FMCWRadar

Project FMCWRadar
Experimenting with inexpensive FMCW radar modules
Status	In progress
Contact	bertrik
Last Update	2023-02-25

What

This project is about experimenting with inexpensive FM-CW radar modules as can be found on AliExpress:

• gaining experience with the hardware
• gaining experience on what kind of compensation/calibration is needed
• apply it in a fun project, e.g. pedestrian speed indicator, or detect bats with it

Perhaps start a cool collection of inexpensive "software-defined" radar projects?

The current generation of inexpensive radar modules (around E40,-) has these typical features:

• operates on 24 GHz
• has quadrature outputs (I and Q) so it can not just detect movement (through Doppler) but also distinguish direction
• has a modulation input that allows a subtle change of the radar operating frequency
• often combined with a cortex M0 or M3/M4 microcontroller,
• pre-configured with firmware to do detection of object speed and direction

Interesting investigation into the electronics for the (relatively simple, no IQ, no FMCW) CDM324 24 GHz sensor.

Interesting article about an investigation into doppler sensors like this http://ael.chungbuk.ac.kr/lectures/graduate/ICT%EC%9C%B5%ED%95%A9%ED%8A%B9%EB%A1%A0/13/13-no-voice.pdf

Theory

An FM-CW radar is a few steps more advanced than the very basic Doppler radars (like the HB-100), typically:

• I and Q outputs as described above
• Modulation input, that allows you to quickly sweep the radar frequency

The basic idea behind an FM-CW radar is that the frequency is sweeped, at some continuous rate. A signal that is reflected by an object in the view of the radar, will arrive back at the radar with some delay. Because of the delay, the outgoing signal will have already changed in frequency compared to the incoming reflected frequency. At the radar, the delayed reflected signal is "mixed" with the outgoing signal, resulting in a low-frequency I+Q output of the difference frequency. The difference frequency at the output of the radar is therefore linearly related to the time delay, so also linearly related to the object distance.

IVS-362

The IVS-362 from Innosent is a tunable 24 GHz radar module, with the following typical specifications

• tuning voltage range about 0.7 - 2.5 V = 1.8V
• modulation sensitivity = 720 MHz/V

NJR

https://www.njr.com/micro/download/datasheet/sensor/NJR4234BV_Datasheet_Rev00-02e.pdf

• mentions a sweep time of 1024 us, supporting the typical 1 ms sweep time assumed in the calculation below
• mentions a bandwidth of 177 MHz, comparable with the assumption as used in the calculation below

calculation

I have very little to go on, so making a couple of assumptions:

• radar works at 24 GHz, therefore wavelength = 12.5 mm
• suppose the range of a full FM sweep is 150 MHz
• object distance d is 1 meter, so time-of-flight = 2 * d / c = 6.67 ns
• to get a 1 kHz difference frequency at this range, we need a chirp rate of delta_f / delta_t = 1 kHz / 6.67 ns = 150 GHz/s
• the FM sweep therefore has to be done in 150 MHz / 150 GHz/s = 1 ms, or 1000 sweeps/s
• suppose the FM sweep consists of 100 individual steps, we need 100,000 steps/s

So the modulation output needs to be updated at 100 kHz, and the IQ inputs needs to be sampled at (say) 10 kHz. Quite challenging, but not necessarily impossible.

Challenges

• Hardware:
  • do the available radar modules actually use the FM modulation input of the radar? -> I will assume that unless it's specifically advertised, this is NOT the case (even though it uses a frontend that could)
  • how is the FM modulation input wired to the CPU? The STM32 processors typically used don't have a DAC output! -> is the ramp perhaps generated with help of an opamp circuit (e.g. current source charging a capacitor)
  • some STM32 MCUs *do* have a DAC, see this application note
• Software:
  • can we find source code of existing firmwares? -> probably NO at this point
  • can we reprogram the microcontroller -> SWD-signals are generally brought out to a header -> might be flash locked, might be possible to physically replace with an unlocked STM32
    • This application note describes the levels: in short 0 = fully unlocked, 1 = flash locked but JTAG/SWD/etc still works, unlock erases flash, 2 = fully locked, JTAG/SWD/etc disabled
• How to cope with real-world inaccuracies, like IQ inbalance -> I guess now that a linear correction matrix can fix most of it, but how to determine the coefficients, preferably automatically
  • I-Q outputs are not exactly 90 degrees apart
  • I-Q outputs have an amplitude inbalance
  • I-Q outputs have a bias
  • dynamic range: this needs to be high, since the radar equation has a 4th-power dependency on distance -> maybe not so critical, range detection relies on measuring a frequency, not an amplitude
• Get some rough idea of
  • inaccuracies a described above
  • Frequency change per m/s
  • Typical modulation index: MHz / V on the modulation input, and the corresponding sweep rate > 150 MHz / ms doesn't seem unreasonable
• Choose signal processing properties
  • choose an appropriate sample rate
  • can we calculate an FFT fast enough, fixed point or floating point
  • what properties should the FFT have, obviously complex->complex, window function?
  • can we stack multiple FFTs for increased sensitivity? -> yes probably, stack them in IQ (not power)

Available FMCW radar modules

Various

DF robot:

• https://wiki.dfrobot.com/mmWave_Radar_Human_Presence_Detection_SKU_SEN0395

Acconeer radars:

• https://www.acconeer.com/products has a list of smart radar modules
• https://learn.sparkfun.com/tutorials/getting-started-with-the-a111-pulsed-radar-sensor/all

From Yanwu Tech:

• FMK24-A series, a range of FMCW modules which appear identical in hardware at least, a.k.a. as "FM24-NP100".
• FM24-NP100 on Aliexpress.

AliExpress 24 GHz radar with FMCW, no CPU:

• Yh-24g04, a 24 GHz quadrature doppler radar (no CPU), has modulation input, for about E16,-
• YH-24G01 (no CPU), for about E15,-

AliExpress 24 GHz radar with FMCW, with CPU:

• IMD2411A2 (has some 32 pin IC)
• IFL2411A2

-> claimed to support FMCW, outputs for divided signal, temperature, for about E15,- . See also https://img.alicdn.com/imgextra/i1/2207378167020/O1CN01dUjv6p21jD06t4F3w_!!2207378167020.jpg . Appears to suggest that the IMD2411A2 uses 3.0V and the IFL2411A2 uses 3.3V. Both have "ADC DAC" interface.

• RD2411A has a review claiming it actually works for distance measurement up to 5m: "The seller sended a datasheet of the unit, so I was able to read out the unit. measurements till 5 meters are no problem, I did not test greater distances. The measurement speed is very low, and needs 600ms. The current stays at 150mA, so it is not very usable in battety equipment "

This series appears to use the Infineon radar chip BGT24LTR11 see also their application note 472.

AliExpress 24 GHz radar, DM-series:

• DM-39, a 24 GHz quadrature doppler radar with CPU for about E32,-. The page shows a SRK1101 radar, with I/Q outputs and tune input. Mentions Cortex M0.
• DM-19, a 24 GHz quadrature doppler radar with CPU for about E48,-. Appears similar in possibilities to DM-39. Mentions Cortex M3/M4 processor.
• another DM-19, 24 GHz quadrature doppler radar, about E40,-
• DM-19 / DB-16 another FMCW radar model, about E39,-

Even though the front-end used can be modulated, no mention is made of FMCW or ranging application!

AliExpress 24 GHz radar, FM-series:

• FM-42, a 24 GHz FMCW radar with CPU for about USD107,-
• FM-49 another FMCW radar module, M3/M4 CPU, claims range 4m, accuracy 5 cm, about E52,-

AliExpress 24 GHz radar, other:

• 182MOD, a module outputting speed for about USD28,- appears to use a 5-pin radar (Vcc,Gnd,I,Q,tune?)
• USRR187 mentions FMCW, has CPU (UART output), pin defintion not clear, for about E38,-
• TD-24G-B-002, claims to support ranging, but information is confusing, about E21,- More information: http://www.hrtsensor.com/prodetail-13346865.html

Hi-link

Hi-link radars, available on AliExpress, typically separate analog frontend + CPU for processing, serial output:

• HLK-LD2410 24G Fmcw 24Ghz, controller chip with markings "S3KM111L" / "15J0101D1". Interesting project on github: https://github.com/ncmreynolds/ld2410
• HLK-LD015-5G 5.8G Radar Sensor Module, has a controller chip with markings "5810S" / "20380A"
• HLK-LD1115H-24G claims static detection up to 5 m, dynamic detection up to 16m
• HLK-LD112 24GHz simple motion detector, radar chip with markings "111A" / "2010" + BISS0001 motion detector chip
• HLK-LD303-24G see below

Analog front-end

Analog front-end for many of the radar modules above seems to be SRK1101A:

• this page claims it has an SPI interface, but I doubt that
• 250 MHz bandwidth
• 25 dB receive gain
• run at 3.3V, 58 mA current typical
• 16 pins

Experimentation

HLK-LD2410

Expimental software to communicate with this module, running on ESP8266: https://github.com/bertrik/hlk-ld2410

Information: https://drive.google.com/drive/folders/1p4dhbEJA3YubyIjIIC7wwVsSo8x29Fq-

Hardware:

• radar-side: S3KM111L / 1540101D1 / 2209H
• electronics side: BPCK234-23A2

Protocol: https://github.com/ESPresense/ESPresense/files/9312938/HLK-LD2410.Serial.Communication.Protocol.V1.02.pdf

Apparently, the device has two kinds of responses:

• ACK, in response to a command, starting with bytes FD FC FB FA
• measurement report, sent unsollicited, starting with bytes F4 F3 F2 F1

Next steps:

• add function to configure the module for a more reasonable bit rate (e.g. 9600 bps) instead of 256000 bps

HLK-LD1115H-24G

Information at manufacturer: https://hlktech.net/index.php?id=973&cateid=749

Can't find a proper datasheet, but found some info here: https://community.home-assistant.io/t/how-to-work-with-hlk-ld1115h-and-wemos-d1-mini-for-human-presence-detection/434427

It mainly outputs two messages:

• occ, for occupancy (or small movement)
• mov, for movement (or large movement)

Hardware

• radar front-end, chip says: SGR / 1101 / 2147, probably SGR semi chip SRK1101, manufactured in 2021 week 47.
• microcontroller: ST (e4) GK05B / 32F030F4P6 / CHN145RNA, probably equivalent to STM32F030F4 https://www.st.com/en/microcontrollers-microprocessors/stm32f030f4.html
• 5-pin power regulator (?): LN30, possibly 3.0V voltage regulator
• 8-pin unknown: RS622, M906130
• there are 4 pads supposedly for flashing/debugging: SCK, SDO, GND, VCU
• 3 unused/empty footprints for a 3-pin component

YH-K24-G01

I have an YH-K24-G01.

It works as a Doppler sensor.

I could not get the modulation input to have any effect on the detection. Tried it with a couple volts at 1 kHz, 10 kHz, 100 kHz. No effect. A review at AliExpress complains about the modulation input having no effect. Maybe I accidentally destroyed it (have been careful though). I measure about 150 ohm from the tune-input to both ground and Vcc, so at least the tune input is not completely isolated.

HLK-LD303-24G

HLK-LD303-24G

Ordered an HLK-LD303-24G module, on AliExpress. Inexpensive, combines a 24 GHz radar module with a microcontroller (STM32 or compatible).

More info: https://www.hlktech.com/en/Goods-94.html

Hardware

Components on this board:

• An "CKCA32" STM32-compatible in LQFP-48 pinout
• MV324, quad opamp
• 8 MHz crystal
• HT50 (5V regulator?) plus two 3.3V regulators (probably)
• radar is an Infineon BGT24LTR11N16 (package says "LTR11" "2020")

The PCB has two pads, marked I and Q near the opamp. So probably at least two of the opamps in the quad-opamp are dedicated to amplification/buffering of the I and Q signals. Signal I goes to pin PA2/ADC12_IN2. Signal Q goes to pin PA3/ADC12_IN3. Perhaps there are two opamps for generation of the FMCW modulation signal?

Oddly enough, I cannot find a signal going from the I and Q signals to the opamp, so perhaps the opamp has nothing to do with the I and Q signals at all! Possibly only used for generation an FMCW ramp?

There is a blue LED connected to pin PB9.

STM32 pinout

Pin	Name	Function
12	PA2/ADC12_IN2	radar-I
13	PA3/ADC12_IN3	radar-Q
26	PB13/SPI2_SCK	???
30	PA9/USART1_TX	serial TX?
31	PA10/USART1_RX	serial RX?
46	PB9	blue LED

Pinout

Arduino	Module	Remark
D2	red wire	Arduino TX
D3	yellow wire	Arduino RX
GND	black wire	ground
5V	white wire	power

NOTE: the pinout as shown on the PCB *does not* match the header!

Parameters

Internal parameters of the HLK-LD303, partially inferred from datasheets (translated from Chinese):

Code	Parameter	Parameter value	Remarks
B1	Operating mode	0 = sensitive, 1 = stable	-
B3	Fitting coefficient (0.001)	?	-
B4	Offset correction (cm)	?	-
D1	Delay time (ms)	200-3000, default 1000	The time the output (blue LED) stays active after detection
D2	Close treatment	0 = keep last measured distance, 1 = clear distance result	-
D3	Measurement	-	Start measurement in mode 6, using the 'query' command packet
D4	Baud rate (unit 100 bps)	-	Set baud rate, activated on next power-up
D5	Trigger threshold (unit: 'k')	30-3000, default 100	-
D9	Output target	0 = nearest, 1 = maximum goal	?
DA	Signal interval (unit: 40ms)	5-20, default 10
DE	Reset	0
E0	Minimum detection distance (cm)	0-200, default 30	-
E1	Sensitivity	60-2000, default 300	Smaller number means more sensitive, it acts like an activity threshold for detection
E5	Maximum detection distance (cm)	50-350, default 350	-
E6	Report interval (unit: 40ms)	0-20	-
E7	Extreme values stats	0-100, default 0	-
E8	Extreme filter times	default 0	-
E9	Number of swipes	0-100, default 10	-
F6	Protocol type	0=ASCII,1=?,6=query,7=automatic	-
F9	Proportion statistic	0-100, default 20	-
FA	Invalid distance (cm)	10-1000, default 30	-
FB	Percentage (%)	10-100, default 30	-
DF	Firmware upgrade	1	-
FE	Query parameters	0	Query all parameters

Software

I wrote a simple Arduino library to communicate with the module, send frames to configure the device and receive frames with measurement data.

My software archive with a demo application for ESP8266: https://github.com/bertrik/hlk-ld303

Firmware

I soldered a connector to the SWD interface and dumped the firmware. No time/motivation yet to reverse engineer it.

Serial interface

The module communicates at 115200 by default. This is slightly fast for the SoftSerial library on ESP8266 and some incoming frames will not be recognised.

In my demo application, you can discover the currently used baud rate using the 'autobaud' command. Then use the 'baud' command to set a new baud rate, this activates after a power-cycle.