how to find garage key fob frequency?

Thread Starter

Andrewlapham

Joined Aug 29, 2017
32
I moved into to a new rental property and was given one key fob for the garage. I thought I might clone it and use an Arduino to make some more but I cant track down the frequency its running on. I have been scanning with an RTL-SDR across the 300 - 433mhz range but nothing, any ideas on what to try next?
photo_2021-02-06_19-39-06.jpg
 
Last edited by a moderator:

Alec_t

Joined Sep 17, 2013
14,280
Are there any numbers/codes/labels printed or moulded on the casing of the key fob or the reverse side of the circuit board?
Even if you know the RF frequency, the fob for a recent opener may be using a rolling code. How would you synchronise your clone with that?
 

Thread Starter

Andrewlapham

Joined Aug 29, 2017
32
What does the other side of the PCB show? Some door operators use or used to use a SAW oscillator (https://www.microsemi.com/product-d...aw-products/3880-rf-microwave-saw-oscillators), and the ones I have opened were marked with a frequency. There is also an obvious antenna, which I don't see on on the side you show.
Yeah i was looking for a crystal or something to give some sort of indication but found nothing. the reverse side of the pcb doesn't help much but you can see the track that is used for the antenna but still doesn't help
photo_2021-02-06_22-57-19.jpg
 

AlbertHall

Joined Jun 4, 2014
12,345
There is a trimmer capacitor and to its left in the picture a black thing surrounded by three capacitors. The black thing has three terminals from the pcb rear picture.
I think the black thing is an inductor which, with capacitors forms a tuned circuit which sets the TX frequency so the only accurate way of getting the frequency is to measure it but as it will be some form of pulsed output when a button is pressed this will be difficult/impossible with 'normal' frequency meters. You might be able to do it with a spectrum analyser or a grid dip oscillator.
 

jpanhalt

Joined Jan 18, 2008
11,087
Are you sure you need the frequency? If in the US, consider getting a cheap, 2-button, programmable "universal" opener, and see if it works. You want an opener that can learn, not the older type that uses switches for the code.

Maybe you can work backwards? What brand of opener is in the garage? Apparently Genie are all 315 and 390 MHz. Chamberlain and LiftMaster may have their own preferred frequencies.
 

wayneh

Joined Sep 9, 2010
17,496
Maybe you can work backwards?
That's what I was going to suggest - get up on a ladder and read whatever you can off the motor/chain housing. A little searching on the model number should uncover both the frequency and how it works. Or just get a learning remote. My cars all have buttons that can learn your garage door code. They work great and have a larger range. I never use the opener that came with the opener anymore.
 

BobaMosfet

Joined Jul 1, 2009
2,110
@Andrewlapham The transmitter likely operates at 340Mhz, from what I've found regarding remotes and garage door openers that use that IC. The RT1762PN produces the control signals and modulates the carrier. You can see L1, VC1, and Several other capacitors which are used to tune it. I admit I'm a bit stumped without reverse engineering it, as I don't see X1 (crystal) anywhere-- It is possible this IC has one internally as a later revision of an earlier RT1762xN by RATO.

This is the ONLY document I could find thus far- and even it doesn't quite match:

1612629978789.png

I'm looking to see if I have a datasheet for the RT1762PN.

EDIT: I did not make the above drawing, I found it online.
 
Last edited:

Thread Starter

Andrewlapham

Joined Aug 29, 2017
32
@Andrewlapham The transmitter likely operates at 340Mhz, from what I've found regarding remotes and garage door openers that use that IC. The RT1762PN produces the control signals and modulates the carrier. You can see L1, VC1, and Several other capacitors which are used to tune it. I admit I'm a bit stumped without reverse engineering it, as I don't see X1 (crystal) anywhere-- It is possible this IC has one internally as a later revision of an earlier RT1762xN by RATO.

This is the ONLY document I could find thus far- and even it doesn't quite match:

View attachment 229675

I'm looking to see if I have a datasheet for the RT1762PN.
I couldn't find any datasheet for the chip anywhere. I was completely stumped too but then assumed that the chip must have had the oscillator built in. it would be great if you had a datasheet though. thanks for the frequency lead though i'll start scoping around the 340mhz range and see if I find anything.
 

jpanhalt

Joined Jan 18, 2008
11,087
I couldn't find any datasheet for the chip anywhere. I was completely stumped too but then assumed that the chip must have had the oscillator built in. it would be great if you had a datasheet though. thanks for the frequency lead though i'll start scoping around the 340mhz range and see if I find anything.
I do not think the RT1762PN chip has the oscillator. This is probably the oscillator section with an RF NPN transistor:

1612690794522.png

Those components connect to the loop antenna. Here's a typical circuit from another garage door remote:


1612690706674.png
 

DickCappels

Joined Aug 21, 2008
10,152
Do you have a scope with FFT mode and a sampling rate of 1 GHz or more? Using a 60 MHz scope with those specs you can probably spot the signal unless it is half the scope's sampling rate or the manufacturer took liberties with the bandwidth rolloff.

The SDR scanner should have caught something.

Is the fob known to work?
 

Thread Starter

Andrewlapham

Joined Aug 29, 2017
32
Do you have a scope with FFT mode and a sampling rate of 1 GHz or more? Using a 60 MHz scope with those specs you can probably spot the signal unless it is half the scope's sampling rate or the manufacturer took liberties with the bandwidth rolloff.

The SDR scanner should have caught something.

Is the fob known to work?
Yes it does work, I've tested the SDR with my car keys that run on 433Mhz and can see the signal so i know that the SDR and the Garage key are both functional.
 

Thread Starter

Andrewlapham

Joined Aug 29, 2017
32
Yes it does work, I've tested the SDR with my car keys that run on 433Mhz and can see the signal so i know that the SDR and the Garage key are both functional.
At this point I'm actually considering putting a servo next to the box inside to physically press the button lol
 

Thread Starter

Andrewlapham

Joined Aug 29, 2017
32
What brand of opener/opener receiver is it? Your fob may be missing the FCC notice, but the receiver shouldn't be.
Its a Steel-Line. i will take the cover off today and have a look at the PCB but considering there is a tuning pot on the side of the case id assume that the circuit would be similar to the fob as in the oscillator may be made up of passive components.
 

BobaMosfet

Joined Jul 1, 2009
2,110
I do not think the RT1762PN chip has the oscillator. This is probably the oscillator section with an RF NPN transistor:

View attachment 229728

Those components connect to the loop antenna. Here's a typical circuit from another garage door remote:


View attachment 229727
The problem is that the above is a variable capacitor, and I cannot find a transistor anywhere on the PCB (either side). Can the TP get another shot of the above, better lit?
 

jpanhalt

Joined Jan 18, 2008
11,087
Its a Steel-Line. i will take the cover off today and have a look at the PCB but considering there is a tuning pot on the side of the case id assume that the circuit would be similar to the fob as in the oscillator may be made up of passive components.
A tuning pot? I suspect that is not for tuning but for setting something like obstruction sensitivity, light timer, closing distance, and so forth.


Maybe this will help focus the search for operating frequency:
1612764013825.png

Now you know where to look with your SDR.

As for the transistor, the picture I posted in #10 clear shows something consistent with a T0-92 when lightened.
 

Thread Starter

Andrewlapham

Joined Aug 29, 2017
32
A tuning pot? I suspect that is not for tuning but for setting something like obstruction sensitivity, light timer, closing distance, and so forth.


Maybe this will help focus the search for operating frequency:
View attachment 229811

Now you know where to look with your SDR.

As for the transistor, the picture I posted in #10 clear shows something consistent with a T0-92 when lightened.
Bingo 310mhz! photo_2021-02-08_21-40-18.jpg
 
Top