Reading Wireless Air Transmitter using Arduino

Please register or login

Welcome to ScubaBoard, the world's largest scuba diving community. Registration is not required to read the forums, but we encourage you to join. Joining has its benefits and enables you to participate in the discussions.

Benefits of registering include

  • Ability to post and comment on topics and discussions.
  • A Free photo gallery to share your dive photos with the world.
  • You can make this box go away

Joining is quick and easy. Log in or Register now!

Open one up, the numbers on the chipset will tell you everything you need to know. I'll even volunteer to do it if someone gives me a transmitter. finding a transmitting frequency won't help much at all, there is a lot more going on there you could never unpack by knowing the frequency.

Example, lets say a chip in there has a number on it that corresponds to a transmitter chip that uses nrf24l011 protocol. All you have to do is buy another chip or dev board with a chip that uses that protocol. You may need to write a program to go through the channels and figure out which one(s) the transmitter uses but that's not very hard. after you establish comm, you can start collecting data and since you will know what it is supposed to be, you can start identifying and parsing it so you can read and use it. It is extremely unlikely that the transmitter uses it's own unique protocol/ chips to communicate.
I don't see anybody cracking the seal on a $350 life support system that is designed to take huge amounts of water pressure just to satisfy our curiosity. Knowing the chip set info does not mean you have any info on how the data produced is sent. You would need a schematic for the RF circuitry to determine that. Judging from one paper I looked at on transmitting RF in the 30+ KHZ region it took 10 watts of power to penetrate 100ft of water. Whatever is inside the AI is not low powered, I suspect it's probably at least a 1 Watt device but the battery lasts because the duty cycle is very low as it just pings the data out every 5 seconds and then goes dormant.
 
I don't see anybody cracking the seal on a $350 life support system that is designed to take huge amounts of water pressure just to satisfy our curiosity. Knowing the chip set info does not mean you have any info on how the data produced is sent. You would need a schematic for the RF circuitry to determine that. Judging from one paper I looked at on transmitting RF in the 30+ KHZ region it took 10 watts of power to penetrate 100ft of water. Whatever is inside the AI is not low powered, I suspect it's probably at least a 1 Watt device but the battery lasts because the duty cycle is very low as it just pings the data out every 5 seconds and then goes dormant.

I would assume a broke one would be what you want to look for, that's what forums like this are for, I have read posts from people who flooded theirs, it is not uncommon so I assume it is likely this thread may reveal a donor.

You said "Knowing the chip set info does not mean you have any info on how the data produced is sent." You don't need to know how the data is being sent, that is some high level stuff. You just need a device (chip) that will communicate with it, knowing the chipset used for transmitting will allow you to get the matching chip to read it, this is simple stuff and you are approaching it in a complex manner that even experienced RF engineers would have difficulty with.

You also said "You would need a schematic for the RF circuitry to determine that." Again, you don't need to know this and there isn't any "RF circuitry", there is a chip in there that gets info through it's serial port (or other com port i.e. I2C) and broadcasts it, its one device (chip) and you don't need to be concerned with what happens inside.

What can pose a challenge is determining modes and establishing communication. The chip you buy to communicate with this may or may not have a number of settings; think of a family band radio, channel 3 station 14 sort of thing. You can write a script on your Arduino that will change the channels over time and listen, if it hears anything, the program can report channels that received data. Since the data is sent every 5 seconds, it may take a while to find but likely not so long it makes the project unworkable.

Another challenge could be parsing the data but I would bet money that the data package is very simple and does not contain any encryption, Something like; (Start) Transmitter serial # -> Battery Level -> Pressure reading (will need to be spanned) -> Transmitter Serial # (End)

You are talking about end to end digital data transmission, not FM analog transmission, You cant "listen" to this data and figure it out. You only need to be concerned with serial outputs of the transmitter/receiver chips, you are looking in the RF part of it and that won't get you anywhere.

Think of 2.4GHz , same as WiFi routers have been around for a while now, Same as the portable house phone you use, same as my kids RC toys, same as the nRF2401A example I sent. If you had a device and knew it was 2.4GHz, how would you read that signal and determine anything from it? You couldn't, 2.4GHz is too ambiguous. once you know the chip, like the nRF2401A example, you can buy the matching chip and they will talk to each other because they use the same frequency and are designed to talk to each other, they wont talk to your portable phone or RC toys because the data, although on the same 2.4GHz freq, is still not in the same language.

I'm not trying to step on your toes, I want to help and think this is interesting. I have built chip level transmitters/receiver devices, design and integrate electrical systems and get contracted to find flaws in existing non or limited functioning equipment. I understand pretty well how to accomplish what you are trying to do.

It may be possible for a talented RF engineer to do what you want with the approach you are suggesting but it would involve serious RF knowledge and the end result is they would figure it out what chips are being used and then tell you to buy the matching chip since no frequency analyzer is going to turn a signal into serial port data which is what you need.
 
I would assume a broke one would be what you want to look for, that's what forums like this are for, I have read posts from people who flooded theirs, it is not uncommon so I assume it is likely this thread may reveal a donor.

Finding a damaged one is not going to do you any good unless it can be fixed. I would also suspect that they have epoxy or gel coated the PCB as that would add a layer of protection against internal condensation. All in all a lot of work and money on the chance that the problem on the one you get is fixable.

You said "Knowing the chip set info does not mean you have any info on how the data produced is sent." You don't need to know how the data is being sent, that is some high level stuff. You just need a device (chip) that will communicate with it, knowing the chipset used for transmitting will allow you to get the matching chip to read it, this is simple stuff and you are approaching it in a complex manner that even experienced RF engineers would have difficulty with.

I do a lot of work on RF design at home, from building HF amplifiers to VHF amplifiers.
At work it's a different story as I am no longer doing design work.
Even if you get a working unit and you can hook onto a data line and read that data what does that do for you? Nothing! The reason I would want to do this is to build some kind of Receiver that decodes the Data from a Pelagic AI unit within range of it.
Actual goal would be a portable device that displays info on every AI device on the boat. Including serial number and Gas pressure.

You also said "You would need a schematic for the RF circuitry to determine that." Again, you don't need to know this and there isn't any "RF circuitry", there is a chip in there that gets info through it's serial port (or other com port i.e. I2C) and broadcasts it, its one device (chip) and you don't need to be concerned with what happens inside.
The chip is only supplying the data that is modulating a carrier frequency. Yes there is RF circuitry on this device, how do you think it "Broadcast it"?

What can pose a challenge is determining modes and establishing communication. The chip you buy to communicate with this may or may not have a number of settings; think of a family band radio, channel 3 station 14 sort of thing. You can write a script on your Arduino that will change the channels over time and listen, if it hears anything, the program can report channels that received data. Since the data is sent every 5 seconds, it may take a while to find but likely not so long it makes the project unworkable.
Change the Channel?? My spectrum analyzer is simultaneously monitoring the whole band at once and I see nothing.
Another challenge could be parsing the data but I would bet money that the data package is very simple and does not contain any encryption, Something like; (Start) Transmitter serial # -> Battery Level -> Pressure reading (will need to be spanned) -> Transmitter Serial # (End)

It certainly could be like that but I never assume anything. The Pelagic system could encode or encrypt the data in a way that makes using their AI systems on your DC platform something that requires approval and licensing by them.

You are talking about end to end digital data transmission, not FM analog transmission, You cant "listen" to this data and figure it out. You only need to be concerned with serial outputs of the transmitter/receiver chips, you are looking in the RF part of it and that won't get you anywhere.

See my first comment. If I cannot see the RF part of it what is the point.
You can listen to the data from this device. I am not listening to the carrier, I am listening for the modulation of the carrier to figure it out if anything is happening every few seconds. Listening to burst of data is how things start out. The idea is not to decode anything it's just to locate that it exists and find out at what frequency it exists.
Then you move on to stage two.

Think of 2.4GHz , same as WiFi routers have been around for a while now, Same as the portable house phone you use, same as my kids RC toys, same as the nRF2401A example I sent. If you had a device and knew it was 2.4GHz, how would you read that signal and determine anything from it? You couldn't, 2.4GHz is too ambiguous. once you know the chip, like the nRF2401A example, you can buy the matching chip and they will talk to each other because they use the same frequency and are designed to talk to each other, they wont talk to your portable phone or RC toys because the data, although on the same 2.4GHz freq, is still not in the same language.

Here is a simple example.

I'm not trying to step on your toes, I want to help and think this is interesting. I have built chip level transmitters/receiver devices, design and integrate electrical systems and get contracted to find flaws in existing non or limited functioning equipment. I understand pretty well how to accomplish what you are trying to do.

Not a problem. I have a lot of stuff on my plate so if you want to give it a shot please post what you find and I will gladly use the info.

It may be possible for a talented RF engineer to do what you want with the approach you are suggesting but it would involve serious RF knowledge and the end result is they would figure it out what chips are being used and then tell you to buy the matching chip since no frequency analyzer is going to turn a signal into serial port data which is what you need.
See above video. Once you know what your dealing with it becomes easy to create an RF circuit to separate out the modulated data. You can feed that data into any kind of computer and start to see what is going on. As I said yes you can start from hacking a unit and directly connecting to a port on a chip. The problem is that even if you decode the data all you find out is the method of encoding or encryption but that has no real world use until you can actually use it on the RF signal.
 
The AI thing has always been intriguing to me. The odd thing I see in this scenario is the unique serial ID numbers for xmitters. The only comparable situations i can think of is CTSS tones or trunking. Maybe if the RX is something like spread spectrum, the xmitter doesn't make sense to anything that isn't given the decode algorithm first. But even a signal that's hopping around or CTSS encoded would be picked up by a spectrum analyzer....
 
The AI thing has always been intriguing to me. The odd thing I see in this scenario is the unique serial ID numbers for xmitters. The only comparable situations i can think of is CTSS tones or trunking. Maybe if the RX is something like spread spectrum, the xmitter doesn't make sense to anything that isn't given the decode algorithm first. But even a signal that's hopping around or CTSS encoded would be picked up by a spectrum analyzer....

The three main things that puzzle me about this device.

1) The FCC data makes no sense! I have looked at dozens of FCC filings and I have never seen one for an RF device that only lists a frequency and then has no power output info, harmonic values or any other data at all.

2) Somebody else also spent a long time looking for the signal and could not find it. I wish I had book marked that post. I cannot find it again.

3) I have never worked with any RF devices at this low a frequency. This is typically a frequency range used for IR modulation or Acoustic gear. Maybe the Antenna I am using is nulling out the signal.
 
Finding a damaged one is not going to do you any good unless it can be fixed. I would also suspect that they have epoxy or gel coated the PCB as that would add a layer of protection against internal condensation. All in all a lot of work and money on the chance that the problem on the one you get is fixable.

The intent is to open it up, which you don't want to do to a working one, and identify the chip. Thats it, I never said try and fix it. I assume the PCB isn't coated well because I can see a tiny bit in mine and it does nto look coated, and they fail when flooded.

I do a lot of work on RF design at home, from building HF amplifiers to VHF amplifiers.
At work it's a different story as I am no longer doing design work.
Even if you get a working unit and you can hook onto a data line and read that data what does that do for you?

No intention of getting it working and hooking into a data line, the spent transmitter is just for identifying the chip and that it.

Nothing! The reason I would want to do this is to build some kind of Receiver that decodes the Data from a Pelagic AI unit within range of it.

I get this, and that is the direction I am going.

Actual goal would be a portable device that displays info on every AI device on the boat. Including serial number and Gas pressure.

I like this idea


The chip is only supplying the data that is modulating a carrier frequency. Yes there is RF circuitry on this device, how do you think it "Broadcast it"?

What I mean by no RF circuitry is that unlike your HF and VHF stuff, this is just one chip, not a few components like what you are probably used to. There is RF circuitry but it is all inside a single chip.


Change the Channel?? My spectrum analyzer is simultaneously monitoring the whole band at once and I see nothing.

Yes, if you have the matching receiver chip, there will be settings in it, you would change the until the speak to each other. Your analyzer isn't seeing anything because it probably isn't the frequency you suspect it to be.

It certainly could be like that but I never assume anything. The Pelagic system could encode or encrypt the data in a way that makes using their AI systems on your DC platform something that requires approval and licensing by them.

Not impossible but unlikely in my opinion.


See my first comment. If I cannot see the RF part of it what is the point.
You can listen to the data from this device. I am not listening to the carrier, I am listening for the modulation of the carrier to figure it out if anything is happening every few seconds. Listening to burst of data is how things start out. The idea is not to decode anything it's just to locate that it exists and find out at what frequency it exists.
Then you move on to stage two.

You dont need to see the RF, your computer receives readings so you know it is sending out data. If you do locate the frequency, what is the next step?


Here is a simple example.


Not a problem. I have a lot of stuff on my plate so if you want to give it a shot please post what you find and I will gladly use the info.


See above video. Once you know what your dealing with it becomes easy to create an RF circuit to separate out the modulated data. You can feed that data into any kind of computer and start to see what is going on. As I said yes you can start from hacking a unit and directly connecting to a port on a chip. The problem is that even if you decode the data all you find out is the method of encoding or encryption but that has no real world use until you can actually use it on the RF signal.

In the video, the software has the standard so it can read the signal, it is alot less likely that the obscure standard for this unit will be in the software so it can be read. This is why finding the matching receiver chip is the path of least resistance, the analog signal needs to be converted to ASCII and the matching receiver chip is the easy way to get that. Each transceiver manufacturer will have their recipe for getting this done, I cant imagine that is even possible to figure that out.

We need to keep an eye out on this forum for flooded transmitters, I assume someone would ship it to one of us at our own cost, I'd pay a few bucks to open one up and see it.
 

Water getting into the unit via a leak is not the same thing as the condensation that will occur. It is possible the board is exposed but I know most designers would not leave a board like this without some form of coating.

It is highly unlikely that this is a one chip design as this device is way to old for that and also it is very unique in its application. The RF power of this device is not going to be coming from the same IC that is generating the data. I suspect it will have at least three stages in the circuit design. Given the info that I read that 10W of power is needed to get a signal through 100ft of water it is very likely that this unit outputs about .5W to 1W and it is probably done via a Mosfet.

What you saw in that Video was just the Menu for Network protocols. There are a ton of other protocols including ASCII as well as manually setting up custom data lengths and stop bits etc.

Anyway I think this is not going in a productive direction. If you get a cheap unit and decide to take on the task let me know how it works out. If I get time I will look into this further I will post back.
 
Given the info that I read that 10W of power is needed to get a signal through 100ft of water it is very likely that this unit outputs about .5W to 1W
How do you conclude this? From https://www.researchgate.net/profil...mmunication.pdf?origin=figuresDialog_download, we find this figure:
RF-attenuation-in-sea-water-41_W640.jpg


The attenuation at 38kHz is less than10 dB/m, and the signal goes 2m at most.
 
Question.
If you're trying to produce a receiver, why not just reverse engineer a functional receiver?
A donor computer would provide you the next step, no?
 
https://www.shearwater.com/products/teric/

Back
Top Bottom