# Mystery signal - FSK, BPSK?

I have a mystery audio signal that I need to decode, it's from a discontinued product. Inspecting the object code shows a module called decodeFSK so that suggests it is a form of FSK. I've tweaked it in MATLAB ad-nauseum but think I must be missing something.

The only documentation I can find says:

"[Binary data is PCM encoded PPG sensor waveform. 68bits of binary data are sent in 12msec bursts at 25Hz.] Current modulation scheme used is Manchester encoder/decoder. Modulated signal is a square signal with frequency range from 4kHz to 8kHz."

Not sure if the 4-8kHz part is correct, as I don't see much there?

Inspecting the signal spectrum shows frequency peaks at 12.4kHz, 6.2kHz, and 200Hz.

Here's a closeup of the peak at the 12.4kHz carrier. Is this perhaps BPSK instead of FSK?

here is the waveform and my attempts to decode it so far: waveform sample | matlab file

Any help much appreciated!

• Looking at the pulses in the time domain, you can clearly see two frequencies, and they are at very different amplitude levels. I'm betting 6.2 kHz is the mark bin, and 12.4 kHz is the space bin. I work on it some more. Mar 8, 2018 at 23:07
• Hmm, nope. Using narrowband PLL's to track the 6.2 kHz bin and the 12.4 kHz bin shows that they are tracking each other, and are not separate symbol frequencies. Mar 8, 2018 at 23:51
• The 12.4 kHz sidelobes are asymmetrical, seems like there could be enough signal there for some kind of *PSK. Maybe the 6.2k is related to baud rate of the burst? Mar 9, 2018 at 0:24
• The instantaneous frequency, $\dfrac{d\phi}{dt}$, during a burst stays at approximately 12.4 kHz, and during the bursts, the In-phase component sometimes almost vanishes, this could be some sort of PSK or just a modulated OOK (i.e. AM with carrier). Mar 9, 2018 at 0:56

After playing around in GNURadio, this waveform looks like 2 level ASK bursts (OOK bursts plus some residual carrier).

The carrier appears to be at 12.4 kHz.

At the 44.1 ksps sample rate, there appears to be about 7.6 samples/symbol or a symbol period of about 173.5 microseconds (assuming the symbols are not Manchester encoded).

See the top plot in the following image showing two filtered, rectified, and pulse filtered bursts.

Update to respond to comment

What I mean by 2-ASK with residual carrier is that, during a transmission, the original signal is probably something like:

$$(0.1 + 0.5q(t))\cos(2\pi 12400t)$$

where $q(t)$ is the train of unipolar message bit pulses. With a square pulse matched filter in the receiver, one is going to get ISI, which you can see in the short (suspected) preamble of the bursts.

By the way, I have not checked the phase to see if the bursts are the real part of QPSK with a non-standard rotation (which would result in 4-QAM with constellation points only on the real axis), but that seems unlikely for a low parts count biometric headphone device.

The signal you provided was already low pass filtered with a corner at about 15-16kHz, indicating something was going to decimate this to a 32 ksps signal.

What I did in GNURadio is in the following flowgraph image:

I used the "Hilbert" block with a 201 tap Hilbert FIR filter to make the real signal analytic. 201 taps is obviously overkill, looking at the negative frequency side of the spectrum.

I then used a Blackman-Harris windowed high pass filter, with real taps, with a corner at 4 KHz, a transition width of 1 kHz, and an objective stop band attenuation of 20 dB. This was to get rid of the mess near DC. Some of the mess at DC was tracking with the signal, but some of it seemed unrelated.

I then took the envelope with the "Complex to Mag" block.

I then used a rectangular pulse matched filter with taps of $[1, 1, 1, 1, 1, 1, 1, 1]/8$ . This introduces receiver side ISI, but reduces the noise.

I don't know how you captured this signal, but it would be better if you can do something on the analog side to improve the signal level or SNR, and also preserve the component that was likely at 18.6 kHz, since you're using a sample rate of 44.1 ksps.

• thanks for your investigations Andy! What are the filters you used? The very first thing I tried months ago was differentiate -> rectify -> lowpass. Some of the symbols seem to be not high or low but somewhere in the middle, which seems ambiguous. Or is that what you mean by 2 level ASK? Mar 9, 2018 at 6:44
• I captured the signal directly from my iPhone microphone ADC input... figured the 15kHz lowpass is on the transmitter side of things. Mar 9, 2018 at 16:57
• here's what I have so far... it looks pretty solid: evernote.com/shard/s262/sh/96e90924-3e65-4611-817a-50b4d7b80b4a/… resample 32kHz -> hilbert transform -> highpass at 4kHz -> complex magnitude -> lowpass at 4kHz (envelope smoother) -> comparator at 0.23 threshold. Now I just need to sample the bits at the proper rate and turn it into a PCM waveform. Mar 9, 2018 at 23:07
• Yup. After looking at the autocorrelation, i think the symbol duration might be closer to 185 microseconds, so about 5400 symbols/second. It's hard to tell though. Mar 10, 2018 at 0:44
• For sampling symbol centers, I'll refer you to a recent presentation of mine: gnuradio.org/wp-content/uploads/2017/12/… and youtu.be/uMEfx_l5Oxk Mar 10, 2018 at 0:59

I'm getting exactly the same information you are. Would it be possible for you to acquire more symbols? It might be possible that not all frequencies are present in the time sample you captured. Correlating the signal with itself I see plenty of similarity. Each burst lasts about 900 samples at 44100 is about 20 ms.