[05.23.21] Long-WiFi: Testing out 802.11ah

Imagine l o n g e r WiFi for rover experiments.

This sounds counter intuitive, bear with me. There are a lot of random point to point links available, zigbee, LoRa, 'holy-bro', etc. Having an IEEE approved standard for operating in the 900mhz US unlicensed band is interesting. 802.11b/g (2.4ghz) is fine for 'strap an access point to a rover and get something working', but we all know its somewhat limited. Your gadget gets 30 meters away from you and behold, you get intermittent communications. You can setup up an access point somewhere in the middle, its ok-ish but doesn't scale well. Does anyone even use anything in the 900mhz band anymore? Is the spectrum less noisy again?

Lets find out what the word is on 802.11ah together.

Project Background
HaLow Modules
Off the shelf Hardware
Range Testing Rover

Conclusion Image Directory

<I'm experimenting with a more mobile friendly layout, things may render weirdly, it's a work in progress>

Some Project Background
802.11ah, or 'WiFi HaLow' is long-range WiFi intended to live in the ISM [900->930] MHz band (US) and other similar bands globally. The Wikipedia article for 802.11ah [link] does a fairly  good job of describing what 802.11ah was intended for, namely 'internet of things'. It supports some fairly high bandwidth links, so what about rovers? I like lil-robots running about, so lets see if this can work for roving snow-bots & autonomous surveying watercraft. As this is a data / network exercise, for the sake of clarity I'm just going to write out kilo bytes/second or kilo bits/second.

The capitalize vs lowercase to indicate either/or is a headache and annoying.
So what's the point of yet another standard?
This is a surprisingly useful diagram, its basic but it gets the point across. 900mhz is not a great band for super-high data rate activities and you shouldn't expect it to be. A number of things transitioned away from 900mhz / ISM bands just because the antennas were physically bigger. Cordless phones, baby monitors, even r/c toys moved away for the convenience of smaller hardware. 2.4 GHz is just amazing, we can make normal silicon with great sensitivity and its become incredibly cheap. There are however some boundary conditions, 2.4 and 5GHz fundamentally don't really get thru walls & boundaries as effectively while lower frequencies do. You've probably already observed this if you have a dual-band home access point in your residence. 5GHz WiFi not quite reaching your bedroom? Switch to 2.4GHz. But what about outside the home? What about a security camera over by the shed or a weather station over in a tree, or your lawn roomba if iRobot ever gets around to finally making one. 900MHz is the next WiFi, its slower and longer. Can you stream 4k Netflix, no. But what about a sensor-laden rover?
HaLow is very similar to 802.11ac, but scooted into the 900MHz band.  A good cursory write-up is available in "A survey on Wi-Fi HaLow technology" [link]. TLDR: there's 1,2,4,8 and 16mhz wide channels, with a completely ridiculous modulation and coding scheme (MCS) lookup table [link]. Seriously there is a 234 megabit / second mode buried in there, is it physically realizable? Probably not, it requires 16mhz channel mode and some tight timing, but we're here to see what's possible.

Nominally the larger the channel the more bandwidth. To be HaLow compliant you need to support at least 1 & 2 MHz channels. There's a convenient plot of what those channels look like on the US band, shown right.
The 802.11ah IEEE spec is available for purchase, but is also available thru academic libraries. Some excerpts are used in this write-up grabbed from my MIT copy. I cant say it enough, how is it possible that standards that we interact with every day are behind paywalls, the 'everything is a frigging profit center' mentality its ludicrous. If an image from the spec is displayed here, it will have to have IEEE permission? As it turns out yes anything that I post requires permission [link].

Here's a comprehensive list of 802.11ah hardware that I tabulated from digging around for a week, detailed below.
Here is a list of the 802.11ah landscape as of 6/2021, broken down by chipset and vendor. We're presently in the middle of a silicon shortage so access to actual hardware is getting somewhat frustrating. Most of the items shown are detailed below, the process of finding each was somewhat curious as some devices just are not properly advertised as being 802.11ah compliant, while others simply are too buried to be found. Realistically though, at the moment, everything is either Newracom based or HugeIC based, with the large deciding factor being channel bandwidth of the device, detailed further below.

For a copy of this Visio file, check here [link]

But Dane, how did you make that wonderful diagram above?

Here's the somewhat laborious process:

Digging in: What chipsets support 802.11ah as of 6-2021?
Chipsets are the actual hardware behind a product. If there are a variety of options, each product has a different capabilities. In conventional 802.11b/g land there are some chipsets that allow promiscuous modes, some chipsets that have an impressive deep-sleep / power save capability, some that are WiFi + Bluetooth all on the same part. If we can identify the chipsets we can start to categorize commercial devices. Given that 802.11ah is relatively new (2018 specification), its likely that developing, testing and getting through FCC has resulted in only a few offerings. Lets take a look as to what is available.

Image is a reference, HaLow does not run on potato chips.
Newracom NRC7292
The Newracom NRC7292 appears to be one of the few IC's that passed FCC testing, so a number of assembled products listed below are likely to all be similar in performance and capabilities. Newracom has some information about their chipset here [link]. They have a product brief [link], its a two-page overview. Lets take a look, there's two arm micro controllers (why two?) some power control hardware and communications buses tied around the 802.11ah base band. They have a formal product manual for their sub-module [requires signup here] zyzyzyzyzyyz.

The key takeaways are:
  • 15 megabit max, external RF amplifier required
  • 4MHZ channel bandwidth max, no 8/16MHZ channel modes :/

Note that this chipset is are available for vendors to purchase and integrate as of the time of this writing [5-2021].


Time for a mystery

Morse Micro MM610x

These don't particularly exist yet [as of 5/2021], as of the time of this writing, they have a placeholder page [link], it appears that all of their products will be in the 802.11ah space. I requested more information and will post findings here. Who is Morse Micro? They have a Wikipedia [link] and appear to be really centered around making 802.11ah hardware. They are relatively new, starting in 2016, but I haven't found an actual image of their chip or a Dev-board on their public site. Their twitter [link] is also devoid of any images of their hardware under test, and there are no apparent FCC filings that I could find. Its possible that they have an upcoming release but not really sure when that will happen. There's an article from embedded computing [link] that shows a cad render of some kind of raspberry pi zero with a camera module an off the shelf lithium charger module. Their IC is on a separate daughter card with a right angle SMA. Again this is a cad render, so not really a whole lot we can glean from this.

What 802.11ah PCB daughter cards / modules are available as of 5-2021?
The Newracom NRM7292A is a daughter-card / module which contains an NRC7292 and an RF amplifier [RFFM6901]. At the moment this module is only available to specific vendors, and not available to consumers directly. Why a daughter-card? Daughter cards are FCC-able, they have either on-board antennas or a connector for an off-board antenna. Adding an FCC qualified part to your design has two major benefits, namely it has known characteristics & you do not need to fiddle with RF routing. For whatever reason though this one does not, there's no onboard ufl connnector, its just brought out as a pin on a pcb. This is fairly odd.
Unlike the only available for specific hardware vendors the Silex SX-NEWAH is purchasable off the shelf as a PCB sub-module. Mouser single-quantity prices are $75 [link]. This is nearly identical to the Newracom sub-module, but has a UFL connector for an external antenna. There's no easily accessible datasheet so far,
Reyax RYW7292
yada yada

So what 802.11ah hardware exists as of 5-2021?
Silex AP-100AH
The first fully enclosed module widget I found was the Silex AP-100AH listed as literally the "First Commercial 802.11ah (HaLow) Wireless Access Point". The AP [link] takes in 10/100 Ethernet (there is zero reason to have gigabit on a device that at best will do 30MB/S), claims a 3km range, 234 simultaneous stations. Here's local copies of the [Quick Setup] and [Users Manual], in case their site changes its links in the future. Interesting. Lets take a look at the full manual and see if there are any interesting details. Ok so some interesting hardware facts:
  • Rated for 0-40 Celsius operation, 903 -> 926 MHZ frequency (so this particular unit is state-side only, the ISM band for Europe is ~860MHZ)
  • It has NAT abilities, such that it can hand-out a separate sub-net of IP's on the 900mhz band.
  • You can hide the web interface from the Ethernet side (blocking its local port 80), so its only accessible from the 802.11ah side.
  • You can twiddle the operating frequency and bandwidth. This is interesting, normally 802.11 wifi kind of dances around either having an auto-selectable channel or a fixed channel, but not a fixed frequency, this is interesting
  • The power consumption is not listed in the manual, just that it uses a 5V supply.
  • The transmit Power / Receive sensitivity is also not listed, which is odd. Is it 10mW, 100mW?
  • They don't list the RF connector type, RPSMA? SMA? a bit odd. 

Its not clear if an AP can be configured as a client as well. They sell two modules a BR and an AP 100AH, the BR being used as a bridge? Lets take a look at it next. 

One other interesting note is the bandwidth vs range settings, The lowest setting and topologically longest range is 330Kb/s while the highest is 15Mb/s. The sentence before that chart ends, uh early, so its not totally clear how or what the MCS / modulation and coding scheme actually automatically transfers.

Lets take a look at the Silex App-note [link] on this subject to see if there's something else that can be gleaned. Yeah no nothing about how that works, except that to make use of existing Linux features, conventional WIFI channel numbers are correlated with low-band frequencies. That's kind of interesting, and probably makes integration less of a headache.
Silex BR-100AH
This module is physically identical to the AP-100AH, it just is the 'client / bridge' version. Not really sure why this isn't just a software / hardware dip-switch. I contacted Silex and got a fairly quick response. From what i can tell both units use the same NRC7292 module internally, and that module can be a client or an access point. Real curious.
Ok so this is the dev-kit version, its based around the NRC7292. Some useful specs:23dBm transmit power, -109dBm receive sensitivity. Its available on mouser [link] for $ 212 USD.
NRC7292  EVK

Ok so this is a vendor who actually makes the module that all of the Silex hardware uses, they are selling an evaluation board [link].

Alpha Network AHPI7292S

Here's an interesting one [link] its similar to the Silex EVK but its reasonably sized. I really like the layout and the price. 54USD?  That's 1/4 of the Silex EVK. Its also a reasonable layout, whereas the silex EVK sticks out to the side of the ras-pi. There doesn't appear to be documentation for the module, but i can try and sort that with the vendor. What do the DIP switches do, etc. The Rockland folks seemed really responsive, I checked in weekly to see when this would be in-stock, and the moment it was back in stock they emailed me. Quite good. From the description we get a NRC7292 and a RFFM6901 as the RF amp. So this is super similar to the Newracom module [NRM7292A] detailed above. They have a UFL connector which is great so this thing should be straightforward to do some testing on. It'd be interesting if they went with an SMA/RPSMA as those are generally so much sturdier, but I'm not complaining. Again this daughterboard has an rf shield outline, but doesn't appear to have one installed? A bit odd.

Interestingly there are some better screen grabs from ALFA's sight directly [link], Rokland displays version 0A, whereas ALFA shows version 0C. There are some differences, we can spy:
  • Population jumpers on the far right for frequency range
  • What appears to be an SMA pad for an antenna, which is not visible from Rokland's page. I dont like how the SMA pad gets a right-angle rf pathway, that is a bit dubious.
  • The dip switch shown on the Rockland post is not populated,
  • There's an underboard 3 position switch with 'stanalone download host' positions, maybe thats station, config, access point mode? No idea
  • There's a 3v3 TTL RS232 header on the board
  • The RF path has a non-populated chip, labeled U4. It could be a filter or maybe a spot for an amplifier? I


Ok now we're getting interesting, an M.2 802.11ah module [link].  Could this actually be a drop in the same spot as a conventional network card M.2 module? Sneak in a 900mhz antenna in your tablet and you have access to 802.11ah net? Well, that would have been pretty cool, they however do not actually list a manual or a setup guide. I reached out via phone & email, so I guess we shall see. There's not really specs available yet aside from some marketing jargon. Will update whenever they get back to me. The pricing was reasonable for a relatively new technology, $95 USD for the card alone. standard looking UFL connector for an external antenna. This is interesting, as it means adding a modem to a contraption is now relatively small. It'd be great if these were ~$20 but I don't expect that for a while, the price is probably driven by the fact that only one vendor makes 802.11ah qualified chipsets at the moment.


I found this filing: [link], from Zhuhai Huge-ic. That is a wonderful vendor name. The FCC report indicates 421.696 mili-watts of transmit power @__@. This is the highest so far for a module.

The module has a users-manual [local copy] and an FCC test report [local copy]. This is a surprisingly detailed manual

  • Supports 32.5 Mbps. This is interesting as we learn that they are not using the NRC7292, as that supports 15Mbps max.
  • 8MHZ mode is supported, the NRC7292 goes to 4mhz channel bandwidth max, also supports AP & STA mode, so it can work as either.
  • Power is supplied at 3v3 (3.6v max), which is interesting as the previous modules could only hit 240mW at 3v3. This is a solid 180mW higher.
  • The operating range is 902-928 mhz, so this is not intended for Europe bands, interesting. So what is the internal chipset?

The Ali-Express weirdness begins:
For whatever reason Ali-express has some 802.11ah compatible hardware. They don't claim that in the title, they do however call out some form of "wi-fi HaLow". There are not many yet but there were a few wireless bridges. I ended up ordering a pair that will hopefully arrive some time in the next decade, the particular model is [link], and because alibaba links tend to evaporate, here's a full screen capture [local pdf link]. Its not clear how accurate the specs are but here are some notes:
  • 902-930mhz, 100mw transmit, 5v 500mA on the power input. There appears to be a 760 - 790mhz band version, not clear which one i will end up with, hopefully the one that's legal to operate in the states. 
    • WPA2 PSK is implemented
    • I was able to get a copy of the 'manual' which is just a rudimentary set-up guide [local copy]
The Ali-Express weird-links are on Amazon in the states?
Ok this is interesting. The strange gadgets I found above on Ali-express are hidden away on amazon from one seller. Extra dubiously, the frequency and band it operates on is listed incorrectly as 1902Mhz/760-790MHz. No idea what that is, it should read ~902-926 / 760-790MHz. Probably makes sense to put these next to a frequency plotter before using them. I contacted the seller and he also just regurgitated the above response. I did order the Ali-Express variant, but it wont appear for at least a month, this may be a good look at what these modules are, ahead of time. I'm somewhat surprised they support 8MHz bandwidth, as that would indicate its not NRC7292 based. Given that there is only one other vendor at the moment with an 802.11ah chipset, Its possible this is a HUGE IC TTLTX-AH-R900A based gadget. We do get some useful info from this advert though, its sub-model # is STK-AIR900/ STK-AIR700. That now is way easier to find and reference.

Other variants appear
This version [link] was opened up by [twitter]. This one looked even more curious [link]. The internal photograph shows a silk-screened board with lots of debug connection points  this is wonderful.

Ok, so given what we know, and that literally all of these modules just run an NRC7292 chip-set on the inside, lets take a look at its datasheet / manual. As of 5/2021, its not publicly available ? You cant directly buy the chipset? Ok so lets dig into what info was submitted to the FCC, there's gotta be something here right? Here's everything on the NRC7292 SXNEWAH module [link]. We start out with a real winner, listed under 'user manual' : 
Is this a joke? you are selling a module that gets integrated into things.
OK so next step, lets see if there's any useful information nuggets on the remainder of the FCC filings.

Alright here's our list of interesting findings from the FCC:
  • 240.4mW transmit power not bad! An older-gen 802.11b/g access point (the venerable wrt54g) was ~60mW, modern ones are ~120mW on the 2.4ghz band. I'm impressed its that high.
  • The internal image is fairly interesting and available here [link] and shown (right). It kind of looks like this is a dual footprint part where you could put in an sma? It really looks like there's two RF paths, maybe in the future there's going to be some kind of mixed mode thing. It could also be likely that one is Europe bands and the others are stateside? Unclear.
  • The external photos don't really show anything interesting [link]
  • Next up, lets read thru the FCC test report [link]
    • The spectral plots look remarkably good, as you'd expect for a software defined radio peripheral
      • The max transmit power figure was interesting, it looks like 915 is somewhat favorable in terms of max transmit power, a solid 1.2dB higher than 926 mHz.

There's two IC's on that FCC internal photo, whats the other one?
The second IC is an RFFM6901 according to the block diagram, and the photo. Huzzah, finally something with a formal datasheet [link] [local copy]. Ok lets see what we've got here.
  • The second IC is an RF transceiver, allowing for higher transmit power without heavily changing the receive sensitivity.
  • It has 30db transmit capability (exciting)
  • Antenna diversity switch (so that's what the other, un-populated port is for).
  • Can run on 2.8 -> 4.2v (lithium ion raw battery voltage range)
  • It looks like there's two modes, 3v bias (low mode, 27dB transmit) and 4v bias (high mode, 30dB transmit). That's somewhat interesting, its not really a great idea to modify a modem, but, it would be curious to run an outdoor test to see the effects. ? Reading further it looks like control input 5 / CTL5, or IC pin 10 defines the HIGH/LOW transmit power mode, this could be a little dip switch away from testing the difference between modes. Excellent!
  • The FCC report indicated the power table should be 26dB, but later on showed a max transmit power of  23dB, which is significantly lower than the 27dB that the amp indicates in low transmit mode. This could be an ideal vs real-world, unclear.
  • Is it possible that the antenna diversity is just not implemented back on the NRC7292? Man it would be great if that part had a proper datasheet. The best we get is this product brief [link] [local link]
  • Lets see what else we can glean, the overview sheet of the NRC7292 does have two RF paths, a tx and rx that feed into the RFFM6901, so technically its possible for antenna diversity to exist, we just don't know enough about the host ic.
We've got a new contender, the RYW7292 !
This is an 802.11ah sub-module based again, around the NRC7292. It has a datasheet, an actual datasheet! [link] [local copy] [product page].
 So, anything we can glean from it actually gives us hints about the NRC7292.
  • This module has a breakout for the NR7292 and the RF amp power supply, both are listed as 3v3 nominal. Ok, so we now know that the NRC7292 is a 3v3 IC, lets keep digging.
  • This is also a 23dbm transmit, at 3v3, interesting so its super similar to the Silex.
  • There's no FCC filing on this module yet [link] so we cant glean any information from there.
  • IT HAS AN EVB schematic! We can now get some more info about our NRC7292 mystery.
    • Well kind of, the EVB schematic is just how the module interfaces to the outside world, not whats inside the module.

I got in some of these gadgets, lets see how they are constructed

This is the xyxyxyx module, purchased from ali-express [link]. Its construction is interesting, Its an outdoor case, with a panel-mount SMA connector and a non-cable gland-ed 12v power+ethernet cable. The pcb doesn't quite fit, so it was mounted offset. The reason I purchased this module was actually only because it had visible silkscreen labels, switches and connectors. This was possibly born as a generic module and got shoved into this case. We can see a physical switch for setting if it is an access point or station (client), some kind of pairing button? a breakout for discrete RSSI states, what looks like a 4.2v generic lipo charger onboard, and a 3v3 I2C breakout. This is wonderful, especially for gleaning more information from the module.
Lets dig a bit deeper,



Lets do some range-testing and collect some real-world data
OK, so we're basically looking for a few fairly straightforward plots, bandwidth vs distance with different software & hardware settings, along with different instruments. Lets make a list of what we're interested in:
  • Position is fairly important, knowing how far away from the base-station reasonably accurately gets us way better data
  • Antennas are also important, I'd like to test a small patch antenna vs a simple rubber ducky style antenna.
  • Environment conditions: I know that humidity (and heavy rain) somewhat effect 2.4ghz but I'm far less familiar as to what happens in 915 mHz land, a small measurement using a handheld %relative humidity meter. May as well record this during testing.
Wait aren't you intending to use these on rovers, why not just put everything on a rover
Yeah, that is a good idea. I have good ol' strawberry bot [link], which has a 2.4ghz receiver and is basically just an RC buggy at this point. Its unlikely I'd get anywhere near 1km on 2.4ghz, but its possible to get some level of remote-control. I do have a longer-range FrSky 900mhz module but that is highly likely to interfere with 802.11ah testing as it's in the same band. As of recently I've been a fan of my Taranis QX7, its possible that at 2.4ghz with a modern FrSky I'd get better range than the hobby-king TX/RX I was previously using. One note, I'd like to keep the antenna under test fairly high up, while not having a rover that immediately flips over, its possible I may need to add some battery-ballast to the front and back. There may end up being two masts, one for the GPS location and the other for the antenna under test.
Lets plot an easy way to range & band-with test.
The previous propulsion was straightforward, a 12v battery, a hobby RC motor controller, a receiver and that's it, its literally an R/C buggy.

To preform network throughput testing however, that's another story. A few of the device's under test are connected directly over Ethernet, while some are raspberry pi daughter-cards. As a result we should support both. We need power (5V 15W DC/DC supplies), a mast to attach antennas to and a GPS to provide some distance information. I opted for two separate DC/DC's in case the modem under test pulled more power than I anticipated.

How are you going to collect data?
Good question. My plot was to just ssh from a base-camp laptop to the rover over the 802.11ah connection. I should be able to pull either GPS Lat/Long or write a python script to report back the distance between the base-camp and the rover. To test the bandwidth the easiest way I can think of is host a file on the rover and WGET it to the base station. IPERF is also an option, but its not totally clear which is a better representation of bandwidth. The process would be step-wise and somewhat manual:
  • Measure base-camp GPS position, and update rover to calculate distance from fixed base-camp.
  • Pilot rover out 15 meters:
    • Verify its actually 15 meters with a tape measure
    • Query GPS distance, jot it down
    • Speed test connection
  • Once the distance is somewhat accurate and repeatable, keep going until bandwidth drops down below 50 kilo bits/second or the connection just drops all together. Repeat every 15 meters or so, plotting results on a lookup table.

Are these things inter-operable?
802.11ah is a standard, so if these are standard compliant, can you get an Ali-Express 802.11ah compliant device to talk to a Silex Access point?

Can you mesh?
Does the 802.11ah standard support meshing or relay nodes? Can my rover drop off little pylons/repeaters to add more range at the expense of latency & bandwidth?

What even exists hardware-wise that supports this standard.

What the heck is this, 802.11ah network simulator? https://github.com/asljivo1/802.11ah-ns3












raspi ethernet tutorial

sdk for mystery chipset?

Taking a quick survey of the area
I have this wonderful device, its a handheld portable spectrum analyzer called the RF Explorer [link]. I use it normally for hunting EMF/RFI, but its really wonderful, I think it was $150 USD at the time of purchase. The part I love? Its portable and straightforward. The model is listed as just "RF Explorer" and  50khz -> 960mhz, this model has been super-seeded by newer variants, which is surprising as it was manufactured 3/2018. The closest model is the WSUB1G [link], 

interesting how to for silex evk
Reyax RYW7292: http://reyax.com.cn/wp-content/uploads/2020/11/RYW7292_EN.pdf  https://reyax.com/products/ryw7292/
ALFA module microbus: https://www.varia-store.com/en/produkt/96031-ahmb7292s-8-ieee-802-11ah-sub-1-ghz-module-with-mikrobus-tm-form-factor.html
Alfa raspi board: https://store.rokland.com/products/alfa-network-ahpi7292s-ieee-802-11ah-sub-1-ghz-module-in-raspberry-pi-hat-form-factor

OK lets make a simple network and see what the range and speed is.

In this case we're starting with an access point and we have one client. The access point has an Ethernet jack so a normal laptop can be used to diagnose and get the speed-test vs distance results. The access point

With that working, lets make an internet connected network

Lets start with a known reference point, an 802.11b/g/ac internet connected network with a known login. We want to do the following:
  • Become a client on that network
  • Forward client traffic to the 802.11ah access point
  • Have the 802.11ah access point provide a NAT for other devices (rover, tablet etc) to connect to.
  • Consume not many watts and be relatively small, effectively this is acting as a network bridge.

Taking a loo

Thermal Thoughts

(There's other photos in the photo gallery)
Concluding Remarks:

If you have questions or comments, ask below or send over an email.
HTML Comment Box is loading comments...

If you wear a reflective vest very few people ask why you're operating a robot with googley eyes.

Rensselaer Polytechnic Institute 
Electrical & Electrical Power