Reverse engineering radio controlled outlets

[Chr] picked up a pack of remote control outlets in order to reverse engineer them and build control into his own projects. These can be plugged into outlets around your house and a relay inside each module will switch whatever device is plugged into it after receiving a command from the remote. Once he cracked open the control housing it was easy to find the data line for the RF module which was on its own board. He used a logic analyzer to capture data from various button presses and then spent some time deciphering the communication protocol. He used what he learned to roll the module and code into an interface box where an ATmega8 connects via USB and passes commands from a computer to the RF board. Now he’s added home automation via a computer quite inexpensively. After the break you can watch a clip of the outlets switched using a smartphone.

So why not just patch into the buttons on the remote? Well, this same project was attempted at our local hackerspace earlier this month and the buttons don’t just pull a pin to ground. They use tri-state logic and are arranged into a matrix that is a lot harder to mimic (if not impossible) with a microcontroller. Analyzing the communications going into the RF module is definitely the less labor-intensive of the two approaches.

Comments

  1. Louie says:

    There’s a company that reverses these for their 3rd party usb-controller, and they release their code. check out http://www.telldus.se/

    (I’m just a user, not affiliated with the company in any way)

  2. ralfm says:

    regarding patching into the buttons: what about using solid state relais?

  3. NsN says:

    I did something similiar for my home automation setup. One main difference as far as i can see: I use an arduino with an ethernetshield as the main controller, so no computer is necessary. I can interface with the system over usb, ethernet, IR or 868 mhz FSK radio.

    A few reference:
    Jee labs: http://talk.jeelabs.net/
    Particularly this post: http://talk.jeelabs.net/topic/407

    Some german info about the protocol (The pictures might be enough otherwise i will gladly translate)
    http://avr.börke.de/Funksteckdosen.htm
    http://avr.börke.de/ARCTECHsteckdosen.htm
    http://thomaskropf.at/index.php?option=com_content&task=view&id=19&Itemid=28

    Bye,
    NsN

  4. YaBa says:

    JeeLabs has one solution to these outlets too.
    It’s an Arduino with RFM module and software to encode in different protocols.
    Check it out, JeeNode is very nice.

  5. YaBa says:
  6. Instructabliss reports a login failure.

    It looks like the instrucabliss site either requires its own login, or its proxy login to instructables.com has been suspended.

    Is instructables.com getting greedy AND snarky?

  7. JC says:

    Very cool! It’s always a pain when things aren’t just a simple 0 or 1.

  8. NsN says:

    ralfm:
    It even works with a multiplexer, with that you can switch between floating and either Vin or GND.
    But basically this is a waste of ports and a pain in the butt (because of resistance, soldering, etc), especially if you need radio communication anyways.

  9. Karl says:

    use opto-isolators across the button contacts – just verify the relative +/- polarity, and connect the opto-isolators accordingly.

  10. Michiel Spithoven says:

    Nice, but why not just jumper the original buttons with a PIC? :)

  11. marshall says:

    Yep – we made something like that a few months before – 12 Channels, IPhone Interface and disco mode ;) – based on a velleman k8055, a few relais, transistors and tons of isolation tape ;)

  12. marshall says:

    And Perl … perl is a weapon

  13. dan fruzzetti says:

    Quite inexpensively? It’s cool that he used a bunch of his time to learn this, so there’s good return (knowledge) on capital investment (time == money); however, you can do this with a $20 X10 kit that probably costs less working time to buy than the time spent hacking this system.

    So, while I give him credit for being awesome, one day when he has kids he’ll be like “man, there’s got to be a solution I can just buy.”

  14. foo says:

    These have been reverse engineered before: http://translate.google.de/translate?hl=en&sl=de&u=http://www.das-labor.org/wiki/Funkfernbedienung&ei=0nFATYbSGYOGswaKkfHUBA&sa=X&oi=translate&ct=result&resnum=1&ved=0CB0Q7gEwAA&prev=/search%3Fq%3Dhttp://www.das-labor.org/wiki/Funkfernbedienung%26hl%3Den%26sa%3DG%26prmd%3Divns

    I even have something like this running for years now. I always wondered if I could just build a very high powered sender, direct it to some big building and cycle through all the available codes…

  15. h3po says:

    @foo: nope, the ones used at “das labor” are different models with a completely different protocol. the model chr used is a pretty good choice if you’re in germany, as they appear at local stores every few months for only 15€ a kit.

  16. one2one.121 says:
  17. echodelta says:

    X 10 is slaughtered by noise. The most useless thing I ever owned. It couldn’t turn a light on in the same outlet, reliably.

  18. James Glanville says:

    Looks good, but surely if it’s a tri-state matrix you could just the fact that avrs can do high/low/high impedance?

  19. Whatnot says:

    That you can’t hack the buttons is rubbish, so you can’t pull them to ground? then you simply use an electronic switch to tie the pins, don’t tell me that’s so impossible, $0.80 part will do it.

    This was nicely done though and is more ‘classy’, but to say the other method can’t be done or is so hard is just silly surely.

  20. uky says:

    I recently bought $6 chinese infrared controlled outlet which performed suprisingly well. The outlet programs to any existing remote control easily. It is definitely an alternative method worth looking into. It certainly isn’t as functional as a radio controlled one, but for the price it can work very well for some setups.

    http://cgi.ebay.com/IR-Infrared-Remote-Control-Power-US-Outlet-Switch-Plug-/350430278200?pt=LH_DefaultDomain_0&hash=item519745b238

  21. Erik Johansson says:

    Does anyone know how much overhead in power usage these things give? Is it constant ~9W or is it dependent on how much the appliance that is pluged in draws.?

  22. Cyk says:

    There’s an interesting project called “Ethersex”.
    It’s a universal firmware for ATMega’s, that
    routes tcp and udp over FSK RF modules, ethernet,
    USB, CAN, RS485, etc.
    It also supports sending ASK codes using a RFM12
    RF module, so you can use it to switch radio controlled outlets.
    It’s easy to build a USB to RF stick, or an Ethernet
    to RF gateway, without writing a single line of code.
    Unfortunately, the website is in german, but the build environment is english.

    http://www.ethersex.de

  23. Figgesoft says:

    This looks same as tellstick
    (usb-stick based of a ftdi-chip, pic cpu and rf-chip).

    The only problem I found was the latency (seems that the codes are sent >2 times at 9600bps which gives latency at the receiver, the driver is however ‘open source’ ^^,

    http://www.telldus.se/

  24. James says:
  25. Owen says:

    The button patch hack can be done on those remotes quite easily. I did it a couple of years ago on my set of RF plugs (exactly like the ones pictured, but UK plugs/sockets).

    A quick scan across the keypad with a multimeter gave me the matrix layout, then I installed a pin header soldered to the required connections, then stuck it down using hot glue and cut a small square in the remote access it easily but keep it functioning normally when not in use.

    Then I made an interface board using two cheap HEF4051 8-channel multiplexers to simulate the key presses. The whole hack was quite quick to do.

    I can document it with pictures/schematics if anyone’s interested.

  26. Gerjan says:

    I already have a setup like this at home. Granted, I didn’t do the hard work myself. Below is a link that explains how to control these sockets with an Arduino and a 433Mhz transmitter. Sample code included. It’s all in Dutch, though…

    http://gathering.tweakers.net/forum/list_messages/1268154/0

  27. danielle says:

    i have a dozen philips remote controlled outlets that i want to change to channel F…so one remote works for all of them. is this easy? how’s it done?

  28. Aybek says:

    I am very new to this but what i am trying to acomplish is to control my ir and rf devices ( power sockets and light switches) with my galaxy tab 10.1 via direct blutooth or wifi connection without using a computer or any other device.

    Basicly what i want is that a device that can revieve my commands over bluetooth or wifi and send them via rf and ir ( according to what device is). i want to control eveyrthing that can be remote controlled by my tablet.

    According to what i gather and learn it is possible to crate a ir and rf controller to be able to used by smartpohe or comuter. The part that i dont understand is how to remove computer and internet from this build. I would love it if u could help me or send me in the right direcion…

  29. bob23 says:

    Handy library for remote controlled outlets:

    http://code.google.com/p/rc-switch/

    • Terry says:

      I can’t wait to integrate the “electric imp” with remote controlled sockets, either by hacking the physical remote or transmitter and protocol emulation.

      It will be possible to order an imp compatible arduino shield. The code is ready, we’re just waiting for the hardware!!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 92,109 other followers