I was scanning the airwaves using my RTL-SDR and found a signal being broadcast locally that I was able to receive. When I configure the SDR Console V3 software to NFM, I get the following audio. (Wav file)


So I started investigating and here are my findings:

What I know:

According to my local FCC equivalent the license documents list it as coming from an electrical switch yard.

There is are two different frequencies for Tx and Rx.

The signal runs continuously.

What I assume:

That this is a 2-fsk/BFSK signal, due to the two tones it uses.

That it is broadcast in NFM. That mode does sound the best however, and lines up with licensing documents.

That it is actually data, not just some tone control system or random noise.

What I have done

In SDR Console V3 I created an IQ recording. (Large File)

I then created a flow graph in GNURadio to record a file using a sink file. (Large File)

I created a GNURadio flow graph using that file as an input to low pass filters and a FM Demod.

The Demodulated file was then opened in Inspectrum which produced the following image.


What I think I need to do next

I think I need to recover the clock of the signal somehow. I have had a look for a preamble but can't see anything that might match.

I thought it might be Manchester encoded but I can see long runs of 0's or 1's so I don't think it is.

I thought it might be clocked to the frequency of the local power supply given that it is in a switch yard, but it doesn't line up completely with rise or falls of the signal.

Am I on the right path with this?

Is there a way to determine the start of the message? The receiving radio has to be able to lock on to the start of the message somehow, right?


1 Answer 1


Does this get you anywhere? Apologies for my lacking coding vocabulary, feel free to edit.

enter image description here
Figure 1. Adobe Audition spectrogram of the lowest band of 06-Sep-2018 18h48m47s - 460.519.5 MHz, NFM.wav using Kaiser (180dB) window, 2048 bands, 100 % window width, 80 dB range. A manually adjusted grid is superimposed over the spectrogram.

It's repeating a 16-bit pattern ???? ???? ?111 1110 (spaces added for readability). That would be 9 data bits, and a synchronization sequence of 6 up bits and 1 down bit. The data bits should not contain the string 1111110 or else synchronization may fail. You can synchronize the bit clock to the first up→down transition after a long enough run of the up frequency.

  • $\begingroup$ Hello, this helped a lot in figuring out the signal. I ended up using the AX25 decoder from luaradio to get the bit stream. Turns out there are two repeating patterns in the signal. There is: 11111110 ???????? and 01111110 ???????? The next challenge is to figure out what the 8 bits following the repeating patterns are, how they're encoded and what endian they are. Example capture of the data should anyone be interested. 1111111011001000011111100110101011111110010110000111111011010100111111101100100001111110 $\endgroup$
    – Macca
    Commented May 22, 2019 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.