gr-ntnisac: An Open GNU Radio Testbed for NTN-ISAC

The gist The paper presents gr-ntnisac, an open GNU Radio testbed that applies an emulated LEO channel to a standard 5G New Radio downlink, sends it through two cabled USRPs, and scores the receiver against the delay and Doppler commanded for every path.

Architecture

The system is designed around three key design decisions that shape its architecture The waveform is generated offline The satellite channel is applied digitally on the transmit side, before the digital-to-analog converter (DAC) The radios then add their converters, filters, and clocks without changing the commanded trajectories used for scoring The receiver contains no NR sequence generation, so another standards-compliant source or recorded IQ can replace the generator

Channel and Scenes

The channel is modeled such that range is the only kinematic input Each path p is described only by its range Rp(t) and gain over time, read from a trajectory table The channel computes y(t) = Xp ap(t) x(t − τp(t)) e −j2πfcτp(t), where x is the baseband waveform, y the output sent to the DAC, ap the path amplitude, τp = Rp/c its delay, and fc the carrier The direct path comes from an analytic circular orbit in Python or from MATLAB SGP4 propagation of a two-line element set (TLE) A scene is a YAML file listing the orbit and every path Path types include direct, static, linear, rotating (a point on a blade, for micro-Doppler), pendulum, custom (an expression in t), and ntn tdl

Receiver Processing

The receiver processes the OFDM symbol by performing two FFTs to get the delay–Doppler map The goal is to hold the direct path at zero delay and Doppler in every symbol The receiver removes the direct path’s carrier phase, which takes out its Doppler and Doppler rate Echoes walk only 0.5 m per dwell relative to the direct path at 5 m/s, so they need no further correction The receiver builds the ideal pointspread function of a hypothesized path, finds and refines the direct-path peak, fits its amplitude by least squares, and subtracts it using Högbom’s CLEAN Detection then applies an ephemeris-derived clutter mask, cell-averaging CFAR, density clustering [27], and rejection of the 50 Hz framerate sidelobes

Hardware Results

The conducted captures used the full-allocation 5 MHz waveform The direct-path peak-to-noise ratio was 82.49± 0.70 dB over 28 dwells (± is one standard deviation) Cancellation depth is the ratio, in dB, of the largest map value within ±1.5 delay bins and ±15 Hz of the direct path before and after cancellation With both additions, the response-aware canceller reaches 72.7±9.3 dB on two hosts, 70.7 ± 7.9 dB with one radio, and 70.7 ± 8.2 dB in the matched simulation

Payload-Aided Example

The payload-aided map gains the full 10.9 dB in peak-to-noise ratio (26.5 to 37.4 dB) On hardware, a 30 s conducted capture carried a ladder of four moving paths at −25, −30, −35, and −40 dB and a static path at 1050 m Replayed through the GNU Radio blocks, the payload-aided receiver associated the −25 dB path in 76.9% of conducted dwells within one delay bin and 10 Hz The weaker paths were not detected, the static path was suppressed as clutter, and a matched target-absent capture gave no association in 299 dwells

This tool allows an experimenter to test an NTN sensing receiver in simulation and on real radios before a satellite trial, scored against commanded path truth with the same code throughout. The paper demonstrates that while cancellation reached 34.8 dB on hardware, controlled simulation traced the limit to the emulator’s 8-tap filter and an unresolved blade echo. The purpose of the tool is to make differences between simulation and hardware visible, repeatable, and attributable.

--- Page 8 ---

Figure 6 Direct-path cancellation depth: (a) by configuration, (b) per dwell. Response-aware: CPE correction, CLEAN, and a per-subcarrier term HW PNR − 3 dB Sim 24-tap blade (resp.-aware) 71.0 Cancellation depth (dB)

--- Page 7 ---

Sim 24-tap no blade Sim 8-tap no blade Sim 8-tap, blade (matched) HW one radio HW two hosts

--- Page 6 ---

Figure 5 Conducted hardware setup. Figure shows the setup with two USRP B200s, a splitter and cabling The conducted rung uses two hosts, two USRP B200s, a splitter, and fixed attenuation (Figure 5) Each radio has its own GPS-disciplined oscillator and the capture starts on a common GPS epoch The carrier is 2.478 GHz, not an NTN allocation, and every hardware run is conducted over cable

--- Page 5 ---

Figure 3 End-to-end testbed: emulated LEO channel, two cabled USRPs, and a replay receiver The end-to-end testbed includes an emulated LEO channel, two cabled USRPs, and a replay receiver.

--- Page 4 ---

Figure 4 Scene file scenes/bench both.yml condensed The scene file scenes/bench both.yml, condensed.

--- Page 3 ---

Table 1 Blocks of gr-ntnisac Block Function leo channel (C++) Applies each path’s range history and gain Block leo truth Each scored path’s commanded excess range and Doppler, time-stamped on the sample clock Message sink Text sink for any message port Table 1 lists the blocks.

--- Page 2 ---

Figure 4 Scene file scenes/bench both.yml, condensed The scene file scenes/bench both.yml, condensed.

--- Page 5 ---

Offline inputs files 5G NR waveform generator MATLAB 5G Toolbox / OCUDU 5G codebase / IQ captured waveform bundle: IQ + RE masks The offline inputs files are the source of the testbed.

--- Page 4 ---

TX host GNU Radio emulates the LEO satellite downlink File Source loop leo channel C++ USRP Sink B200 GPSDO clock; GPS-timed start Conducted RF conducted over cables at 2.

1. The gr-ntnisac testbed enables a lab setup is needed that runs the receiver on real radios while the delay and Doppler of every path are known, allowing for testing algorithms against a repeatable path-level truth. This allows AI systems to be trained on hardware data where the exact kinematic inputs (range, Doppler, delay) are precisely controlled, moving beyond simulations that omits converter filters, oscillator phase noise, and clock offsets.

2. The system implements a response-aware canceller that involves removing the direct path's phase and fitting/subtracting a term at the direct path’s Doppler to approximate the combined response of hardware imperfections. This allows AI systems to develop more robust detection capabilities by explicitly modeling and compensating for real-world hardware effects like the common phase error (CPE) that oscillator phase noise puts on every subcarrier.

3. The payload-aided receiver demonstrates that a moving −25 dB object stood 9.6 dB above its CFAR threshold with references only, 13.0 dB payload-aided, and 13.1 dB with the genie, showing the potential for AI to leverage known reference signals to enhance detection margins. This capability allows AI systems to improve target detection sensitivity by re-creating the data REs from its own channel estimate, equalizer, and hard decisions.

A passive receiver can sense nearby objects from the echoes of a 5G downlink. When the transmitter is a low-Earth-orbit (LEO) satellite, one transmitter covers a wide area, but the receiver must handle tens of kHz of Doppler and a direct-path delay that changes within every observation interval. Such a receiver should be tested where the correct answer is known before it is tried on a satellite. This paper presents gr-ntnisac, an open GNU Radio testbed that applies an emulated LEO channel to a standard 5G New Radio downlink, sends it through two cabled USRPs, and scores the receiver against the delay and Doppler commanded for every path. The same receiver code runs in simulation, on recorded captures, and on hardware. As a first use, we measure cancellation of the direct path, the strong satellite signal that masks weak echoes. Depth is 34.8 dB on hardware and 37.6 dB in a matched simulation without radios, so the radios are not the main limit. Controlled simulation shows that the emulator's 8-tap fractional-delay filter and a simulated rotating blade at almost the direct path's delay each limit depth to about 40 dB; without either, depth reaches 71.0 dB. A diagnostic canceller that also removes the per-subcarrier response and per-symbol phase reaches 72.7 dB on the same captures. On a conducted capture, a payload-aided receiver detects a-25 dB moving path in 76.9 percent of dwells.