Sub-1GHz FSK / OOK & Sensor Decoding
Before complex spread-spectrum chips existed, sub-1GHz telemetry relied on pulse modulation and frequency-shift keying. Millions of wireless weather stations, water meters, and environmental sensors broadcast in the clear on 433 MHz and 915 MHz using straightforward bit encodings.
01 · The Modulation Hierarchy: OOK, 2-FSK, and GFSK
In sub-1GHz engineering, selecting a modulation scheme represents a strict compromise between receiver sensitivity, circuit complexity, and adjacent channel interference:
| Modulation | Carrier Modulation Physics | Occupied Bandwidth | Minimum SNR | Field Role |
|---|---|---|---|---|
| OOK / ASK | Carrier keyed ON for binary 1, OFF for binary 0 | Narrow (~10–50 kHz) | +10 to +14 dB | Low-cost remotes, wireless doorbells, tire pressure sensors (TPMS), weather sensors |
| 2-FSK | Shifts between Mark (fc + Δf) and Space (fc - Δf) | Medium (50–200 kHz) | +6 to +8 dB | Wireless alarms, industrial telemetry, smart utility meters, CC1101 transceivers |
| GFSK | 2-FSK pre-filtered by Gaussian filter (BT = 0.5) to smooth transitions | Controlled (~50–150 kHz) | +5 to +7 dB | Bluetooth LE, Z-Wave 100 kbps, modern sub-1GHz links requiring low sidelobes |
| 4-FSK | Transmits 2 bits per symbol across 4 discrete frequency states | Wide (~100–300 kHz) | +10 to +12 dB | High-throughput sub-1GHz modems, digital mobile radio (DMR), paging networks |
Why Gaussian Filtering (GFSK) Matters
In raw 2-FSK, switching carrier frequencies instantly causes abrupt phase discontinuities that splatter energy across neighboring spectrum as high-frequency harmonic sidelobes.
Gaussian Frequency Shift Keying (GFSK) feeds the binary pulse stream through a Gaussian filter (typically with a bandwidth-time product $BT = 0.5$) before reaching the voltage-controlled oscillator (VCO). This rounds off the sharp pulse edges, drastically suppressing adjacent channel interference and ensuring compliance with FCC Part 15 and ETSI emission masks.
02 · Bit Encoding Schemes: NRZ, Manchester, PWM, and PPM
Modulating a carrier wave is only the transport layer. The receiver still needs to extract individual bits and maintain clock synchronization without drifting out of phase:
| Encoding Format | Representation of '0' | Representation of '1' | Baud Overhead | Clock Recovery & Synchronization |
|---|---|---|---|---|
| NRZ (Non-Return-to-Zero) | Low voltage level for entire bit clock | High voltage level for entire bit clock | 0% (1 baud = 1 bit) | Poor on long sequences of 0s or 1s (needs bit stuffing or scrambler) |
| Manchester Encoding | Rising edge in bit center (Low → High) | Falling edge in bit center (High → Low) | 100% (2 bauds = 1 bit) | Perfect; guaranteed transition every bit period. Zero DC bias |
| PWM (Pulse Width) | Short high pulse (1/3 time) followed by long low | Long high pulse (2/3 time) followed by short low | Variable clock duration | Self-clocking on every rising edge; resilient to receiver crystal drift |
| PPM (Pulse Position) | Extremely brief pulse emitted at t = 0 | Extremely brief pulse emitted at t = T/2 | Ultra-low duty cycle | Requires precise receiver timebase synchronization |
Timing Comparison Diagram
NRZ-L: +-------+ +-------+-------+
| | | | |
-----+ +-------+-------+ +-------+
Manchester (IEEE): +---+ +---+ +---+ +---+
| | | | | | | |
-----+ +-------+---+ +---+ +-------+ +---
PWM (Pulse Width): +-------+ +---+ +-------+ +-------+
| | | | | | | |
-----+ +---+ +-------+ +---+ +---
03 · Hardware Packet Correlators & Demodulators (CC1101 & Si4463)
Integrated transceivers like the Texas Instruments CC1101 and Silicon Labs Si4463 do not burden the host microcontroller with sampling analog radio noise. Instead, dedicated internal hardware handles preamble detection and sync word correlation:
1. Preamble Quality Estimator (PQI)
The receiver continuously checks incoming samples for alternating 0101 bit transitions. When a threshold (typically 4 or 8 bits) is met, the demodulator enables the bit synchronizer.
2. Sync Word Correlator
Bits stream into a shift register compared continuously against a configured 16-bit or 32-bit sync register (e.g., 0xD391). Only when the match is verified does the radio assert its GDO0 pin to wake the host CPU.
3. Receiver Channel Bandwidth (Carson's Rule)
The receiver filter bandwidth must be sized using Carson's Rule: BW ≥ DataRate + 2×Δf + 2×CrystalDrift. Too wide admits noise; too narrow clips the signal.
04 · Dissecting a 433.92 MHz Weather Sensor Packet
This real-world frame represents an outdoor temperature and humidity sensor transmitting unencrypted public telemetry in the 433 MHz band using Manchester-encoded OOK:
| Field Name | Example Hex | Field Width | Decoded Meaning & Calibration Parsing |
|---|---|---|---|
| Preamble | 0x55 0x55 | 16 bits | Alternating 01010101 bit train. Allows receiver AGC to settle and bit slicer to lock clock |
| Sync Word | 0x2D 0xD4 | 16 bits | Unique synchronization marker. Correlator fires hardware interrupt when matched |
| Device ID | 0x8A | 8 bits | Randomized 8-bit identifier assigned upon battery insertion to distinguish neighbors |
| Flags / Channel | 0x02 | 8 bits | Bit 7: Low Battery flag (0=OK, 1=Low). Bits 0–1: Physical channel switch (Ch 1, 2, or 3) |
| Temperature | 0x02 0x18 | 16 bits | Binary Coded Decimal (BCD): 0x0218 = 21.8°C (or signed integer depending on manufacturer) |
| Relative Humidity | 0x45 | 8 bits | Direct BCD percentage: 0x45 = 45% relative humidity |
| CRC-8 / Checksum | 0x9E | 8 bits | Polynomial checksum calculated over payload bytes to detect bit flips in flight |
Payload Integrity Verification
The sensor calculates a CRC-8 over the Device ID, Flags, Temperature, and Humidity bytes. If the receiver's computed CRC matches the final byte (0x9E), the packet is validated and ingested into the telemetry database. If noise flipped even one bit, the packet is silently discarded.
05 · Bench Diagnostic Tools & Signal Inspection
Reverse engineering and auditing sub-1GHz sensor networks requires tools capable of turning raw electromagnetic energy into readable bitstreams:
rtl_433 (Software Defined Radio Decoder)
An open-source program that turns an inexpensive RTL-SDR dongle into a passive receiver for over 200 consumer sensor protocols. It detects pulse width, decodes Manchester/PWM frames, checks CRCs, and outputs JSON telemetry to MQTT or stdout.
Logic Analyzer on Transceiver GPIO Pins
Connecting a USB logic analyzer (such as a 24 MHz 8-channel analyzer) to the digital demodulated data pin (GDO0 on CC1101) lets you inspect raw pulse transitions directly in PulseView / Sigrok without needing RF software tools.
URH (Universal Radio Hacker)
A dedicated suite for investigating unknown wireless signals. Record I/Q samples, adjust demodulation thresholds, auto-detect symbol lengths, assign custom demodulation rules, and visually break bitstreams into protocol fields.