Signal identification is critical to many local and federal government groups for security, law enforcement, and intelligence applications. With the growing congestion of complex digitally modulated signals used in wireless systems, especially in urban environments, signal identification and analysis becomes even more challenging in the field, requiring the right mix of measurement equipment and expertise to properly separate and identify the many different signals within a given band.

Working in the field to identify signals does not afford the same convenience of a large, fixed installation as in the laboratory. Of course, some approaches to performing digital signal analysis in the field involve simply using the measurement equipment that was designed for the laboratory. But this method is limited in mobility and effectiveness, favoring the use of equipment and techniques that were designed for portability.

Identification and analysis of unknown wireless signals requires a methodical procedure to minimize errors when tracking and isolating signals. The first step in finding a signal is to search for RF energy at some designated physical location. Measurements with a signal or spectrum analyzer over a bandwidth of concern that show signals at significant power levels are candidates for further analysis. That power level is set at some threshold point that is deemed to represent potential interference to known RF/microwave and other systems (such as computers) in the area.

Signals that are constant (always present) are the easiest to detect and log using a spectrum analyzer. Signals that are intermittent are more difficult to detect, but can be found by using a spectrum analyzer in “max hold” mode or “spectrogram mode” for a duration that is long enough to allow capture of the intermittent signals. When looking for new signals, the trace mathematics contained on many modern spectrum analyzers can help. Finding new signals trace math involves using a reference waveform recorded earlier as a baseline signal for comparison. Any newer waveforms in question are subtracted from the reference waveform to produce a difference waveform. Any dips in this difference waveform indicate signals that are no longer present, while humps or rises in the waveform show new signals.

Mask testing is a useful way to spot new signals (Fig. 1). Any signals recorded at a specific location in the past can be used to create a mask for comparison to newer signals. If there is no alarm in the comparison, the newer recorded signals do not contain any new waveforms of interest. If a mask violation occurs, the trace is logged for further investigation. Instruments with automatic mask creation can greatly speed and simplify this signal hunting procedure.

Another way to log data is to use a spectrogram, which is a three-dimensional display of frequency, power, and time. One implementation of a spectrogram shows signal power levels in different colors and time on the vertical axis. When paused, a user can scroll through the spectrogram’s time axis and view the corresponding frequency versus-time trace in terms of a frequency-versuspower trace within the same display screen (Fig. 2).

The spectrogram is an effective way to spot weak signals that otherwise would be buried in the noise and also a way to easily see intermittent signal behavior that comes and goes on a spectrum trace. The intermittent signals in the example spectrogram of Fig. 2 are easy to spot, since they appear as vertical columns that look like dashes. On a conventional frequency-versus-power display, they would come and go quickly, making them difficult to see. With a spectrogram, operators can scroll through the captured data, analyzing it at leisure.

When using a spectrogram, it is particularly important that the host spectrum analyzer employ Fast Fourier Transform (FFT) signal analysis capability. An FFT-based analyzer captures a wide portion of the frequency range at once, allowing users to see the true shape of the signal even when it a burst-type or frequency-hopped signal. A conventional swept-frequency spectrum analyzer will show instrument artifacts instead of the bursted signal when in spectrogram mode.

It is possible to use a spectrogram as a time index, to simplify a review of logged signal data. One useful technique for long-term spectrum monitoring is to set the spectrogram trace function to max-hold (to catch bursted signals) and slow the trace update rate. Since the max-hold is reset every time the spectrogram is updated, it is still possible to see signals change, and the spectrogram’s time stamp makes this technique even more useful.

While signal logging, spectrograms, and spectrogram logging are useful in finding unknown signals, it is also helpful to have an organized way to keep track of all the signals that are being monitored and recorded. When searching through a large number of signals, it is important to simply be able to identify a signal as one that has come before, or one that is not yet identified. This is where a signal survey has benefits.

On a spectrum analyzer’s signal survey screen, the short bars near the top of the screen as well as the blue box, denote spectral regions of interest (Fig. 3). The bars are the collapsed form and the box is the expanded form. These regions of interest can be created quickly to facilitate locating and identifying signals of interest.

Once RF energy is found and indexed, signals can be screened. The first level of screening will identify RF characteristics such as frequency, channel, bandwidth, and shape. Many signals can be quickly dismissed by a skilled operator— one familiar with the RF signals to be found at that location. For analog signals, there are a number of established techniques to better understand if they are legitimate.

One technique that combines all four of these first-level measurements is a signal profile test driven off a database stored in the internal memory of a spectrum analyzer (Fig. 4). The signal profile, shown above in green, incorporates the different RF screening elements discussed above. The profiles available for selection are based on what “should” be present at that location and frequency. Using these profiles, the signal can be evaluated against a series of clues to determine legitimacy.

The shape of the profile is the first clue. If the signal matches a profile, this is evidence that the signal is what it appears to be and is legitimate. The second clue is that the profile will be centered on a legal channel for the signal chosen, making any frequency error or channelization errors apparent. The signal profile test combines the elements of frequency, channels, and shape, as well as any available information collected from other investigations. When using a signal profiling tool, it will be apparent if a signal of interest or a similar signal has been scanned before. The signal profiling function is an effective first-pass screening tool for field use.

Continue to page 2