Open L16-fhss-link.grc, run it, and set the Jammer amplitude slider to 3. The figure is that window. The transmitter is Lesson 8’s FSK modem sending Lesson 8’s packets, one packet per hop, on a new channel every hop. On the left waterfall, the band the receiver sees, the signal is a trail of short dashes stepping around eight channels, and the jammer, a strong tone parked on one channel, is the solid line at +5 kHz.

Now look at the right waterfall, the output of the receiver’s Hop Sync block. The signal stands still at 0 Hz, and the jammer is the one that hops. Watch the Packets label: about 88% of the packets arrive, because only the hops on the jammer’s channel, 1 in 8, are lost. This is frequency-hopping spread spectrum (FHSS).

Interference on one channel, from a microwave oven, a Wi-Fi network, or a jammer, takes from a hopping link only the hops that land there, and a listener without the sequence hears only short bursts scattered across the band.

Bluetooth Classic hops among 79 channels 1 MHz apart at 2.4 GHz, in 625 µs slots, and its adaptive frequency hopping (AFH) drops channels that stay busy. SINCGARS, the Army’s VHF-FM radio, hops among up to 2320 channels 25 kHz apart and takes its sequence from a security key and the time of day. Unlicensed hoppers at 915 MHz follow FCC Part 15.247: a pseudo-random sequence that uses every channel equally, at least 50 channels for a narrowband signal, and an average of no more than 0.4 s on any one channel within a 20 s period.

Open L16-fhss-tx.grc. The top row is Lesson 8’s FSK transmitter, 1000 baud with a 1 kHz deviation, running at 128 kHz so the hops have room. Its Tagged Stream Mux now has four inputs: 2 guard bytes, the access code and header from the Protocol Formatter, the line USAFA ECE 448, and 2 more guard bytes.

The bottom row is the hop synthesizer. A Vector Source lists the hop frequencies, a Repeat holds each one for 30,720 samples, one hop, and a VCO with sensitivity \(2\pi\) turns each value into a tone at that many hertz. The Multiply moves the FSK signal to that tone’s frequency, which is the frequency shift of the GNU Radio wiki’s Frequency Shifting tutorial, done once per hop.

The packet and the hop are the same length, so no packet is ever split across two channels; Bluetooth does the same, one packet per slot. The guard bits at each end, the pattern 01010101, carry no data. A receiver that changes channel a few milliseconds early or late loses only guard bits, and the Timing Error frame below shows how far that goes.

Channel \(k\), for \(k = 0\) to 7, sits at

so channel 0 is at −35 kHz and channel 7 at +35 kHz, far enough apart that the 4 kHz-wide FSK signals do not overlap. Run L16-fhss-tx.grc and watch: the waterfall shows the dashes stepping around the band, and the time sink on the right shows the hop frequency as a staircase. The variable seq, np.random.default_rng(key).permutation(8), is the hop sequence, a shuffled list of the 8 channels set by the key. Key 448 gives 7, 2, 0, 6, 4, 1, 3, 5; drag the Hop key slider and the staircase changes order.

A shuffled list uses each channel exactly once per cycle of 8 hops, which meets Part 15’s equal-use rule and, as Part 3 shows, makes sync simple. Real systems use far longer sequences; Bluetooth’s takes about 23 hours to repeat.

Open L16-fhss-link.grc. The top half is the transmitter you just ran, then a channel: a Delay for a path delay the receiver does not know, a Noise Source, and the jammer, a Signal Source at the center of one channel.

The receiver starts with Hop Sync, an Embedded Python Block. It multiplies the band by a tone at minus the current hop frequency, which de-hops it: every hop comes out at 0 Hz. A Low Pass Filter keeps ±2 kHz and decimates by 4, which removes the other seven channels, and from the Quadrature Demod on, the receiver is Lesson 8’s. The Text Sink sends a message out its pkt port each time a packet arrives, and the dashed line back to Hop Sync carries it.

Run it with the sliders at their defaults. The Receiver label reads “locked” within a fraction of a second, and the right waterfall shows one steady trace at 0 Hz: the transmitter multiplied by \(e^{j2\pi f_k t}\) on hop \(k\), Hop Sync multiplies by \(e^{-j2\pi f_k t}\), and the two cancel. Every packet arrives.

Now drag the Noise amplitude slider up and watch the Packets label: at 1 every packet arrives, at 2 a few are lost, and at 2.5 about a third are. After the Low Pass Filter the receiver sees what Lesson 8’s receiver saw, so noise affects it the same way. FSK suits a hopper because the Quadrature Demod needs no carrier phase, so a phase jump at a hop boundary does no harm.

That lock at startup is Hop Sync finding the hops. A receiver with the key still does not know which hop the transmitter is on or when it began, because the path delay is unknown, and on a radio so is the USB latency. We use sync on a known hop: Hop Sync parks on the sync channel, seq[0], channel 7 for key 448. The sequence visits each channel once per cycle, so the transmitter appears there only on hop 0. When the power on channel 7 jumps to four times its recent average, hop 0 has begun; Hop Sync takes that instant as its hop boundary and hops from then on. It waits at most one cycle, 1.92 s.

After that, Hop Sync hops on its own count of samples; the packets only stop it from parking again. That leaves two weak points. A jammer on the sync channel keeps a receiver from locking, which the Jammer frames show. And the timing never follows clock drift: harmless on one Pluto, whose transmitter and receiver share a clock, but between two radios a few parts per million apart, the hop boundaries would slowly drift out of the guard time. A start-of-hop marker alone would give timing but not the hop number, and time of day, which SINCGARS uses, needs a shared clock.

While the link runs, drag the Path delay slider from 100 to 400 ms, as if the buffering between two radios had changed. Watch the right waterfall: the steady trace breaks up into scattered dashes, because the receiver’s hop boundaries are now 300 ms, more than a hop, off. The Receiver label goes back to “searching” after more than 9 hops with no packet, and when hop 0 next reaches the sync channel it locks again and the trace returns. In the figure the Packets label shows 20 of 37 packets since the slider moved: the receiver lost 17 hops, about 4 s.

The waterfall’s time axis is only approximate, because the GUI scrolls one row per display update; on it, an 8-hop cycle of 1.92 s spans about 1.5 s. Read times from the Packets label instead.

Set the Receiver hop offset slider to +1. Hop Sync now tunes to seq[k+1] while the transmitter is on seq[k]. Watch the right waterfall: the steady trace is gone, and the signal lands at the difference between two channels, a different place every hop, never inside the Low Pass Filter. The Packets label stays at 0, because consecutive entries of a shuffled list are never the same channel. Try −1 and +2: still nothing.

Hop Sync keeps parking and relocking, but it applies the offset after every lock, so it never recovers. A receiver with the right timing on the wrong hop receives nothing, while a fixed receiver parked on any one channel would still catch 1 packet in 8.

Set the Jammer amplitude to 3, three times the signal’s amplitude, on channel 4. Watch the right waterfall: Hop Sync shifts the jammer along with the band, so it lands somewhere new every hop, usually outside the Low Pass Filter. Only on the hop to channel 4 does it land at 0 Hz and capture the Quadrature Demod. Watch the Packets label settle near 88%, 7 hops in 8.

Now drag the amplitude up to 10. The Packets label hardly moves: once the jammer takes the hops on its own channel, more power takes no more. Then set the amplitude to 0.5, and every packet arrives again.

The L16 Lab moves this link onto a PlutoSDR at 915 MHz. The transmit half ends at a PlutoSDR Sink instead of the channel, with a jammer tone added in software before it, and the receive half starts at a PlutoSDR Source, with the same Hop Sync and FSK receiver. As in L10 and L12, a Rational Resampler raises the 128 kHz stream by 8, to 1.024 MS/s, on the way out and lowers it on the way in, and an AGC holds the received level steady. The radio adds a delay of its own between the TX and RX ports, which Hop Sync finds the same way it finds the simulated path delay.

All eight channels lie within ±40 kHz, inside the 1.024 MS/s the Pluto samples, so the hopping happens in software and the Pluto’s own synthesizer never changes frequency. A hopper whose channels span more than its sample rate, such as SINCGARS over 58 MHz, retunes its synthesizer at every hop, and the time the synthesizer takes to settle limits its hop rate.

In class we transmit only into a cable, into a shielded enclosure, or at very low power in an ISM band, and only when the lesson says to. Nothing in this lesson transmits; the L16 Lab transmits from the Pluto’s TX port through an inline 30 dB attenuator into its own RX port. We have run the PlutoSDR flowgraph only in simulation, with a model of the cable in place of the radio, so the lab is its first run on hardware.

The L16 Lab is the hands-on version of this lesson. You build a hop synthesizer and a de-hopper from standard blocks on an empty canvas, measure how many packets get through as the jammer, the number of channels, and the receiver’s timing change, and then send the hopping link through a PlutoSDR and a cable.

Lesson 17 turns to RF reverse engineering: capturing an unknown signal and working out its modulation, its symbol rate, and its bits. A hopper is one of the harder signals to reverse engineer, because a receiver parked on one channel sees only one hop in \(N\).