from datasheets (translated from Chinese):

Code Parameter Parameter value Remarks
B1 Operating mode 0 = sensitive, 1 = stable -
B3 Fitting coefficient (0.001) ? -
B4 Offset correction (cm) ? -
D1 Delay time (ms) 200-3000, default 1000 The time the output (blue LED) stays active after detection
D2 Close treatment 0 = keep last measured distance, 1 = clear distance result -
D3 Measurement - Start measurement in mode 6, using the 'query' command packet
D4 Baud rate (unit 100 bps) - Set baud rate, activated on next power-up
D5 Trigger threshold (unit: 'k') 30-3000, default 100 -
D9 Output target 0 = nearest, 1 = maximum goal ?
DA Signal interval (unit: 40ms) 5-20, default 10
DE Reset 0
E0 Minimum detection distance (cm) 0-200, default 30 -
E1 Sensitivity 60-2000, default 300 Smaller number means more sensitive, it acts like an activity threshold for detection
E5 Maximum detection distance (cm) 50-350, default 350 -
E6 Report interval (unit: 40ms) 0-20 -
E7 Extreme values stats 0-100, default 0 -
E8 Extreme filter times default 0 -
E9 Number of swipes 0-100, default 10 -
F6 Protocol type 0=ASCII,1=?,6=query,7=automatic -
F9 Proportion statistic 0-100, default 20 -
FA Invalid distance (cm) 10-1000, default 30 -
FB Percentage (%) 10-100, default 30 -
DF Firmware upgrade 1 -
FE Query parameters 0 Query all parameters


I wrote a simple Arduino library to communicate with the module, send frames to configure the device and receive frames with measurement data.

My software archive with a demo application for ESP8266:


I soldered a connector to the SWD interface and dumped the firmware. No time/motivation yet to reverse engineer it.

Serial interface

The module communicates at 115200 by default. This is slightly fast for the SoftSerial library on ESP8266 and some incoming frames will not be recognised.

In my demo application, you can discover the currently used baud rate using the 'autobaud' command. Then use the 'baud' command to set a new baud rate, this activates after a power-cycle.