Detecting very low power motion sensors

[glradio]

I have a TinySA Ultra with firmware updated to version 1.4-156 with which I can detect the transmission frequency of all devices at my disposal (remote controls, wifi routers, alarm sensors etc.)

The company that has deployed the alarm in an house under construction in 2011, has hidden several radio motion sensors inside the walls, simply by sliding the devices inside the brick cavities that were then plastered !

Some sensors activate the alarm at a distance of 1.5 meters, others even as close as 60 cm, so as to detect the passage of people accurately and only at certain strategic points such as hallways, stairs and other transit points, even outside the house.

The problem I’m experiencing is that I cannot detect the transmissions frequency of these sensor. I’m using the TinySA Ultra stock antenna with these settings: frequency span 100 MHz, Hold+Max Hold, RBW 300 KHz, LNA=ON (LNA OFF above 6 GHz).

As I get closer to where the sensor is located, I would expect to see a stationary signal which must decrease in intensity as I move away, but I can't see nothing !

Since I don't know anything about the type of sensor and its transmission frequency, I focused my attention on frequencies typically used by these devices: 2.4 - 3 - 5.8 - 10.5 GHz, then also the entire spectrum supported by TinySA Ultra up to 20 GHz.

What is the best strategy to detect the signal ?

Which antenna should I use for the purpose ?

[Psi]

Are you reviewing raw data dumps from the TinySA or trying to find it on the screen?

It's probably an extremely short pulse or burst every few seconds to save power.
So you'll never see it on the screen except maybe with some sort of peak hold mode.

[EE-digger]

Assuming that for battery life, 2011, yikes, I think you may want a RTSA with spectrogram or waterfall display.

But in addition to this, you may want an H field sensor that's well shielded, in order to block most of the ambient, or else you will be swamped by all the things you mentioned ... that neighbors own.

Why would they be tucked in walls permanently?  Were they for the benefit of the builder, say, for security during construction?

[Bud]

What is on the recieving side? You may get some clues checking the reciever construction, antenna and board.

Edit: assuming the sensors are wireless.

[coppercone2]

maybe you should use a metal detector if its on brick it might show up because their metal specific now. might have a weird reading not similar to rest of wall. find at least 1.


i would be pissed if the construction company left batteries in the walls WTF. sounds like you can find 1, go to a lawyer and have them find the rest, instead of wasting your time

I think it would make anyone anxious that some foreman is getting information about your buildings occupancy after they are gone. I would also get it checked out for microphones 

its lithium primary cell, they have steel bodies because its really flammable (elemental lithium)



these devices chirp also, very similar to a bird. you need to narrow down on the frequency and scan it high to catch it. try catching your cell phone, it also seems to do this. you get bursts when you access info (i.e. view a page).


and are you sure this is real? it kind of sounds like a prank. construction companies are cheap as fuck

[Infraviolet]

"lithium primary cell, they have steel bodies because its really flammable"
Probably shouldn't be a concern here in practice? If it was Li Ion batteries embedded in your walls there'd be reason to be scared, but Li primary cells (coin cells effectively) don't ever self-ignite as far as I've been aware, however old and degraded they become? And if something else nearby was burning, then the cell heating up and combusting in response wouldn't add much more damage to the flames already raging around it?

[coppercone2]

ehhhh i dunno you know those sheet rock products and compound emit sulfur and corrosive stuff often because its hardly super well regulated. cement also secretes crystals etc. Plus water leaks and also cracks.


I noticed my putty knife always likes to rust up and looks like it taken a beating from putty. Always wash and dry those


If you take a lithium primary cell apart, you will notice its not like fort knox. its a bit dangerous and easy to hurt yourself, but you are trusting plated thin cans and plastic seals made by people crazy about BOM cost. They are impressively flammable. Smash one of those cells and throw it out in the rain and its similar to a jumping jack firework of moderate size (don't do this). They also can spew flammable chunks like a road flare kinda

its also assembled with high speed automated presses at minimum cost. They supposedly are supposed to have strong QC (its what you pay for, not the battery, trust me).. but at those volumes it can't hurt being cautious about LiPrimary cells. Battery companies have impressive QC departments, required to maintain a ultra low materials and assembly cost mega volume product. And its a super cut throat market, the people that have certified batteries can't really raise prices too much to say increase quality... try convincing people to buy them, you will go out of buisness in a hearrt beat

one theoretical scenario I see is someone hanging carpets on brick wall (eastern europe, germany) for insulation and sound proofing. a severely corroded battery inside of a crack in the wall behind the carpet ignites and shoots fire through the crack, igniting the carpet. Normally bad idea to have flamable things on the wall but people might think "well its a god damn empty hallway with a brick wall" and do it anyway.

With anything electrical, chances are a electrician or handyman is going to look at it for some reason, and keep it safe. but a hidden battery? 

[CaptDon]

You need to look at the obvious. They wouldn't be battery operated since they can't be accessed. They must be hard wired for power and probably are not R.F. linked to the alarm central control but also hard wired. As for the R.F. signal used to detect motion they are more than likely 10.525GHz. What idiot would plaster these into a wall? With the exception of some skunk works government building I think this is totally bogus. 99.9% of the motion sensor home quality detectors look like a 'wired in' smoke detector located on the ceiling, not in a wall. Some of the integrated alarm systems in fact have all of the following in one head, Smoke detector, Heat rise detector, Motion sensor, Infra Red badge reader (tells what badge is near what sensor). We had X-Band detectors in one of the buildings where I worked and the blasted things would trigger from cars in the parking lot and that was on the other side of a cinder block wall 30 feet from the motion sensor!! I didn't believe they were X-Band gunnplexors until the installer opened one up and showed me!! They were continuous wave when turned on and used doppler shift to detect motion. They were on 10.525GHz identical to police X-Band speed guns.

[coppercone2]

actually he is right I forgot that it needs to power the radar, batteries would not last a long time for that

https://www.parallax.com/product/x-band-motion-detector/

Power supply requirements: regulated 5 VDC, 8 mA

x band is what old super market doors used to use (x-mart)


any active radar is going to use alot of power. a passive sensor can last alot longer, but it would need a window for the detector.

I was thinking of IR sensor. A radar will have to repeatedly make a signal, either CW or pulses. but for it to detect motion, i.e someone walking through a hallway fast, it needs to pulse alot. it should be easy to find if that device is around if you know the frequency.


Also I think it would need power to get through plaster, thats hydride. I don't think its super transparent to RF. Meaning signal loss


so if this is true, its either real fancy, or has a power wire, or its just a hoax (most likely)

[glradio]

Are you reviewing raw data dumps from the TinySA or trying to find it on the screen?

I'm simply trying to visualize the signal on the screen.

I had never heard of the TinySA Ultra's raw data dumps and can't find anything about them: how can collect and consult this kind of data ?

It's probably an extremely short pulse or burst every few seconds to save power. So you'll never see it on the screen except maybe with some sort of peak hold mode.

I have in fact enabled a second on-screen trace with the "Max Old" function enabled, enabled the built-in waterfall feature but most importantly I have disabled the "Spur Removal" function of the TinySA Ultra.

Assuming that for battery life, 2011, yikes, I think you may want a RTSA with spectrogram or waterfall display ...

Why would they be tucked in walls permanently?  Were they for the benefit of the builder, say, for security during construction?

Are you saying that the TinySA Ultra has some kind of limitations and that I should move toward a high-end spectrum analyzer to see the sensor signal ?

The sensors are mains powered, so there is no problem with battery life.

They were hidden in this way both for aesthetics and safety.

What is on the recieving side? You may get some clues checking the reciever construction, antenna and board.

I cannot inspect a receiving side, because microwave motion sensors, integrate both the transmitting and receiving sides, just like a radar ...

[floobydust]

What does plaster, concrete, mortar, brick do to microwave signals?
Are you sure about your suspicions, they seem a bit stretched. Then you need to use low band RF to get the message out. Like 433MHz ISM band. Not microwave.
Also you need to configure/pair the sensors to the alarm panel and how is that done when they are encased?
There are wireless alarm sensors with rated 10-year battery life but it's a fairly large lithium battery sub AA.

[glradio]

i would be pissed if the construction company left batteries in the walls WTF. sounds like you can find 1, go to a lawyer and have them find the rest, instead of wasting your time ...

and are you sure this is real? it kind of sounds like a prank. construction companies are cheap as fuck

Yes it's real and it was done for absolutely lawful purposes, the only requirement was to hide the sensors.

As mentioned above, the sensors are mains powered, but it is not a problem to know where they are located because homeowner knows exactly their location. I have also verified that approaching the points where the sensors are located triggers the alarm.

[floobydust]

There are two RF frequencies - the motion detect microwave Doppler and the baseband RF message TX.
Which one do you want to search for?

[coppercone2]

oh, you are just studying it. I thought maybe you bought some rigged up property you have a problem with.

If its close I don't think you need much of an antenna. Anything broad band (spiral maybe?). Tape it to the wall in front of the sensor and sweep through the SA


antenna is great for low power signal. radar is fairly high power, especially up close. Like near field close, I think.

a radar needs to transmit alot to get a minute signal back


Spiral antenna work for a very wide range, multiple octaves


start with an attenuator, its easy to fry probobly

[Psi]

Are you reviewing raw data dumps from the TinySA or trying to find it on the screen?

I'm simply trying to visualize the signal on the screen.

I had never heard of the TinySA Ultra's raw data dumps and can't find anything about them: how can collect and consult this kind of data ?

My fault, I assumed it was an SDR underneath and you could connect to it and download the raw data.

[CaptDon]

Are you sure they use R.F. to talk to the alarm control center? If they chirp an R.F. data stream you will play hell trying to catch it with a TinySA or any other sweeping analyzer. You will first need a very good guess at what frequency to zero in on. Sweeping across a bandwidth of perhaps 50MHz with an I.F. bandwidth of 5MHz may help you zero in. Does the alarm control center actually have an R.F. receiver? Any guess at what frequency it looks like it is designed to receive? Why is this of interest anyway?

[floobydust]

Alarm panels power all wired sensors with battery-backed up 12V power. Why then run mains wiring to these motion sensors? The PSU will make them big.
The men in black prefer tachyon power, to know what room you are in.

[coppercone2]

I assume he means mains powering 12v powering box powering sensors

[A.Z.]

hmm... maybe the sensors have rechargeable batteries to keep working on power outages, and then, they may transmit using their power lines instead of sending RF signals, that way going through walls won't be an issue

[Miek]

I did some searching and couldn't find any information about commercial alarm sensors designed to be hidden in a wall. I did find this though: https://www.forensicfocus.com/forums/off-topic/audio-bug-microwave-motion-sensor-hidden-inside-wall/ which sounds awfully familiar. (aside from some key details changed to suit the audience here?)

[glradio]

There are two RF frequencies - the motion detect microwave Doppler and the baseband RF message TX.
Which one do you want to search for ?

I'm interested in the frequency of the motion sensor, because I assume that it is always transmitting and thus easier to detect than the radio signal that some sensors transmit to the control panel only if motion is detected to trigger the alarm.

Are you sure they use R.F. to talk to the alarm control center ? ...

I'm not sure because I could not investigate further, but as I said above, I'm interested in the continuous signal transmitted by the motion detector, not the alarm signal itself ...

[glradio]

Alarm panels power all wired sensors with battery-backed up 12V power. Why then run mains wiring to these motion sensors? The PSU will make them big.

I assume he means mains powering 12v powering box powering sensors

I did not specify the voltage, I just meant that they are cable-powered and not battery-powered. Most likely they are powered by low voltage from the alarm panel itself.

[A.Z.]

if so they may just use the power line to send signals to the controller, so no RF signalling you can detect

[CaptDon]

As stated prior, look around at 10.525GHz X-Band and if not then it may be Ku band at 24GHz. X-band can penetrate cinderblocks and detect the motion of cars in the parking lot through a cinderblock wall 30 feet away as stated in my earlier post. That is possible with 10 to 50 milliwatts from a gunnplexor unit exactly like those in police radar. Incidently, 31.25Hz is equal to 1 M.P.H. at 10.525GHz.

[ejeffrey]

Yeah my guess would be above the frequency the tinySA can see.  Typical frequencies for proximity radar are 10.525 GHz, 24 GHz and 77 GHz.  10 GHz is possible with a slightly higher end SDR like the SignalHound.  For the higher frequencies you are going to have to work harder or pay a lot more or both.

Another possibility would be ultrasonic, like automotive parking sensors.  If you aren't completely sure it's radar based I would look for ultrasonics.