Crescendo: Towards Wideband, Real-time, High-Fidelity Spectrum Sensing Systems

Spectrum sensing systems provide real-time feedback essential for spectrum sharing. However, the growth of spectrum sharing is limited by the capabilities of these spectrum sensors. Sharing a new frequency band is only possible if sensors can detect activity in that band with sufficient time granularity and signal fidelity to meet spectrum sharing policy requirements. In this work, we introduce Crescendo, a system design that shows we can achieve wideband, real-time, high-fidelity spectrum sensing using sweeping spectrum sensors. We first provide an analysis that demonstrates there are operating points of sweeping sensors that can sense multiple popular protocols. Then we demonstrate these sensors can be built in practice with an adaptive gain super-heterodyne RF frontend with high-fidelity LO generation, and evaluate a prototype built with COTS components. In our benchmarks, Crescendo outperforms prior wideband spectrum sensors, achieving a 30 dB increase in dynamic range and 10 dB increase in SNR.


INTRODUCTION
Sustaining the growth of wireless communication requires spectrum sharing to efficiently make use of the limited usable spectrum [42].Fortunately, there are many opportunities for spectrum sharing, such as CBRS [13,14], WiFi-6E [39], and the FR3 band (10 GHz to 20 GHz) [3].One of the factors limiting effective spectrum sharing is the capabilities of spectrum sensors.The sensor must be wideband to observe the ever-increasing number of RF bands where spectrum sharing is permitted.It should be adaptive, and able to observe and process signals in real-time1 to provide context and understanding of spectrum usage.Wireless systems operate on millisecond time scales, with events of interest like packet collisions and harmful interference occurring on similar scales.Finally, the sensor must have a high enough signal fidelity to inform measurement accuracy.The fidelity of its observations dictates the sensors reliability.Unfortunately, spectrum sensors can miss signals due to the sensor needing to attenuate loud signals, or detect spurious signals due to over-amplification resulting in saturation [20].
To meet the demands of wideband, real-time, and highfidelity signal measurements, intricate designs spanning both the analog and digital domains are essential.Enhancing the ADC (analog-to-digital converter) sampling rate, supported by a robust wideband analog front-end, seems a direct approach to real-time sensing.However, this requires processing large data volumes and runs the risk of ADC saturation from dominant signals, thereby compromising data integrity.On the flip side, spectrum analyzers, which leverage analog filter banks and sophisticated RF design to counteract saturation, typically offer only band-specific power data, often sidelining pivotal contextual details such as the protocol or signal type [4,20,31].Within this landscape, SweepSense [20] stands out.It repurposes an SDR (softwaredefined radio) for rapid spectrum sweeping, achieving impressive bandwidth and real-time performance.However, due to its static design and clock inconsistencies, it sacrifices frequency stability and signal fidelity for speed; presenting a trade-off between speed and quality in performance.
In this study, we present Crescendo, a sensor design that achieves wideband capabilities, real-time operations, and high signal fidelity leveraging discrete COTS components.Figure 1 illustrates how Crescendo integrates a specialized sweeping frontend to a standard SDR.This system adopts a rapid spectrum-sweeping architecture, inspired by SweepSense, and is further optimized through meticulous RF design combined with adaptive gain control algorithms to guarantee signal fidelity and consistency.The challenges we had to overcome to build Crescendo and our contributions to overcome those challenges are summarized below: Challenge 1: Handling spectrum usage dynamics: The continuous evolution in signal profiles, new application scenarios, and increased bandwidth demands, makes it necessary to carefully tune the parameters of spectrum sweeping to achieve the high-fidelity real-time sensing for all signals that need to be detected.For instance, the CBRS bands require detecting constantly transmitting LTE base stations as well as ephemeral radar signals.
We provide a theoretical framework that guides the design and configuration of sweeping spectrum sensors based on the characteristics of the signals they need to detect.Using this framework we analyzed a typical spectrum sensing scenario, and discovered the minimum performance specifications needed from a sweeping sensor is surprisingly high: sweep rates surpassing 33 GHz/sec and a sampling bandwidth exceeding 70 MHz.Challenge 2: Limitations of sweeping radio hardware: No sweeping radio today can achieve the real-time performance, dynamic range, bandwidth, and stability that we need for the typical spectrum sensing scenario.For instance, we can not use traditional spectrum analyzers because they lack fidelity: they only take power measurements and no phase information, preventing detailed signal analysis.Moreover, recent endeavors, such as SweepSense, lack phase stability and so they have poor signal fidelity, resulting in inaccurate detection of signals, and even missed signals.
We evaluated using a sweeping PLL, typically used in radar systems, for sweep local oscillator (LO) generation.Our analysis of phase coherence, settling time, and sweep rates demonstrates that the PLL-centric approach meets Crescendo's requirements.Challenge 3: Power dynamics in wideband spectrum: Sweeping over wideband spectrum will often result in sensing both loud and quiet signals.Unfortunately, the loud signals can induce intermodulation and other non-linear disturbances that significantly harm sensing accuracy of the quiet signals.Using data collected at our university we found that sweeping sensors must handle an extraordinarily wide dynamic range, often extending beyond 100 dB.
We developed a sophisticated power handling mechanism for Crescendo to capture signals with disparate power levels while sweeping.Namely, we use a super-heterodyne sensor architecture augmented with RF filter-banks and a precise Intermediate Frequency (IF) filter.Concurrently, we introduce SDGA, an algorithm that modifies Crescendo's gain in real-time during sweeps-adapting to the power dynamics of the sensed signals-ensuring high-fidelity signal acquisition.
Crescendo can be built using COTS components attached to a Software-Defined Radio.We evaluated its performance in real-world environments and compared against SweepSense and a wideband SDR.Our results confirm that Crescendo can operate seamlessly in previously challenging scenarios, such as when situated proximate to a high-power transmitter.The capability of Crescendo to modify filters and adjust gains during sweeps cproduces a 10× improvement in SNR and a 1000× improvement in dynamic range over a baseline sweeping sensor.Additionally, we performed micro-benchmarks that demonstrate the benefits of PLL-based sweep LO generation in sweeping spectrum sensors, namely their quick sweep speed and inherent stability.

SWEEPING SPECTRUM SENSING:
CHALLENGES AND REQUIREMENTS  1: Parameters of wireless protocols expressed in terms of bandwidth and transmission/packet sizes.
will have to coexist with much weaker earth-to-satellite signals [3].Additionally, sweeping spectrum sensing techniques generally are tailored for certain frequency bands or operational activities, making them less adaptive to evolving use of the spectrum [30].

Sweeping spectrum sensors
Sweeping spectrum sensors have emerged as a significant advancement in spectrum sensing, offering potential advantages in wide-bandwidth coverage coupled with real-time performance [20].These sensors operate by utilizing a constrained IF sampling bandwidth and dynamically adjusting the LO to sweep across the desired spectrum.This sweeping mechanism enables broad spectral coverage with minimal downtime during re-tuning.A key benefit of the limited IF sampling bandwidth is the substantial reduction in system processing load, mitigating the challenges of digitizing spectrum in the GHz range and facilitating efficient signal feature extraction for subsequent identification and classification.However, a notable challenge with sweeping spectrum sensors is their intermittent observation, which poses questions about the optimal choice of parameters to maximize performance.Additionally, current solutions have made the tradeoff of compromised signal fidelity caused by phase and frequency instabilities in their sensor hardware hardware design.
In an attempt to improve sweeping spectrum sensors, we develop a framework to understand the effect of the rate of LO sweeping (Sweep rate) and the choice of IF Bandwidth.In addition, we also need to understand the requirements of signal power handling and dynamic range to ensure distortionfree sensing.

Choosing Sweep Rate and IF Bandwidth
An important aspect of our requirement exploration process involved creating a framework to determine appropriate values for the IF sampling bandwidth (   ) and sweep rate (  ).We identified two key constraints in our approach: (1) Decoding/signal feature constraint: It is imperative to ensure that the overlap of Crescendo with the band of the signal of interest while sweeping is many times the signal symbol time (say 10x).This facilitates higher resolution in the frequency domain for the signal of interest and allows us to conduct basic cyclostationary analysis [9,16].(2) Overlap probability constraint: We aim to maintain the overlap probability of the signal, given some signal packet size, to be more than a designated value .The overlap probability is the probability that our sweeping spectrum sensor will be able to observe a single random instance of that signal.These constraints can be expressed as inequalities for known values of signal bandwidth (  ), signal packet size (  ), and the total bandwidth of observation (  ).The inequalities are as follows: (1) More details are provided in Appendix A. The choice of    and   must satisfy these inequalities for any particular application.We consider a total bandwidth of 6 GHz.The choice of  controls duty-cycling, and, therefore, the processing reduction we aim to achieve.If we want IF bandwidths 100x smaller than the total bandwidth, the target  value would be 0.01.In other words, using a 100x smaller IF bandwidth approximately leads to a 100x reduction in the probability of overlap on average.Although this choice seems low initially, typical real-world signals exist for many seconds and emit hundreds of transmissions like WiFi or are always on like FM radio or LTE.The goal of a spectrum sensor is to provide measurements and context and the choice of  will still allow it to do so.Besides, the choice of  can be increased for applications that demand stricter parameters.
We evaluated a range of real-world signals to validate our design framework, as illustrated in Table 1.We plot the regions of valid choices for each signal and identify the common operational area in Figure 2. The minimum feasible IF bandwidth for all signal cases was found to be 70 MHz, which corresponds to a sweep rate of 250 GHz/sec.If we can accommodate an IF bandwidth of 80 MHz, then the sweep speed can be relaxed to anything above 33 GHz/sec, providing a more flexible design.
Following the demarcation of design parameters, a definitive range of permissible IF bandwidths and sweep rates will emerge.We describe and develop a design that meets these requirements in Section 3.

Power Dynamics in Sub-6 GHz spectrum
To understand the power dynamics in the sub-6 GHz spectrum, we use a spectrum analyzer and capture power levels across the entire band at three different ground-level outdoor locations on our urban university campus.While these locations were randomly selected, we believe our conclusions about power level handling would translate to any similar urban scenario.The power-handling requirements may get more severe if the sensor is deployed at a height due to lower path loss [35].The data is captured by incrementally tuning an SDR [34] with 100 MHz sampling bandwidth between 100 MHz and 6 GHz and capturing I/Q samples using a wideband antenna [33].The samples are cut into 30 us chunks and the peak power in the time domain (as dBm) is computed.The 99th percentile of the peak power on a per-band basis is plotted in Figure 3.The value goes as high as -13 dBm for the 700 MHz LTE band that has a lot of activity at our campus.The cause of high power is typically due to a combination of strong transmitters, proximity to transmitters, and path-loss at various frequencies.For example, the FM bands consistently exhibit extremely high power levels due to strong broadcast transmitters and low path-loss.In contrast, most of the power in 2.4 GHz or 5 GHz bands comes from nearby WiFi transmitters since path loss in these bands is much higher.The 700 MHz LTE bands fall somewhere in the middle, where the base-stations are moderately powerful, and the path loss is somewhere between the former two examples.The lowest possible power observed without distortion for a given peak power is expressed using the Spurious Free Dynamic Range (SFDR) metric [7].Typical wideband ADCs have an SFDR of around 75 dB [6], AD9625.The receiver  1.For an FM-like signal to be detectable at the sensitivity level regardless of its center frequency, the sensor must support an SFDR of 105 dB, which is 30 dB more than a non-adaptive system.Therefore, the analog system is required to dynamically adapt the powers of various signals (up to 30 dB) so that the SFDR of the ADC is enhanced.

DESIGN
Our design is composed of decoupled modules and, once implemented, can be integrated with any SDR or radio with a fixed sampling rate and DSP.The aim is to capture the entire sub-6 GHz spectrum in real-time with high fidelity.Initially, we'll discuss the architecture of Crescendo and its approach to wideband sweeping such that it meets the requirements set in the previous section.Subsequent discussions will explore how sweeping can be viewed as a form of configurable filtering.We then discuss how we can leverage the configurable filtering using SDGA and handle the power dynamics in the spectrum.The overall architecture is shown in Figure 4.

Stable Sweeping Architecture
Achieving wideband operation requires the system to mix and downconvert a wide range of RF frequencies.This is achieved using an LO that spans a wide bandwidth.The quality of the generated LO directly affects the quality of received samples and the sensor's effectiveness.As observed in [20], a low-quality LO generated from an open loop VCO has poor phase noise characteristics and unpredictable frequency errors of multiple MHz.Using a sweeping LO is challenging, as it is difficult to control and keep stable in the face of unpredictable phase and frequency drifts [20].
An unstable LO leads to poor signal quality when sampled.Some sweep LO spectrum analyzers skirt around this problem using highly narrow-band analog filters to measure only power.Still, power alone is not informative about the content of the spectrum.PLL Sweeping LO: In Crescendo we explore using a PLL with a sweep frequency generation capability for wideband spectrum sensing.Such PLLs are commonly used to generate FMCW signals in radar and spectrum analysis applications [37].They can produce fast sweeps while maintaining phase and frequency lock.In Figure 5, we evaluate the stability of the sweeping LO produced by the HMC703 [23] at various sweep rates.We use the off-the-shelf evaluation board for this analysis.The PLL can generate sweeps as fast as 200 GHz/sec with settling times of < 170 us.This means 6 GHz of frequency can be spanned in less than 30 ms.The loop filter limits the settling time, and increasing the loop filter bandwidth can allow the PLL to sweep faster than 1 THz/sec [2].In Figure 5(a), we evaluate the phase and frequency drift of the sweep LO over 40 seconds for various sweep rates.We perform this analysis by sampling the sweep with a synchronized ADC.The median phase drift is 0.042 radian, while the median frequency drift is 2.2 mHz, indicating the LO is stable and repeatable.This analysis shows that the PLL based sweep has the capability to meet the requirements we set and we chose to use it in Crescendo.

Superheterodyne sweeping
In the previous sub-section, we demonstrated the feasibility of constructing a wideband spectrum sensor with a stable sweep frequency local oscillator (LO).The next critical question is how to deliver signal quality and dynamic range in the context of our sweeping-based approach.
In our design, we employ a two-stage receiver with a fixed IF.It is well known that such an architecture allows for higher signal selectivity and easier placement of in-band signals inside the dynamic range of the ADC [32].This is primarily due to the multi-stage filtering effect and the ease of design of sharp signal and image reject filters in RF and typical IF frequencies.The sweep-frequency Local Oscillator (LO) is used to downconvert RF signals to a fixed Intermediate Frequency (IF).A conventional radio can then bring the IF signal to baseband and sample it for analysis.A sharp bandpass filter at the IF stage cuts out all signals outside the radio's sampling bandwidth.The RF frequency that is downconverted and visible at the output of the IF filter is determined by the frequency of the LO.Since the LO sweeps, the RF frequency visible at the IF is also sweeping.This architecture differs from a spectrum analyzer's, as it has a much wider IF filter and, more importantly, performs sampling to allow for rich signal processing and inference [20].
The second stage of the superhet architecture is a fixedfrequency IF receiver fed through the IF filter.This filter is bandpass and equivalent to the IF receiver's bandwidth.The filter's roll-off is very sharp to suppress out-of-band signals effectively.The first stage LO's frequency, determines the RF frequency that mixes down to the fixed IF.Since the LO's frequency increases monotonically with time, the frequency of the portion of the band visible through the IF filter also increases monotonically with time.The IF device down-converts the signal to baseband and performs sampling.The sweep-frequency LO of the first stage and the IF filter effectively create a moving frequency window into the RF spectrum, implementing the sweep-sampling described in prior work [10,20].The superhet and the IF filter's first stage can be bundled into an external attachment to conventional software-defined radios.This allows Crescendo to be deployed quickly as an add-on to conventional radios.Sweeping as configurable filtering: A diverse range of wireless systems utilize the Sub-6 GHz spectrum, each transmitting at different frequencies, power levels, and locations.As a result, loud and weak signals are distributed across a large bandwidth, presenting significant challenges for spectrum sensing systems that aim to detect and analyze these disparate signals accurately.Filters play a crucial role in addressing these challenges by providing the ability to attenuate out-of-band signals as the receiver moves out of their frequency range.As shown in Figure 6(a), when combined with a sweeping LO, filters effectively create a moving filter that can adapt to the dynamic spectral environment.This moving filter enables high dynamic range, allowing the spectrum sensor to handle a wide range of signal power levels and more effectively discern between closely spaced signals with varying amplitudes.
By leveraging the sweeping LO as a configurable filtering mechanism, our proposed approach can deliver signal quality and dynamic range while mitigating the interference caused by out-of-band signals.This sweeping-based filtering technique forms the foundation of our novel spectrum sensing system, providing the flexibility and adaptability necessary to accurately analyze the rapidly evolving Sub-6 GHz spectrum.How Crescendo dynamically filters signals: As discussed in the previous subsection, our sweep-frequency generation method gives us precise knowledge about the frequency swept at each instant in time.Additionally, most radios have a variable gain block at the frontend.It's common for these If the same frequency band has both strong and weak signals, then the gain setting will apply for both signals, and therefore, we will be forced to set a lower gain to prevent the high-power signal from saturating the receiver.Our insight to address this challenge is that any two signals separated in frequency will, at some point, be visible individually because of the sweeping nature of the LO.Recall that the IF filter attenuates out-of-band signals heavily, effectively creating a sliding frequency window.This window will encounter one signal first, then the other.Similarly, the signal encountered first will move out of the window and then the other.Therefore, when the weak signal is visible exclusively, the gain can be set to a high value, allowing its detection despite the strong signal's presence.Many high-sample rate spectrum sensors are prone to saturation due to stray highpower interference since they sample the entire bandwidth at once [18,19].Some authors have proposed analog cancellation mechanisms to tackle high-power interference in high-sample rate spectrum sensors.Still, these can only deal with one or two strong interferers in the entire bandwidth of interest.However, Crescendo's design is agnostic to strong interferers' number and frequency location and can handle all possible scenarios.This technique provides independent control over the gain of the chain over the entire band of interest, with fine-grained control achievable through the LO generation and IF gain block.By choosing a range of gains that spans 35 dB, we can enhance the SFDR of the system by the required amount.

SDGA: Synchronous Dynamic Gain Adaptation
To fully exploit the benefits of configurable filtering in our sweeping architecture, it is essential to implement gain control on a per-frequency basis while sweeping synchronously.Appropriate gain adjustment is crucial for achieving good signal-to-noise ratio (SNR), signal quality, and dynamic range, particularly in dynamic spectrum environments where signal powers vary significantly across different frequencies.
As the spectrum is dynamic and constantly changing, fixed gains are insufficient to maintain optimal performance.Instead, a more flexible and adaptive approach to gain control is required.Conventional AGC loops will not work for Crescendo: In the previous two subsections, we described the architecture and frequency selective gain control.However, a gain control scheme is incomplete without a feedback mechanism.Conventional automatic gain control (AGC) techniques use a power detector to observe the in-band power and keep ramping up the gain till the input power reaches a specified operating threshold.Conventional AGCs aim to manage the gain without the ADC's knowledge to keep the input power to the ADC around a nominal set value.Conventional AGCs produce gain-pumping effects -rapid changes in gain resulting in receive signal distortion [38].Fast-settling AGCs are commonplace but distort relative signal amplitudes (amplitudes of two different signals at different times); making power-based spectrum monitoring difficult.AGCs do not provide access to the baseband processor's gain settings or history.Conventional AGCs distort relative signal amplitudes, impede decoding, and, therefore, cannot be used for spectrum sensors like Crescendo.SDGA: Our proposed Synchronous Dynamic Gain Adaptation (SDGA) is a reactive method devised to adjust the per-band gain between LO sweeps according to the powers observed at a per-frequency basis.The core innovation behind SDGA is that, when a subsequent sweep begins, the gains are applied on a per-frequency basis.This ensures that gain settings are precisely suited to the unique characteristics of the spectrum at each frequency, resulting in more accurate and adaptable spectrum sensing.A toy example of measured power levels at the ADC and the corresponding gain choices is illustrated in Figure 6(b).
We use ADC samples to determine the instantaneous signal power as a function of frequency.At the start, SDGA operates with a default nominal gain of  0 for every frequency band, positioning the thermal noise floor 3 dB above the quantization noise floor.Starting with a  0 gain ensures that the SNR of weaker signals remains undisturbed because of the minimal advantage of a gain higher than  0 [32].
As the sweeps progress, SDGA evaluates the maximum power detected in each frequency band, using this data to determine the instantaneous signal power as a function of frequency.If any bands hint at ADC saturation, SDGA instantly reduces the gain in that particular band for the upcoming sweep.For a given frequency band of interest, SDGA modifies its gain only between sweeps.This means that while SDGA adjusts the gain across various bands within a single sweep, for a specific band, the adjustment only happens between sweeps, based on previously calculated gains for the next sweep.This mechanism enables real-time operation, wherein gains previously computed only apply to the forthcoming sweep.Post the appearance of a strong signal, SDGA holds onto the max power information for each frequency band over the last N seconds, adjusting gains only after this Nsecond duration, where the value of N is determined empirically and discussed in the evaluation section.
The IF filter bandwidth in Crescendo plays a pivotal role in determining signal selectivity and the efficacy of the SDGA algorithm in excluding out-of-band signals.Opting for a smaller IF bandwidth is tempting, as it enhances selectivity and eases the processing load by necessitating a lower ADC sample rate.Nevertheless, the associated trade-offs, as highlighted in Figure 2 and Table 1, prevent the usage of an IF bandwidth less than 70 MHz.
Implementing SDGA necessitates stringent clock synchronization among the baseband radio, the sweeping PLL, and the gain blocks, ensuring that appropriate gains are applied at the right moments.SDGA operates on the receiver's baseband processor, which can relay its set gain values synchronized alongside the ADC samples.Since the gains employed by the algorithm are known, compensating for their effects is straightforward: divide the sample value by the set gain value.This compensation process is further elaborated in the following sub-section.

Reconstruction of high-fidelity signal in base-band
The sweep-sampling approach performs digital sampling and not just scalar power detection.This has major advantages for sensing as both amplitude and phase values can be captured, allowing digital signal processing techniques to identify signal features like protocol and modulation scheme [20].Sweep-sampling has two major components, the sweepfrequency generation and the subsequent unsweeping steps.Prior design of sweep-sampling used unreliable open loop VCOs and tedious calibration processes for unsweeping [20].Crescendo simplifies the calibration process and also incorporates gain calibration.
Sweep-frequency unsweeping: Sweeping the LO frequency while downconverting distorts the original signals.
Conventional signal processing methods intended for fixedfrequency receivers cannot be directly applied to the baseband samples of Crescendo.In [20], the authors developed a method to remove this distortion and allow sensing.This method can be directly adopted for Crescendo, with some important simplifications.While the chirp generated by the PLL synthesizer is repeatable and highly linear, the first mixer stage has a frequency-dependent response to the LO.This response may be factory calibrated and will not change with the operating conditions of the system, unlike [20] where the calibration has to be repeated often.Since the PLL's sweep profile is known, digital calibration samples are synthetically generated, offset by the respective calibration values, and then used to unsweep the baseband samples (Fig 7).
Gain calibration: Since the gains are set in discrete steps using the SDGA algorithm at times synchronous with the sweep, the baseband processor knows exactly when a specific gain command took effect during the duration of the sweep.By calibrating the value of the gain block at each frequency (at the time of manufacture), the baseband processor can undo the distortions produced by gain change.This is a method of producing high dynamic range measurements.The baseband processor post-multiplies the inverse of the applied analog gain values to convert the I/Q samples after unsweeping into power values at each frequency (Fig 7).

IMPLEMENTATION
Proof of Concept Prototype: We implement Crescendo using the USRP X300 SDR with a TwinRX daughterboard [5,12].The TwinRX features a two-channel superheterodyne receiver with preamplifiers, preselectors, and two mixer stages.By feeding an external sweeping LO to the first mixing stage of the TwinRx, we can implement sweep-sampling as described in Section 3. The Twin-RX uses an internal LO for the second mixing stage.The external LO determines the center frequency downconverted to IF.An external reference clock is also connected to the HMC703 from X300.The required triggers for starting and stopping sweeping are provided through the front panel GPIO of the X300.We utilize the RF Filter bank in the Twin-RX to perform the pre-select filtering.The IF stage in the Twin-Rx comprises a cascaded SAW filter pair with 80 MHz bandwidth -ideal for our application.Sweep-Frequency LO Generation: The range of sweeping with the USRP X300 is limited by the capabilities of the external LO generated by the HMC703.Only frequencies from 1.15-1.65GHzor 2.25-2.75GHzcould be observed with this prototype due to frequency limitations of the HMC703 evaluation board.These restrictions could be overcome by the implementation of another VCO that could operate between 2-6.5 GHz which would allow the prototype of this frequency-selective sensor to sweep the spectrum from 0-6 GHz.Sweep Sample Unsweeping: The received I/Q samples out of the USRP are distorted due to the sweeping nature of the first stage LO.The sweep LO generated by HMC703 can be modeled exactly, i.e, its frequency is known at each and every sample.Using this knowledge, we design a digital compensation signal that is the negative frequency (in baseband) of the signal that HMC703 generates.Unsweeping is performed by multiplying this compensation signal with the received I/Q samples.The unsweeping process is similar to the technique discussed in [20], but without the manual data collection process.In [20], the behavior of the open loop VCO is unknown, so a known tone has to be injected into the system to collect the compensation signal.SDGA and compensation: The gain of the USRP can be set at precise time intervals (down to the clock edge) from software using timed-commands [29].Since the sweep LO behavior and time-scales of the HMC703 can be computed from the data-sheet, we set gains from software before every sweep as a set of timed commands.These timed commands would take effect exactly when the PLL is sweeping predetermined frequencies.At the end of every sweep, the gains are compensated by scaling the received I/Q with the inverse of the gain used.Since we control when each timed command took effect, compensation is easily done.Performing these steps necessarily requires that the PLL's reference clock is synchronized to that of the USRP.It also requires that the trigger to start sweeping is also provided by the USRP in tandem with the start of sampling.Wideband outdoor prototype: We also prototype Crescendo using the Signal Hound SM200C, which is a state-of-the-art spectrum analyzer and SDR [34].This prototype allows us to perform experiments across the entire sub-6 GHz bandwidth, beyond the limitations of the USRP X300 prototype.The SM200C hops from one frequency to the next and does not perform linear frequency sweeps.At each hop, it captures a pre-defined number of I/Q samples.While there is close to a 60% overhead associated with frequency hopping, the SM200C can reasonably approximate sweep-sampling.The SM200C software API allows for the implementation of SDGA in a synchronized manner.We implement SDGA with the SM200C and use it to perform outdoor and mobile measurements to motivate the need for dynamic gain control and filtering.

EVALUATION
Crescendo's function is extensively evaluated to establish its performance real-life scenarios.Our results are driven by two case-studies that highlight the importance of wideband operation and time-frequency gain control.Our first case-study involves studying a spectrum sensor co-located with a high-power transmitter like a base-station.By dynamically varying the gain while sweeping, Crescendo can maximize the SNR of weak signals in the frequency vicinity of the strong transmissions.We compare the performance of Crescendo with SweepSense as the baseline.We implement SweepSense on a USRP N210 platform using the open source implementation from [20].In our second case-study, we take Crescendo out into the wild on a cart to measure real-life power dynamics.We show how simple events like LTE speed tests and rotating antennas can significantly change signal powers, requiring dynamic gain adaptation.
Our results are summarized below: • Crescendo provides 11 dB improvement in SNR for a signal close to the noise floor in typical wideband sensing scenarios over the baseline.It can also sense and decode information while sweeping • Crescendo can provide independent frequency-specific gain for any two signals separated by more than 100 MHz and simultaneously maximize their SNR.For separations less than 100 MHz, a best-effort gain is applied.This bandwidth separation is limited only by the IF filter roll-off.
• Crescendo provides >30 dB dynamic range improvement over SweepSense, while adapting to dynamics in transmit power across the spectrum.

Case-study: Co-location with high-power transmitter
We evaluate Crescendo in a deployment where it is co-located with a high-power transmitter and has to detect weak signals in nearby bands to asses spectrum activity.The high-power transmitter is a sinusoidal tone that has a power of -10 dBm at the input of our receiver.The weak signal is an 802.11gWiFi packet that is 200 us long.We carefully calibrate the power of the weak signal and vary the SNR (w.r.t thermal noise floor) from 0 to 30 dB.The received signal is split using a power splitter and sent to both Crescendo and SweepSense hardware for a fair evaluation.This setup recreates a scenario where the sensor is deployed near a high-power base station or access point.Crescendo performs SDGA control while sweeping, while the gain of SweepSense is set as high as possible while avoiding ADC saturation.We evaluate the ability of both sensors to detect the weaker signal and decode it while avoiding ADC saturation.
Receive power and SNR: We perform energy detection on the receive signals on both sensors and extract the observed SNR of the weaker signal.The higher the SNR, the better we have to detect a signal's presence.Figure 9(a) shows the detected SNR at the sensors as a function of the input SNR.Since Crescendo dynamically adjusts gains while sweeping, it can observe the weaker signal with higher gain -improving its SNR.In contrast, SweepSense uses a lower gain, and is affected by the high ADC quantization noise, which reduces signal SNR.Overall, Crescendo's detector SNR is 11 dB better than SweepSense.
Signal quality and decoding: Energy detector SNR does not directly translate to signal decoding quality.While energy depends only on the magnitude of analog signal that is digitized, the decoding quality depends on the phase stability and jitter as well.Since SweepSense uses an unlocked LO to  When trying to observe a weak signal, Crescendo provides SNR gain if the weak signal is frequency separated from the strong transmitter.Crescendo is able to provide this gain due to the dynamic, frequencydependent gain control.In contrast, using a fixed gain like in SweepSense provides a fixed, low SNR.As the center frequency moves away from the frequency where a strong signal is present, SDGA increases the gain and noise performance.In Figure 10, we show how Crescendo improves the SNR of the weaker signal as a function of its frequency separation from the strong signal.When the strong and weak signals are in the same band, Crescendo works the same as the baseline, but as the frequency separation increases, Crescendo's gain control kicks in and improves the SNR by as much as 18 dB at 120 MHz separations.
The SweepSense baseline has limited SNR because of its fixed gain operation.Since the gain-control range for Crescendo features up to 30 dB of control, the improvement in dynamic range will be 30 dB at maximum.

Case-study: Handling time-frequency variations in power
To motivate the importance of frequency-specific filtering and SDGA, we take Crescendo outdoor on a cart.Our goal was to understand power dynamics in day-to-day spectrum sensor applications and show how the simplest of real-world deployments require SDGA.We use our outdoor prototype using an SM200C for this case study (Sec 4).We configure the SM200C to sweep 100 MHz -6 GHz in 7 ms.SDGA monitors the per-band power levels and modifies the attenuations between the sweeps.The minimum reaction time for the system is 7 ms, the time it takes to complete a sweep.We plot the system's chosen attenuations as a function of frequency and time in Figure 11.We corroborate the attenuation changes to real-life events.Strong signals come and go in order of multiple seconds, and attenuation changes of as much as 30 dB are required to support some of our target applications.In Figure 11(a), an LTE speed test around 40 seconds into the experiment.Crescendo increases the attenuation in 1650-1750 MHz bands in response and keeps it high to prevent saturation.Once the speed test concludes, Crescendo turns the attenuation down to maximize noise performance again.In the last leg of the speed test (around 80 seconds), the attenuation is further increased to compensate for the higher power output from the LTE phone during the upload test.In Figures 11(b) and Figures 11(c), we walk in our campus in an open courtyard and playground for a distance of about 50 m each.At various locations, the power levels registered in the 700 MHz and 100 MHz bands change dynamically due to nearby LTE base stations and narrow-band transmitters.Crescendo adapts the frontend attenuation in these power dynamic bands while maximizing SNR in low power bands (by keeping the attenuation at the lowest value).Figures 11(d)-11(f) show the power spectral density across the entire 6 GHz spectrum as a function of time.In Figure 11(e) in particular, the increase in attenuation in the 700 MHz band corresponds in time to the increase in power levels in that band Understanding time-frequency variation in power: In our assessment of Crescendo's SDGA algorithm, we utilized our SM200C prototype to perform a spectrum sweep, capturing I/Q samples across an array of bands.Using this data, we undertook an analysis of the time-domain power within each specific band.
To quantify the variability in power, we introduced a metric termed "power coherence time." This measures the duration between successive events within a band where there's a shift in power by at least 4 dB.Such a significant change indicates a need to alter the gain used by Crescendo for that particular band.We evaluated our case-study data and calculated the median power coherence time for every 100 MHz band as illustrated in Figure 12(a).Our findings revealed that, in general, power coherence times exceeded 1 second.Notably, the coherence time extended into tens of seconds in certain bands like FM and specific LTE bands, mainly because these bands have relatively constant power over time.
The configuration of the value of N in SDGA is crucial.Ideally, it should at least match the power coherence time.Failing to do so might prompt SDGA to elevate the gain prematurely, potentially resulting in saturation every time there's a significant shift in power level.For our study, we opted for a conservative approach, setting N at 10 seconds, slightly above the median power coherence time observed across all bands.This choice offers simplicity, but tailoring a specific N value to each band might further enhance performance and diminish the likelihood of ADC saturations.Comparison with SweepSense: Our analysis highlighted the significant shortcoming of SweepSense: a static gain control that frequently leads to signal saturation, especially in bands where signals are particularly robust.We employed the Dynamic Range (DR) loss metric to evaluate this performance differential.This metric quantifies the difference in decibels (dB) between the optimal gain dynamically determined by Crescendo and the consistent, unvarying gain utilized by SweepSense.We computed the expected DR loss by examining the data from our case study and tracking the gain values set by Crescendo over varying times and frequencies.Across multiple instances, as shown in Figure 12(b), we observed a DR loss ranging between 5 to 30 dB, underscoring Crescendo's superior capability in effectively handling intense signals without experiencing saturation.Comparison with GHz sampling ADCs: We utilized I/Q sweeps from the SM200C to emulate a wideband baseline in the form of a 6 GSps ADC.By adding up the I/Q samples from each center frequency as if they occurred at the same time, we can emulate the signal a multi-GHz ADC would see at its input.It is important to perform this superposition in the complex I/Q domain as various sometimes constructively add up in the time domain to produce high peak power.By calculating the peak power in this superposition, we approximated the potential power faced by a 6 GSps ADC across the entire 6 GHz band.With an assumed ADC Spurious Free Dynamic Range (SFDR) of 70 dB, we derived the minimum detectable power.When comparing this to the desired threshold -the power of a 38 kHz signal 10 dB above the noise floor (akin to an FM signal) -the gap reveals the dynamic range loss.Shown in Figure 12(c), the DR loss is close to 30 dB in the median across all the case studies, and the maximum possible loss is above 40 dB in all cases.High peak powers challenge the ADC, potentially pushing weak, narrow-band signals outside the SFDR.

RELATED WORK
Crescendo is related to the following areas of research: Sweeping sensors: Sweeping spectrum sensors use a sweep-LO to scan wide bandwidths [36].Conventional spectrum analyzers are the most well-known type of sweeping spectrum sensors, and they use narrow IF filters, power detectors, and sweeping LOs to estimate the power spectral density of the spectrum accurately [4,31].However, since these analyzers measure only power, they cannot be used for signal processing or spectral estimation.
Another technique proposed in the literature is sweepsampling, which involves I/Q sampling while sweeping.[10] is a sweep-sampling technique that uses slow-FMCW-based sweeping without unsweeping or gain control for long-term spectrum occupancy analysis.The sweep-sampling technique is further improved by SweepSense by developing a robust unsweeping mechanism [20].In comparison, SweepSense is similar to this work, but it lacks the ability to control power on a per-frequency band basis.Additionally, since SweepSense uses an unlocked VCO, it lacks the phase stability needed for reliable signal processing with high fidelity.In contrast, Crescendo demonstrates that with power control and a locked VCO, we can achieve high signal fidelity without compromising on its ability to achieve wideband real-time operation.Wideband sampling sensors: Over the past decade, several spectrum sensors that use an ADC to sample wideband spectrum have been developed [18,21,27,28].These techniques have a common limitation of being constrained by the dynamic range of the ADC since they rely on a single ADC to sample the entire spectrum.For instance, OneRadio [18] utilizes a multi-GHz ADC to sample 6 GHz of spectrum and analog cancellation techniques to prevent ADC saturation caused by high-power signals.Today, analog cancellation techniques are limited to specific signals and frequencies and cannot handle signals that dynamically switch bands like base-stations.But this provides a possible parallel path to achieving the goals of Crescendo.
Compressed sensing techniques like [21,27,28] use analog techniques to force spectrum aliasing, but they still expose the entire analog signal to the ADC, resulting in low dynamic range.For example, BigBand [21] performs sub-Nyquist sampling without gain control methods, limiting its dynamic range in the sub-6 GHz spectrum. 3 [19], an extension of BigBand, uses innovative MEMS-based filtering to introduce sparsity in the signal and achieve high accuracy in compressed sensing.While  3 , as presented, can only detect power, novel filtering methods at lower cost are useful in ensuring signal fidelity even for Crescendo.Low-cost and distributed spectrum sensing: Making spectrum sensors low-cost have the benefit of realizing distributed spectrum sensing and improving adoption [20,25,26].The intent to drive down costs usually makes signal fidelity a secondary goal for these efforts.In addition to distributed sensing, there has also been research into aggregation and backhaul of spectrum sensor data, where the goal is to efficiently and selectively represent spectrum data at the sensors [24,41].We believe many of these techniques can be explored with Crescendo to make it lower cost and more practical to deploy at scale.HDR Methods and AGC: The topic of high dynamic range (HDR) has been extensively studied in audio and video processing [11,15,17].In particular, multi-exposure HDR methods, which capture the same scene at different exposures and combine the resulting images to produce an image with higher dynamic range, are commonly used in commercial smartphone cameras [17].In [11], the authors extend this technique to software-defined radios using two receivers with different gains.However, multi-exposure techniques typically require multiple receive chains and ADCs, which increases cost.Moreover, they improve dynamic range only by the difference between the highest and lowest gains across all receivers.Automatic gain control (AGC) techniques are frequently used in radio receivers [1,8,40] to control the power of the analog signal.In [15], the authors propose combining analog gain control and multi-exposure.To our knowledge, Crescendo is the first work to propose using AGC followed by explicit gain-compensation to improve dynamic range in spectrum sensing applications.

Figure 1 :
Figure 1: Crescendo incorporates a stable sweeping LO with careful RF design and adaptive algorithms to achieve real-time, high-fidelity sensing over a wide band.It is developed on COTS hardware and turns an SDR into an efficient spectrum sensor.

Figure 3 :
Figure 3: Power distribution across various bands in the sub-6 GHz range captured using a spectrum analyzer, the dynamic range requirement exceeds typical ADC SFDR by 30 dB.

Figure 4 :
Figure4: Overview of Crescendo's architecture: Wideband, real-time, and high fidelity spectrum sensing can be achieved through a combination of Analog Circuits (in green), LO generation and mixing (in red), and digital processing (in purple).

Figure 5 :
Figure 5: (a) Demonstrates stability of locked PLL used in Crescendo with the standard deviation of phase noise and phase/frequency drift, (b) A plot showing the instantaneous frequency as a function of time when the PLL settles for various sweep rates.The settling time of the sweeps generated by PLL is < 170 us.

Figure 6 :
Figure 6: (a) A representation of the sweep sensor overlapping with high and low power signals in the duration of a single sweep.(b) Power at ADC input showing two regions for high and low power.We use low gain for the former and high gain for the latter signal.

Figure 7 :
Figure 7: Putting it all together: Shows the signal transmissions amongst the individual components within each sub-systems -Analog systems (in green), digital processing (in purple), adaptive gain control (in yellow) and LO synthesis (in red)

Figure 8 :
Figure 8: Hardware setup with the USRP X300 highlighting the sweep LO generation, superhet architecture, and the SDR backend

Figure 9 :
Figure 9: (a) Receive power and detected SNR for Crescendo and baseline.Due to its superior signal fidelity, Crescendo consistently provides better SNR (up to 11 dB) than SweepSense, (b) Decoding WiFi: Crescendo's use of stable sweeps provides virtually zero BER, while SweepSense cannot decode packets reliably even at 30 dB SNR (c) BPSK constellation plot of two decoded OFDM signals for both Crescendo and Sweepsense.The constellation of Crescendo has lower variance than that of Sweepsense due to the unstable phase noise introduced by the unlocked VCO used in Sweepsense.

Figure 10 :
Figure10: Sensor co-located with strong transmitter: When trying to observe a weak signal, Crescendo provides SNR gain if the weak signal is frequency separated from the strong transmitter.Crescendo is able to provide this gain due to the dynamic, frequencydependent gain control.In contrast, using a fixed gain like in SweepSense provides a fixed, low SNR.

Figure 11 :
Figure 11: Time-frequency-attenuation plots (top) for Crescendo in three outdoor case-studies along with the captured power spectral density over time (bottom).These plots show how Crescendo can dynamically adapt to power varying environments using SDGA.(a,d) is the LTE speed test experiment in the 1700 MHz band.(b,e) and (c,f) show how the gains and spectrum evolve for experiments where we walked around with Crescendo at two different locations on our campus.

Figure 12 :
Figure 12: (a) Median interval between events of interest per 100 MHz band, bands with slower paced activity show larger coherence times.The median across all bands is 9 seconds.(b) DR loss comparison between Crescendo and SweepSense (c) DR loss comparison between Crescendo and a multi-GHz ADC based wideband spectrum sensor.
The constellation of Sweepsense ranges five times worse than that of Crescendo.Even though SweepSense can decode the packets, the high phase noise present in the sensor causes decoded bits to be unreliable.Gain control and Dynamic range improvement: SDGA allows frequency-specific gain control.While sweeping center frequency, the IF filter can be leveraged to filter strong signals.