How to find a remote control frequency?

[onesixright]

Hi All,

I have a  RF remote-control and I like to figure out on what frequency it communicates.

The question is: what is a "easy" (maybe not so easy...) way to figure out what frequency the remote is using?  While pressing the buttons i should use a frequency counter?

Thanks!

[Zero999]

Yes a frequency counter would do the job. It needs to have a 50 Ohm input and be able to work up to a high enough frequency.

Stick a short piece of wire into the frequency counter's co-axial input socket and activate the transmitter nearby. You should get a decent reading.

I've done a similar thing myself to test a home made RF oscillator.

[onesixright]

Hi Hero999,

Thanks thats a great tip!

Yes a frequency counter would do the job. It needs to have a 50 Ohm input and be able to work up to a high enough frequency.

Stick a short piece of wire into the frequency counter's co-axial input socket and activate the transmitter nearby. You should get a decent reading.

Now when i startup my remote and i keep it close to the wire, it reads 49.000.000 Hz ~ 50 Mhz. I guess thats the Crystal of the MCU?, since i didn't press any buttons. When i press a button, i see no change.

Is it possible that my FC doesn't have enough bandwidth? Im using a Rigol DG1062Z, according to the specs:

Frequency Range: 1?Hz to 200MHz

Assuming the RF remote is probably being round 433 Mhz, i guess its out of limit?  Any other though how to determine the transmit frequency?

Thanks again.

[apis]

If you have a RTL-SDR dongle you might be able to see the signal, most cover 433mhz.

[continuo]

The question is: what is a "easy" (maybe not so easy...) way to figure out what frequency the remote is using?

Quick search on the interwebz? 

[LA7SJA]

Best guess 433.92MHz, try with a 70cm receiver/tranceiver (even narrowband FM will work). Have you open it yet? The usual TX-modules are labeled 433 or 433.92. If you google "pictures 433.92 modul" you should find the one used in your unit.

Johan-Fredrik

[onesixright]

Best guess 433.92MHz, try with a 70cm receiver/tranceiver (even narrowband FM will work).

Another good tip, found it 433.512 Mhz.

Thanks!

[LA7SJA]

Just one more thing:

How?

Johan-Fredrik

[onesixright]

Aha, sorry.

I had a old receiver laying around, so i tested the 433 spectrum and when pressing the buttons i heard the "beep"

See the attachments 

[LA7SJA]

I think you found the modualtion sideband and not the carrier (sometimes the sideband gets most of the energy). Do you find any other signals up to 434.5Mhz? Can you verify the scanners local 10MHz oscilator? (check local 70cm repeater channels and see if they are on frequency). Several carrier frequencies are commonly used in commercially-available RF modules, including those in the industrial, scientific and medical (ISM) radio bands such as 433.92 MHz, 315 MHz, 868 MHz, 915 MHz, and 2400 MHz. These frequencies are used because of national and international regulations governing the used of radio for communication. Try to key a 50W 70cm radio to 433.92 on a big parking lot when everyone trys to go home and see how many car owners you can lock out of their car (may not be legal but this is a HAM radio frequency and I know that some have tested this for "fun").

Johan-Fredrik

[onesixright]

@Johan-Fredrik,

I scanned the whole (432-436), but only @ 433.500 i hear something like a beep/click (when pressing). Nothing else shows up.

Im not sure what you mean by:

Can you verify the scanners local 10MHz oscilator?

what should i do? (sorry, i'm a complete noob with regard to radios!)

@apis
Thats a good thought as-well, i ordered a cheap version from e-Bay, always fun!

Thanks you all!

[BennVenn]

Have you opened the transmitter? Is there a SAW filter in there? or a crystal of some sort?

[onesixright]

I just opened the remote, see the attached a picture.

I seems there is a TI CC1050 chip in it.

Single Chip Ultra Low Power RF Transmitter for the 315/433/868/915 MHz SRD Band

http://www.ti.com/product/cc1050

Which can run on multiple frequencies.  Well together with the crystal (400 Mhz?) and my receiver test, we can conclude it should be operating on 433 MHz ?

What i want is to be able to copy all the commands (~ 30) and be able to send the command via something like a Arduino (or a Microchip). So recoding the command will be the next step. I hoped that once i have the frequency nailed down, i can buy a simple transceiver (for the correct freq.), hook it up with a Arduino and start listening to the commands. Or is that to simple? Any thoughts on that are more then welcome!

Thanks!

[AG6QR]

Looks like you've found the answer, but another trick that often works, at least for devices that are certified for use in the USA, is to search the device for an FCC ID, and google that id.  The FCC maintains a lot of information about approved devices, including what frequencies they transmit at, and often modulation protocols, and other nifty info.  It's so easy and cheap to get that info, it's always worth a check.

Assuming that strategy doesn't yield any information for you...

Since you've found that it's transmitting on 433, and you've been able to receive it, be aware that most devices in that band use simple on-off keying.  If you can receive anything at all, then hook the output of the receiver into an oscilloscope and see what you can see.  Or if you can take the device apart, you may find a logic level input to the radio transmitter, and if so, you can use a scope to figure out the timing of its on/off pulses.

[BennVenn]

It is likely the data transmitted is 'rolling code' which is plain instructions XOR'd with a Pseudo random number. Without the seed, key and the routine used it is unlikely you'll be able to do much with the data going out of the transmitter or into the receiver.

Do a search on the IC that generates the data stream?

Edit - There are 3 crystals on that board, a 32khz in the upper left, one next to the TI chip (which is what is used for RF generation) and the lower one (I dont think it'll be 400mhz...) for the ATMEL IC.

That big one next to the TI chip will be a division of the output freq, Does it divide into 433.92mhz evenly?

[onesixright]

@AG6QR
Good point the FCC, but for this device nothing like that. I do keep it in mind ! ;-)

Hookup the oscilloscope, yeah was thinking that too, but how I hook up to pin 24? A TSSOP-25 package, any tips on that? Another practical problem is that the buttons are facing down. Anyone using something lik ether POMONA Micro SMD hooks? I rather don't go solder wires (i know that i might endup like that :-)

@BennVenn
The big one is 14.7456 (so 14.7456:433.92 ~ 3.39) is that close enough? With regard to the rolling codes, i assume that if it would not use any, then i should see the same code flying by every time?

[BennVenn]

It needs to be an integer of the primary frequency (or a multiple of it if it is pre-divided) It'll all be in the datasheet though.

Rolling code will send out the same code as long as the key is pressed (depending on IC really) and only change on each new keypress. You'll spot it easy enough with a scope if it changes every press etc.

Automotive keys will send one code for the first second or so you hold the key down, then change to another. So you might see that too.

Edit: What is the standard freq in your country? AU is 433mhz, most of the EU is three hundred and something?

[Zero999]

Hi Hero999,

Thanks thats a great tip!

Yes a frequency counter would do the job. It needs to have a 50 Ohm input and be able to work up to a high enough frequency.

Stick a short piece of wire into the frequency counter's co-axial input socket and activate the transmitter nearby. You should get a decent reading.

Now when i startup my remote and i keep it close to the wire, it reads 49.000.000 Hz ~ 50 Mhz. I guess thats the Crystal of the MCU?, since i didn't press any buttons. When i press a button, i see no change.

Is it possible that my FC doesn't have enough bandwidth? Im using a Rigol DG1062Z, according to the specs:

Frequency Range: 1?Hz to 200MHz

Assuming the RF remote is probably being round 433 Mhz, i guess its out of limit?  Any other though how to determine the transmit frequency?

Thanks again.

Yes, you were probably measuring the crystal oscillator or IF. It's probably a good idea to invest in a better frequency counter. Nowadays 2.5GHz frequency counters aren't expensive.

[bingo600]

+1 for looking up the FCC ID, if it's an RF device

/Bingo

[onesixright]

Just a little feedback.

I tried probing the output of the CC1050. I got some sine waves from the antenna output. I have no micro clips that i can grab the pins, i should probe the output pin of the MCU.

I ordered a USB CS1101 Transceiver, will take some time before it arrives,  and then I will have look if that sheds some light on it....

Thanks so far!