Emulating A Remote Control Ceiling Fan Transmitter In An FPGA

[Joel] has a remote control ceiling fan. It’s nothing special, the controller has a low-power 350MHz transmitter and a Holtek encoder to send commands by keying the transmitter’s output. Desiring something a little better, he set about reverse engineering the device’s protocol and implementing it on a Lattice iCE40 FPGA.

To decode the device’s packets he reached for his RTL-SDR receiver and took a look at it in software. GQRX confirmed the presence of the carrier and allowed him to record a raw I/Q file, which he could then supply to Inspectrum to analyse the packet structure. He found it to be a simple on-off keying scheme, with bits expressed through differing pulse widths. He was then able to create a Gnu Radio project to read and decode them in real time.

Emulating the transmitter was then a fairly straightforward process of generating a 350MHz clock using the on-board PLL and gating it with his generated data stream to provide modulation. The result was able to control his fan with a short wire antenna, indeed he was worried that it might also be doing so for other similar fans in his apartment complex. You can take a look at his source code on GitHub if you would like to try something similar.

It’s worth pointing out that a transmitter like this will radiate a significant amount of harmonics at multiples of its base frequency, and thus without a filter on its output is likely to cause interference. It will also be breaking all the rules set out by whoever the spectrum regulator is where you live, despite its low power. However it’s an interesting project to read, with its reverse engineering and slightly novel use of an FPGA.

Wireless remote hacking seems to be a favorite pastime here in the Hackaday community. We’ve had 2.4GHz hacks and plenty of wireless mains outlet hacks.

7 thoughts on “Emulating A Remote Control Ceiling Fan Transmitter In An FPGA

    1. I haven’t ever used the ICE40 FPGAs, but I just ordered the ICE40HX8K dev board from digikey so I can play around with icestorm and the up-and-coming RISC-V ISA without having to deal with the cancer that is the “Big Two’s” development software. Vivado, XSDK, ISE, etc. (and Altera’s offerings as well, I’d reckon) are all terrible pieces of software that should not have seen the light of day without a serious rewrite and proper linux port (why the hell people keep shelling out money for Windows is beyond me as well). However, I am not at all worried about getting this board up and running with the icestorm toolset, even if I’ve never used them before, because I have well-earned faith in the open source community. Bottom line: I can’t wait to see what this thing can do!

      1. FYI: If you ever use the phrase “why the hell people keep shelling out money for is beyond me” you come off as a snob. People like different things than you, its okay!

      2. If you really want to play with Risc-V, then you want a board with SRAM. icoBoard.org is a well suited board for your purpose as there already exists a Risc-V SoC for it , and there was even Contiki as an OS ported to it.

        https://github.com/cliffordwolf/icotools/tree/master/icosoc
        https://github.com/osdomotics/osd-contiki/tree/ico

        If you want to see what the thing can do, see the FPGA with a Risc-V in action driving a LED panel.

        You can get an icoBoard at icoboard.org

        Have fun!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s