Reverse-Engineering a Wireless BBQ Thermometer

[Bob] has his own smoker and loves to barbecue, but doesn’t like spending all day checking on his smoker’s temperature. He thought about building his own wireless thermometer setup, which would have been pretty awesome, but then he had a better idea: why not hack an existing wireless barbecue thermometer? [Bob] purchased an off-the-shelf wireless BBQ thermometer and reverse-engineered its wireless protocol to make his own wireless thermometer setup.

The first problem [Bob] encountered was figuring out the frequency of the transmitter. Thankfully [Bob] had access to a spectrum analyzer, where he discovered the transmitter was running at 433.92MHz (a cheap RTL-SDR dongle would also get the job done). Next, [Bob] started digging into the manufacturer’s FCC filings and found that it actually called out the transmit frequency, which matched the transmit frequency he measured. He also found a ton of other helpful information in the filing, like a block diagram and full transmitter schematic.

[Bob] used a Radiometrix RF module to receive the thermometer’s signal. He hooked up the output to his logic analyzer to start decoding the protocol. After a quick visual analysis, [Bob] found that the signal was a preamble followed 13 bytes of Manchester-encoded data being transmitted at 2kbps. He started collecting data with known temperatures, created a table of the data, and began looking for patterns. After quite a bit of searching [Bob] was successfully able to find and parse the temperature values out of the data stream. [Bob] did a great job of documenting his process and results, so check out his writeup if you want to try it out yourself.

IR remote as PC input

As a learning experience [GeriBoss] put together an IR remote control receiver board for his PC. His want of volume control from across the room was reason enough to undertake the project, and he got to work with a 38 kHz receiver module and Manchester encoding in the process.

The decoder portion of the project is built around an ATtiny2313 chip. The external interrupt pin (INT0) is connected to a TSOP31238. When it decodes a valid remote code it pushes a character to the RS232 chip connecting to the computer’s serial port.

We think this is a wonderful accomplishment for [GeriBoss], but we encourage him to refine the design further. You’ll notice in the image there’s a USB port on the board which is only used to provide regulated power. We know it’s possible to use V-USB with the ATtiny2313 to add USB functionality and this would be a great way to learn about it. We’d also like to mention the resistor and capacitor suggested for filtering the IR receiver module signal. We’ve included the recommended application schematic for that part after the break.

Continue reading “IR remote as PC input”

Raspberry Pi controlled tank goes deeper than you might think

This remote control tank now takes its orders from a Raspberry Pi board. Well, actually it’s taking orders from commands pushed to the RPi board via SSH. The control scheme works out quite well. Using a low-profile WiFi dongle the RPi automatically connects to the wireless network when it is powered on. This makes it a snap to SSH into the device, and a more user-friendly controller will put a nice front-end into play at some time in the future.

But the real meat and potatoes of the hack comes in getting the RPi to talk to the tank’s circuitry. Just getting the Heng Long Tiger I remote control tank apart proved to be a ton of work as the treads need to be removed to do so and there’s a lot of screws holding it together. Instead of just replacing all of the control circuitry [Ian] wanted to patch into the original controller. To do so he spent a bit of time analyzing the signals with an oscilloscope and discovered that commands were coming in a Manchester encoded format. He established what various packets were doing, used a transistor to protect the GPIO pin on his board, and now has full control of the Tank. The final part of the hardware alteration was to power the RPi from the Tank’s battery.

After the break you can catch a demo of the reassembled tank sporting its new wireless controller.

Continue reading “Raspberry Pi controlled tank goes deeper than you might think”

Light programming for a clock


So at first glance we were thinking there wasn’t much special about this clock. It’s based on an Arduino and displays the time using a character LCD screen. But then we realized that there’s no battery-backed RTC and no buttons. How the heck do you set the time on this thing? [Mossblaser] is using a light programmer to set the time using a computer screen.

We’ve tried nearly the same data transfer technique before, using a white and black flashing computer screen to push Manchester encoding to a light dependent resistor. We were met with limited success, but you can see that [Mossblaser’s] rig is much more reliable and we think there’s a few reasons behind this. First, he’s only sending five bits per seconds, a very slow speed when it comes to digital transmissions. This helps to make up for slow LCD screen refresh. Also, the LDR is surrounded by material on the back of the case that will help to block out ambient light. And finally, he’s using a smaller part of the screen instead of flashing the whole thing. This may result in more accurate timing. You’ve got to admit, this is pretty slick!

Continue reading “Light programming for a clock”

Microcontroller comm with a computer monitor

Prolific Hack a Day author [Mike S] has been playing in his lab again and he’s come up with a neat way to talk to microcontrollers with an LCD monitor. The basic idea behind [Mike]’s work isn’t much different from the weird and/or cool Timex Datalink watch from the 1990s.

Despite the fancy dev board, the hardware is very simple – a photoresistor is pointed at a computer monitor and reads bits using Manchester encoding. The computer flashes a series of black and white screens thanks to a simple Javascript/HTML page, and data is (mostly) transmitted to the micro. [Mike] says he has about a failed message about 60% of the time, and he’s not quite sure where the problem is. He’s looking into another kind of Manchester encoding that uses samples instead of edges, so we hope everything works out for him.

This build is very similar – and was inspired by – an earlier post about microcontroller communication with flashing lights. Still, [Mike]’s build reminds us of the strangely futuristic Ironman watch we had in ’97. Check out [Mike]’s demo of his computer/micro comm link after the break and his code on github.

Continue reading “Microcontroller comm with a computer monitor”

Infrared transmission decoding

Alright class, quiet down and open your books to the chapter on Manchester Encoding. [Brian J Hoskins] did just that when building this RC5 decoder. This protocol is commonly used in television remote controls. You use them on a daily basis, don’t you think it’s time you understood what’s going on? Check out his writeup and learn the dark art of invisible light communication. Or just skip the learning and follow our how-to.

[Thanks Tim]