Detecting and locating electronic devices using their unintended electromagnetic emissions

Electronically-initiated explosives can have unintended electromagnetic emissions which propagate through walls and sealed containers. These emissions, if properly characterized, enable the prompt and accurate detection of explosive threats. The following dissertation develops and evaluates techniques for detecting and locating common electronic initiators. The unintended emissions of radio receivers and microcontrollers are analyzed. These emissions are low-power radio signals that result from the device\u27s normal operation. In the first section, it is demonstrated that arbitrary signals can be injected into a radio receiver\u27s unintended emissions using a relatively weak stimulation signal. This effect is called stimulated emissions. The performance of stimulated emissions is compared to passive detection techniques. The novel technique offers a 5 to 10 dB sensitivity improvement over passive methods for detecting radio receivers. The second section develops a radar-like technique for accurately locating radio receivers. The radar utilizes the stimulated emissions technique with wideband signals. A radar-like system is designed and implemented in hardware. Its accuracy tested in a noisy, multipath-rich, indoor environment. The proposed radar can locate superheterodyne radio receivers with a root mean square position error less than 5 meters when the SNR is 15 dB or above. In the third section, an analytic model is developed for the unintended emissions of microcontrollers. It is demonstrated that these emissions consist of a periodic train of impulses. Measurements of an 8051 microcontroller validate this model. The model is used to evaluate the noise performance of several existing algorithms. Results indicate that the pitch estimation techniques have a 4 dB sensitivity improvement over epoch folding algorithms --Abstract, page iii

A Comparison of Algorithms for Detecting Synchronous Digital Devices using their Unintended Electromagnetic Emissions

Electronically initiated explosives can have unintended electromagnetic emissions, which propagate through walls and unshielded containers. These emissions, if properly characterized, can be used to quickly detect explosive threats. In this paper, an analytic model is developed for the unintended emissions of clocked digital devices, such as microcontrollers, which can be used as initiators. It is demonstrated that these emissions are clock-dependent, periodic train of impulses. An autoregressive model of these clock emissions is developed, and the model is validated using measurements of an 8051 microcontroller. Existing algorithms, including pitch-estimation and the epoch-folding algorithm, are surveyed for detecting generic digital devices with unknown clock frequencies and emissions characteristics. A novel detection algorithm, which uses pitch estimation, is proposed. The model is used, in a simulated environment, to evaluate the noise performance of the proposed algorithms. Results indicate that the pitch-estimation techniques are robust against jitter and have a 4-dB sensitivity improvement over epoch-folding algorithms

Detecting Electronic Initiators using Electromagnetic Emissions

The accurate and timely discovery of radio receivers can assist in the detection of radio-controlled explosives. By detecting radio receivers, it is possible to indirectly infer the presence of an explosive device. Radio receivers unintentionally emit lowpower radio signals during normal operation. By using a weak stimulation signal, it is possible to inject a known signal into these unintended emissions. This process is known as stimulated emissions. Unlike chemical traces, these stimulated emissions can propagate through walls and air-tight containers. The following case study discusses methods for detecting and locating two different types of radio receivers. Functional stimulated emissions detectors are constructed, and their performance is analyzed. Stimulated emissions are capable of detecting super-regenerative receivers at distances of at least one hundred meters and accurately locating superheterodyne receivers at distances of at least fifty meters. These results demonstrate a novel technique for detecting potential explosive threats at stand-off detection distances

A Practical Superheterodyne-Receiver Detector using Stimulated Emissions

The accurate and timely discovery of radio receivers can assist in the detection of radio-controlled explosives. Superheterodyne receivers emit low-power radio signals during normal operation. These are known as unintended emissions. In this paper, the unintended emissions of superheterodyne receivers are analyzed. Such receivers are exposed to known stimulation signals, and their behavior is measured. Recorded emissions demonstrate that it is possible to inject arbitrary signals into a radio\u27s unintended emissions using a relatively weak stimulation signal. This effect is called stimulated emissions. A novel detection system that uses these stimulated emissions is proposed. The performance of this system is compared with passive-detection techniques using artificially generated emissions signals. The proposed system offers a 5- to 10-dB sensitivity improvement over existing techniques

Locating Noncooperative Radio Receivers using Wideband Stimulated Emissions

Accurately determining the position of radio receivers can aid in the rapid discovery of radio-controlled explosives. Prior research has demonstrated that superheterodyne receivers unintentionally emit low-power radio signals during normal operation. By using a weak stimulation signal, it is possible to inject a known signal into these unintended emissions. This process is known as stimulated emissions. In this paper, a method is developed using radarlike techniques to determine the range to the radio receiver. Unlike conventional radar, it depends on the modification of the unintended emissions from the device and not on a passive reflection. High-bandwidth stimulated emissions measured from a typical superheterodyne receiver -- which was not designed to be located -- are used to make high-resolution time-of-arrival measurements. A continuous-wave radarlike system was designed, and its hardware realization is discussed. The accuracy of the radar is tested in a noisy multipath-rich indoor environment. Results indicate that the proposed radar can locate superheterodyne radio receivers that are 50 m away or more. The root-mean-square position error is less than 5 m when the signal-to-noise ratio is 15 dB or above. The proposed system offers a viable alternative to existing techniques for locating radio-controlled explosives

Vectorless Estimation of Power Consumption Variations in an FPGA

Estimates of power consumed by an IC are useful not only for handling thermal issues, but also for predicting power- and signal-integrity issues, since variations in power on a clock-by-clock basis can be used to estimate power-bus noise. Estimation of clock-by-clock power consumption is challenging, however, because full vectored simulation is computationally intensive and traditional vectorless techniques only estimate the average power over many clock cycles. Methods are presented to estimate the statistical variation of power consumed on a clock-by-clock basis. Estimates of the mean and standard deviation of power are compared to results of Monte Carlo simulations performed using VHDL and Altera\u27s Quartus II PowerPlay Power Analysis tools

Attenuation Analysis of Rayleigh Waves Used to Locate Shallow Manmade Tunnels

The Attenuation Analysis of Rayleigh Waves (AARW) algorithm was applied to multi-channel surface wave seismic data acquired at two test sites for the purpose of locating manmade tunnels in the Earth\u27s shallow subsurface. The surface wave data were acquired by incrementally moving a 24-channel geophone array and source along a traverse oriented perpendicular to the center-line of the tunnel. The near source-receiver offsets were 3 & 6 m, respectively; the 4.5 Hz geophones were spaced at 0.5 m. The geophone array geometry was optimized for nominal tunnel depths and diameters of ~1 m. Using AARW, the authors were able to reliably determine tunnel locations and delineate void geometries. Confidence levels and uncertainties with respect to void locations and geometries are discussed herein. Electrical resistivity or GPR data were acquired along each traverse for comparison purposes. This study demonstrates that the AARW algorithm may enable engineers to detect tunnels and estimate the geometry of the same