The plethora of wireless communications technologies have cut the comms wire for many applications, but these devices still require power. For home automation, this might mean a battery or mains power, but there is also an alternative that we don’t see often: Kinetic power. [Bigclivecom] bought some kinetic switches from eBay and gave it his usual reverse engineering treatment.
True to the marketing, these switches do not require external power or a battery to send a wireless signal. Instead, it harvests energy from the magnetic latching action of the switch itself. When the switch is actuated, a small current is induced in a coil as the polarity of the magnetic field through its core changes rapidly. Through a series of diodes and resisters, the energy is stored in a capacitor, which is then used to power a small transmitter chip. The antenna coil is wrapped around the switch housing.
The receiver side is powered by mains and includes a relay output for lights. It would be really nice to have a hacker-friendly module for projects. We would be curious to see the range that these devices are capable of.
The same technology is used inside the Philips Hue Tap switch, of which Adafruit did a teardown a few years ago. If you want to learn more about RF modulation, check out the crash course article we put out a while back. Of course, the RTL SDR is an indispensable and affordable tool if you want to do some experimentation.
Interesting though I wouldn’t want something so insecure in my home. I’m sure there are peculiar situations where this is an ideal switch but nothing comes to mind.
Seems ideal to turn off a lamp after exiting the room, instead of walking further in to turn it off and walking twice the distance to leave while in the dark.
If someone is inside of my house in order to perform a replay attack, the light and its switch is extremely far down the list of concerns from having a stranger in my house :P
I don’t remember the brand, but I have something similar as a door bell. It is quite useful as the main doesn’t go to the garden gate and you never know when a battery powered switch will fail. In this situation, I don’t see security as much of a concern since the device is outside anyway.
If someone is motivated enough to have a crack at a light switch, they’ll certainly be motivated enough to find an opening in something more worthwhile, like your network.
Besides, we don’t really have a clue how secure or insecure this is. For all we know it sets itself up properly when you pair them. Or not.
I could see a wireless switch controlling several other switches in a different location. A master-slave arrangement. Easier than running a bunch of wires especially in older buildings.
That was my first thought. If you were to rewire an old house it would be nice not needing to run wires to switches, and also to have multiple switches for the same thing like the top and bottom of a stair case or the far ends of a hallway.
Reg, thanks for your comment. In an older building a wireless switch would be a plus.
I would not consider this less secure than a normal remote controlled socket. And the worst thing somebody could do, is switching on a decorative light in the living room.
Less secure than easily accessible wires attached to the side of the house? Or a residential lock? It’s all relative, I guess.
Curious how this is done with the hue tab though, as hue is ZigBee based and I wonder if you can harvest enough energy to do a encrypted/signed ZigBee message …
Likely a bridge unit somewhere
https://zigbeealliance.org/wp-content/uploads/2019/11/docs-09-5499-26-batt-zigbee-green-power-specification.pdf
It’s part of the ZigBee specification.
Got a similar one on Amazon 2 years ago, broke after 18 Months. Unclear what broke, but other users reported the same issue.
Just out of curiosity, did you dissect the one you got from Amazon? It sounds like it may have been powered by a button cell that died.
I’ve got acne of these off ebay. Interesting to see how they work. I honestly suspected they had a small button cell hidden in them and they’d die after 3 months, but it’s been working for years now so is presumably legit!
I really would have liked to see waveforms of the switch toggle events and following power supplies. Perhaps some day….
Good Job!
yeah… would have been nice to see some V/A traces around the coil and around the voltage regulator during operation.
Most interesting would be the size of the storage capacitor, and the peak voltage it’s charged to. From that you can calculate the final harvested energy.
I was a bit surprised by the simplicity of the energy harvester.
You could quite easily hack a bigger version together from a relay coil and a nibbidibbibidium magnet. although the arrangement described in US7710227 is slightly easier to hack together.
So, like an old-style dynamo-powered blasting machine.
The inimitable Cody’s Lab shows one in detail: https://youtu.be/wh8FbnZdhJg
We need these in car remotes NOW. I am sick of changing the batteries.
What on earth are you doing to burn through batteries?
I’ve had just one die, after 10 years (an ’08, replaced in ’18). The ones from my ’03 outlived the car (12 years). My ’15’s are still on their original batteries.
It’s not how often, it’s the when of it. They build so much intelligence into the key that it knows when you have parked with the only keyholed entry point up against a wall and kills the battery then. :)
Incredible luck. Kind of a once-in-a-lifetime. You oughta buy a lottery ticket.
Fortunately, a replacement battery can be found just about any convenience or dollar store, and takes just a minute to replace.
My Outback’s fob batteries failed with more than enough advance warning of “hey it’s not reliably unlocking/locking but it’s at least working for now” that if you REALLY got stuck due to a battery failure it’s your own fault in 99% of scenarios.
As in – to get stuck by a dead battery you’d have to ignore a failing battery for over a month.
The EnOcean switches (PRM21x) are a very good energy-harvesting design. I have a couple.
They can use strong encryption (rolling counter, AES, MAC). Somewhat pricey though.
The radio packets are also well designed and structured, not just some fixed OOK pulses…
The company I am employed at currently uses these kinetic energy harvesting.
As stated by other comments:
Some of the modules used are enocean tcm320u /PTM 535 and work with paired receiver ,no other accepted input. They state as the communication is encrypted but how strong it is, remains to be seen.
Advised is not using these in security or safety related applications.
As for reliable the tests in industrial work conditions (humidity, shocks, dirt, radio interference outside their band) the longest random test was for 1 million clicks with around 50 failures of transmission. That was also dependent on the custom case done for them.
I’ve seen a different variation of this idea that uses a spring-over hammer in the switch to strike a piezo-electric element and use the power-spike produced to rf trigger a remote receiver.
I have these exact switches and after weeks of trying I have finally been able to learn and replay the signals using RPitx with an SDR.
Care to share how you did it?
I recently saw a similar product, suitable for doing some DIY, I got it and studied the principle, very interesting. https://www.dfrobot.com/product-2568.html