Air Conditioner Remote Reverse Engineered Despite Esoteric Protocol

Infra-red remote control is something of a Done Deal when it comes to hardware hacking, it has been comprehensively reverse engineered, and there exist libraries and software packages to seamlessly take care of all its quirks. Just occasionally though, along comes an IR remote whose protocol doesn’t follow that well-worn path

[William Dudley] found himself in this position with an air-conditioning unit remote control. He found it sent a stream of data with all settings of the machine rather than the single command codes you might expect from a familiar TV remote. The solution was to reverse engineer and reimplement the IR codes.

His reverse engineering relied on an Arduino and IR receiver which he used to sniff the packets coming out of the remote. Eventually he was able to recognise some of the functions from the remote, and create his own protocol that can recreate most of the remote’s functions. This was pushed over to a Raspberry Pi Zero which uses an IR LED to command the air conditioner, joining the ranks of his growing home automation setup.

The write-up makes for a fascinating primer on analysis of obscure IR protocols, and is well worth a read for anybody with an interest in the topic. Meanwhile if you want more IR reverse engineering stories, try this tale of a bathroom scale.

23 thoughts on “Air Conditioner Remote Reverse Engineered Despite Esoteric Protocol

  1. I just want a remote that can turn a GE windows AC on and off, according to the setting of a thermostat across the room. Crazy AC temp sensor is wildly inaccurate, claiming it’s 65F in the room when it’s actually near 80F.

        1. Weird, I’ve got a Haier AC and it displays the target temp at all times except when I put it either in fan or dehumidifier mode. I think mine’s only a couple years old though so maybe that’s been changed since your model.

    1. Back in the 90’s, I worked in a shop where someone had hardwired the window A/C to be controlled with a conventional wall-mounted thermostat. I seem to work just fine. I never knew if it was a “hack” or a feature of the A/C that allowed for a remote connection. But the way we jury rigged and improvised stuff, I’m leaning to the first option.

  2. I had experience with doing something similar, the air conditioner in my student room had a remote that consumed AAA batteries like crazy. I recorded the signal to turn the AC on and off (electrically tapping into the using an AVR and then reproduced the signal using an ESP-01. In the end, I could implement complex schedules using basic scripting and netcat on my machine which would be talking to the ESP

    I’m new to blogging so here’s my (rather poor) attempt at it.
    http://goblintinker.blogspot.com/2018/05/that-blinky-part-1.html

    1. “consumed AAA batteries like crazy”

      Anything that uses AAA batteries consumes them like crazy, I’ve been coming to the conclusion that it’s actually a form of votive offering to keep a lesser known god alive rather than being an actual useful battery format.

  3. I just completed a similar project for the AC unit in my shop. I used NodeMCU hardware to first record the packets using the IRrecvDumpV2 example in the IRremoteESP8266 library, and then turned that around to blast packets back out (after spending a bit of time decoding them). Now my OpenHab home automation system communicates with the NodeMCU hardware via MQTT, and lets me cool the shop down from work so its comfortable by the time I get home.

  4. Window A/C’s have always had rock salt (not just a grain of salt) for a temperature control. Just because it’s digital don’t mean beans. The remote type aren’t any better. Energy saving mode turns off fan so air room temp is a wild card.

    The real hack here is to just turn the A/C on or off according to a decent algorithm of sensing and response, temp and humidity curves included.

    1. You actually don’t entirely want it solely controlled by a remote setup because some of the controls are to prevent freezing and the like. I discovered this earlier this summer when the control board died in my old Frigidaire unit. I decided I’d hardwire the fan and compressor. The nights would dip to around 60F*** which makes the indoor coil(of all AC units, window or not) susceptible to freezing and it didn’t have anything to turn it off when the coil got to that temp. I eventually had to replace the whole thing because when I put a manual temp control board on it I discovered what killed the original board: the startup windings of the fan/blower were dying and drawing a ton of current.

      ***while it would dip into the 60s outside, this is in my server room on the 2nd floor so I was still experiencing 80F+ temps even while the coil was around 25-30F.

    1. (Replying to myself because I’m an idiot and hit enter too soon) I first tried to decode the Remote’s IR, never got soemthing reliable. Then I hooked a cheap logic analyser on the emmeter IR diode on the remote and got the “real” signal, without the distortion of the transmit line and IR receiver/decoder. A was the able to simulate my own with 100% accuracy. I first diid this with a teensy 3.0 + Ethernet adapter + I2C temp & hum sensor + I2C lux sensor + IR LED. I recently ditched this setup (because I wasn’t able to recompile my code with the updated libraries) and replaced it with an esp8266+sensors. Since then the original remote was destroyed by a battery leak, I’m glad I have my uppgraded backup :)

  5. I was too lazy to deal with the IR. Popped the faceplate off, found the test points, and took direct control. Mine has a fan on/off test point (to whatever the speed setting is) and a compressor run test point. No more was needed.

  6. I reverse engineered* Microsoft’s funky IR protocol for their media center keyboards, which was almost, but not quite like NEC32 format. Actually, you could call it NEC35 format since it had 35 bits per command/keystroke. The hardest part was their obfuscated checksum generation. Now with one button press on a universal remote, I can type in my password, launch programs and websites, copy files, or play a particular song.
    *Credit where credit is due: several other people figured out bits and pieces of it, but never completed it. I put it all together and figured out the remaining bits. I would thank them personally, but none of them signed their work.

    1. Where can I find your work? I don’t have an immediate (or forseeable) need, but such things are very difficult to search google for – it seems all you get these days are links to ebay…

      1. I haven’t gotten around to publishing it yet, although was planning to publish it on RemoteCentral.com and JP1 (hifi-remote.com). I have an Excel spreadsheet that has just about any code you are likely to want in it, and if not, I have a Windows app in C# that will generate ANY possible code.
        Fair warning: Once I got it finished, I discovered that it actually takes a fair bit of time to transmit a bunch of keystrokes. I can actually type it out on the keyboard faster (although I am a good typist). Convenient nonetheless for infrared macros.
        Ping me at wizard at wizster dot com and I’ll send you copies.

  7. I really need to do something like this to figure out a problem with a room heater I have, on occasion turning the tv volume down using a xbox1 media remote will change the mode settings of the heater but not at a repeatable level (maybe once in 20 times) so I am assuming that its just some combination of the remote to xbox infrared signals and the kinect to tv infrared signals looking like the mode change that the heater expects.

Leave a Reply to OstracusCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.