Shop OBEX P1 Docs P2 Docs Learn Events
sniffing remote control codes using 433 MHz transceivers — Parallax Forums

sniffing remote control codes using 433 MHz transceivers

DAVID COOKEDAVID COOKE Posts: 42
in BASIC Stamp
I have a 6 digit timing display which can be operated using a remote control using 433MHz
The remote control has limited functions - mostly start and stop
The manufacturer does not reveal the actual (binary) codes used by the remote
I want to start and stop the display automatically but to do this I need the codes
Can I use the BS with a transceiver to do this?
thanks for your help

Comments

  • hatallicahatallica Posts: 175
    Maybe ... are you able to disassemble the remote to inspect the circuit? Also, can you confirm that it is truly a transceiver ... or does the remote control exclusively transmit?

    A common signal chain for a simple remote control is: digital signal --> encoder IC --> RF transmitter.
    If you find an IC such as HT12E or PT2262, then this exercise becomes a bit easier.
  • DAVID COOKEDAVID COOKE Posts: 42
    thanks
    The remote would not be easy to take apart without wrecking it
    the remote only transmits so any circuit built to interrogate it would only require a receiver

    there are pages on the web showing how to use Raspberry Pi and Arduino for this purpose but I would prefer to use the BS
  • hatallicahatallica Posts: 175
    I googled "arduino 433mhz sniffer" to get a sense of what you may have seen (link to page that I skimmed). That page ignores most of your puzzle! Notice that the comment section is full of people indicating that it did not work for their remotes.

    They state that "Any type of 433 MHz receiver should work", which is not true. There are perhaps a half dozen different modulation schemes on the market for transmitting RF data. For an inexpensive remote, you could make a reasonable guess that the modulation scheme is one called "ASK". The next step would be to guess the rate at which data is transmitted. I don't have a good suggestion for that.

    Can you show an image of the remote? I have never met one that could not be easily taken apart.
  • DAVID COOKEDAVID COOKE Posts: 42
    thanks for your help
    yes the page that you saw
    https://www.princetronics.com/how-to-read-433-mhz-codes-w-arduino-433-mhz-receiver/
    is the one I looked at as well

    I attach two photos of the remote - no screws on the case (not even in the battery compartment) so no easy way to dissemble
    the system is made by an Indian company 'Cosy' http://www.cosycom.com/
    the model I have is CS604UDRF (I attach a pdf of the wired version - in retrospect it would have been easier to adapt this version)
    I asked them if they would let me know the start/stop codes but had no response
    remote 2.jpg
    1632 x 1224 - 613K
    remote 1.jpg
    1632 x 1224 - 658K
  • ASKMEASKME Posts: 172
    I agree with hatallica, the best way is to dis-assemble this remote to reveal the circuitry inside. There should be a way to open this remote without damaging it.
  • hatallicahatallica Posts: 175
    Regarding the case - I expect that it is one of two scenarios. 1) There are screws hidden behind the labels; or 2) It snaps together and can be gently pried apart.

    For #1, you would notice one or more areas of the label that are dimpled (due to the screw hole).
    For #2, it can be a bit daunting unless you have previously taken apart similar enclosures. So, I understand any reluctance.

    Looking at the pictures and the website, I did not see anything indicating 433MHz. Is it indicated on the portion of the label hidden by the batteries? Or maybe some other indication?

    We can pretty much rule out HT12E and PT2262 as possible chip sets used in this remote. They are much happier running 5V to 12V, so two AA batteries suggests a different chip set for data encoding.
  • ASKMEASKME Posts: 172
    Along the edge of the case it's most likely that there are clips that hold the two halves together and are part of the case and a small Flathead screwdriver you might be able to separate them.
  • DAVID COOKEDAVID COOKE Posts: 42
    thanks for the contributions
    I'll have a go at opening the case using one of the two options above and let you know how I get on
    the 2 batteries in one of the two images obscure some of the text but there is mention of 433 in that area
    I thought I would try the manufacturer again and they have responded
    I wrote to them-
    I want to adapt the device so that it is triggered automatically by a photofinish system
    do have any suggestions?
    they replied-
    Dear Sir , if your photo finish system has a dry contact relay output then same can be connected by you in parallel to START or STOP buttons of clock or remote control ,as required by you .
    pl. note there should not be any voltage from relay output. i hope you are a technical person or can take help from any technicians for this small task.
    pl. write back if you need any further information

  • DAVID COOKEDAVID COOKE Posts: 42
    I have managed to open the case (just a few retaining clips)
    I attach a photo of the board
    the chip has CSRF717 hand written on it but I suspect that is only relevant to the manufacturer
    thanks for you help
    inside remote.jpg
    1632 x 1224 - 502K
  • DAVID COOKEDAVID COOKE Posts: 42
    by 'shorting' between soldering points I can activate the 'reset' function but I cannot activate the other functions using this 'manual' technique
  • msrobotsmsrobots Posts: 3,709
    can you get on the other side and try to shorten the push buttons?

    That is what I would understand how you could use a small relay to press START / STOP button as they explained.

    Enjoy!

    Mike
  • DAVID COOKEDAVID COOKE Posts: 42
    I would still prefer to have a 'wireless' communication with the remote rather than a long cable
  • kwinnkwinn Posts: 8,697
    DAVID COOKE wrote: »
    I would still prefer to have a 'wireless' communication with the remote rather than a long cable

    Couldn't you connect the BS and remote with a bit of additional circuitry to simulate button presses and use it for your wireless transmitter?
  • DAVID COOKEDAVID COOKE Posts: 42
    If we knew the remote codes for start and stop, I could dispense with the remote entirely (I think)
  • kwinnkwinn Posts: 8,697
    DAVID COOKE wrote: »
    If we knew the remote codes for start and stop, I could dispense with the remote entirely (I think)

    You may need to know a bit more than the remote codes. You may also need to know the rf modulation (am, fm, fsk, etc). I have no experience with 433mhz comms, and I'm not sure if there is a standard modulation.
  • DAVID COOKEDAVID COOKE Posts: 42
    thanks
    what I need a circuit to 'sniff' the codes coming from the remote
    please see my original posting and the early comments
  • kwinnkwinn Posts: 8,697
    DAVID COOKE wrote: »
    thanks
    what I need a circuit to 'sniff' the codes coming from the remote
    please see my original posting and the early comments

    I did read your original post and all the rest of the posts.

    As hatallica posted “There are perhaps a half dozen different modulation schemes on the market for transmitting RF data”, and that is something you need to know in order to find or build a sniffer. There are three common types of signal modulation commonly used in RF transmitter and receiver modules: ASK · OOK · FSK.

    Perhaps a better approach to figuring out the remote codes would be to open up the clock and see if it is possible to use it’s RF receiver output to read the demodulated codes coming from it. At least that would bypass the RF modulation problem.
  • DAVID COOKEDAVID COOKE Posts: 42
    many thanks for all the inputs from all the contributors
    I think we should terminate the discussion for the time being while I consider the options
Sign In or Register to comment.