How to find a remote control frequency? - Page 1
Forum section: electronics / beginners

author: onesixright
author_rank: Frequent Contributor
timestamp: July 22, 2015, 07:36:52 am
content: Hi All,I have a RF remote-control and I like to figure out on what frequency it communicates.The question is: what is a "easy" (maybe not so easy...) way to figure out what frequency the remote is using? While pressing the buttons i should use a frequency counter?Thanks!

author: Zero999
author_rank: Super Contributor
timestamp: July 22, 2015, 07:54:11 am
content: Yes a frequency counter would do the job. It needs to have a 50 Ohm input and be able to work up to a high enough frequency.Stick a short piece of wire into the frequency counter's co-axial input socket and activate the transmitter nearby. You should get a decent reading.I've done a similar thing myself to test a home made RF oscillator.

author: onesixright
author_rank: Frequent Contributor
timestamp: July 22, 2015, 08:36:51 am
content: Hi Hero999,Thanks thats a great tip!QuoteNow when i startup my remote and i keep it close to the wire, it reads 49.000.000 Hz ~ 50 Mhz. I guess thats the Crystal of the MCU?, since i didn't press any buttons. When i press a button, i see no change.Is it possible that my FC doesn't have enough bandwidth? Im using a Rigol DG1062Z, according to the specs:Frequency Range:1?Hz to 200MHzAssuming the RF remote is probably being round 433 Mhz, i guess its out of limit? Any other though how to determine the transmit frequency?Thanks again.

author: apis
author_rank: Super Contributor
timestamp: July 22, 2015, 09:05:54 am
content: If you have a RTL-SDR dongle you might be able to see the signal, most cover 433mhz.

author: continuo
author_rank: Frequent Contributor
timestamp: July 22, 2015, 09:09:30 am
content: Quote from: onesixright on July 22, 2015, 07:36:52 amQuick search on the interwebz?

author: LA7SJA
author_rank: Regular Contributor
timestamp: July 22, 2015, 09:13:48 am
content: Best guess 433.92MHz, try with a 70cm receiver/tranceiver (even narrowband FM will work). Have you open it yet? The usual TX-modules are labeled 433 or 433.92. If you google "pictures 433.92 modul" you should find the one used in your unit.Johan-Fredrik

author: onesixright
author_rank: Frequent Contributor
timestamp: July 22, 2015, 09:35:21 am
content: QuoteAnother good tip, found it 433.512 Mhz.Thanks!

author: LA7SJA
author_rank: Regular Contributor
timestamp: July 22, 2015, 09:53:33 am
content: Just one more thing:How?Johan-Fredrik

author: onesixright
author_rank: Frequent Contributor
timestamp: July 22, 2015, 10:03:39 am
content: Aha, sorry.I had a old receiver laying around, so i tested the 433 spectrum and when pressing the buttons i heard the "beep"See the attachments

author: LA7SJA
author_rank: Regular Contributor
timestamp: July 22, 2015, 11:50:49 am
content: I think you found the modualtion sideband and not the carrier (sometimes the sideband gets most of the energy). Do you find any other signals up to 434.5Mhz? Can you verify the scanners local 10MHz oscilator? (check local 70cm repeater channels and see if they are on frequency). Several carrier frequencies are commonly used in commercially-available RF modules, including those in the industrial, scientific and medical (ISM) radio bands such as 433.92 MHz, 315 MHz, 868 MHz, 915 MHz, and 2400 MHz. These frequencies are used because of national and international regulations governing the used of radio for communication. Try to key a 50W 70cm radio to 433.92 on a big parking lot when everyone trys to go home and see how many car owners you can lock out of their car (may not be legal but this is a HAM radio frequency and I know that some have tested this for "fun").Johan-Fredrik

author: onesixright
author_rank: Frequent Contributor
timestamp: July 22, 2015, 07:25:16 pm
content: @Johan-Fredrik,I scanned the whole (432-436), but only @ 433.500 i hear something like a beep/click (when pressing). Nothing else shows up.Im not sure what you mean by:Quotewhat should i do? (sorry, i'm a complete noob with regard to radios!)@apisThats a good thought as-well, i ordered a cheap version from e-Bay, always fun!Thanks you all!

author: BennVenn
author_rank: Regular Contributor
timestamp: July 22, 2015, 09:49:55 pm
content: Have you opened the transmitter? Is there a SAW filter in there? or a crystal of some sort?

author: onesixright
author_rank: Frequent Contributor
timestamp: July 22, 2015, 10:13:55 pm
content: I just opened the remote, see the attached a picture.I seems there is a TI CC1050 chip in it.Quotehttp://www.ti.com/product/cc1050Which can run on multiple frequencies. Well together with the crystal (400 Mhz?) and my receiver test, we can conclude it should be operating on 433 MHz ?What i want is to be able to copy all the commands (~ 30) and be able to send the command via something like a Arduino (or a Microchip). So recoding the command will be the next step. I hoped that once i have the frequency nailed down, i can buy a simple transceiver (for the correct freq.), hook it up with a Arduino and start listening to the commands. Or is that to simple? Any thoughts on that are more then welcome!Thanks!

author: AG6QR
author_rank: Frequent Contributor
timestamp: July 22, 2015, 10:42:05 pm
content: Looks like you've found the answer, but another trick that often works, at least for devices that are certified for use in the USA, is to search the device for an FCC ID, and google that id. The FCC maintains a lot of information about approved devices, including what frequencies they transmit at, and often modulation protocols, and other nifty info. It's so easy and cheap to get that info, it's always worth a check.Assuming that strategy doesn't yield any information for you...Since you've found that it's transmitting on 433, and you've been able to receive it, be aware that most devices in that band use simple on-off keying. If you can receive anything at all, then hook the output of the receiver into an oscilloscope and see what you can see. Or if you can take the device apart, you may find a logic level input to the radio transmitter, and if so, you can use a scope to figure out the timing of its on/off pulses.

author: BennVenn
author_rank: Regular Contributor
timestamp: July 22, 2015, 10:46:43 pm
content: It is likely the data transmitted is 'rolling code' which is plain instructions XOR'd with a Pseudo random number. Without the seed, key and the routine used it is unlikely you'll be able to do much with the data going out of the transmitter or into the receiver.Do a search on the IC that generates the data stream?Edit - There are 3 crystals on that board, a 32khz in the upper left, one next to the TI chip (which is what is used for RF generation) and the lower one (I dont think it'll be 400mhz...) for the ATMEL IC.That big one next to the TI chip will be a division of the output freq, Does it divide into 433.92mhz evenly?

author: onesixright
author_rank: Frequent Contributor
timestamp: July 22, 2015, 11:19:31 pm
content: @AG6QRGood point the FCC, but for this device nothing like that. I do keep it in mind ! ;-)Hookup the oscilloscope, yeah was thinking that too, but how I hook up to pin 24? A TSSOP-25 package, any tips on that? Another practical problem is that the buttons are facing down. Anyone using something lik ether POMONA Micro SMD hooks? I rather don't go solder wires (i know that i might endup like that :-)@BennVennThe big one is 14.7456 (so 14.7456:433.92 ~ 3.39) is that close enough? With regard to the rolling codes, i assume that if it would not use any, then i should see the same code flying by every time?

author: BennVenn
author_rank: Regular Contributor
timestamp: July 22, 2015, 11:37:47 pm
content: It needs to be an integer of the primary frequency (or a multiple of it if it is pre-divided) It'll all be in the datasheet though.Rolling code will send out the same code as long as the key is pressed (depending on IC really) and only change on each new keypress. You'll spot it easy enough with a scope if it changes every press etc.Automotive keys will send one code for the first second or so you hold the key down, then change to another. So you might see that too.Edit: What is the standard freq in your country? AU is 433mhz, most of the EU is three hundred and something?

author: Zero999
author_rank: Super Contributor
timestamp: July 23, 2015, 08:56:02 am
content: Quote from: onesixright on July 22, 2015, 08:36:51 amYes, you were probably measuring the crystal oscillator or IF. It's probably a good idea to invest in a better frequency counter. Nowadays 2.5GHz frequency counters aren't expensive.

author: bingo600
author_rank: Super Contributor
timestamp: July 23, 2015, 01:00:38 pm
content: +1 for looking up the FCC ID, if it's an RF device/Bingo

author: onesixright
author_rank: Frequent Contributor
timestamp: July 24, 2015, 10:31:54 am
content: Just a little feedback.I tried probing the output of the CC1050. I got some sine waves from the antenna output. I have no micro clips that i can grab the pins, i should probe the output pin of the MCU.I ordered a USB CS1101 Transceiver, will take some time before it arrives, and then I will have look if that sheds some light on it....Thanks so far!