# Chiseling out The Chip!

This post may be a bit redundant with the info I added in the other place, but I am excited, so I felt the need to rewrite some of it here.

Le Chip! This work took a while. To celebrate, I thought it deserves a few words in the blogs. During the past year or so, I was/have-been/will-continue-to-be working on an image sensor ADC testchip. It was finally taped out yesterday! What’s left now is some additional gastronomical work on the tapeout cake and the drainage of a rusty bottle of champagne.

The chip in all its ugly majesty with all these redundant power pads and LVDS pairs.

The core of the testchip is a fast 12-bit column-parallel ramp ADC at 5u pitch, utilizing some special counting schemes to achieve the desired 1us ramp time at slow clock rates. Alongside, to be able to fully verify the pipelined CDS functionality and crosstalk, I’ve built a pixel array in line-scan configuration, some fast LVDS drivers, clock receivers, references, state machines, a few 8-bit iDACs, bond pads, ESD, and some other array-related stuff, all from scratch! The chip has a horizontal resolution of 1024 and 128 lines with RGBW color filters and microlenses.

On the top-left corner there are some experimental silicon photomultipliers and SPAD diodes. These I plan to measure for fun and I promise to post the results in any of the two blogs.

Unfortunately, this chip wouldn’t yield tons of publicaiton work, apart from the core ADC architecture and comparator. To test the ADC one needs a whole bunch of other fast readout blocks, which in the end are not something novel, but yet, one needs them and designing these takes time. Finishing up this test system was a lot of work and I realize that it might be a bit risky and ambitious to be doing this as part of a doctorate. What if it fails to work because a state machine had an inverted signal somewhere? Or the home-made ESD and pads suffer from latch-up? Or the LVDS driver CMFB is unstable and I cannot readout data out? Or there is a current spike erasing the content of the SRAM? Or, or, or ?

We university people don’t have the corporate power to tapeout metal fixes twice a month until we’re there. I probably have another two or three chip runs for my whole doctorate. It may therefore be better (and more fun) to stick with small but esoteric modules, which one can verify separately and have time to analyze in detail. But hey, I’ll quote a colleague here: “It is what it is, let’s think how we can improve things.”

Finally, I have added this little fella who I hope will be my lucky charm.

Mr Le Duck!

With his 15um of height, could he compete in the annual “smallest duck on the planet” contest? Cheers!

# Dithering and is no noise a good noise? – Part one.

The technique which I will try to briefly describe in this post is often referred to as dithering. The term according to Wikipedia comes from the old English word “didder”, meaning to shiver, shake.

During continuous to discrete-time signal conversion a so called quantizer component is used. Quantization in signal processing is a process of converting the information from a fine continuous-time (analog) signal to one represented in finite amplitude steps by sampling. It is important to mention that time sampling (ideally w/o quantization) does not generate noise and if one ensures that the sampling frequency exceeds the Nyquist rate, then a smooth signal is again obtained and no information is lost. In reality however in a sampled system we can not save each sample with its exact value, but instead we often need to quantize (digitize) it and store it with a limited number representation (bits). Having a limited set of numbers means that in reality there would be a discrepancy between the real analog signal and the quantized (digitized) one. Here is a quick sketch showing what I actually mean:

An analog signal and its quantization

The analog signal is quantized in a finite set of steps and the error between the real sampled and the converted (quantized) values is shown in the hatched area. Now, it has been shown that with the help of oversampling techniques one can statistically increase the resolution of a quantizer by generally speaking accumulation and averaging.

My post aims to show how the effect of oversampling and therefore Signal to Noise (SNR) ratio can be increased by injecting even more noise into the system. At first glance one might say – no way! However, that’s not always the case. If the quantizer is coarse (so that no circuit thermal noise would influence it much) and if the injected noise (dither) has the right magnitude we can gain a lot. Let’s have a look at a simple and intuitive example. Here is an overview of our system consisting of a signal source $x$ random uniform noise source $d$ and a quantizer (2-bit) to ease-up our drawings later-on.

Analog additive dither and a quantizer

Let’s apply a sinewave $x$ as our input signal and skip adding a dither signal $d$ , then the input and output of the quantizer would look like this:

An ideal quantized sinewave

Now if we inject random uniform (a key role, to be discussed in Part 2 of this post) noise $d$ with an amplitude of one least-significant bit (LSB) we can observe the following picture:

A quantized sinewave with additive dither

It comes to ones intuition that if we try to average the samples we might actually have done a higher resolution quantization. Think low-pass filtering. However to give a very clear illustration I’ll introduce a numerical example. Consider a DC signal of 2.5 Volts and an ideal quantizer of 2 bits:

An example of DC signal oversampling with and without dither injection.

We can see that without any dither the average conversion value is still 3, while by adding dither we randomize the error and after averaging we have gained additional resolution. Obviously my 2.5V example is a bit too idealistic and there is an awful lot more to this, but I just wanted to make my trial at introducing this concept here. Some other day I will write some about analog additive and digital subtractive dither, as well as its impact on images.

# Reception and decoding of POCSAG Emergency Service messages

Lately I have been scanning the frequency spectrum with an R820T and Realtek RTL2832U DVB-T tuner. Scanning the spectrum for mysterious signals and hunting decryption schemes gives me an immense pleasure. With such a module I am able to do frequency sweeps from 24MHz up to 1.8GHz and a few nights ago I spotted some strange Frequency Shift Keying (FSK) bursts at around 153-154 MHz.

POCSAG FSK Signal Reception

An initial thought was that these are traffic light or possibly train radio relaying signals as I live close to the train station. I was clearly able to distinguish the FSK modulation but the encoding/encryption schemes used were still a mystery. An initial guess was RTTY, however after spending some time on the problem it appeared that this was the so called POCSAG protocol and the messages transmitted were clearly coming from the ambulance/emergency services.

I found about Elias Oenal / Tom Sailer’s multimon-ng decoder and decided to give it a try. Aaah, it’s so great when you can use things ready made by someone else, although a joke-saying we used to often repeat with colleagues during my bachelor studies in Ruse read “You are not a man if you aren’t writing your hardware drivers on your own!”… After some listening I tuned my receiver on 153.345 MHz and started decoding. (offtopic/public non-encrypted messaage: Simon, if you are reading this, ok, yes, no, agreed, this is not a bravery at all).

A quick command for the enthusiasts: “rtl_fm -g 47.2 -E dc -E edge -f 153.345M -M fm -s 22050 | multimon-ng -t raw -i -p -u -e -f alpha /dev/stdin | grep –line-buffered -i POCSAG > pocsaggrep.txt”

I spotted some quite frightening messages and could not believe that so many accidents are actually happening in right now. Here are some examples of what one can hear/read on these bands. It might not be very politically correct to publish such information, but as there are no names in the messages I am more reliant that is should be OK, for the name of science 😉

POCSAG1200: Address: 432795 Function: 2 Alpha: 22:39-11 11/12/2014 22:38:28 INC 11703852 27D03S 2 SLAIDBURN PLACE, RIBBLETON PRESTON, PR2 6JY Male 30 Years MALE – STABBED GRD 357053 430858<NUL>

POCSAG1200: Address: 640324 Function: 2 Alpha: 22:37-78 11/12/2014 22:35:21 INC 11703843 17D03 PENNY FARTHING THEATRE BAR, 89 ROE STREET, LIVERPOOL CITY CENTRE L1, L1 1EP Female 45 Years fem been on drugs and alcohol/ fallen

POCSAG1200: Address: 40078 Function: 2 Alpha: 22:35-39 11/12/2014 22:34:13 INC 11703838 10C02 BROOK COURT – FLAT 45, MOOR LANE, SALFORD 7 SALFORD, M7 3NF Female 85 Years FEMALE CHEST PAIN GRD 382144 402077

POCSAG1200: Address: 1565498 Function: 2 Alpha: 22:31-32 11/12/2014 22:30:12 INC 11703827 01D01 132 SHEAR BROW, BLACKBURN, BB1 8DZ Female 34 Years Pt condition has worsend- Upper stomach and lower back pain GRD 367963 429071<NUL>

POCSAG1200: Address: 1259918 Function: 2 Alpha: 22:31-70 11/12/2014 22:28:52 INC 11703821 19C03 THE VENUS BUILDING, G4 SECURITY, OLD PARK LANE, TRAFFORD PARK MANCHESTER, M41 7HA Male 55 Years Q ANGINA ATTACK GRD 376491 396927

POCSAG1200: Address: 432795 Function: 2 Alpha: 22:30-10 11/12/2014 22:26:49 INC 11703812 11D02 86 YEWTREE AVENUE, GRANGE/RIBBLETON PRESTON, PR2 6QA Male 1 Months BABY NOT BREATHING GRD 357222 431741

POCSAG1200: Address: 432477 Function: 2 Alpha: 22:29-85 11/12/2014 22:28:40 INC 11703820 09E01 45 BEECHWOOD ROAD, BROMBOROUGH WIRRAL CH62, CH62 7BQ Male 79 Years MALE FALLEN GRD 334376 381540<NUL>

POCSAG1200: Address: 16127 Function: 2 Alpha: 22:27-43 11/12/2014 22:25:05 INC 11703810 30D01 (BLUE ANCHOR, AINTREE LANE, AINTREE L10, L10 2JJ Female 67 Years M F HEAD INJ GRD 337376 398861<NUL><NUL>

POCSAG1200: Address: 134937 Function: 2 Alpha: 22:11-02 FOR YOUR INFORMATION **** ****** HAS LEFT THE INCIDENT SCENE AT SHILBOTTLE NOW, IT APPEARS THAT THE 80 YEAR OLD FEMALE OCCUPANT HAS TRIED TO SET A FIRE IN AN AREA OTHER THAN THE FIREPLACE, ALTHOUGH THERE WAS A FIRE IN THE FIREPLACE, THIS HAS SET FIRE TO CURTAINS WHICH SHE HAS REMOVED AND TRIED TO TAKE OUTSIDE WHICH PROBABLY RESULTED IN HER SETTING FIRE TO HER CLOTHING, SHE MAY BE SUFFERING FROM SOME DEMENTIA AS THERE WERE CORNFLAKES IN THE OVEN. PARAMEDICS INDICATE THAT ALTHOUGH SHE IS SUFFERING 45% BURNS THEY DO NOT APPEAR TO BE TOO DEEP BUT AT THIS STAGE IT IS DIFF

However, it seems like these messages are transmitted nationwide, or? Anyone, ideas? Some addresses listed are not even in the region I am…

POCSAG1200: Address: 14904 Function: 0 Alpha: 23:38-11 POLICE SERVICE OF NORTHERN IRELAND PLS CALL BACK 07989 970 160 RE FESABILITY CHECK
POCSAG1200: Address: 1039155 Function: 3 Alpha: <ACK>/
POCSAG1200: Address: 18743 Function: 2 Alpha: 23:39-15 PLS CALL CHILDRENS CDU ON 26876 – 2ND REQUEST<NUL><NUL>
POCSAG1200: Address: 49263 Function: 2 Alpha: 23:39-95 MEDICAL EMERGENCY – WARD 1 – UHND
POCSAG1200: Address: 311674 Function: 0 Alpha: 23:40-84 THIS IS A PAGER TEST PLS RESPOND VIA RADIO

Here is a short video on rtl_sdr and POCSAG decryption (you will note the discontinuity in the sound, it is due to CPU overload, sorry).

The next interesting miniproject would be live weather satellite multispectral image reception and reconstruction. Once I complete the latter I promise a proper post with more and interesting satellite images, hopefully, luckily, Christmas and New Year are approaching… 🙂