Drone Teardown

A couple of teardowns of Russian Orlan-10 UAVs captured by Ukrainian forces have appeared on the Internet lately. This drone is a short-ish range platform for reconnaissance and artillery target acquisition that acquired a fearsome reputation after the 2014 battle of Zelenopillya in the Donbas, where a substantial Ukrainian force was destroyed by Russian artillery firing from within Russia after being spotted by multiple drones apparently using both cameras and passive electronic-intelligence detection. Basic details are here and here. The airframe is a small high wing monoplane with a small piston engine, essentially a big model aircraft, which can lift about 6 kg of whatever you’re interested in.

Whatever you’re interested in turns to be a Canon EOS Digital Rebel T6i SLR camera, a perfectly reasonable piece of consumer photographic equipment but perhaps not what we were expecting. A lot of people have commented on the improvised appearance of the whole thing, but this isn’t necessarily a weakness in itself – the Ukrainians have absolutely excelled at adapting whatever technology is at hand, and being able to swap between different payloads by unfastening some Velcro has its uses. I am more interested by a different teardown, as it shows some of the system-level electronics.

The two circuit boards contain an uBlox GNSS module (the uBlox logo is visible) and a GSM/GPRS cellular radio module, with its IMEI number helpfully printed on a label. The board is marked “TRK” which might mean something like “TRX”, a common abbreviation in the GSM world for a transmitter-receiver. The GNSS is a multi-band receiver for the various satellite navigation systems (the US’s GPS, EU Galileo, Russian GLONASS, and Chinese Beidou), while the cellular radio is basically what I had in my mobile phone in 2006.

Now this is interesting – if the GSM/GPRS is the main communications link for the drone, it’s going to be the binding constraint on the drone’s capabilities. The various spec sheets talk about sending telemetry between “120 and 600 km” but this is not happening over GSM/GPRS, as GSM has a hard limit on the size of its cells at a diameter of 37km. We can be reasonably sure they’re using the protocol as designed because the radio module is a bog ordinary one you can buy for less than a fiver. As such, the drone can’t be further than 18.5km from the GSM base station. The control unit could be somewhere else and connected to the base station over some other network, and the base station itself could be connected to a relay of some sort, but the last radio link is that long and no more.

The 2.5G radio would also be a constraint in terms of what the drone could do while it’s out there. In principle, E-GPRS aka EDGE can do data rates up to 236Kbps but the actual module’s manufacturer says it tops out at 85Kbps. Uploading images taken by that Canon DSLR would take an impractically long period of time at this rate, especially if they want the RAW file for further processing. In fact, the only imagery application that is likely to work would be sending back very low-quality viewfinder images to help aim the real camera. Latency would be an even bigger problem – even the 3.5G technologies like HSPA suffered from high latency to the extent that getting it down was a major goal of 4G, and GPRS was far worse, with typical roundtrip times in the hundreds of milliseconds and bad ones over a second.

Piloting the drone remotely over such a link would be extremely difficult, and doing anything that involved flying precisely, impossible. Interestingly, the commercial quadcopters the Ukrainians use so many of are very good at exactly this, which helps getting high quality images and also makes it considerably simpler to do anything that needs precise aim, such as using a laser designator. The best you could do would be to send it commands – fly to such and such a geographic location, set a course to point x, start capturing images, stop, return home. This suggests that its operations are pre-planned, and that the user of its intelligence has to wait for the drone to return and side-load the images to look at them or run any automated processing before making a decision. Ironically, one of the drone’s good features – its claimed endurance of up to 18 hours – is a problem here as it imposes a long wait for results.

It’s possible that the GSM/GPRS isn’t the only radio present on the drone – in some ways the Orlan-10 seems more of a kit of parts than an integrated system, which isn’t necessarily a bad thing – and in fact I find it hard to imagine they’re relying on 2.5G for all the reasons above and also because the cryptography in GSM is thoroughly obsolete and vulnerable to interception. For all the reasons above, though, it’s hard to think of a reason to have one on board except as a low-bandwidth command link. Wikipedia has a picture of the command vehicle:

The UAV’s wingspan is 3m and using that for scale I make the antenna ~59cm by ~85cm. I can’t really match the estimated dimensions to GSM parameters – 900MHz is 33.3cm wavelength and you divide by 2 to get the ideal half-wave dipole antenna – but perhaps there are multiple antennas in there.

Anyway, enough with the rivet-counting. The action at Zelenopillya, having been used as a fashionable case study, has been rehistoricised and deconstructed in a way that certainly suggests that “fly home and download” might be how they work. I’d also point out that one strength of this approach is that it puts control of the drone, and more importantly, of information, in the hands of whoever gets that big green command vehicle with its base station antenna. Nobody further forward is going to get any information until well after the drone gets back. This fits very well with everything else we know or suspect about the Russian army.