Underslung pod
Receiver, compute and storage in one housing under the carrier. Five channels are received coherently, and the direction is computed by MUSIC from raw IQ on board — what goes down is a bearing, not a sample stream.
Operator modem
The other end of s.Link — our own physical and link layer. It takes the bearing telemetry in and sends commands back. The band is narrow, and in a waterfall the burst reads as a domestic sensor rather than as a military channel.
High-rate modem
The same s.Link modem on a larger die. In SL-1 the physical layer is computed by the host, in Python — at 25 000 symbols per second that is correct and cheap. The high-rate mode does not work that way: 15.36 Msym/s will not pass through USB into Python, the chain has to live in fabric, and on the SL-1 die only eight of eighty multiplier slices are free.
Kintex figures are datasheet, not our measurement
Sector direction finder
A cheap direction finder for the band where a coherent array cannot work: above 1766 MHz the GR-1 tuner stops, and FPV control and video live exactly there. Five directional antennas in a ring compare power, not phase, so neither synchronous channels nor array calibration are needed. It gives a sector, not a degree — and says how much to trust it.
Specification follows the first on-air measurement
Ground complex
Eight coherent channels of direct sampling — there is no local oscillator at all. The PLL phase jump on every retune, which breaks wideband direction finding on the five-channel station, does not exist here as a phenomenon. The die sees the whole band and computes a direction on every bin, not on one.
Specification follows the first board
Antenna array
Five elements in a Ø195 mm ring. It is the ring geometry, not the receiver, that decides where a bearing is unambiguous: the chord between neighbouring elements is 114.6 mm, and spacing against wavelength is recomputed on every retune.
Antenna array
Two switched concentric rings of five elements. One ring cannot cover the whole GR-1 range: spacing against wavelength, unambiguous at the top of the band, stops yielding a direction at the bottom. Two rings split the band between them; the receiver stays the same.
Geometry is fixed by the first drawing
Squint ring
Five log-periodic antennas placed radially, 72° apart. The ring for ZR-1: each looks into its own sector, and the direction comes from the power difference between neighbours — which is why the elements here are directional, unlike a UCA ring, where they must be identical and omni.
Name provisional — the release session decides
Three rings
Three switched concentric rings of eight elements. Nothing covers 100 MHz – 6 GHz with a single ring, so the rings are made electrically identical and split the range three ways — each working its own third with the same geometry.
Collision mechanics are computed by plan 268
Platform
We are not building an instrument that shows a direction but a platform that folds an arbitrary number of physical sensors into one picture. A coherent array, a wideband survey receiver, someone else's receiver inside a customer's system — the platform does not care what does the receiving. What matters is what comes out.
And what comes out is not a list of bursts but a map with context: which band of the frequency plan this is, which operator holds it, whether this is a legitimate user, and whether the same emitter was already here yesterday. Detections are fused into sources by frequency, harmonics, shared location and modulation coherence — and only then reach the operator.
War is moving exactly there. Control of the spectrum is its next technological cycle, and it will be won not by whoever jams loudest but by whoever sees more and sooner. The station suppresses nothing — it is a SIGINT sensor, not a jammer — and that is what carries it through export control where a jammer stalls for months.
Under the hood: a five-channel coherent array and the MUSIC algorithm give the direction from the phase differences between elements. Each station reports to the operator over its own link; the console crosses bearings from several stations, and a point on the map falls out.
The path difference between elements is the bearing
Specification
The array and the receivers have different limits. A Ø195 mm ring gives a 114.6 mm chord between adjacent elements, and everything else follows from it: below 262 MHz the array is too small and yields energy only; above 1309 MHz the spacing exceeds half a wavelength and a mirror twin appears. So the receivers tune to 1766 MHz but an unambiguous bearing ends at 1309, and we mark such measurements ambiguous rather than passing them off as clean.
What already works as a product
What is already measured — in the field, with a date
| Measured | Value | When |
|---|---|---|
| Bearing on an 868.000 CW beacon, spread | 0.2–1.5° over 90-second legs, 107 bearings | 22.08 · field |
| Source proven by frequency selectivity | 69.6 dB at 868.0 vs ~16 dB either side — a 53.1 dB drop | 22.08 · field |
| Beacon moved 0° → 30° | the bearing moved +35.9° for a true +30° | 22.08 · field |
| Automated tests passing | 18,542 passed / 44 skipped, 0 red | 08.09 · test run |
Ready in code — waiting for the air
These are not plans or intentions: the code is written, the chain closes on the bench, the tests are green. Exactly one thing is missing — a run on the air.
Where the limit moves next
The same receiver, lifted to altitude, works in a different order of ranges — because what changes is geometry, not sensitivity. For a ground-level source the radio horizon follows straight from height:
The other half of the problem is position. A direction finder gains from closing on the line of contact exactly as it gains from altitude: both move the same horizon. Together they take the station from single kilometres into tens.
The figures above are geometric line of sight, not a promised bearing range: a confident bearing is planned more conservatively, at roughly half to two thirds of the lesser of the two limits. An airborne carrier also brings problems of its own, which we have already worked through rather than leaving to be discovered in flight: a planar array gives no stable azimuth directly beneath the carrier, one degree of attitude error costs one degree of bearing error, the array centre has to be kept clear of motors and power runs, and baseline runs must be taken separately with the motors off and on.
Signature analysis
We determine what kind of transmitter this is from features of the signal — temporal, spectral, structural — rather than from what it carries. This is a matter of principle: the system stays receive-only and needs neither keys nor any right to the payload. That is precisely why it can be placed where a system that demodulates would not be allowed.
The task is not "recognise ELRS" but to detect the whole family — including variants whose channels and parameters we do not yet know: mLRS forks, MILELRS, Kuznechik, closed Crossfire. So we catch it by the invariants that physics and the chipset dictate, not by a list of known signatures.
The invariants first read "chirp or FLRC, not OFDM". For ELRS and mLRS that is true — and as a family trait it is wrong: it cuts out FrSky ACCST/ACCESS, Flysky AFHDS, Futaba FASST, Spektrum DSMX and SiK/RFD900 telemetry. All of them are FHSS with the same burst-level behaviour but on GFSK or DSSS — a detector built on chirp would have missed half the popular fleet.
The family invariant is behaviour, not modulation. Modulation distinguishes a branch within the family, not the family itself.
A separate detector tells modern standard families apart with three correlators — DVB-T2 P1, 5G NR PSS (three m-sequences per 3GPP TS 38.211) and Wi-Fi. The output is a family, a confidence and a score per correlator. There is no demodulation here either.
Our board's instantaneous window is 30.72 MHz — not the nominal 56, because it accepts no more — and a 65 536-point transform gives a resolution of 469 Hz inside it. The entire hop set of the sub-GHz families fits inside that window, so we measure the channel grid step rather than guessing it: this resolution divides a 525 kHz grid into 1120 cells.
An honest limitation: this works in park mode. In survey mode the dwell is shorter than the hop period — a sweep against FHSS is doomed, and we do not rely on it.
We can show the station working in person. The full technical wiki and the protocol specification are in the data room.