3

I was scanning the airwaves using my RTL-SDR and found a signal being broadcast locally that I was able to receive. When I configure the SDR Console V3 software to NFM, I get the following audio. (Wav file)

Waterfall

So I started investigating and here are my findings:

What I know:

According to my local FCC equivalent the license documents list it as coming from an electrical switch yard.

There is are two different frequencies for Tx and Rx.

The signal runs continuously.

What I assume:

That this is a 2-fsk/BFSK signal, due to the two tones it uses.

That it is broadcast in NFM. That mode does sound the best however, and lines up with licensing documents.

That it is actually data, not just some tone control system or random noise.

What I have done

In SDR Console V3 I created an IQ recording. (Large File)

I then created a flow graph in GNURadio to record a file using a sink file. (Large File)

I created a GNURadio flow graph using that file as an input to low pass filters and a FM Demod.

The Demodulated file was then opened in Inspectrum which produced the following image.

Inspectrum

What I think I need to do next

I think I need to recover the clock of the signal somehow. I have had a look for a preamble but can't see anything that might match.

I thought it might be Manchester encoded but I can see long runs of 0's or 1's so I don't think it is.

I thought it might be clocked to the frequency of the local power supply given that it is in a switch yard, but it doesn't line up completely with rise or falls of the signal.

Am I on the right path with this?

Is there a way to determine the start of the message? The receiving radio has to be able to lock on to the start of the message somehow, right?

I did find a program in Linux called minimodem. I used the following command to get a somewhat readable output.

minimodem -r -i -5 -M 1615 -S 1680 12 -f file_mono1.wav It gave me the following output:

TTTGB?/2991"05"/"ZWLOQB?/29.1?)5"/"WWLOPZBOWWOMQBLTZXZLWZTGB?/OOMBLTZXZQWLOBB?/29.1?)5"/"YWLOHB?/29.1")6"LZ_OYB?/29.1")5"/""5"5^""?9/29.1?)5"/"B59&??/29.1?)5)6"WBTOGB?/29.1?)5"/"TGLOQB?/2991")5"/"LGLOPB?/29.1?)5"/"WGLOGB?/29.1?)5"/"BLTOZBBOXWOMQBLTZXZHGLOXB?/29.1?)5"/"TLTTHB?/29.1?)5"/"ZLTTOB?/;59.?)

But since I know nothing about the signal it may not be ASCII, it could be anything. It may not be 5 bit, it could be 8 bit for all I know. Can anyone shed any light on where to go next in investigating this?

4
  • You could try UniversalRadioHacker, see github.com/jopohl/urh
    – josh
    Oct 8, 2018 at 9:33
  • Have you looked in the Signal Identification Guide?
    – not2qubit
    Oct 13, 2018 at 23:49
  • Any updates on your mystery?
    – not2qubit
    Oct 31, 2018 at 15:30
  • Nope, no luck at all. I tried recording a sample and running on a loop through minimodem. I was getting different data each time so there is something wrong there. I'm not sure where else to ask, if anyone can recommend other forums to post this question it would be helpful.
    – Macca
    Nov 2, 2018 at 9:45

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.