Mobile networks are evolving rapidly, with 6G promising unprecedented capabilities in terms of data rates and ultra-low latencies. However, the development of testbed platforms for wireless experimentation has not kept pace. Existing platforms typically offer either end-to-end capabilities with low bandwidth or high bandwidth with limited or no real-time functionality. In this paper, we introduce HELIX, an experimentation platform with 6G scalable real-time capabilities. HELIX integrates a comprehensive physical layer subsystem with multi-numerology support alongside an advanced mixed software-hardware control unit responsible for interacting with the fronthaul network and dynamically configuring the functional split in real time. On the server side, we implement the necessary drivers and routines to enable seamless integration with O-RAN systems, thus facilitating open and end-to-end experimentation. We demonstrate the capabilities of HELIX through a variety of experiments at sub-6 GHz, 28 GHz, and 60 GHz frequencies. Notably, HELIX achieves data rates of up to 1200 Mbps using 256-QAM modulation with over 417 MHz of bandwidth, and end-to-end bidirectional latencies of 500 μs. We show advanced features, including the implementation of Integrated Sensing And Communication (ISAC), and discuss how the platform could be extended to support bandwidths of up to 1670 MHz.

LoRaWAN has become a widely adopted, cost-effective solution for Low-Power Wide-Area Networks (LPWANs), bridging the gap between short-range wireless protocols and high-power cellular networks. Its affordable hardware and robust physical layer make it a key enabler for Internet of Things (IoT) applications across sectors like agriculture, smart cities, and industrial automation-domains where security is of central importance. In this paper, we present BlindSpot, a novel jamming attack that enables efficient selective jamming of LoRaWAN gateways. Unlike traditional approaches that rely on creating high-power interference, BlindSpot exploits the limited number of demodulation paths in LoRaWAN gateways to continuously occupy the gateways with fabricated frames, blinding them for any other legitimate transmissions. Compared to existing approaches, this reduces the attacker's power requirements and allows them to decode the legitimate transmissions with a high probability. Selectively retransmitting these frames, the attacker has precise control over which transmissions can be decoded by the gateway. Using a Software-Defined Radio (SDR)-based LoRa transceiver, we demonstrate the effectiveness of the attack against commercial LoRaWAN gateways and propose detection and mitigation strategies to improve the security of LoRaWAN deployments.

LoRaWAN has become a widely adopted, cost-effective solution for Low-Power Wide-Area Networks (LPWANs), bridging the gap between short-range wireless protocols and high-power cellular networks. Its affordable hardware and robust physical layer make it a key enabler for Internet of Things (IoT) applications across sectors like agriculture, smart cities, and industrial automation-domains where security is of central importance. Investigating LoRaWAN's resilience against physical-layer attacks, we developed BlindSpot, a novel jamming attack targeting state-of-the-art LoRaWAN gateways. Unlike traditional jammers, BlindSpot does not rely on overpowering transmissions but prevents their reception by exhausting resources at the gateway. This is possible since commercial gateway processors have only a limited number of demodulators for parallel frame reception. In this demo, we show the effectiveness of the attack against a commercial LoRaWAN gateway, compare it to traditional jamming, and show how our Software-Defined Radio (SDR)-based receiver can overcome the attack.

LoRa is about to become the standard for Low-Power Wide-Area Networks (LPWANs), being well suited for many Internet of Things (IoT) and sensor network applications. The success of the technology sparked interest to adopt LoRa for other, more challenging use-cases in industrial automation or control of cyber-physical systems. Regular LoRa gateways are, however, limited in their number of parallel demodulation paths and restricted to a single network. To overcome this limitation, we implement a software-defined, multichannel LoRa receiver that is able to receive all common spreading factors and uplink channel combinations of the LoRaWAN EU868 frequency plan. In addition, our receiver does not rely on hard-coded sync words, enabling a mechanism similar to monitor mode in WLAN networks. Experimental evaluation using Software-Defined Radios (SDRs) confirms superior performance compared to commercial LoRa gateways.

Future cellular networks will be programmable and increasingly software-defined with APIs to hook into the communication stack closer and closer to the physical layer. This allows operators, for example, to plug-in third-party machine learning algorithms to optimize performance. At the same time, this flexibility implies that compute resources cannot be provisioned statically but have to be distributed dynamically during runtime. While the hardware platforms for such systems are available, we lack suitable software frameworks that help to realize such systems. In this demonstration, we present two Open Source projects that fill this gap: FutureSDR, a portable real-time signal processing framework with native support for accelerators (like GPUs and FGPAs); and IPEC, which enables fully automatic composition of multi-accelerator FPGA designs. We believe that these tools - especially in combination with each other - can provide the base for building research prototypes and allow experimentation with software-defined wireless communication systems.

Unmanned Aerial Vehicles (UAVs) are already part of everyday life as they are commonly used for disaster response, industrial applications, and smart farming. Resilient and flexible communication is key for the operation of UAVs themselves as well as many applications realized using them, e.g., gathering of data from Internet of Things (IoT) sensors without a direct uplink. Realizing new ideas, optimizations, and what-if analyses are usually lengthy processes to get from theoretical models to the actual real-world implementation. We propose an integrated testbed using emulation, where actual implementations can be evaluated in virtual environments that also simulate the network connectivity. Through the use of a software stack similar to actual UAVs that is built around Linux and the PX4 flight controller, we allow realistic prototyping, automated experiments and interactive missions. Additionally, we enable Hardware-inthe-Loop integration through a wideband Software Defined Radio (SDR)-based channel emulator to experiment with new radio links for more robust UAV control in challenging environments.

Cooperative Driving requires ultra-reliable communications, and it is now clear that no single technology will ever be able to satisfy such stringent requirements, if only because active jamming can kill (almost) any wireless technology. Cooperative driving with multiple communication technologies which complement each other opens new spaces for research and development, but also poses several challenges. The work we present tackles the fallback and recovery mechanisms that the longitudinal controlling system of a platoon of vehicles can implement as a distributed system with multiple communication interfaces. We present a protocol and procedure to correctly compute the safe transition between different controlling algorithms, down to autonomous (or manual) driving when no communication is possible. To empower the study, we also develop a new version ofPlexe, which is an integral part of this contribution as the only Open Source, free simulation tool that enables the study of such systems with a modular approach, and that we deem offers the community the possibility of boosting research in this field. The results we present demonstrate the feasibility of safe fallback, but also highlight that such complex systems require careful design choices, as naïve approaches can lead to instabilities or even collisions, and that such design can only be done with appropriate in-silico experiments.

We present a novel physical layer frame format and a corresponding decoding strategy for energy-constraint single-carrier transceivers, often used in sensor networks and cyber-physical systems. The main advantage of our approach is that decoding does not rely on dedicated preamble symbols, which usually introduce considerable overhead in terms of energy consumption and utilization of the wireless channel. We show that omitting the preamble can be achieved by buffering the signal in the receiver and processing the samples twice; first to synchronize and in a second iteration to decode the actual data. To introduce our approach, we provide a theoretical description, including a discussion of the implications of synchronizing on data symbols instead of optimized preamble sequences. The practical feasibility of the algorithm is shown by simulations and experiments using prototype implementations based on software defined radio. We implemented our algorithm for two technologies, a custom ultra low-power BPSK transceiver and the O-QPSK physical layer of the IEEE 802.15.4 standard. Finally, we present an extension of the algorithm that allows us to reduce the buffered data to a small constant number of samples, making our algorithm applicable to physical layers independent from their maximum frame size.

We present a complete simulation and experimentation framework for IEEE 802.11p. The core of the framework is a Software Defined Radio (SDR)-based Orthogonal Frequency Division Multiplexing (OFDM) transceiver that we validated extensively by means of simulations, interoperability tests, and, ultimately, by conducting a field test. Being SDR-based, the transceiver offers important benefits: It provides access to all data down to and including the physical layer, allowing for a better understanding of the system. Based on open and programmable hardware and software, the transceiver is completely transparent and all implementation details can be studied and, if needed, modified. Finally, it enables a seamless switch between simulations and experiments and, thus, helps to bridge the gap between theory and practice. Comparing the transceiver's performance with independent results from simulations and experiments, we underline its potential to be used as a tool for further studies of IEEE 802.11p networks both in field operational tests as well as for simulation-based development of novel physical layer solutions. To make the framework accessible to fellow researchers and to allow reproduction of the results, we released it under an Open Source license.

Receive diversity increases the reliability and robustness of ultra-low power Wireless Sensor Networks (WSNs) by using spatially separated antennas without modifying the physical layer. We consider a distributed ground network in the wild to track bats in their natural habitat. The bats are equipped with a sensor node of only 2 g that limits the energy budget available for communication. In this work, we exploit the distributed nature of the ground network to employ diversity combining, i.e., we use the ground nodes as a geographically distributed multi-antenna array. However, this causes several research challenges given the limited bandwidth between nodes and the need for accurate synchronization to combine signal copies constructively at a central node. Sending all signal samples from all ground nodes to the central node is prohibitive due to the required data rates in the network. As a novel concept, we propose a system that only forwards selected signal samples belonging to a packet with high probability. We study the performance in simulations as well as in a testbed using a Software Defined Radio (SDR) prototype implementation. Our results clearly indicate a substantial performance gain while keeping the data rate in the ground network in a feasible range.

We present OpenC2X, an Open Source approach to field testing of vehicular networking solutions. Field Operational Test (FOT) and real-world experimentation are becoming more relevant to our research community as well as to industry and regulation. Unfortunately, available commercial solutions make experimental modifications to the protocol stack time consuming or prohibit it completely. To overcome this limitation, we implemented the ETSI ITS-G5 stack on a standard embedded PC hardware and running Linux system. OpenC2X is the first complete Open Source experimentation and prototyping platform. Our system is fully interoperable to commercial solutions, yet easily extensible with new protocols and applications for vehicular networks.

Diversity combining is a popular technique to in- crease the robustness of wireless communications. Multiple independent paths are needed for successful combining to recover a signal; which is particularly helpful in fading scenarios. Typically, this is achieved using multiple, sufficiently spaced apart antennas at a single receiver. We consider a Wireless Sensor Network (WSN) to monitor bats in the wild by equipping them with sensor nodes weighing only 2g and, therefore, having very tight energy budgets. A distributed ground network is used to receive the signals from bats at multiple nodes. We propose to exploit the distributed nature of these receivers to cooperatively decode the received signal. This scenario poses a number of research challenges related to the necessary synchronization of the receivers as well as the very limited energy budget at the nodes. To optimize link utilization in the ground network, we study the performance of low-complexity soft-bit diversity and unequal gain combining for robust packet-based communication. To assess the performance of diversity combining strategies, we conduct simulations and measurements using MATLAB as well as a Software Defined Radio (SDR)-based prototype. Finally, our application-specific diversity techniques are adapted to provide a more general solution.

Localization and tracking of small animals in the wild using sensor networks require nodes with ultra-low power consumption, which are particularly challenging to design. Here, we target the tracking of bats in their natural habitat and have to limit the weight of the mote to 2g. To optimize the energy consumption in this scenario, the combination of data communication and ranging is essential. The limitations of the platform and the specific use case ask for a dedicated signal design. We start exploring the use of Binary Offset Carrier (BOC), which is known to be well suited for localization. In this paper, we concentrate on the data communication part of the system. We develop a BOC transceiver in Software Defined Radio (SDR) and perform simulations as well as lab measurements to evaluate its performance and compare it to Binary Phase-Shift Keying (BPSK), which is often used in low-power sensor systems. Most importantly, we conducted realistic field measurements to study the effects of multipath fading and shadowing. Our results clearly show that BOC is perfectly suited for ultra-low power communication in forest environments.

An Intersection Assistance System aim to assist road users in avoiding collisions at intersections, either by warning the driver or by triggering automated actions. Such a system can be realized based on passive scanning only (e.g., using LiDAR) or supported by active Inter-Vehicle Communication (IVC). The main reason to use Inter-Vehicle Communication (IVC) is its ability to provide situation awareness even when a possible crash candidate is not yet in visual range. The IVC research community has identified beaconing, i.e., one-hop broadcast, as the primary communication primitive for vehicular safety applications. Recently, adaptive beaconing approaches have been studied and different congestion control mechanisms have been proposed to cope with the diverse demands of vehicular networks. In this paper, we show that current state-of-the-art congestion control mechanisms are not able to support IAS adequately. Specifically, current approaches fail due to their inherent fairness postulation, i.e., they lack fine grained prioritization. We propose a solution that extends congestion control mechanisms by allowing temporary exceptions for vehicles in dangerous situations, that is, situation-based rate adaptation. We show the applicability for two state-of-the-art congestion control mechanisms, namely Transmit Rate Control (TRC) and Dynamic Beaconing (DynB), in two different vehicular environments, rural and downtown.

We present a novel concept for a wake-up system based ultra-low power communication protocol for sensor networks. The main application field is monitoring contacts and even tracks of bats in the wild. Our sensor nodes can weigh at most 2 g out of which 1 g remains for the battery. We investigate a novel communication protocol design applicable to these systems and also showing great potentials for other ultra-low power sensor networks. In particular, we investigate the bat to ground communication by combining duty cycling with a multi-stage wake-up receiver. We employ Binary Offset Carrier (BOC) modulated signals that allow to accurately localize and track the bats while transmitting data in parallel. In a first step, we evaluated the conceptual design using a software-defined radio system to demonstrate the feasibility of the protocol design.

Many people use smart phones on a daily basis, yet, their energy consumption is pretty high and the battery power lasts typically only for a single day. In the scope of the EnAct project, we investigate potential energy savings on smart phones by offloading computationally expensive tasks into the cloud. Obviously, also the wireless communication for uploading tasks requires energy. For that reason, it is crucial to understand the trade-off between energy consumption for wireless communication and local computation in order to assert that the overall power consumption is decreased. In this paper, we investigate the communications part of that trade-off. We conducted an extensive set of measurement experiments using typical smart phones. This is the first step towards the development of accurate energy models allowing to predict the energy required for offloading a given task. Our measurements include WiFi, 2G, and 3G networks as well as a set of two different devices. According to our findings, WiFi consumes by far the least energy per time unit, yet, this advantage seems to be due to its higher throughput and the implied shorter download time and not due to lower power consumption over time.

Performance evaluation of communication protocols is usually carried out using typical network metrics as delay, jitter, or goodput. However, recent studies in the context of Inter-Vehicle Communication (IVC) have shown that using these metrics is not sufficient for evaluating vehicular safety applications. To highlight the importance of safety metrics and their applicability, we extended our existing simulation framework Veins to visualize these metrics live while the road traffic and network simulation are running in parallel. In particular, we demonstrate the impact of communication on intersection assistance applications. To simulate different intersection approaches, we implemented a simulation model that resembles different kinds of driver behavior and enables crashes at intersections. The resulting situations are displayed in the road traffic simulator and give the visitor insights on the current state of endangered vehicles. Furthermore, an autonomous controller has been implemented which tries to avoid accidents and hence shows the real-world impact, i.e., accidents can be avoided using advanced beaconing techniques. To increase interactivity of the demo, visitors will have the possibility to interact with and take control over endangered vehicles.

We study the ability of Inter-Vehicle Communication (IVC) solutions to handle real-time requirements in safety scenarios using beaconing as a communication primitive. One of the envisioned safety applications is intersection assistance. The objective of such applications is to either warn the driver or even to act autonomously if other approaching vehicles endanger the vehicle. Fairness, combined with aggressive channel access for low-latency safety messages, has been one of the main research line according to which state of the art congestion control mechanisms have been developed. We show that these solutions are not able to sufficiently support intersection assistance applications. Specifically, we show that current approaches fail exactly due to their fairness postulation. We propose a new situation-aware solution to this fairness dilemma by allowing temporary exceptions for vehicles in dangerous situations. We show the applicability for two state of the art congestion control mechanisms, namely ETSI Transmit Rate Control (TRC) and Dynamic Beaconing (DynB). Our investigation also reveals important research objectives for future IVC protocols, namely how much reactivity and situation-awareness is needed in the highly dynamic environment of vehicular networks.

We just released an Open Source receiver that is able to decode IEEE 802.11a/g/p Orthogonal Frequency Division Multiplexing (OFDM) frames in software. This is the first Software Defined Radio (SDR) based OFDM receiver supporting channel bandwidths up to 20MHz that is not relying on additional FPGA code. Our receiver comprises all layers from the physical up to decoding the MAC packet and extracting the payload of IEEE 802.11a/g/p frames. In our demonstration, visitors can interact live with the receiver while it is decoding frames that are sent over the air. The impact of moving the antennas and changing the settings are displayed live in time and frequency domain. Furthermore, the decoded frames are fed to Wireshark where the WiFi traffic can be further investigated. It is possible to access and visualize the data in every decoding step from the raw samples, the autocorrelation used for frame detection, the subcarriers before and after equalization, up to the decoded MAC packets. The receiver is completely Open Source and represents one step towards experimental research with SDR.

Inter-protocol interference is one of the most critical issues in wireless communication. For example, this becomes extremely problematic in environments where robustness and real-time communication need to be considered, e.g., in industrial automation or health care applications. Recently, possible approaches for interference mitigation have been described in the literature assuming that the interferer is known in advance. We contribute to this line of research with a framework for interferer detection and classification. Essentially, we use a simple IEEE 802.15.4 transceiver as for example used on the TelosB sensor motes to scan the 2.4 GHz ISM band. This band is used by different technologies including Bluetooth, WiFi, and cordless phones. The key challenge is the accurate timing of the scanning of the frequency band. The presented framework supports flexible descriptions of such scan jobs allowing to adapt to the detectors requirements, depending on the interfering protocols.