8
$\begingroup$

I'm trying to find out what kind of modulation and encoding is used by my window cover remote control, aiming to implement the same on a Raspberry Pi to add a bit of home automation.

A colleague helped me sample the signal with an USRP and gave me the data files. I have examined them with Inspectrum.

I'm afraid the samples have been recorded centered very close to the frequency of the signal. I've later read that this might not be a good idea, and I think this is what causes the permanent noise you can see in the pictures. Should I center the sampling a few kHz below in the future?

Single press of the "open window" signal

Signal overview

Symbol rate, or rather what I guessed was the symbol rate, seems consistent at this level (around 42 bauds).

This shows frequency energy. X axis is time, Y axis is frequency (baseband). Colors have been tuned to show only the interesting power.

Detail of one of the "blocks"

Signal detail Signal detail (Freq, Phase, IQ)

Here, the last picture shows, frop to bottom: frequency, IQ (red/blue), and phase. I don't quite know what the frequency chart represents here.

Zoom on the transition between sparse to dense

The "symbol rate" doesn't seem constant here.

Transition detail Transition detail (Freq, Phase, IQ)

I have no idea what kind of modulation, encoding, bit rate, or protocol this remote uses, and right now my only option would be to blindly try all the demod blocks in gnuradio.

It'd be extra helpful if the answer could include some guidance as to how to demodulate this signal in gnuradio in order to get bits out. I think I can take it from there.

The controller is for a Velux window cover, but I haven't found any information on the web. I ultimately need to find out what chip to buy for the Arduino/rPi.

enter image description here

I can tell the chip has some text inscribed, but I cannot read it, seems it's worn off, but I don't have a magnifier... :/

Raw data uploaded to: https://www.dropbox.com/s/rh2k7ho68dvoxhd/data_mando3.dat?dl=0 . Sample rate is 3MHz. Data format is GNU Radio Companion default, which is IQ, each component expressed as a 32 bit float.

Update

After some more investigation this seems to be io-homecontrol protocol. It seems it hasn't been reverse engineered, it's ciphered, and no information is available. It's a two way protocol so I'll need to grab samples from full conversations (the current samples are taken with only the remote available).

This chip in theory is able to work with this protocol: http://www.analog.com/media/en/technical-documentation/data-sheets/ADF7022_2page.pdf

The consortium will not provide specs. I'm still interested in sniffing a few conversations with GNURadio and see if I can work from them. Given this, I can only recommend against io-homecontrol and Velux products.

Thank you!

|improve this question
$\endgroup$
  • 1
    $\begingroup$ Can you describe more, what each curve shows? First figure looks like STFT. What are green, blue and red curves in the last figure? $\endgroup$ – Maximilian Matthé Mar 11 '17 at 14:41
  • 2
    $\begingroup$ Yes would be good if you could resample, so that an integer multiple of the sampling rate does not land in vicinity of your signal. Further if you are doing real sampling, you want the digital signal to land at a Digital IF frequency. An ideal choice is to have your sampled spectrum at $f_s/4$, therefore use the relationship $N f_s-f_c = f_s/4$ and $N f_s-f_c > 2 f_b$ where $f_c$ is your carrier frequency and $f_b$ is the bandwidth of the signal. I recommend going with a result such that f_c >> 2* f_b$. Once you do that you can digitally remove the carrier by observing the rotation. $\endgroup$ – Dan Boschen Mar 11 '17 at 15:10
  • 1
    $\begingroup$ Have you opened up the remote? Many of those companies will use commercial silicon, and there will be a part number on the chip, that can often easily lead to a data sheet. $\endgroup$ – Stephen Rauch Mar 11 '17 at 15:24
  • $\begingroup$ @MaximilianMatthé I updated the question, thanks! $\endgroup$ – jjmontes Mar 11 '17 at 15:28
  • 1
    $\begingroup$ @jjmontes I want to be sure you saw the link I added to the top of my response in the "update" section, repeated here: cansecwest.com/slides/2015/… . The presenter shows you step by step how to demodulate the io-homecontrol signal. $\endgroup$ – Dan Boschen Mar 13 '17 at 3:28
5
$\begingroup$

Ok I did some signal forensics on the data capture and believe the modulation is a form of FSK.

The FSK modulation was +/- 20 KHz with a data rate of 38 KHz.

UPDATE: The OP discovery that this is "io-homecontrol" and the datasheet from ADI that he found has confirmed that this is indeed FSK with a deviation of 20KHz and 38.4 Kbps data rate. Further this link gives more details on the modulation format:

https://cansecwest.com/slides/2015/From_Baseband_to_bitstream_Andy_Davis.pdf

It looks like it may actually be Gaussian-FSK, with full-response signalling (BT=1), meaning the response for each bit is completed before the next bit starts. This can be easily implemented with a Gaussian filter (see Gaussian FIR filter with no multipliers?) followed by an NCO. In this case each data bit is represented as impulses followed by zeros for the full length of the filter and the output of the filter drives the frequency control word into the NCO (a digital VCO). (For partial-response signalling which requires a more complicated receiver and not what they are doing here, the zeros are shorter than the length of the filter, but that would also work). Frequency deviation can be set with a multiplier gain constant between the filter output and NCO input. The choice to go with Gaussian FSK vs simple FSK is for better spectral containment in the transmitted waveform (and is the reason for the rounded transitions that we see).

I will include the plots in case anyone has further insight:

First a macro view in vicinity of the first burst, occurring around 0.93 seconds. To get this plot, I had removed a frequency offset corresponding to 0.2688 radians/sample after decimating by 10 samples, assuming the original sampling rate was 3 MHz, this corresponds to a 12.834KHz offset.

This plot shows the unwrapped phase vs time (vertical axis is radians) and the corresponding magnitude vs time. I assume when the magnitude is low that we are viewing the noise, and the signal of interest is occurring only when the magnitude is higher.

enter image description here

Zooming in on the first part of the burst, the pulse starts at approx 0.9265 seconds, and at the start of the burst, the phase is "flat" for approximately 3 ms. Corresponding to an unmodulated carrier, I believe, from comparing to the detail we see later.

enter image description here

enter image description here

After the 3 ms of the "flat phase" portion, there is a very long pattern of what appears to be 1 0 1 0 1 0 with a data rate of 37.5 KS/s. The modulation is going between 0 and 180 degrees, but later we will see clear phase ramps making me suspect FSK instead of BPSK. (If it was MSK I would have expected to see evidence of 90 degree rotations, but the minimum rotation I found was 180 degrees). Note at the very start of the pattern (assuming +180 =1 and -180 =0), we see 1 1 0 1 0 1 0 1... which then lasts with the 1 0 1 0 pattern for approx 90 ms before again inserting a "1 1" near the 1.02 second mark, and then continuing again as 0 1 0 1 0 1... until the 1.414 second mark. (approx 0.4 seconds duration with a 1 0 1 0 pattern). Note the "hump" in the overall trajectory; I believe that we are just seeing the wandering of the clock (either the radio or the sampling clock that took the data) given the long time durations involved.

enter image description here

enter image description here enter image description here enter image description here

At 1.414 seconds the real data starts. (The first was probably a sync/acquisition pattern). Looking first at a macro view we see a pattern that at this view appears to repeat 3 times before the burst ends.

enter image description here

Zooming in on the first region, we see consistent positive and negative phase sloped indicative of FSK. At the end of the data burst there is a long duration of 1's for 4 ms followed by the 101010 pattern again for about 14 ms.

enter image description here

enter image description here

The next burst starting around 1.51 seconds, shortly after the first one again has the same starting pattern of an unmodulated carrier followed by the 101010 long modulation pattern. (Although slightly different in that the start was 1 1 1 1 0 1 0 1 0 1 0 1 but the duration of the 1010 pattern before the data modulation was again 14 ms)

enter image description here

|improve this answer
$\endgroup$
  • $\begingroup$ Noob side question: during sync, there are like 5~7 prominent frequency bands in the waterfall chart. I still however have to center my (lowpass) filter in the central one (20kHz), is that right? I am surprised because this leaves part of the spectrum (which expands from ~+-35kHz) out of the filter, but seems to work nonetheless :? $\endgroup$ – jjmontes Mar 12 '17 at 14:58
  • $\begingroup$ You center at 12.834 KHz offset to demodulate, and then the frequency of that signal will be your data. A delay and multiply with itself can make a simple frequency discriminator. $\endgroup$ – Dan Boschen Mar 12 '17 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.