Reverse Engineer RF Transmitter Circuit

Hello EDAboard, it has been a while.

I have a circuit that I would like to learn more about and I am hoping some of the more EE educated folks can give me a hand. I am attaching a photo of the circuit and a few details of what I know.

This is an RF transmitter circuit that operates at 315Mhz, It uses a standard CR2032 3v battery as a power source, and As best I can the board was made in 1997.

So far the components I see on the circuit look like this:

-----

At this point I assume the Microchip component is a microcontroller with the information to be transmitted and the MAXIM chip is used as a Direct RF transmitter.


To further my knowledge, I have 3 tasks and I am open to suggestions for more:
1) Draw out the circuit diagram in hopes of getting a better understanding of components. If I have to desolder this may come last, or I will desolder and break it out on a breadboard to do further analysis. -- This should help me understand if the Direct RF theory is right.
2) 'Listen' to the RF data using a USB SDR.
3) Hook up a logic analyzer to the data on the Microchip component to see if I can glean more information that way.

Sorry for the double-post. It appears that my image did not post properly, so I have attached it to this post.

It seems relevant to mention that this is a two-layer board with only buttons on the other side. I will post a schematic when it is finished, most likely next week since I am traveling.

The 'M' chip is probably a variant of the PIC18F1220 but factory programmed for this particular application. The crystal and connections to the other IC seem to match those on the 1220 data sheet.

The 5101 looks to be a PLL sythesizer, probably producing RF at a multiple of 9.8437MHz. The manufacturer is difficult to tell but numbering like that and the font are like those used by Fujitsu, if it is, the full part number will probably be MB5101. A second guess would be Siemens.

Brian.

MB5101-4 looks up as a 1k Static RAM 256x4bit

It was just a guess, without a manufacturers name of logo it's very difficult to tell. As far as I know Maxim (from original post) always use a logo or 'MAX' prefix.

Brian.

betwixt said:

The 'M' chip is probably a variant of the PIC18F1220 but factory programmed for this particular application. The crystal and connections to the other IC seem to match those on the 1220 data sheet.

The 5101 looks to be a PLL sythesizer, probably producing RF at a multiple of 9.8437MHz. The manufacturer is difficult to tell but numbering like that and the font are like those used by Fujitsu, if it is, the full part number will probably be MB5101. A second guess would be Siemens.

Brian.

Click to expand...

Hi Brian and SunnySkyguy thank you both for the input, it is greatly appreciated.

Brian, I think you are spot on with your first post. I know the transmit frequency is 315Mhz, which corresponds to the datasheet below from Infineon on their 5101 PLL synthesizer.
**broken link removed**

To add to our confirmation, 315Mhz is a 32x multiple for the 9.8437Mhz crystal and from the datasheet we can see this is the recommended configuration for ASK-Mode. (pg 25) I assume also that pin 13 and 15 tie in to ground just under the chip. I will test with a multimeter to confirm.

The PIC suggestion sounds very likely as well. I will see if I can connect to it with any of my existing hardware.


Edit to add a picture of the TDK chips, look like the right markings.

Looks like the Murata CERALOCK 4.000 MHz resonator perhaps for baseband bi-phase modulation.