[Joel] has a remote control ceiling fan. It’s nothing special, the controller has a low-power 350MHz transmitter and a Holtek encoder to send commands by keying the transmitter’s output. Desiring something a little better, he set about reverse engineering the device’s protocol and implementing it on a Lattice iCE40 FPGA.
To decode the device’s packets he reached for his RTL-SDR receiver and took a look at it in software. GQRX confirmed the presence of the carrier and allowed him to record a raw I/Q file, which he could then supply to Inspectrum to analyse the packet structure. He found it to be a simple on-off keying scheme, with bits expressed through differing pulse widths. He was then able to create a Gnu Radio project to read and decode them in real time.
Emulating the transmitter was then a fairly straightforward process of generating a 350MHz clock using the on-board PLL and gating it with his generated data stream to provide modulation. The result was able to control his fan with a short wire antenna, indeed he was worried that it might also be doing so for other similar fans in his apartment complex. You can take a look at his source code on GitHub if you would like to try something similar.
It’s worth pointing out that a transmitter like this will radiate a significant amount of harmonics at multiples of its base frequency, and thus without a filter on its output is likely to cause interference. It will also be breaking all the rules set out by whoever the spectrum regulator is where you live, despite its low power. However it’s an interesting project to read, with its reverse engineering and slightly novel use of an FPGA.
Wireless remote hacking seems to be a favorite pastime here in the Hackaday community. We’ve had 2.4GHz hacks and plenty of wireless mains outlet hacks.
The ICE40 has quickly become my favourite fpga in the past year
I haven’t ever used the ICE40 FPGAs, but I just ordered the ICE40HX8K dev board from digikey so I can play around with icestorm and the up-and-coming RISC-V ISA without having to deal with the cancer that is the “Big Two’s” development software. Vivado, XSDK, ISE, etc. (and Altera’s offerings as well, I’d reckon) are all terrible pieces of software that should not have seen the light of day without a serious rewrite and proper linux port (why the hell people keep shelling out money for Windows is beyond me as well). However, I am not at all worried about getting this board up and running with the icestorm toolset, even if I’ve never used them before, because I have well-earned faith in the open source community. Bottom line: I can’t wait to see what this thing can do!
Altera’s Quartus II was the reason I avoided FPGAs like the plague until very recently. Its Linux port is especially bad: using a commercial Win32 porting library that craps itself when it encounters symbolic links.
Vivado/ISE has a linux port. Many industrial designs are P&R’ed with the linux toolchain on big compile farms. The gui is less than stellar, indeed.
FYI: If you ever use the phrase “why the hell people keep shelling out money for is beyond me” you come off as a snob. People like different things than you, its okay!
If you really want to play with Risc-V, then you want a board with SRAM. icoBoard.org is a well suited board for your purpose as there already exists a Risc-V SoC for it , and there was even Contiki as an OS ported to it.
https://github.com/cliffordwolf/icotools/tree/master/icosoc
https://github.com/osdomotics/osd-contiki/tree/ico
If you want to see what the thing can do, see the FPGA with a Risc-V in action driving a LED panel.
https://www.youtube.com/watch?v=hE6uRCurNAU
You can get an icoBoard at icoboard.org
Have fun!
What about the fan remotes that operate on 299.5Mhz. I haven’t been able to find a module for for that frequency.