Reverse Engineering Radio Controlled Outlets

[Chr] picked up a pack of remote control outlets in order to reverse engineer them and build control into his own projects. These can be plugged into outlets around your house and a relay inside each module will switch whatever device is plugged into it after receiving a command from the remote. Once he cracked open the control housing it was easy to find the data line for the RF module which was on its own board. He used a logic analyzer to capture data from various button presses and then spent some time deciphering the communication protocol. He used what he learned to roll the module and code into an interface box where an ATmega8 connects via USB and passes commands from a computer to the RF board. Now he’s added home automation via a computer quite inexpensively. After the break you can watch a clip of the outlets switched using a smartphone.

So why not just patch into the buttons on the remote? Well, this same project was attempted at our local hackerspace earlier this month and the buttons don’t just pull a pin to ground. They use tri-state logic and are arranged into a matrix that is a lot harder to mimic (if not impossible) with a microcontroller. Analyzing the communications going into the RF module is definitely the less labor-intensive of the two approaches.

[youtube=http://www.youtube.com/watch?v=_Nn7xAD_cVE&w=470]

31 thoughts on “Reverse Engineering Radio Controlled Outlets

  1. I did something similiar for my home automation setup. One main difference as far as i can see: I use an arduino with an ethernetshield as the main controller, so no computer is necessary. I can interface with the system over usb, ethernet, IR or 868 mhz FSK radio.

    A few reference:
    Jee labs: http://talk.jeelabs.net/
    Particularly this post: http://talk.jeelabs.net/topic/407

    Some german info about the protocol (The pictures might be enough otherwise i will gladly translate)
    http://avr.börke.de/Funksteckdosen.htm
    http://avr.börke.de/ARCTECHsteckdosen.htm
    http://thomaskropf.at/index.php?option=com_content&task=view&id=19&Itemid=28

    Bye,
    NsN

  2. ralfm:
    It even works with a multiplexer, with that you can switch between floating and either Vin or GND.
    But basically this is a waste of ports and a pain in the butt (because of resistance, soldering, etc), especially if you need radio communication anyways.

  3. Yep – we made something like that a few months before – 12 Channels, IPhone Interface and disco mode ;) – based on a velleman k8055, a few relais, transistors and tons of isolation tape ;)

  4. Quite inexpensively? It’s cool that he used a bunch of his time to learn this, so there’s good return (knowledge) on capital investment (time == money); however, you can do this with a $20 X10 kit that probably costs less working time to buy than the time spent hacking this system.

    So, while I give him credit for being awesome, one day when he has kids he’ll be like “man, there’s got to be a solution I can just buy.”

  5. These have been reverse engineered before: http://translate.google.de/translate?hl=en&sl=de&u=http://www.das-labor.org/wiki/Funkfernbedienung&ei=0nFATYbSGYOGswaKkfHUBA&sa=X&oi=translate&ct=result&resnum=1&ved=0CB0Q7gEwAA&prev=/search%3Fq%3Dhttp://www.das-labor.org/wiki/Funkfernbedienung%26hl%3Den%26sa%3DG%26prmd%3Divns

    I even have something like this running for years now. I always wondered if I could just build a very high powered sender, direct it to some big building and cycle through all the available codes…

  6. @foo: nope, the ones used at “das labor” are different models with a completely different protocol. the model chr used is a pretty good choice if you’re in germany, as they appear at local stores every few months for only 15€ a kit.

  7. That you can’t hack the buttons is rubbish, so you can’t pull them to ground? then you simply use an electronic switch to tie the pins, don’t tell me that’s so impossible, $0.80 part will do it.

    This was nicely done though and is more ‘classy’, but to say the other method can’t be done or is so hard is just silly surely.

  8. I recently bought $6 chinese infrared controlled outlet which performed suprisingly well. The outlet programs to any existing remote control easily. It is definitely an alternative method worth looking into. It certainly isn’t as functional as a radio controlled one, but for the price it can work very well for some setups.

    http://cgi.ebay.com/IR-Infrared-Remote-Control-Power-US-Outlet-Switch-Plug-/350430278200?pt=LH_DefaultDomain_0&hash=item519745b238

  9. There’s an interesting project called “Ethersex”.
    It’s a universal firmware for ATMega’s, that
    routes tcp and udp over FSK RF modules, ethernet,
    USB, CAN, RS485, etc.
    It also supports sending ASK codes using a RFM12
    RF module, so you can use it to switch radio controlled outlets.
    It’s easy to build a USB to RF stick, or an Ethernet
    to RF gateway, without writing a single line of code.
    Unfortunately, the website is in german, but the build environment is english.

    http://www.ethersex.de

  10. The button patch hack can be done on those remotes quite easily. I did it a couple of years ago on my set of RF plugs (exactly like the ones pictured, but UK plugs/sockets).

    A quick scan across the keypad with a multimeter gave me the matrix layout, then I installed a pin header soldered to the required connections, then stuck it down using hot glue and cut a small square in the remote access it easily but keep it functioning normally when not in use.

    Then I made an interface board using two cheap HEF4051 8-channel multiplexers to simulate the key presses. The whole hack was quite quick to do.

    I can document it with pictures/schematics if anyone’s interested.

  11. I am very new to this but what i am trying to acomplish is to control my ir and rf devices ( power sockets and light switches) with my galaxy tab 10.1 via direct blutooth or wifi connection without using a computer or any other device.

    Basicly what i want is that a device that can revieve my commands over bluetooth or wifi and send them via rf and ir ( according to what device is). i want to control eveyrthing that can be remote controlled by my tablet.

    According to what i gather and learn it is possible to crate a ir and rf controller to be able to used by smartpohe or comuter. The part that i dont understand is how to remove computer and internet from this build. I would love it if u could help me or send me in the right direcion…

    1. I can’t wait to integrate the “electric imp” with remote controlled sockets, either by hacking the physical remote or transmitter and protocol emulation.

      It will be possible to order an imp compatible arduino shield. The code is ready, we’re just waiting for the hardware!!

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.