A few weeks ago I discovered a cheap wireless power control set from Clas Ohlson. At first I intended to use it with my universal remote, but this turned out to be impossible because the universal remote was infrared (IR) only, and the power unit was RF (433 MHz). So I would have to shell out $400 for a more fancy remote… or, I could hack the light controller!

I wanted to add an IR receiver to the RF remote control, and use it as a transceiver / repeater, so I could use my universal remote to control the RF light switches.

2010-02-14 18.53.21

Opening the remote

I brought the gear to PING, where Håvard and I disassembled it. The remote control contains two PCBs:

  • Frontend with 6 buttons, an LED, a channel selector, a 12V battery, and a signal encoder chip
  • Backend with RF unit

The two PCBs were connected with GND, SIG (+5v) and VCC (+12v).

Decoding the protocol

a1-on

Trace of "A1 ON" command

Physical layer

We hooked up our logic analyzer between the two units, and recorded the signal.

The physical layer protocol was easy to reverse by looking at the trace, two patterns was clearly visible: 1000 and 1110. It looks like each data bit is represented by four bits in the physical layer; a start bit (high), the data bit repeated twice, and then a stop bit (low).

0 = 1000
1 = 1110

Data link/application layer

We then tried to analyze the higher level protocol, first we decoded channel A, lamp 1, button “On” and “Off”:

0001 0101 0001 0101 0101 0111 0
0001 0101 0001 0101 0101 0100 0

Finding the difference was easy; 11 is on and 00 is off.

Next we needed to understand the addressing, and so we recorded and decoded most of the possible “On”-signals:

A1-ON : 0001 0101 0001 0101 0101 0111 0
A2-ON : 0001 0101 0100 0101 0101 0111 0
A3-ON : 0001 0101 0101 0001 0101 0111 0

B1-ON : 0100 0101 0001 0101 0101 0111 0
B2-ON : 0100 0101 0100 0101 0101 0111 0
B3-ON : 0100 0101 0101 0001 0101 0111 0

C1-ON : 0101 0001 0001 0101 0101 0111 0
C2-ON : 0101 0001 0100 0101 0101 0111 0
C3-ON : 0101 0001 0101 0001 0101 0111 0

D1-ON : 0101 0101 0001 0101 0101 0111 0
D2-ON : 0101 0101 0100 0101 0101 0111 0
D3-ON : 0101 0101 0101 0001 0101 0111 0

So each packet (which was repeated several times when pushing a button) had the following structure:

CHANNEL-NO[6] 01 LIGHT-NO[6] 01 0101 01 STATE[2] 0

Channels:

A = 000101
B = 010001
C = 010100
D = 010101

Lights:

1 = 000101
2 = 010001
3 = 010100

15 Responses to “IR-RF transceiver: Part I – Taking stuff apart”

  1. Manie Bakhshian Says:

    Aw, this was a very nice post. In idea I want to put in writing like this moreover ?taking time and precise effort to make a very good article?but what can I say?I procrastinate alot and not at all appear to get something done.

  2. Calgary wedding photographer Says:

    …[Trackback]…

    More info…

  3. source Says:

    Cool post ! Thanks for, posting on this blog man! I will message you soon! I didnt realise that!

  4. social network Says:

    Please let me know if you’re looking for a article writer for your blog. You have some really good articles and I think I would be a good asset. If you ever want to take some of the load off, I’d
    absolutely love to write some content for your blog in
    exchange for a link back to mine. Please blast me an email if interested.
    Cheers!

  5. Hershel Says:

    Oh my goodness! Impressive article dude! Thank you so much, However I
    am having difficulties with your RSS. I don’t know the reason why I cannot subscribe to it. Is there anybody having similar RSS problems? Anyone that knows the solution will you kindly respond? Thanks!!

  6. Coast Gaurd Museum Says:

    Way cool! Some very valid points! I appreciate
    you writing this article and the rest of the website is really good.

  7. Rechtsschutzversicherung Test 24 Says:

    Greetings! Very helpful advice in this particular article!
    It is the little changes that will make the most important
    changes. Thanks for sharing!

  8. ????? Says:

    ????????

  9. google.com Says:

    Actually when someone doesn’t be aware of afterward its up
    to other people that they will help, so here it occurs.

    My web blog … search engine optimization (google.com)

  10. abc mouse coupom Says:

    Wow! After all I got a webpage from where I can truly get helpful facts concerning my study and knowledge.

  11. diet to go coupons discount Says:

    Howdy just wanted to give you a quick heads up.
    The text in your content seem to be running off the screen in Ie.
    I’m not sure if this is a formatting issue or something to do with web browser compatibility but I thought I’d post
    to let you know. The layout look great though! Hope you get the issue fixed soon.

    Many thanks

  12. gourmet monthly clubs promotional coupons Says:

    I just like the valuable information you supply to
    your articles. I’ll bookmark your weblog and test once more here frequently.
    I’m slightly sure I’ll be informed a lot of new stuff right here!
    Good luck for the next!

  13. hale groves coupons Says:

    Right now it sounds like Drupal is the preferred blogging platform out there right now.
    (from what I’ve read) Is that what you are using on your blog?

  14. laithwaites wine discount code coupon Says:

    Hi there, I desire to subscribe for this blog to take hottest updates, so where can i do it
    please assist.

  15. love scent internet coupon codes Says:

    Today, I went to the beachfront with my kids. I found a sea shell and gave it
    to my 4 year old daughter and said “You can hear the ocean if you put this to your ear.” She put the shell to her ear and screamed.
    There was a hermit crab inside and it pinched her
    ear. She never wants to go back! LoL I know this is
    completely off topic but I had to tell someone!

Leave a Reply