Detecting very low power motion sensors - Page 1
Forum section: electronics / rf-microwave

author: glradio
author_rank: Contributor
timestamp: April 20, 2024, 10:57:31 am
content: I have a TinySA Ultra with firmware updated to version 1.4-156 with which I can detect the transmission frequency of all devices at my disposal (remote controls, wifi routers, alarm sensors etc.)The company that has deployed the alarm in an house under construction in 2011, has hidden several radio motion sensors inside the walls, simply by sliding the devices inside the brick cavities that were then plastered !Some sensors activate the alarm at a distance of 1.5 meters, others even as close as 60 cm, so as to detect the passage of people accurately and only at certain strategic points such as hallways, stairs and other transit points, even outside the house.The problem I’m experiencing is that I cannot detect the transmissions frequency of these sensor. I’m using the TinySA Ultra stock antenna with these settings: frequency span 100 MHz, Hold+Max Hold, RBW 300 KHz, LNA=ON (LNA OFF above 6 GHz).As I get closer to where the sensor is located, I would expect to see a stationary signal which must decrease in intensity as I move away, but I can't see nothing !Since I don't know anything about the type of sensor and its transmission frequency, I focused my attention on frequencies typically used by these devices: 2.4 - 3 - 5.8 - 10.5 GHz, then also the entire spectrum supported by TinySA Ultra up to 20 GHz.What is the best strategy to detect the signal ?Which antenna should I use for the purpose ?

author: Psi
author_rank: Super Contributor
timestamp: April 20, 2024, 11:42:40 am
content: Are you reviewing raw data dumps from the TinySA or trying to find it on the screen?It's probably an extremely short pulse or burst every few seconds to save power.So you'll never see it on the screen except maybe with some sort of peak hold mode.

author: EE-digger
author_rank: Frequent Contributor
timestamp: April 20, 2024, 01:08:34 pm
content: Assuming that for battery life, 2011, yikes, I think you may want a RTSA with spectrogram or waterfall display.But in addition to this, you may want an H field sensor that's well shielded, in order to block most of the ambient, or else you will be swamped by all the things you mentioned ... that neighbors own.Why would they be tucked in walls permanently? Were they for the benefit of the builder, say, for security during construction?

author: Bud
author_rank: Super Contributor
timestamp: April 20, 2024, 01:49:03 pm
content: What is on the recieving side? You may get some clues checking the reciever construction, antenna and board.Edit: assuming the sensors are wireless.

author: coppercone2
author_rank: Super Contributor
timestamp: April 20, 2024, 01:59:37 pm
content: maybe you should use a metal detector if its on brick it might show up because their metal specific now. might have a weird reading not similar to rest of wall. find at least 1.i would be pissed if the construction company left batteries in the walls WTF. sounds like you can find 1, go to a lawyer and have them find the rest, instead of wasting your timeI think it would make anyone anxious that some foreman is getting information about your buildings occupancy after they are gone. I would also get it checked out for microphonesits lithium primary cell, they have steel bodies because itsreallyflammable (elemental lithium)these devices chirp also, very similar to a bird. you need to narrow down on the frequency and scan it high to catch it. try catching your cell phone, it also seems to do this. you get bursts when you access info (i.e. view a page).and are you sure this is real? it kind of sounds like a prank. construction companies are cheap as fuck

author: Infraviolet
author_rank: Super Contributor
timestamp: April 20, 2024, 04:00:01 pm
content: "lithium primary cell, they have steel bodies because its really flammable"Probably shouldn't be a concern here in practice? If it was Li Ion batteries embedded in your walls there'd be reason to be scared, but Li primary cells (coin cells effectively) don't ever self-ignite as far as I've been aware, however old and degraded they become? And if something else nearby was burning, then the cell heating up and combusting in response wouldn't add much more damage to the flames already raging around it?

author: coppercone2
author_rank: Super Contributor
timestamp: April 20, 2024, 04:16:24 pm
content: ehhhh i dunno you know those sheet rock products and compound emit sulfur and corrosive stuff often because its hardly super well regulated. cement also secretes crystals etc. Plus water leaks and also cracks.I noticed my putty knife always likes to rust up and looks like it taken a beating from putty. Always wash and dry thoseIf you take a lithium primary cell apart, you will notice its not like fort knox. its a bit dangerous and easy to hurt yourself, but you are trusting plated thin cans and plastic seals made by peoplecrazyabout BOM cost. They are impressively flammable. Smash one of those cells and throw it out in the rain and its similar to a jumping jack firework of moderate size (don't do this). They also can spew flammable chunks like a road flare kindaits also assembled with high speed automated presses at minimum cost. They supposedly are supposed to have strong QC (its what you pay for, not the battery, trust me).. but at those volumes it can't hurt being cautious about LiPrimary cells. Battery companies have impressive QC departments, required to maintain a ultra low materials and assembly cost mega volume product. And its a super cut throat market, the people that have certified batteries can't really raise prices too much to say increase quality... try convincing people to buy them, you will go out of buisness in a hearrt beatone theoretical scenario I see is someone hanging carpets on brick wall (eastern europe, germany) for insulation and sound proofing. a severely corroded battery inside of a crack in the wall behind the carpet ignites and shoots fire through the crack, igniting the carpet. Normally bad idea to have flamable things on the wall but people might think "well its a god damn empty hallway with a brick wall" and do it anyway.With anything electrical, chances are a electrician or handyman is going to look at it for some reason, and keep it safe. but a hidden battery?

author: CaptDon
author_rank: Super Contributor
timestamp: April 20, 2024, 04:44:02 pm
content: You need to look at the obvious. They wouldn't be battery operated since they can't be accessed. They must be hard wired for power and probably are not R.F. linked to the alarm central control but also hard wired. As for the R.F. signal used to detect motion they are more than likely 10.525GHz. What idiot would plaster these into a wall? With the exception of some skunk works government building I think this is totally bogus. 99.9% of the motion sensor home quality detectors look like a 'wired in' smoke detector located on the ceiling, not in a wall. Some of the integrated alarm systems in fact have all of the following in one head, Smoke detector, Heat rise detector, Motion sensor, Infra Red badge reader (tells what badge is near what sensor). We had X-Band detectors in one of the buildings where I worked and the blasted things would trigger from cars in the parking lot and that was on the other side of a cinder block wall 30 feet from the motion sensor!! I didn't believe they were X-Band gunnplexors until the installer opened one up and showed me!! They were continuous wave when turned on and used doppler shift to detect motion. They were on 10.525GHz identical to police X-Band speed guns.

author: coppercone2
author_rank: Super Contributor
timestamp: April 20, 2024, 04:56:11 pm
content: actually he is right I forgot that it needs to power the radar, batteries would not last a long time for thathttps://www.parallax.com/product/x-band-motion-detector/Power supply requirements: regulated 5 VDC, 8 mAx band is what old super market doors used to use (x-mart)any active radar is going to use alot of power. a passive sensor can last alot longer, but it would need a window for the detector.I was thinking of IR sensor. A radar will have to repeatedly make a signal, either CW or pulses. but for it to detect motion, i.e someone walking through a hallway fast, it needs to pulse alot. it should be easy to find if that device is around if you know the frequency.Also I think it would need power to get through plaster, thats hydride. I don't think its super transparent to RF. Meaning signal lossso if this is true, its either real fancy, or has a power wire, or its just a hoax (most likely)

author: glradio
author_rank: Contributor
timestamp: April 20, 2024, 05:57:52 pm
content: Quote from: Psi on April 20, 2024, 11:42:40 amI'm simply trying to visualize the signal on the screen.I had never heard of the TinySA Ultra's raw data dumps and can't find anything about them: how can collect and consult this kind of data ?Quote from: Psi on April 20, 2024, 11:42:40 amI have in fact enabled a second on-screen trace with the "Max Old" function enabled, enabled the built-in waterfall feature but most importantly I have disabled the "Spur Removal" function of the TinySA Ultra.Quote from: EE-digger on April 20, 2024, 01:08:34 pmAre you saying that the TinySA Ultra has some kind of limitations and that I should move toward a high-end spectrum analyzer to see the sensor signal ?The sensors are mains powered, so there is no problem with battery life.They were hidden in this way both for aesthetics and safety.Quote from: Bud on April 20, 2024, 01:49:03 pmI cannot inspect a receiving side, because microwave motion sensors, integrate both the transmitting and receiving sides, just like a radar ...

author: floobydust
author_rank: Super Contributor
timestamp: April 20, 2024, 06:04:54 pm
content: What does plaster, concrete, mortar, brick do to microwave signals?Are you sure about your suspicions, they seem a bit stretched. Then you need to use low band RF to get the message out. Like 433MHz ISM band. Not microwave.Also you need to configure/pair the sensors to the alarm panel and how is that done when they are encased?There are wireless alarm sensors with rated 10-year battery life but it's a fairly large lithium battery sub AA.

author: glradio
author_rank: Contributor
timestamp: April 20, 2024, 06:10:36 pm
content: Quote from: coppercone2 on April 20, 2024, 01:59:37 pmYes it's real and it was done for absolutely lawful purposes, the only requirement was to hide the sensors.As mentioned above, the sensors are mains powered, but it is not a problem to know where they are located because homeowner knows exactly their location. I have also verified that approaching the points where the sensors are located triggers the alarm.

author: floobydust
author_rank: Super Contributor
timestamp: April 20, 2024, 06:35:01 pm
content: There are two RF frequencies - the motion detect microwave Doppler and the baseband RF message TX.Which one do you want to search for?

author: coppercone2
author_rank: Super Contributor
timestamp: April 20, 2024, 06:39:05 pm
content: oh, you are just studying it. I thought maybe you bought some rigged up property you have a problem with.If its close I don't think you need much of an antenna. Anything broad band (spiral maybe?). Tape it to the wall in front of the sensor and sweep through the SAantenna is great for low power signal. radar is fairly high power, especially up close. Like near field close, I think.a radar needs to transmit alot to get a minute signal backSpiral antenna work for a very wide range, multiple octavesstart with an attenuator, its easy to fry probobly

author: Psi
author_rank: Super Contributor
timestamp: April 20, 2024, 09:30:02 pm
content: Quote from: glradio on April 20, 2024, 05:57:52 pmMy fault, I assumed it was an SDR underneath and you could connect to it and download the raw data.

author: CaptDon
author_rank: Super Contributor
timestamp: April 21, 2024, 01:36:44 am
content: Are you sure they use R.F. to talk to the alarm control center? If they chirp an R.F. data stream you will play hell trying to catch it with a TinySA or any other sweeping analyzer. You will first need a very good guess at what frequency to zero in on. Sweeping across a bandwidth of perhaps 50MHz with an I.F. bandwidth of 5MHz may help you zero in. Does the alarm control center actually have an R.F. receiver? Any guess at what frequency it looks like it is designed to receive? Why is this of interest anyway?

author: floobydust
author_rank: Super Contributor
timestamp: April 21, 2024, 03:47:32 am
content: Alarm panels power all wired sensors with battery-backed up 12V power. Why then run mains wiring to these motion sensors? The PSU will make them big.The men in black prefer tachyon power, to know what room you are in.

author: coppercone2
author_rank: Super Contributor
timestamp: April 21, 2024, 05:48:11 am
content: I assume he means mains powering 12v powering box powering sensors

author: A.Z.
author_rank: Super Contributor
timestamp: April 21, 2024, 07:37:23 am
content: hmm... maybe the sensors have rechargeable batteries to keep working on power outages, and then, they may transmit using their power lines instead of sending RF signals, that way going through walls won't be an issue

author: Miek
author_rank: Regular Contributor
timestamp: April 21, 2024, 11:13:44 am
content: I did some searching and couldn't find any information about commercial alarm sensors designed to be hidden in a wall. I did find this though:https://www.forensicfocus.com/forums/off-topic/audio-bug-microwave-motion-sensor-hidden-inside-wall/which sounds awfully familiar. (aside from some key details changed to suit the audience here?)

author: glradio
author_rank: Contributor
timestamp: April 21, 2024, 05:22:31 pm
content: Quote from: floobydust on April 20, 2024, 06:35:01 pmI'm interested in the frequency of the motion sensor, because I assume that it is always transmitting and thus easier to detect than the radio signal that some sensors transmit to the control panel only if motion is detected to trigger the alarm.Quote from: CaptDon on April 21, 2024, 01:36:44 amI'm not sure because I could not investigate further, but as I said above, I'm interested in the continuous signal transmitted by the motion detector, not the alarm signal itself ...

author: glradio
author_rank: Contributor
timestamp: April 21, 2024, 05:36:45 pm
content: Quote from: floobydust on April 21, 2024, 03:47:32 amQuote from: coppercone2 on April 21, 2024, 05:48:11 amI did not specify the voltage, I just meant that they are cable-powered and not battery-powered. Most likely they are powered by low voltage from the alarm panel itself.

author: A.Z.
author_rank: Super Contributor
timestamp: April 21, 2024, 06:46:27 pm
content: if so they may just use the power line to send signals to the controller, so no RF signalling you can detect

author: CaptDon
author_rank: Super Contributor
timestamp: April 22, 2024, 02:23:10 am
content: As stated prior, look around at 10.525GHz X-Band and if not then it may be Ku band at 24GHz. X-band can penetrate cinderblocks and detect the motion of cars in the parking lot through a cinderblock wall 30 feet away as stated in my earlier post. That is possible with 10 to 50 milliwatts from a gunnplexor unit exactly like those in police radar. Incidently, 31.25Hz is equal to 1 M.P.H. at 10.525GHz.

author: ejeffrey
author_rank: Super Contributor
timestamp: April 22, 2024, 02:36:21 pm
content: Yeah my guess would be above the frequency the tinySA can see. Typical frequencies for proximity radar are 10.525 GHz, 24 GHz and 77 GHz. 10 GHz is possible with a slightly higher end SDR like the SignalHound. For the higher frequencies you are going to have to work harder or pay a lot more or both.Another possibility would be ultrasonic, like automotive parking sensors. If you aren't completely sure it's radar based I would look for ultrasonics.

author: glradio
author_rank: Contributor
timestamp: April 23, 2024, 11:18:59 am
content: Quote from: Miek on April 21, 2024, 11:13:44 amThere are probably no microwave motion sensors designed to be hidden in a wall, but there is nothing to prevent putting them there , since radio waves have the ability to pass through walls.In fact, several microwave detectors need to be calibrated to avoid generating false alarms: if the sensor power is too high, detection may occur in the room adjacent to the one in which the sensor is placed ...Quote from: A.Z. on April 21, 2024, 06:46:27 pmMicrowave motion sensors always emit a radio source, then the alarm can be triggered either by cable or by radio signal to the central ...

author: LaserSteve
author_rank: Super Contributor
timestamp: April 23, 2024, 11:54:57 pm
content: One of the problems with passive cavities is you may need a swept frequency source and a return loss bridge on a horn antenna to find them. Unless carefully compensated, the resonant frequency of an open ended cavity drifts considerably in use. near Field Body presence will have some semi-serious effects as well. A SA with a low sweep rate is not a great choice here for finding these, even with a tracking generator output.The real way used to find them is a TSCM trick using some specialized gear and a narrow modulation or harmonic mixing technique. A TSCM specialist would not bat an eyelash over buying a 40,000$ or 100,000$ Spec An with IF and Tracking Generator Ports. Don't ask me in a PM, the answer is NO.You have a web link for the widget in question? This sounds wayyyy too much like a "Great Seal" device, unless it is some tiny self mixing PCB. Ebay/Amazon searches would reveal many short range motion detectors and their rough frequency, which will drift because the self mixing method is somewhat independent due to direct conversion IFs. Method used for the in wall device will be highly dependent on installers budget and the customer's whims / skillset.Steve

author: LaserSteve
author_rank: Super Contributor
timestamp: April 24, 2024, 12:17:15 am
content: At point blank ranges you would use broadband horn antenna sets or for hobby use, a set of Log Periodic antennas by a fellow named WA5VJB :https://www.wa5vjb.com/products1.htmlWaveguide beyond cutoff issues and Horn bandwidths are outside the scope of my post.This can be a very tricky problem, especially if FMCW or other modulations are used.You may need to search up to the millimeter wave bands, and that gets tricky.Steve

author: glradio
author_rank: Contributor
timestamp: April 24, 2024, 04:43:04 pm
content: Quote from: CaptDon on April 22, 2024, 02:23:10 amQuote from: ejeffrey on April 22, 2024, 02:36:21 pmTinySA Ultra can detect motion sensor frequencies around 10 GHz, in these examples (see link1,2,,4), however, the sensor is in direct contact with the spectrum analyzer.In my case there is no direct contact, but by setting the exact frequencies at which these sensors operate I expect to see some signal ...Quote from: ejeffrey on April 22, 2024, 02:36:21 pmCould ultrasonic sensors work reliably through a wall ?Is it possible to somehow detect the emissions of ultrasonic sensors placed behind a wall ?

author: glradio
author_rank: Contributor
timestamp: April 24, 2024, 05:39:33 pm
content: Quote from: LaserSteve on April 23, 2024, 11:54:57 pmUnfortunately not, otherwise everything would have been simple ...

author: LaserSteve
author_rank: Super Contributor
timestamp: April 24, 2024, 05:46:30 pm
content: That picture has a plastic cased SA point blank into an unmatched waveguide. A bare 1n914 diode would detect a signal at that point. In that picture the SAs front end is massively overdriven, so it sees the harmonics in the mixer. . The SA would not see the far weaker signal of a tiny transmitter which would be close to or below its noise floor.Sorry, You need a better instrument or a professional.Steve

author: ejeffrey
author_rank: Super Contributor
timestamp: April 25, 2024, 01:23:29 am
content: Quote from: glradio on April 22, 2024, 02:23:10 amI thought it only went to 6 but I now see there is a higher frequency version. My understanding is that it has much worse sensitivity above 6 GHz so I would count on it working.QuoteDepends on the wall and the sensor. Going from wall to air, reflecting, back to the wall and to the sensor is probably a tall order? It's also possible to hide things by e.g. drilling a hole in the wall, mounting sensors in the hole, skim coating it and painting over.A microphone with an audio signal analyzer would work as long as the microphone works up to the frequency in use. I think the things used in parking sensors are like 40 kHz?

author: glradio
author_rank: Contributor
timestamp: April 26, 2024, 09:43:10 am
content: Quote from: LaserSteve on April 24, 2024, 05:46:30 pmThat's what I think too: the power of these sensors is so low that the TinySA Ultra does not have the necessary sensitivity to see the emitted signal ...I was wondering whether an antenna made from a short "stub" of wire (like the one shown below) of the appropriate length to receive the emission frequencies of motion sensors, would change things appreciably or whether it would be better to try a higher-end device ...

author: Teledog
author_rank: Regular Contributor
timestamp: May 02, 2024, 04:07:44 am
content: Perhaps they're RCWL-0516 microwave motion sensors. Low power & can pass through drywall, etc.They run @ ~3.181-3.2 GHz.G'luck!

author: glradio
author_rank: Contributor
timestamp: May 12, 2024, 02:45:06 pm
content: Quote from: Teledog on May 02, 2024, 04:07:44 amI have that sensor and have done some bench tests.The TinySA Ultra has no problem detecting it even when placed behind a wall about 30 cm wide.