Daniel Estévez

@destevez

Everything space & RF. Amateur radio operator (EA4GPZ / M0HXM). PhD in Mathematics from Univ. Autónoma de Madrid. he/him

67 Following687 Followers350 Posts

Bluesky

Is this your profile?Claim it and destevez.dirty.social is yours.Claim profile

Daniel Estévez@destevez· 5d

New blog post: Tianwen-1 safe mode telemetry. Peter from @amsat-dl.org noticed that a few days ago Tianwen-1 was transmitting in safe mode. Here I analyze the telemetry signal, which is only 32 baud (16 bits per second). destevez.net/2026/08/tian...

A screenshot of a GNU Radio GUI that shows the spectrum of the signal and a time domain plot of the demodulated symbols.

Daniel Estévez@destevez· 13d

This Sentinel-2 infrared image from yesterday shows the extent of the Madrid wildfires, which are now stable and do not show any smoke in satellite imagery. The false colour map shows two shortwave infrared bands (B12 and B11) in red and blue, and near infrared (B8) in green.

A false colour satellite image that shows the western half of Spain and all of Portugal. The tweets describe how the false colour map works and what fires can be seen. Besides that, it is noticeable the higher amount of vegetation in the north and northwest part of the Iberian peninsula, and also in a few small regions in the interior.

Daniel Estévez@destevez· Jun 15

New blog post: Tianwen-2 low data rate telemetry. This is a short post where I analyze a recording of low rate (4 kbaud) telemetry done on June 8 during Tianwen-2's arrival to asteroid Kamo'oalewa. destevez.net/2026/06/tian...

A screenshot of a GNU Radio GUI showing the spectrum and constellation of the signal.

Daniel Estévez@destevez· Jun 11

Explicit formulas can be obtained by applying a Padé approximant to this degree 6 equation. This leads to designs that have a very small error in the loop bandwidth and have the correct damping. Read more: destevez.net/2026/06/pll-...

A plot that shows the loop bandwidth relative error in terms of the normalized loop bandwidth. The error tends to zero when the loop bandwidth tends to zero, and it is already around 0.01% for a loop bandwidth of 0.1.

Daniel Estévez@destevez· May 28

New blog post: An update about Tianwen-2 telemetry. This is a quick update about Tianwen-2 telemetry decoding. First, I've figured out the format of the timestamps included in AOS frames. I explain what was confusing me yesterday.

A plot of space packet APIDs received over time by Bochum

Daniel Estévez@destevez· May 27

New blog post: Decoding Tianwen-2. I analyze the telemetry decoded from recent @radiotelescoop.bsky.social recordings of Tianwen-2. Compared to Tianwen-1, there is not much in the telemetry. There are not that many fields and most are mainly static. Read more: destevez.net/2026/05/deco...

A screenshot of a GNU Radio flowgraph GUI demodulating the signal from Tianwen-2, which has rather high SNR.

A raster map of one of the decoded Space Packet APIDs. We can see a few fields changing values, but most of the contents are fairly static.

Daniel Estévez@destevez· May 13

More fun with the Ryzen AI NPU. I'm working on a more complex algorithm, and I'm seeing memory stalls that make me lose one cycle in each iteration. It turns out that the data memory of compute tiles is organized as 8x 256-bit wide 8 KiB memory banks.

A trace shown in the Perfetto UI that shows that the processor performs 8 cycles of vector instructions and then stalls waiting for memory for one cycle.

A figure from the AIE-MLv2 documentation that shows the memory module organized as 8 banks.

Daniel Estévez@destevez· May 8

Finally, I show how to use tracing to measure the performance of the NPU workload execution, and check that it matches the understanding we had obtained by analyzing the assembly code.

A screenshot of the Perfetto UI that shows an execution trace. We measure how many cycles it takes to execute each C++ kernel call.

Daniel Estévez@destevez· May 8

I implement a C++ kernel and show how it maps to assembly, and how to read the assembly to detect performance losses.

The assembly code for a C++ kernel that performs some 8x8 times 8x8 matrix multiplications. The architecture is VLIW and there are loop registers for hardware-controlled iteration. The main loop is just two instructions that are simultaneously loading data from memory with two load units and performing matrix multiply-accumulate with the vector unit.

Daniel Estévez@destevez· May 8

I start by giving an overview of the NPU hardware, explaining how it is organized as an array of compute, memory, and shimNOC tiles connected together mainly by an AXI-S interconnect for wide bandwidth data movement. I also explain the exposed-pipeline VLIW SIMD architecture.

A diagram that shows an array of compute tiles and their local memories. Data interconnections between the tiles are shown, including connection of each tile to an array-wide AXI-Stream interconnect, direct memory connections between adjacent tiles, and a cascade connection for accumulator values.

Daniel Estévez@destevez· Apr 25

I relate all these decodes to the uplink decodes from my previous post, explaining the UE and network conversations. Read more: destevez.net/2026/04/deco...

A wireshark listing that shows the decoded MAC PDUs in the uplink and downlink recordings. This shows how the V16 beacon connects to the RRC and sends a control plane service request. The same kind of traffic happens twice.

Daniel Estévez@destevez· Apr 25

I explain how the Type2 common and UE-specific search spaces for the NPDCCH work, how to do blind decoding, and how to decode the NPDSCH transmissions. The SNR in these transmissions is not great, but I'm impressed of how the repetition and FEC often give good decodes.

A constellation of a typical NPDSCH transmission sent to the V16 beacon. There are many symbols which are too large because they are corrupted by interference from other cells. Still, the transmission can be decoded.

Daniel Estévez@destevez· Apr 25

I start by showing how to process the NPSS and NSSS synchronization signals and the NRS reference signals. I detect 6 cells with different SNRs. Interestingly, one of them is not synchronized to the rest. I show how the NPSS and NSSS are beamed in patterns of 4 transmissions.

A plot of the NPSS amplitude classified by the system frame number modulo 4, since that is how the beaming pattern is organized. There are interference fringes that are caused by different eNBs not having exactly the same carrier frequency due to their disciplination.

Daniel Estévez@destevez· Apr 25

New blog post: NB-IoT downlink. This is another post in my series about V16 car warning beacons. Here I explain mostly everything about the LTE NB-IoT downlink. It's perhaps the longest post I've ever written. If you want to know more about NB-IoT this is the place to go.

An inspectrum waterfall that shows an NB-IoT uplink carrier and an NB-IoT downlink carrier aligned in time. The uplink carrier is sending NPRACH and then an NPUSCH containing an RRC connection request. The downlink has signals from many cells, and it is replying to the NPRACH, although it is barely visible.

Daniel Estévez@destevez· Mar 18

Yesterday @amsat-dl.org received and decoded again telemetry from Tianwen-1. I have done an updated plot of the orbital parameters with the new state vector telemetry. This shows that there have been no manoeuvres during the 3 months in which we haven't seen any signals.

A plot of the orbital parameters for Tianwen-1 for the last 4 years.

Daniel Estévez@destevez· Mar 12

Following up on yesterday's announcement by @amsat-dl.org about the lack of signals received from Tianwen-1 since 2025-12-23, I have published a short post that contains the orbital state based on telemetry received up to 2025-12-22.

A series of plots showing the evolution of orbital parameters over time. The data up to 2025-12-22 is based on decoded telemetry. The data afterwards is propagated.

Daniel Estévez@destevez· Feb 13

In this post I go over some details of the flight software, including file downlink, logs, and on board scripting. I also find some quaternion data and gyroscope data that are a good match, plus other quaternions that I don't know how to interpret.

A panel with four plots. Each row corresponds to one of the two spacecraft. The first column shows the rotation rate corresponding to some quaternions. The second column shows what appears to be gyroscope telemetry. We see a good match between the quaternions and the gyroscopes.

Daniel Estévez@destevez· Jan 21

Finally, a Wireshark dissector allows analyzing CSP and RDP packets (RDP is the reliable data protocol used in CSP for sequence-controlled delivery). Read more: destevez.net/2026/01/tool...

A Wireshark screenshot where we see packet analysis on a data transmission done with CSP and RDP.

Daniel Estévez@destevez· Jan 21

New blog post: Tooling for CSP. CSP is the cubesat space protocol. It is a network protocol used in cubesat buses, RF communications, and groundstations. Here I showcase some tooling to perform CSP network performance analysis and debugging that I have open sourced.

A screenshot of a terminal where we can see csp-iperf running and showing TX and RX rates and packet counts, round trip time measurements, and number of lost packets.

Daniel Estévez@destevez· Jan 9

New blog post: V16 beacon full uplink conversation. A follow up about my decoding of NB-IoT-connected car beacon warning lights (which is a thing starting this year in Spain). This time I have made a longer recording starting before the beacon is powered on.

A waterfall of the uplink transmissions of a beacon when it first begin transmitting. This is the message exchange that is needed to register the beacon in the cell network.

Daniel Estévez@destevez· Dec 29

In this post I analyze a recording of the B20 band NB-IoT uplink of a V16 beacon, showing how to decode the NPUSCH and obtain MAC PDUs that we can inspect in Wireshark.

The list of decoded MAC PDUs shown in Wireshark. The main interest is the RRC connection setup complete message, which contains a control plane service request NAS message that embeds the beacon message.

Daniel Estévez@destevez· Dec 29

New blog post: Decoding a V16 beacon. Starting in 2026, the V16 beacon mandatorily replaces the emergency triangles in road vehicles in Spain. This beacon has a strobe light and an NB-IoT connection to the cell network that it uses to send a message containing its GNSS location.

A waterfall of the uplink of a V16 beacon. We can see an m-FSK signal that is the NPRACH, and then some single-tone and multi-tone NPUSCH transmissions.

Daniel Estévez@destevez· Dec 10

Most of the recordings have a problem regarding a huge receiver frequency drift, as shown here. This limits the sensitivity of the acquisition algorithm. Read more: destevez.net/2025/12/firs...

A plot of the cross ambiguity function of a GPS signal. We see a vertical streak that spans almost 700 Hz. This is caused by the receiver frequency drifting during the 300 ms integration that is used to make this plot.

Daniel Estévez@destevez· Dec 10

New blog post: First analysis of the Lunar GNSS Receiver Experiment data. I have developed a high-sensitivity GPS acquisition algorithm in CUDA and ran it on the experiment datasets. 1 to 3 satellites are detected in 60% of the recordings.

An image showing the cross ambiguity function of a GPS signal. The correlation peak has high SNR and is clearly visible.

Daniel Estévez@destevez· Nov 19

The telemetry packets contain many interesting strings with log messages, which appear to be generated by a Linux system running Rocket Lab's MAX flight software. Read more: destevez.net/2025/11/deco...

$Some log messages extracted from the telemetry: /mnt/mmc0/logs/compton/inv_sts/inv_sts-1763132730.mtc.gz /mnt/mmc0/logs/compton/inv_eps/inv_eps-1762763341.mtc.gz /mnt/mmc0/logs/compton/inv_cdh_spoc_misc/inv_cdh_spoc_misc-1762770516.mtc.gz E_CMD_HIST: [ OK ] EPS_SPOC_DIO_ST_OCP_EN ENABLE_STATE=[0, Off] E_CMD_HIST: [ OK ] CDH_SPOC_IO_GPIO_STATE_SET IDX=[109] STATE=[0, E_Low] E_CMD_HIST: [ OK ] FJ_ABORT, Proc: CommsFallback E_INFO: set_st_power_state: End sequence E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo 'WAIT(2)' >> /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: sed -i '$d' /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: rm /tmp/*_files_list.txt E_CMD_HIST: [ OK ] MISC_CONFIG_PARSE, String: tlm_master.set_apid_freq(620, 0.05); E_CMD_HIST: [ OK ] FJ_START_ABS, Time: 1763146080.000000, File: CommsFallback, Args: E_CMD_HIST: [ OK ] FJ_START_REL, Seconds: 3600.000000, File: DisableComponents, Args: STA E_CMD_HIST: [ OK ] FJ_START_REL, Seconds: 0.000000, File: BackorbInit, Args: E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo PROC BackorbDownload > /tmp/BackorbDownload.fj E_CMD_HIST: [ OK ] MISC_SYSTEM, STRING: echo \'CMD "MISC_SYSTEM" ("gzip -c -f -k /tmp/BackorbDownload.fj > /tmp/BackorbDownload.gz")\' >> /tmp/BackorbDownload.fj E_WARNING: LoadProc (File: FJExecute.cpp Line: 1205): Procedure found in working directory, executing: /tmp/BackorbDownload.fj E_INFO: SetThermostatMode: Setting thermostat 'EESA' to mode ClosedLoop E_INFO: SetThermostatSetpointsClosedLoop: new setpoints for ON -35.000000 deg C. OFF -30.000000 deg C.$

Daniel Estévez@destevez· Nov 19

New blog post: Decoding ESCAPADE. Here I decode a recording of the ESCAPADE spacecraft that I did with an Allen Telescope Array antenna the day after they were launched. The modulation is PCM/PSK/PM with rate=1/2 Turbo code. The telemetry uses CCSDS TM frames and Space Packets.

A waterfall of the ESCAPADE-Gold telemetry signal. It shows that there are significant changes in power over time. There is a gap caused by a problem with the recording. The signal resumes at a slower data rate after the gap.

Daniel Estévez@destevez· Nov 9

I have made a new release of the Maia SDR firmware. This is a maintenance release that updates dependencies and includes some USB Ethernet connectivity improvements to Android devices.

The release changelog.

Update Maia SDR to v0.12.0. Updates dependencies.

Update IQEngine to latest main.

Add IPv6 link-local address fe80::1/64 to simplify connecting to the Pluto by ssh before the IPv4 network is configured (for instance this can be used in Android devices that use an address of the form 10.xxx.yyy.zzz/24, which is not covered by the ipaddrmulti feature)

Include IP from fw_printenv ipaddr in the Subject Alternative Names of the maia-httpd SSL certificate.

Daniel Estévez@destevez· Nov 2

New blog post: sigmf-toolkit. I present a new Python package I've made and showcase one of its tools, which adds to a SigMF file annotations for each packet in a PCAP file. This is a good way of doing protocol analysis and debugging across the physical and upper layers. destevez.net/2025/11/sigm...

A screenshot of Inspectrum that shows a waterfall containing multiple packets. Each packet is bounded with an annotation. There are also annotations for reply packets, which are not visible in the waterfall. The mouse is hovered over one packet, and the tooltip shows a dump of an IPv4 ping packet generated with Scapy.

Daniel Estévez@destevez· Oct 25

New blog post: Non-coherent m-FSK BER. Another short post in which I derive the following formula for the symbol error rate of non-coherent m-FSK and validate it using simulations. destevez.net/2025/10/non-...

A formula of the symbol error rate for m-FSK. It is a summation with m - 1 terms that contains a binomial coefficient and an exponential term that depends on the Es/N0.

A plot showing the BER versus Eb/N0 of m-FSK for m=2,4,8,16,32. The results using the closed-form formula and simulations are compared.

Daniel Estévez@destevez· Sep 28

When setup timing is violated, typically the output delay becomes much larger than the nominal one, increasingly more as the data transition approaches the clock edge. This goes somewhat against the usual idea that setup violations mainly cause metastability. Read more: destevez.net/2025/09/flip...