How to see/read RF signal on receiver

Other Hardware General Electronics
1

Hi,

I bought a wireless battery-free switch, it came with a receiver which control the device you connect to it (e.g. a light); when pressed the switch send a RF signal at 433MHz, the receiver takes it and activate/deactivate its relay.

I was trying to "capture" that signal, but I had no success, so, I'm wondering if I could see/read the signal connecting something (e.g. an oscilloscope) to the receiver chip or the antenna.

Could this be possible?

And if you think there's any other solution, or want to recommend me trying other ways to "sniffing" the signal, or anything else related to this, be free to write it down, I'll appreciate any suggestion to solve this.

Thank you very much.

P.S.: The receiver chip is an "CC113L Value Line Receiver" from Texas Instruments (link to its datasheet)

2

You may see pulses like this when you put oscilloscope RF_P or RF_N , when the transmitter is close to receiver

https://www.google.ca/search?q=TV+remote+control+pulses&tbm=isch&tbs=rimg:Cdrg5MIMcItOIjiTN-Ol9cLd7DCmDLT3cxIOsrnPSmHXl_1UvYQXPk8gH5d4vuuurFjiTNDoDjMGceWB45DZTd3jHfyoSCZM346X1wt3sERaFNBO_1wVCIKhIJMKYMtPdzEg4RZ2eBDRlFFsoqEgmyuc9KYdeX9RFt3GXeTwLGXioSCS9hBc-TyAflEc9Ux2qJHxtDKhIJ3i-666sWOJMRoND7z84kJ6IqEgk0OgOMwZx5YBEjIYfDjXSHfCoSCXjkNlN3eMd_1ERk17nwFuFZ_1&tbo=u&sa=X&ved=2ahUKEwjw1fX4z_jaAhVJnOAKHaPTBDwQ9C96BAgBEBs&biw=1440&bih=787&dpr=1

3

What is it that you hope to achieve?

The linked receiver datasheet appears to be RF in and decoded data out, that is, an entire receiver chain and decoder on a single chip, so there doesn't appear to be much opportunity to monitor other points in the signal path. The receiver datasheet also indicates an FSK modulation scheme. There may be an opportunity to hack into the transmitter side, if we know the key components of it.

It's also possible to capture the over-the-air signal using something like an RTL-SDR receiver, but one would need some signal processing expertise to make sense of it.

4

I bought a wireless battery-free switch

Please post a link to the product page for this.

5

ted:
You may see pulses like this when you put oscilloscope RF_P or RF_N , when the transmitter is close to receiver

Perfect! Now I need to figure how can I see that signal without an oscilloscope, I don't have one right now...

MrMark:
What is it that you hope to achieve?

My principal objetive is to use an Arduino instead of the receiver, so I can control anything I connect to it, with the transmitter. Also, knowing what the transmitter send could be useful to use the receiver in some cases.

MrMark:
The linked receiver datasheet appears to be RF in and decoded data out, that is, an entire receiver chain and decoder on a single chip, so there doesn't appear to be much opportunity to monitor other points in the signal path. The receiver datasheet also indicates an FSK modulation scheme. There may be an opportunity to hack into the transmitter side, if we know the key components of it.

What I see for what you tell me, the chip receives a coded message, which is decoded after passing the chip, so the message that I need is the one before entering the chip, but also is modulated (I pressume that is done by the "bunch" of capacitators and coils that are between the antenna and the chip); so what I'll see in RF_P/RF_N is what I need or (in case my assumption is true) I need to demodulate it?

And in the transmitter side, I'll try to open it, but I'm not sure that I could do it without break the switch...

MrMark:
It's also possible to capture the over-the-air signal using something like an RTL-SDR receiver, but one would need some signal processing expertise to make sense of it.

I don't know how much expertise is needed, but I never did that, so I think that I couldn't go on this way, at least, by now.

jremington:
Please post a link to the product page for this.

Here is!!!

6

without oscilloscope - field-strength meter

https://www.google.ca/search?q=uhf+field-strength+meter+circuit&tbm=isch&tbs=rimg:CRKCPB27OZgZIjinORkOsdLQVywXv_1Iag0O5XQs0JgqzT5x_10zm0HN3UYcsEpN54npL0KumjlBh6HdklDfC2E-O_1YyoSCac5GQ6x0tBXEVR8zzrSEEKLKhIJLBe_18hqDQ7kRbN7662PCtEgqEgldCzQmCrNPnBGqRBBPnvBGTioSCX_1TObQc3dRhEevhNq76B_1NiKhIJywSk3niekvQRruQGiOT7T5UqEgkq6aOUGHod2RGu6ZvKGUMpkCoSCSUN8LYT479jEU0CvcojsQpH&tbo=u&sa=X&ved=2ahUKEwjh_MHLh_vaAhXE34MKHeYdAk4Q9C96BAgBEBs&biw=1440&bih=744&dpr=1

7

Dakmor:
. . .
Here is!!!

From the photos in your link, it appears the manufacturer lists a website www.simplelink.cc, which doesn't appear to be working.

I did find a product teardown here: https://www.cnx-software.com/...

The transmitter, like the receiver is fully integrated, RF on one end, SPI on the other, so one would need to instrument one or the other to gain insight into the over-the-air protocol. Neither is a trivial task, but both should be possible.

One of the more interesting things about this device is the battery-free remote. The cnx article has a broken link to a Coilcraft page, but I did find this general article on energy harvesting techniques.

8

Dakmor:
My principal objetive is to use an Arduino instead of the receiver, so I can control anything I connect to it, with the transmitter. Also, knowing what the transmitter send could be useful to use the receiver in some cases.

Not clear.
My guess - you want to capture transmitted signal by arduino, make arduino as receiver ???
(GDO 1) and GDO 2 = demodulated pulses from where you can take them to arduino.

Or you want to make arduino as transmitter ?

9

Download Visual Analyser to your PC, you may see something.
Make a wire loop 5 cm diameter, the ends of the loop to microphone PC plug, transmitter inside of the loop.

10

The datasheet says that chip is SPI - so put a logic analyser on the the SPI bus?

The alternative requires high-end RF lab equipment with demodulation capabilities...

11

A simple 433 MHz receiver, combined with Audacity on a laptop, might work to intercept and decode the RF signal.
Tutorial here.

However, the method in described in the tutorial will work only if the transmitter chip is using the OOK method of data encoding, rather than FSK or GFSK.

One of the more interesting things about this device is the battery-free remote.

Agreed! Looks like a simple moving magnet + coil generator. However, my automobile key is coin battery operated and has worked for 13 years of daily use without a change of batteries.

12

I wanted to answer all your post one by one, but mine's could be too large, so I will write a general answer here for all without quotes.

MrMark:
...
The transmitter, like the receiver is fully integrated, RF on one end, SPI on the other, so one would need to instrument one or the other to gain insight into the over-the-air protocol. Neither is a trivial task, but both should be possible.
...

MarkT:
The datasheet says that chip is SPI - so put a logic analyser on the the SPI bus?

The alternative requires high-end RF lab equipment with demodulation capabilities...

I don't have any logic analyzer right now, maybe I should buy one, but I'm not sure about that.

ted:
Not clear.
My guess - you want to capture transmitted signal by arduino, make arduino as receiver ???
(GDO 1) and GDO 2 = demodulated pulses from where you can take them to arduino.

Yes, I want my arduino as a receiver.

ted:
Download Visual Analyser to your PC, you may see something.
Make a wire loop 5 cm diameter, the ends of the loop to microphone PC plug, transmitter inside of the loop.

jremington:
A simple 433 MHz receiver, combined with Audacity on a laptop, might work to intercept and decode the RF signal.
Tutorial here.

However, the method in described in the tutorial will work only if the transmitter chip is using the OOK method of data encoding, rather than FSK or GFSK.

I tried with a simple 433MHz receiver without Audacity, only looking at arduinos IDE's serial monitor, and I only saw noise, nothing happened when I pressed the switch. I was thinking on use audacity (I have already seen that rayshobby tutorial, thanks :wink: ), but my question is, if I didn't see any change in the serial monitor, will I see anything with audacity? If I can't see anything, maybe the transmiter is not using the OOK method, as you said @jremington....

MrMark:
One of the more interesting things about this device is the battery-free remote. The cnx article has a broken link to a Coilcraft page, but I did find this general article on energy harvesting techniques.

jremington:
Agreed! Looks like a simple moving magnet + coil generator. However, my automobile key is coin battery operated and has worked for 13 years of daily use without a change of batteries.

Yep, I found this wireless switches without batteries, and the energy harvesting in general, very interesting.

13

I tried with a simple 433MHz receiver without Audacity, only looking at arduinos IDE's serial monitor

I wonder what that phrase could possibly mean. Without code or a circuit diagram, it is anyone's guess.

Either try the method in the "rayshobby" blog, or give up.

14

jremington:
I wonder what that phrase could possibly mean. Without code or a circuit diagram, it is anyone's guess.

Either try the method in the "rayshobby" blog, or give up.

This one is the first I tried, then this other one, and finally this one, then I tried combinations of this 3 codes, but with no results.

So, for what I can see, my only chance (without buying more equipment) will be trying the "rayshobby" blog method, I'll keep you inform.

Thanks.

15

put Visual analyzer oscilloscope on data pins Rx and Tx do you see something ?

16

You can buy rf probes quite cheaply - they consist of a fast diode detector and a bit of smoothing.

They're very wideband, but not very sensitive.

One of these with an oscilloscope might give you what you need.

Allan

17

Dakmor:
. . . So, for what I can see, my only chance (without buying more equipment) will be trying the "rayshobby" blog method, I'll keep you inform. . . .

We're not talking about huge investments in test equipment. That said, one has to be sufficiently invested in the hobby to figure out what it is the instrument is telling them.

DVB-T2 receivers for RTL-SDR are cheap and quite powerful tools for looking at radio transmissions.

Similarly FX2-based USB Logic Analyzers supported by the open source SIGROK software are cheap and effective tools for looking at most microcontroller signal protocols.