MZFS RF Test Kit

Frequency plans and RF-resilience test material for MZFS airframe links, built for the PortaPack Mayhem H4M (HackRF, DC-6 GHz), plus future notes for the mmWave range above it.

Purpose

Repeatable, contained resilience testing of MZFS drone links (ELRS control, analog/digital VTX, GPS, and the Walter LTE-M cell modem or a phone gateway) against active-radio RF denial, so failover to companion / mesh links can be validated end to end.

All transmit testing is CONTAINED: shielded enclosure, or conducted via coupler + attenuator. Denial is applied to a live radio inside the box so the modem exercises its real retry and loss-detection behavior; emissions do not radiate off-air.

FREQMAN files (drop into /FREQMAN on the H4M SD)

Format: Mayhem freqman range entries, a=<start_hz>,b=<stop_hz>,d=<label>. Read by the Jammer, Recon, and Search apps. Ranges are kept <=75 MHz so the Jammer's 80 MHz per-range limit (which is exclusive, an exact 80 MHz span is rejected) is never hit.

• MZFS_CELL.TXT all US sub-6 cellular, band-edge aligned, 600 n71 to C-band n77 (3.3-4.2 GHz)
• MZFS_ISM_FPV.TXT CB, 433, 868/900 ELRS, VTX 1.2/1.3/3.3/5.8, GPS L1, 2.4 ELRS/WiFi
• MZFS_AVIATION.TXT VHF nav/voice, UAT 978, SSR 1030, ADS-B 1090
• MZFS_VZW.TXT Verizon deployed layers
• MZFS_ATT.TXT AT&T deployed layers
• MZFS_TMO.TXT T-Mobile deployed layers
• MZFS_DISH.TXT Dish/Boost deployed layers
• MZFS_MMWAVE.TXT REFERENCE ONLY, above the H4M 6 GHz ceiling. 24 GHz radar-nav band, 5G FR2 n257-n261, 60 GHz 802.11ad swarm, 60 GHz radar. Needs a downconverter or other hardware to actually use.

Naming convention: <scope> <freq> <BXX/nXX> <chunk>, e.g. TMO 2500 n41 a.

Carrier layer combinations

The per-carrier files deny ALL of one carrier's deployed layers at once, so the DUT cannot reselect to an un-jammed layer and actually loses the link. Downlink/TDD focused (what the DUT receives), which is the efficient way to force loss inside the box. Carrier files reflect typical US band portfolios; trim to the local market if a layer is not deployed where you test.

Recon files (activity / denial detection)

Recon consumes the same freqman format but uses fields the Jammer ignores: s= (scan step) and m=/bw= (how to detect/demod). No 80 MHz cap. The MZFS_RECON_* files use SPEC modulation for wideband energy detection, so they answer "is this band active, or has it been denied", which pairs with the jammer files for a full test loop.

• MZFS_RECON_CELL.TXT cell downlink presence (SPEC): tower-present vs denied
• MZFS_RECON_FPV.TXT control/video/nav presence (SPEC), GPS L1 as jammer-energy detector
• MZFS_RECON_AIR.TXT airband voice (AM demod) + ADS-B/UAT energy detect (SPEC)

Loop: Recon a band to confirm the signal, run the matching jammer file to deny it, Recon again to confirm it is gone. Format details in docs/recon-freqman-format.md.

Jammer app settings

Type Rand for broadest denial (Sweep to characterize threshold vs offset), Hop 10-50 ms, TX gain to the minimum that achieves loss inside the enclosure. The Jammer writes no log; enable Settings -> Log and use Recon or Level on the receive side to capture denial vs time.

DUT self-report (the actual pass/fail record)

• Walter GM02SP: AT+SQNMONI=9 (serving band, EARFCN, RSRP, RSRQ), AT+CEREG?, AT+CESQ. The modem camps on one band at a time, so read the serving band and deny just that for a targeted test, or load a full carrier file to defeat reselection.
• 5G phone: field-test / diag app (SignalCheck Pro, Cellmapper, Network Signal Guru) for band, SSB-RSRP, beam index, including the mmWave leg where present.

App support matrix (which apps load presets)

Verified from mayhem-firmware source (branch next):

• Recon: full freqman consumer. Single/Range/HamRadio (r=/t=)/Repeater (l=/t=), honors per-entry m=/bw=/s=. Enable the Load ranges/hamradios/repeaters toggles in Recon settings or those entry types are skipped. Max 150 entries/file.
• Scanner: reads /FREQMAN/ channel-list files. Takes m=/bw=/s= from the FIRST entry as the file default; scans the Single/Repeater/Ham freqs. For a Range file it uses only the FIRST range as a stepped sweep. Channel-list files are the right shape here.
• Looking Glass: does NOT use freqman. Reads /LOOKINGGLASS/*.TXT, format min,max,label in integer MHz. See lookingglass/STOCK_GLASS.TXT.
• Capture / Search / Level: no preset-file loading. Set frequency manually, or launch Capture from the freqman manager with a chosen entry.

Stock library (general capability, /FREQMAN/)

Drop-in presets for everyday SDR use, correct m=/s=/bw= per band. US-primary.

• STOCK_FM, STOCK_NOAA_WX, STOCK_WXSAT (APT/LRPT via WFM stand-in)
• STOCK_MARINE, STOCK_AIS, STOCK_POCSAG
• STOCK_GMRS_FRS, STOCK_MURS, STOCK_PMR446 (EU)
• STOCK_HAM2M, STOCK_HAM70CM
• STOCK_ADSB_UAT, STOCK_ISM (SPEC energy detect)

SPEC entries and the WFM weather-sat entries are for presence/energy or for handing the frequency to the dedicated decode app (ADS-B, AIS, POCSAG, APT); freqman has no APT/digital token, so WFM is the stand-in.

Looking Glass presets (/LOOKINGGLASS/)

Separate directory and format (min_MHz,max_MHz,label, integer MHz). lookingglass/STOCK_GLASS.TXT has full-span and per-band sweep windows for the wideband waterfall view of denial.

Docs

• docs/mmwave-sensing-and-swarm-datalink.md: options above 6 GHz. mmWave receive/sensing on a budget (phone diag, SDR + downconverter), and a jam-resistant 60 GHz swarm datalink concept.

Related

• Firmware: sovereign-rf/mayhem-firmware (H4M / PortaPack Mayhem mirror).