This instructable creates a measurement instrument to help analyse RF 433MHz transmissions which are commonly used for low power remote communications in home automation and sensors. It could probably be easily modified to work 315MHz transmissions used in some countries. This would be by using the 315MHz version of the RXB6 instead of the current 433MHz one.

The purpose of the instrument is two fold. First, it provides a signal strength meter (RSSI) which can be used to examine coverage around a property and find any black spots. Secondly it can capture clean data from transmitters to allow easier analysis of the data and protocols used by different devices. This is useful if trying to design compatible add-ons to existing units. Normally data capture is complicated by the background noise present in receivers producing lots of spurious transitions and making it more difficult to discover the true transmissions.

The unit uses a RXB6 superhet receiver. This uses the Synoxo-SYN500R receiver chip which has an RSSI analog output. This is effectively a buffered version of the AGC signal used to control the gain of the receiver and gives signal strength over a wide range.

The receiver is monitored by an ESP8266 (ESP-12F) module which converts RSSI signal. It also drives a small local OLED display (SSD1306). The electronics can also capture timing information on data transitions.

Captures can be triggered locally by a button on the unit. Captured data is saved to files for later analysis.

The ESP12 module runs a web server to give access to the files and captures may also be triggered from here.

The instrument is powered by a small LIPO rechargeable battery. This gives a reasonable run time and the electronics have a low quiescent current when not in use.

Step 1: Components and Tools Required

Important Note:

I have found some RXB6 433Mhz receivers have a non functioning RSSI output even though the AGC and the rest of the functionality is OK. I suspect there may be some clone Syn500R chips being used. I have found that receivers labelled as WL301-341 use a Syn5500R compatible chip and the RSSI is functional. They also have the advantage of not using a screening can making the AGC capacitor easier to modify. I would recommend using these units.

The following components are needed

ESP-12F wifi module

3.3V regulator xc6203
220uF 6V capacitor
2 schottky diodes
6mm push button
n channel MOSFET e.g. AO3400
p channel MOSFET e.g. AO3401
resistors 2x4k7, 3 x 100K, 1 x 470K
small piece of prototyping board
RXB6 or WL301-341 superhet 433MHz receiver
SSD1306 0.96 OLED display (single colour SPI version)
LIPO battery 802030 400mAh
3 pin connector for charging
Hook up wire
Enamelled copper wire self-fluxing
Epoxy resin
Double sided tape
3D printed enclosure

Tools needed

Fine point soldering iron
Desolder braid
Tweezers
Pliers

Step 2: Schematic

The circuit is fairly straightforward.

A LDO 3.3V regulator converts the LIP to 3.3V needed by the ESP-12F module.

Power is supplied to both the display and the Receiver via two switching MOSFETS so they are off when the ESP module is sleeping.

The button starts the system up by supplying 3.3V to the EN input of the ESP8266. The GPIO5 then sustains this while the module is active. The button is also be monitored using GPIO12. When GPIO5 is released then the EN is removed and the unit shuts down.

The data line from the receiver is monitored by GPIO4. The RSSI signal is monitored by the AGC via a 2:1 potential divider.

The SSD1306 display is controlled via SPI consisting of 5 GPIO signals.It may be possible to use an I2C version but this will require changing the library used and remapping some of the GPIO.

Step 3: Receiver Modification

As supplied the RXB6 does not make the RSSI signal available on its external data pins.

A simple modification makes this possible. The DER signal connector on the unit is actually just a repeat of the Data signal signal. They are wired together through the 0 Ohm resistor labelled R6. This must be removed by using a soldering iron. The component labelled R7 must now be linked across. The top end is actually the RSSI signal and the bottom goes to the DER connector. One could use a 0 Ohm resistor but I just linked across with a bit of wire. These locations are accessible outside of the metal screening can which does not need to be removed for this modification.

The modification can be tested by attaching a voltmeter across DER and GND with the receiver powered up. It will show a voltage between about 0.4V (no received power) and about 1.8V with a local source of 433MHz (e.g. a remote control).

The second modification is not absolutely essential but is quite desirable. As supplied the AGC response time of the receiver is set to be quite slow taking several hundred milliseconds to respond to received signal. This reduces the time resolution during RSSI captures and also makes it less responsive to use RSSI as a trigger for data capture.

There is a single capacitor which controls the AGC response times but, unfortunately, it is located under the metal screening can. It is actually fairly easy to remove the screening can as it is just held by 3 lugs and it can be prised up by heating each of these in turn and levering up with a small screwdriver. Once removed one can clean out the holes for re-assembly by using de-soldering braid or re-drilling with about a 0.8mm bit.

The modification is to remove the existing AGC capacitor C4 and replace it with a 0.22uF capacitor. This speeds up the AGC response by about 10 times. It does not have any detrimental effect on the performance of the receiver. In the image I show a track cut and a link through to this track from the AGC capacitor. This is not necessary but makes the AGC point available on a pad outside the screening can under the crystal in case one wanted to add extra capacitance back in. I have not needed to do that. The screening can then be replaced.

If using the WL301-341 RX unit then the photo shows this with the AGC capacitor highlighted. The RSSI signal pin is also shown. This is not actually connected to anything. One can just connect a fine wire directly to the pin. Alternatively there the two central jumper pins are connected together and both carry the data output. The trace between them can be cut and then the RSSI linked through to the spare one to make the RSSI signal available on a jumper output.

Step 4: Construction

There are about 10 components needed outside of the ESP-12 module. These can be made up and connected on a piece of prototyping board. I used an ESP specific prototyping board I used to facilitate mounting the regulator and other smd components. This attaches directly on top of the ESP-12 module.

The box I used is a 3D printed design with 3 indentations in the base to take the receiver, display and esp module. It has a cutout for the display and holes for the charging point and push button which should be inserted and secured with a small amount of poxy resin.

I used hook up wire to make the connections between the 3 modules, the charging point and the buttons. and then secured them in place using double side tape for the ESP and receiver and small drops of epoxy to hold the sides of the display in place.The battery is wired to the charging point and mounted on top of the receiver using double sided tape.

Step 5: Software and Configuration

The software is built in the Arduino environment.

Source code for this is at https://github.com/roberttidey/RF433Analyser The code can have some constants for passwords changed for security purposes before being compiled and flashed to the ES8266 device.

WM_PASSWORD defines the password used by wifiManager when configuring device onto local wifi network
update_password defines a password used to allow firmware updates.

When first used the device enters wifi config mode. Use a phone or tablet to connect to the Access point set up by the device then browse to 192.168.4.1. From here you can select the local wifi network and enter its password. This needs only to be done once or if changing wifi networks or passwords.

Once the device has connected to its local network it will listen for commands. Assuming its IP address is 192.168.0.100 then first use 192.168.0.100:AP_PORT/upload to upload the files in the data folder. This will then allow 192.168.0.100/edit to view and upload further files and also allow 192.168.0.100 to access the user interface.

Points to note in the software are

The ADC in the ESP8266 can be calibrated to improve its accuracy. A string in the config file sets the achieved raw values for two input voltages. This is not particularly important as RSSI is a fairly relative signal depending on antenna etc.
The RSSI voltage to db is reasonably linear but curves at the extremes. The software has a cubic fit to improve the accuracy.
Most of the arithmetic is done using scaled integers so RSSI values are actually 100 times the actual. Values written to files or displayed are converted back.
The software uses a simple state machine to control capture of RSSI and data transitions.
Data transitions are monitored using an interrupt service routine. The normal Arduino loop processing is suspended during data capture and the watchdog kept alive locally. This is to try to improve interrupt latency to keep timing measurements as faithful as possible.

Configuration

This is kept in the esp433Config.txt.

For RSSI capture the sampling interval and duration can be set up.

For data capture the RSSI trigger level, number of transitions, and maximum duration can be set up. A suitable trigger level is about +20dB on the background no signal level. A pulseWidths string also allows simple categorisation of pulse widths to make analysis easier. Each logged line has pulseLevel,width in micorseconds and the code which is the index in the pulseWidths string which is greater than the measured width.

CalString can improve ADC accuracy.

idleTimeout controls the number of milliseconds of inactivity (no captures) before the device automatically shuts down. Setting it to 0 means that it will not timeout.

The three button settings control what distinguishes short medium and long button presses.

displayUpdate gives the local display refresh interval.

Step 6: Usage

The unit is turned on by pressing the button for a short time.

The display will initially display the local IP address for a few seconds before starting to display RSSI level in real time.

A short button press will initiate an RSSI capture to file. Normally this will terminate when the RSSI duration has finished but a further short button press will also terminate the capture.

A medium button press will initiate a data transition capture. The screen will show waiting for trigger. When the RSSI goes above the trigger level it will then start capturing timed data transitions for the number of transitions specified.

Holding the button down for longer than the button long duration will power down the unit.

Capture commands can also be initiated from the web interface.

Step 7: Web Interface

Accessing the device by its ip address shows a web interface with 3 tabs; Captures, status and config.

The captures screen shows the currently captured files. The contents of a file may be shown by clicking on it s name. There are also delete and download buttons for each file.

There are also capture RSSI and capture Data buttons which may be used to initiate a capture. If a filename is given it will be used otherwise a default name will be generated.

The config tab shows the current configuration and allow svalues to be changed and saved.

The web interface supports the following calls