# How to identify the type of modulation and data rate of an RKE system transmission

Many devices that measure frequencies of key fobs, can inform, in addition to the frequency measurement, also the type of modulation, FSK or OOK, and the data rate in bps. Previously in this forum, I made questions about methods of how to measure frequencies and reverse engeneering of a hardware of a device able to perform these measurements. Based on the discussions, I decided to use the Prescaling method. In this method, the signal received would be amplified, its frequency would be divided and then it would go to a controlled gate and a counter. I will put the links of these previous discussions at the end of the post for those who wants more information.

I only know that the main modulation methods used by transmitters of the key fobs are OOK and FSK. I don't have any additional information about protocols or how these modulation are implemented in these transmiters.

So, to differentiate OOK from FSK, I imagined the following circuit:

simulate this circuit – Schematic created using CircuitLab

The idea with this circuit is to monitor the activity of the signal. If the signal is pulsating it will means that the modulation is OOK, but, if after a determined interval of time no pulses are detected, it means it is FSK. The range of fequency is from 100MHz to 915MHz, so, for the calculus of the capacitor's discharge time, I take the worst case, the longest period, that happens at the lower frequency, It means 0,01$$\\mu\$$s. I took arbitrarily 3 times this period to be the time of discharge,Td, of the capacitor. So, we have:

Td = 0,03$$\\mu\$$s = 5*R2 *C

Considering R2 = 1k$$\\Omega\$$; we will have C = 6pF.

Doing this, I had the following concern: This period of 0,03$$\\mu\$$s is 27 times longer than the smaller period, of 1,09ns in 915MHz. So, to detect a low level of a pulse(switch-off) in 915MHz, this low level will need to have a duration of at least 27 cicles of carrier.

Doing reverse engeneering at a hardware that can do these measurements, I came across with the folowing circuit, Which I think is the circuit to check signal activity: (Onservation: In the original hardware, the value of C2 was 18pF and R6 was 10K. I just changed it to the value that I calculated here )

simulate this circuit

Based on this explanation. I have the following doubts:

1. Only frequency counting is sufficient to know the data rate and modulation ? If not, which of the circuits above would be better to discover the modulation ? Is there a better solution ?
2. How can I know, or estimate, the data rate ?

Below, are the previous discussions that I mentioned at the beginning of the post.

Discussion about methods of how to measure frequencies:

Which frequency measurement method is more suitable for RF signals from 200MHz to 915MHz?

Discussion about a reverse engeneering of a hardware of a device that can do these measurements:

Digital Frequency Measurement

• You're assuming your key fob is either OOK or FSK. With a good chance, it is neither. Do you actually know that you're dealing with either OOK or FSK? Commented Sep 3, 2020 at 20:11
• also, why do you want to do this in a discrete circuit? This is a hard enough problem if you can throw SDR at it, but building a discrete circuit to discriminate OOK or FSK, of which you don't even know packet duration and symbol rate, sounds very hard to do. Commented Sep 3, 2020 at 20:19
• That even more sounds like you'd want to implement that on a digital transceiver chip, i.e. SDR, instead of as discrete circuits. Seriously, building something like a detector for modulation types in discrete components is hard, even ignoring the need for demodulation, and doing it compact is very hard. You're most definitely not approaching this in a sensible manner. Also: "Embedded" is a very stretchy term. What kind of platform does it mean for you? A 8 bit MCU? An Nvidia jetson board? A car entertainment system? The autopilot of an autonomous car? All embedded systems. Commented Sep 3, 2020 at 20:55
• and citing an 8 and a 15 years old app note will not take you very far. Industry these days makes full use of these nifty integrated CPU core+SDR+RF frontend microcontrollers, and both OOK and (classical) FSK are being phased out in favor of GMSK systems, typically even combined with frequency hopping to avoid blockers. Or they go straight for standards like Bluetooth or Bluetooth low energy (which are both frequency hopping GMSK or differential PSK systems). Commented Sep 3, 2020 at 21:00
• But trying to do it in discrete means it will be large, heavy and battery hungry! So the opposite of what you want. Commented Sep 3, 2020 at 21:13

Instead of using the very expensive MC9S12XE as you say in your comments, use a microprocessor that's not as expensive, but way cheaper, like the many ARM cortex-M based RF+SDR+MCU systems on chips that you get. For example, SiLabs has a lot of such, but so do TI and Microchip.

Then, you'd try to bend the DSP chain in these to your will, i.e. try out a couple known modulations, and if that fails, try to fall back on a bypass mode where you get direct access to the baseband samples and just process them in software; the TI CC1100 (not really a new chip by any means!) has achieved quite a popularity among radio people for actually being a lowish-bandwidth SDR in a cheap chip.

If you pick your main CPU fast enough for processing many of these modes, instead of trying to shoehorn a strange 16 bit MCU with a lot of very automotive-specific peripherals into a compact handheld device, you will have a better chance of developing something that works.

But seriously, neither of these approaches stand a chance against

• systems that are neither FSK nor OOK (GMSK is arguably not a type of FSK)
• you misjudging the pause between non-OOK packets as off-periods in OOK,
• frequency-hopping systems (Bluetooth has really gotten cheap and power-efficient).

I doubt it. They are definitely lacking any receiver frontend, and 0-5V sounds way higher than anyone would sensibly amplify an RF receive signal, so it'll be hard to find a great design for your receiver frontend. You're trying to detect statistical properties of signals with bandwidths in the MHzes, and durations in the higher microseconds to milliseconds.

You will need a bank of these detectors, then some clever method of choosing which detection is most likely true, and to displaying that. In essence, even if you, 1970's cold war signal intelligence style, built a massive expensive detector array, it would be large, and still lacking the hard parts of the actual RF frontend and the actual decision.

So, really, this becomes manageable on a somewhat faster CPU, with a proper SDR frontend. Something like a PlutoSDR running GNU Radio will make you look pretty bad pretty much for half the price in components alone to build a realistic detector array for most of the likely key fob modulations.

Signal classification is a hard job. I didn't mention the cold war (figure from 1984's habilitation " Automatic Classification of High Frequency Signals" by Jondral) without reason: the availability (e.g. 1990's patent) of computing and reception hardware that led to the SDR explosion around the year 2000 is more or less a result of the allied efforts to automatically classify signals. Doing that in discrete analog was too much of an effort, even for nation states. I don't think you'll do a great job designing a handheld device using 1970's technology.

• Thank you, you did a good explanation. But some assumptions need to be clarified. I will try to explain them below Commented Sep 4, 2020 at 13:08
• About the MC9S12XE, it is not a choice, it is a product that is already commercialized and consolidated for a long time , I must integrate the circuit to this product to add to it these capabilities. The redesign of theenteire product would be a taks completelly different and bigger. Commented Sep 4, 2020 at 13:09
• About the method and the technologies is needed to made a distinction. The techology cited in the references that I used are old, indeed, but the methods are valid and used until today. I don't need to use the same technology cited in them. When I started to study this subject, I was interested only in frequency measurement, now, I'm interested in these features that I mentioned here. Commented Sep 4, 2020 at 13:15
• Still about technology involved, I need to mention that many people use keys fobs and gates'control that has this technology, and is this public that is needed to be attend. To them, is totally necessary to measure frequency, but, would be just desireble, not necessary, to have information about the modulation and data rate used. Commented Sep 4, 2020 at 13:15
• Well, as I said in great breadth now: You will need to get an SDR-enabled device. You can certainly keep your MC9..., but it will not be enough for your problem to just add discrete circuitry, full stop. And you're still acting as if doing things in discrete makes them small. That is wrong. The opposite is true. Commented Sep 4, 2020 at 15:44