RippleSense: Scalable and Efficient Wideband Spectrum Sensing

Presenting our Paper RippleSense at ACM SenSys 2026

This paper is a joint work by Dr. Yanbo Zhang, Prof. Mo Li and me, spanning the WANDS group at the Hong Kong University of Science and Technology and the NTU-IoT group at Nanyang Technological University Singapore. It was published and presented at ACM SenSys 2026 during CPS-IoT Week in Saint-Malo, France.

This post provides an accessible overview of the key ideas behind RippleSense, following the structure of the talk. For full details and equations, please refer to the paper.

---

The Problem: Wideband Spectrum Sensing is Expensive

Spectrum sensing is the task of detecting which frequencies in the radio spectrum carry signal energy. This is important for applications like Dynamic Spectrum Sharing (DSS), where unlicensed devices can opportunistically reuse licensed spectrum when it is not in use, and for critical signal detection such as identifying radar pulses that could interfere with other systems.

Conventional wideband spectrum sensing requires high-speed analog-to-digital converters (ADCs). A survey of over 9,000 commercially available ADCs shows that higher sampling rates come with dramatically higher cost and power consumption. Prior approaches have attempted to work around this, but face limitations: sparse Fourier transform methods assume the spectrum is mostly empty (which contradicts the very goal of DSS: efficiently sharing densely used spectrum), sequential scanning methods miss fast, transient signals, and some hardware-heavy designs end up consuming as much power as Nyquist-rate ADCs.

Background: The Nyquist-Shannon Sampling Theorem

At the foundation of our approach is the Nyquist-Shannon sampling theorem: to perfectly reconstruct a signal, you need to sample at least twice the highest frequency component. For example, to capture a 5 GHz signal, you would need a 10 GHz ADC - which is extremely expensive and power-hungry. So what happens if we intentionally violate this requirement?

Aliasing: What Happens When You Under-Sample

When sampling below the Nyquist rate, we get ambiguous signals known as aliases. A high-frequency signal and a low-frequency signal can produce identical samples, making them indistinguishable. The spectrum naturally divides into intervals of half the sampling rate, called Nyquist zones. Signals in higher zones look the same as signals in the first zone after sampling - which is normally a problem. But we turn this into an opportunity.

Folding: The Core Insight

Signals from higher Nyquist zones naturally fold down into the baseband (first Nyquist zone) when sampled, mirrored at each zone boundary. After folding, all signals are stacked on top of each other in a narrow band - and we cannot tell where they originally came from.

The core idea of RippleSense: what if we inject a distinct, per-Nyquist-zone signature into the signals before they fold? If each zone carries a unique fingerprint, we can later identify which zone each signal came from and reconstruct the full wideband spectrum - all from a single low-speed ADC.

Hardware: Injecting Signatures via Voltage Ripple

On the receive side, the signal is either captured with a single wideband antenna or stitched together from multiple antennas. A divider splits the signal into separate paths, one per Nyquist zone, each filtered by a bandpass filter (or sequential low- and high-pass filter stages).

The key trick: each zone's gain amplifier is supplied with a power voltage that has a small, distinct voltage ripple. This ripple modulates the amplifier's gain over time, imprinting a unique amplitude signature onto the signal passing through - similar to analog amplitude modulation, but very subtle. The signals are then combined and sampled by a single slow ADC, where all zones fold into baseband.

The ripple injection is implemented using a custom PCB - the Rippler - which generates a controlled voltage ripple with tunable DC offset and amplitude. The left side shows the physical setup: a signal generator provides the ripple waveform, which is fed through the Rippler board to modulate the amplifier's supply voltage. The oscilloscope capture on the right shows the effect: the input DC supply (blue) is transformed into a clean sinusoidal ripple (yellow) at the output, with precise control over both offset and amplitude. This simplicity is key - the entire signature injection mechanism is a single, inexpensive analog circuit per Nyquist zone.

Software: Reconstructing the Full Spectrum

On the reconstruction side, the algorithm processes each column (time slice) of the folded spectrogram. For each column, an FFT along the time axis reveals which ripple signature frequencies are present. If a particular ripple frequency appears, we know there is an active signal in the corresponding Nyquist zone. We then copy that column into all zones whose signatures are detected, reconstructing the entire wideband spectrum.

Algorithm Performance

The reconstruction algorithm is highly parallelizable, scaling from ~50 MSPS on a single CPU core to over 10 GSPS on a GPU (RTX 3090) - well above the 5 GSPS needed for real-time DC-to-10 GHz sensing. Since the workload is dominated by FFT operations and data transfer, a dedicated FFT engine (e.g. on an FPGA or ASIC) could achieve similar throughput at a fraction of the cost and power.

Prototype: DC to 10 GHz Sensing

We built a prototype capable of sensing the entire spectrum from DC to 10 GHz with 4x sub-Nyquist sampling. The RF frontend uses off-the-shelf components - bandpass filters, gain amplifiers, combiners - except for a custom PCB that generates the ripple signatures. On the digital side, an RFSoC4x2 FPGA board handles data acquisition at 5 GSPS, and the reconstruction algorithm runs in real-time on a single NVIDIA RTX 3090 GPU.

Over-the-Air Results

The figure shows a fully reconstructed spectrogram captured over the air. The four Nyquist zones (DC-2.5 GHz, 2.5-5 GHz, 5-7.5 GHz, 7.5-10 GHz) are reconstructed and stitched together. Test signals injected at 915 MHz and 5.8 GHz ISM bands are visible and correctly placed, qualitatively verifying that the signature-based reconstruction works.

Dense Spectrum Performance

A key advantage over prior work is that RippleSense maintains stable performance even when the spectrum is densely occupied. Unlike sparse-spectrum methods that degrade when more than 5-10% of the spectrum is in use, our approach achieves F1 scores above 0.95 across all occupancy levels - from 12.5% up to 100%.

Scalability and Trade-offs

The design parameters are highly flexible and can be traded off against each other. The system supports signal durations as short as 10 ns, sub-sampling factors from 1x to 60x, bandwidths up to 10 GHz, and sensitivity down to -100 dBm. For example, if you are only monitoring a 40 MHz WiFi band, you can use coarse 40 MHz frequency bins, which drastically reduces the required ADC sampling rate and power consumption. This makes the approach applicable from milliwatt-level IoT sensors to high-bandwidth deployments.

Open Source

The project is open-sourced for the research community at github.com/andreaskuster/RippleSense. This includes the reconstruction software, the FPGA/RTL hardware design, and all schematics and bill of materials for the RF frontend.