I was scanning the airwaves using my RTL-SDR and found a signal being broadcast locally that I was able to receive. When I configure the SDR Console V3 software to NFM, I get the following audio. (Wav file)
So I started investigating and here are my findings:
What I know:
According to my local FCC equivalent the license documents list it as coming from an electrical switch yard.
There is are two different frequencies for Tx and Rx.
The signal runs continuously.
What I assume:
That this is a 2-fsk/BFSK signal, due to the two tones it uses.
That it is broadcast in NFM. That mode does sound the best however, and lines up with licensing documents.
That it is actually data, not just some tone control system or random noise.
What I have done
In SDR Console V3 I created an IQ recording. (Large File)
I then created a flow graph in GNURadio to record a file using a sink file. (Large File)
I created a GNURadio flow graph using that file as an input to low pass filters and a FM Demod.
The Demodulated file was then opened in Inspectrum which produced the following image.
What I think I need to do next
I think I need to recover the clock of the signal somehow. I have had a look for a preamble but can't see anything that might match.
I thought it might be Manchester encoded but I can see long runs of 0's or 1's so I don't think it is.
I thought it might be clocked to the frequency of the local power supply given that it is in a switch yard, but it doesn't line up completely with rise or falls of the signal.
Am I on the right path with this?
Is there a way to determine the start of the message? The receiving radio has to be able to lock on to the start of the message somehow, right?
I did find a program in Linux called minimodem. I used the following command to get a somewhat readable output.
minimodem -r -i -5 -M 1615 -S 1680 12 -f file_mono1.wav It gave me the following output:
TTTGB?/2991"05"/"ZWLOQB?/29.1?)5"/"WWLOPZBOWWOMQBLTZXZLWZTGB?/OOMBLTZXZQWLOBB?/29.1?)5"/"YWLOHB?/29.1")6"LZ_OYB?/29.1")5"/""5"5^""?9/29.1?)5"/"B59&??/29.1?)5)6"WBTOGB?/29.1?)5"/"TGLOQB?/2991")5"/"LGLOPB?/29.1?)5"/"WGLOGB?/29.1?)5"/"BLTOZBBOXWOMQBLTZXZHGLOXB?/29.1?)5"/"TLTTHB?/29.1?)5"/"ZLTTOB?/;59.?)
But since I know nothing about the signal it may not be ASCII, it could be anything. It may not be 5 bit, it could be 8 bit for all I know. Can anyone shed any light on where to go next in investigating this?
