|Experimenting with inexpensive FMCW radar modules|
- 1 What
- 2 Theory
- 3 Challenges
- 4 Available FMCW radar modules
- 5 Experimentation
This project is about experimenting with inexpensive FM-CW radar modules as can be found on AliExpress:
- gaining experience with the hardware
- gaining experience on what kind of compensation/calibration is needed
- apply it in a fun project, e.g. pedestrian speed indicator, or detect bats with it
Perhaps start a cool collection of inexpensive "software-defined" radar projects?
The current generation of inexpensive radar modules (around E40,-) has these typical features:
- operates on 24 GHz
- has quadrature outputs (I and Q) so it can not just detect movement (through Doppler) but also distinguish direction
- has a modulation input that allows a subtle change of the radar operating frequency
- often combined with a cortex M0 or M3/M4 microcontroller,
- pre-configured with firmware to do detection of object speed and direction
Interesting investigation into the electronics for the (relatively simple, no IQ, no FMCW) CDM324 24 GHz sensor.
Interesting article about an investigation into doppler sensors like this http://ael.chungbuk.ac.kr/lectures/graduate/ICT%EC%9C%B5%ED%95%A9%ED%8A%B9%EB%A1%A0/13/13-no-voice.pdf
An FM-CW radar is a few steps more advanced than the very basic Doppler radars (like the HB-100), typically:
- I and Q outputs as described above
- Modulation input, that allows you to quickly sweep the radar frequency
The basic idea behind an FM-CW radar is that the frequency is sweeped, at some continuous rate. A signal that is reflected by an object in the view of the radar, will arrive back at the radar with some delay. Because of the delay, the outgoing signal will have already changed in frequency compared to the incoming reflected frequency. At the radar, the delayed reflected signal is "mixed" with the outgoing signal, resulting in a low-frequency I+Q output of the difference frequency. The difference frequency at the output of the radar is therefore linearly related to the time delay, so also linearly related to the object distance.
The IVS-362 from Innosent is a tunable 24 GHz radar module, with the following typical specifications
- tuning voltage range about 0.7 - 2.5 V = 1.8V
- modulation sensitivity = 720 MHz/V
- mentions a sweep time of 1024 us, supporting the typical 1 ms sweep time assumed in the calculation below
- mentions a bandwidth of 177 MHz, comparable with the assumption as used in the calculation below
I have very little to go on, so making a couple of assumptions:
- radar works at 24 GHz, therefore wavelength = 12.5 mm
- suppose the range of a full FM sweep is 150 MHz
- object distance d is 1 meter, so time-of-flight = 2 * d / c = 6.67 ns
- to get a 1 kHz difference frequency at this range, we need a chirp rate of delta_f / delta_t = 1 kHz / 6.67 ns = 150 GHz/s
- the FM sweep therefore has to be done in 150 MHz / 150 GHz/s = 1 ms, or 1000 sweeps/s
- suppose the FM sweep consists of 100 individual steps, we need 100,000 steps/s
So the modulation output needs to be updated at 100 kHz, and the IQ inputs needs to be sampled at (say) 10 kHz. Quite challenging, but not necessarily impossible.
- do the available radar modules actually use the FM modulation input of the radar? -> I will assume that unless it's specifically advertised, this is NOT the case (even though it uses a frontend that could)
- how is the FM modulation input wired to the CPU? The STM32 processors typically used don't have a DAC output! -> is the ramp perhaps generated with help of an opamp circuit (e.g. current source charging a capacitor)
- some STM32 MCUs *do* have a DAC, see this application note
- can we find source code of existing firmwares? -> probably NO at this point
- can we reprogram the microcontroller -> SWD-signals are generally brought out to a header -> might be flash locked, might be possible to physically replace with an unlocked STM32
- This application note describes the levels: in short 0 = fully unlocked, 1 = flash locked but JTAG/SWD/etc still works, unlock erases flash, 2 = fully locked, JTAG/SWD/etc disabled
- How to cope with real-world inaccuracies, like IQ inbalance -> I guess now that a linear correction matrix can fix most of it, but how to determine the coefficients, preferably automatically
- I-Q outputs are not exactly 90 degrees apart
- I-Q outputs have an amplitude inbalance
- I-Q outputs have a bias
- dynamic range: this needs to be high, since the radar equation has a 4th-power dependency on distance -> maybe not so critical, range detection relies on measuring a frequency, not an amplitude
- Get some rough idea of
- inaccuracies a described above
- Frequency change per m/s
- Typical modulation index: MHz / V on the modulation input, and the corresponding sweep rate > 150 MHz / ms doesn't seem unreasonable
- Choose signal processing properties
- choose an appropriate sample rate
- can we calculate an FFT fast enough, fixed point or floating point
- what properties should the FFT have, obviously complex->complex, window function?
- can we stack multiple FFTs for increased sensitivity? -> yes probably, stack them in IQ (not power)
Available FMCW radar modules
- https://www.acconeer.com/products has a list of smart radar modules
From Yanwu Tech:
- FMK24-A series, a range of FMCW modules which appear identical in hardware at least, a.k.a. as "FM24-NP100".
- FM24-NP100 on Aliexpress.
AliExpress 24 GHz radar with FMCW, no CPU:
- Yh-24g04, a 24 GHz quadrature doppler radar (no CPU), has modulation input, for about E16,-
- YH-24G01 (no CPU), for about E15,-
AliExpress 24 GHz radar with FMCW, with CPU:
-> claimed to support FMCW, outputs for divided signal, temperature, for about E15,- . See also https://img.alicdn.com/imgextra/i1/2207378167020/O1CN01dUjv6p21jD06t4F3w_!!2207378167020.jpg . Appears to suggest that the IMD2411A2 uses 3.0V and the IFL2411A2 uses 3.3V. Both have "ADC DAC" interface.
- RD2411A has a review claiming it actually works for distance measurement up to 5m: "The seller sended a datasheet of the unit, so I was able to read out the unit. measurements till 5 meters are no problem, I did not test greater distances. The measurement speed is very low, and needs 600ms. The current stays at 150mA, so it is not very usable in battety equipment "
This series appears to use the Infineon radar chip BGT24LTR11 see also their application note 472.
AliExpress 24 GHz radar, DM-series:
- DM-39, a 24 GHz quadrature doppler radar with CPU for about E32,-. The page shows a SRK1101 radar, with I/Q outputs and tune input. Mentions Cortex M0.
- DM-19, a 24 GHz quadrature doppler radar with CPU for about E48,-. Appears similar in possibilities to DM-39. Mentions Cortex M3/M4 processor.
- another DM-19, 24 GHz quadrature doppler radar, about E40,-
- DM-19 / DB-16 another FMCW radar model, about E39,-
Even though the front-end used can be modulated, no mention is made of FMCW or ranging application!
AliExpress 24 GHz radar, FM-series:
- FM-42, a 24 GHz FMCW radar with CPU for about USD107,-
- FM-49 another FMCW radar module, M3/M4 CPU, claims range 4m, accuracy 5 cm, about E52,-
AliExpress 24 GHz radar, other:
- 182MOD, a module outputting speed for about USD28,- appears to use a 5-pin radar (Vcc,Gnd,I,Q,tune?)
- USRR187 mentions FMCW, has CPU (UART output), pin defintion not clear, for about E38,-
- TD-24G-B-002, claims to support ranging, but information is confusing, about E21,- More information: http://www.hrtsensor.com/prodetail-13346865.html
Hi-link radars, available on AliExpress, typically separate analog frontend + CPU for processing, serial output:
- HLK-LD2410 24G Fmcw 24Ghz, controller chip with markings "S3KM111L" / "15J0101D1". Interesting project on github: https://github.com/ncmreynolds/ld2410
- HLK-LD015-5G 5.8G Radar Sensor Module, has a controller chip with markings "5810S" / "20380A"
- HLK-LD1115H-24G claims static detection up to 5 m, dynamic detection up to 16m
- HLK-LD112 24GHz simple motion detector, radar chip with markings "111A" / "2010" + BISS0001 motion detector chip
- HLK-LD303-24G see below
Analog front-end for many of the radar modules above seems to be SRK1101A:
- this page claims it has an SPI interface, but I doubt that
- 250 MHz bandwidth
- 25 dB receive gain
- run at 3.3V, 58 mA current typical
- 16 pins
Expimental software to communicate with this module, running on ESP8266: https://github.com/bertrik/hlk-ld2410
- radar-side: S3KM111L / 1540101D1 / 2209H
- electronics side: BPCK234-23A2
Apparently, the device has two kinds of responses:
- ACK, in response to a command, starting with bytes FD FC FB FA
- measurement report, sent unsollicited, starting with bytes F4 F3 F2 F1
- add function to configure the module for a more reasonable bit rate (e.g. 9600 bps) instead of 256000 bps
Information at manufacturer: https://hlktech.net/index.php?id=973&cateid=749
Can't find a proper datasheet, but found some info here: https://community.home-assistant.io/t/how-to-work-with-hlk-ld1115h-and-wemos-d1-mini-for-human-presence-detection/434427
It mainly outputs two messages:
- occ, for occupancy (or small movement)
- mov, for movement (or large movement)
- radar front-end, chip says: SGR / 1101 / 2147, probably SGR semi chip SRK1101, manufactured in 2021 week 47.
- microcontroller: ST (e4) GK05B / 32F030F4P6 / CHN145RNA, probably equivalent to STM32F030F4 https://www.st.com/en/microcontrollers-microprocessors/stm32f030f4.html
- 5-pin power regulator (?): LN30, possibly 3.0V voltage regulator
- 8-pin unknown: RS622, M906130
- there are 4 pads supposedly for flashing/debugging: SCK, SDO, GND, VCU
- 3 unused/empty footprints for a 3-pin component
I have an YH-K24-G01.
It works as a Doppler sensor.
I could not get the modulation input to have any effect on the detection. Tried it with a couple volts at 1 kHz, 10 kHz, 100 kHz. No effect. A review at AliExpress complains about the modulation input having no effect. Maybe I accidentally destroyed it (have been careful though). I measure about 150 ohm from the tune-input to both ground and Vcc, so at least the tune input is not completely isolated.
Ordered an HLK-LD303-24G module, on AliExpress. Inexpensive, combines a 24 GHz radar module with a microcontroller (STM32 or compatible).
More info: https://www.hlktech.com/en/Goods-94.html
Components on this board:
- An "CKCA32" STM32-compatible in LQFP-48 pinout
- MV324, quad opamp
- 8 MHz crystal
- HT50 (5V regulator?) plus two 3.3V regulators (probably)
- radar is an Infineon BGT24LTR11N16 (package says "LTR11" "2020")
The PCB has two pads, marked I and Q near the opamp. So probably at least two of the opamps in the quad-opamp are dedicated to amplification/buffering of the I and Q signals. Signal I goes to pin PA2/ADC12_IN2. Signal Q goes to pin PA3/ADC12_IN3. Perhaps there are two opamps for generation of the FMCW modulation signal?
Oddly enough, I cannot find a signal going from the I and Q signals to the opamp, so perhaps the opamp has nothing to do with the I and Q signals at all! Possibly only used for generation an FMCW ramp?
There is a blue LED connected to pin PB9.
|D2||red wire||Arduino TX|
|D3||yellow wire||Arduino RX|
NOTE: the pinout as shown on the PCB *does not* match the header!
Internal parameters of the HLK-LD303, partially inferred from datasheets (translated from Chinese):
|B1||Operating mode||0 = sensitive, 1 = stable||-|
|B3||Fitting coefficient (0.001)||?||-|
|B4||Offset correction (cm)||?||-|
|D1||Delay time (ms)||200-3000, default 1000||The time the output (blue LED) stays active after detection|
|D2||Close treatment||0 = keep last measured distance, 1 = clear distance result||-|
|D3||Measurement||-||Start measurement in mode 6, using the 'query' command packet|
|D4||Baud rate (unit 100 bps)||-||Set baud rate, activated on next power-up|
|D5||Trigger threshold (unit: 'k')||30-3000, default 100||-|
|D9||Output target||0 = nearest, 1 = maximum goal||?|
|DA||Signal interval (unit: 40ms)||5-20, default 10|
|E0||Minimum detection distance (cm)||0-200, default 30||-|
|E1||Sensitivity||60-2000, default 300||Smaller number means more sensitive, it acts like an activity threshold for detection|
|E5||Maximum detection distance (cm)||50-350, default 350||-|
|E6||Report interval (unit: 40ms)||0-20||-|
|E7||Extreme values stats||0-100, default 0||-|
|E8||Extreme filter times||default 0||-|
|E9||Number of swipes||0-100, default 10||-|
|F9||Proportion statistic||0-100, default 20||-|
|FA||Invalid distance (cm)||10-1000, default 30||-|
|FB||Percentage (%)||10-100, default 30||-|
|FE||Query parameters||0||Query all parameters|
I wrote a simple Arduino library to communicate with the module, send frames to configure the device and receive frames with measurement data.
My software archive with a demo application for ESP8266: https://github.com/bertrik/hlk-ld303
I soldered a connector to the SWD interface and dumped the firmware. No time/motivation yet to reverse engineer it.
The module communicates at 115200 by default. This is slightly fast for the SoftSerial library on ESP8266 and some incoming frames will not be recognised.
In my demo application, you can discover the currently used baud rate using the 'autobaud' command. Then use the 'baud' command to set a new baud rate, this activates after a power-cycle.