Sunday, August 9, 2015
Wednesday, May 8, 2013
Hacking 433MHz RF link home automation
My project is to build a home wireless automation system. The system are going to interface existing infrastructure and new components like Arduino, Raspberry Pi, PIC microcontrollers and some new components and sensors. 433MHz RF link is a cheap and usefull wireless communication. This is what i bought on ebay:
The first task is to discover what those sensor are sending out. Since they are sending on 433MHz I bought some wireless senders and receivers:
I soildered a 17,3 cm long antenna on the devices and hooked the RX module up to my Arduino Uno port 2. Then I programmed my Arduino with the RCswitch example ReceiveDemo_Simple sketch and opened serial monitor in the Arduino programmer to see what the activated door sensor was sending out.
This is the message i got 10 times in my serial monitor :
Received 13981015 / 24bit Protocol: 1
Then I progammed my Arduino with RCswitch example ReceiveDemo_Advanced sketch and the message was like this:
Decimal: 14112085 (24Bit)
Binary: 110101110101010101010101
Tri-State: 1FF1FFFFFFFF
PulseLength: 542 microseconds
Protocol: 1
Raw data: 16828,1596,564,1596,568,512,1652,1596,564,516,1648,1600,560,1600,564,1596,568,512,1648,1596,568,512,1652,1592,568,516,1648,1596,568,516,1648,1596,568,512,1652,1596,564,512,1652,1592,568,516,1652,1592,568,512,1656,1592,568,
I moved one of the jumpers around and get different Tri-State messages in the Arduino serial monitor when I activated the sensor:
1 ............ L
2 ........|..| N
3 ........|..| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FF1FFFFFFFF
1 ........|... L
2 ........|..| N
3 ...........| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FF0FFFFFFFF
1 ............ L
2 |..........| N
3 |..........| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FFFFFFF1FFF
1 ............ L
2 ...|.......| N
3 ...|.......| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FFFFFFFFFF1
Then I moved the jumper marked: 1.5, 3.3, 4.7. This jumpers have inpact on the baud rate (bits pr second). This is the result:
Jumper set on 1.5 gives PulseLength: 177 microseconds
The PulseLength is the single bit-length of the signal. This gives the baud rate of 1/PulseLength:
Jumper set on 4.7 gives baudrate of: 1845 bits/s
Jumper set on 3.3 gives baudrate of: 2680 bits/s
Jumper set on 1.5 gives baudrate of: 5649 bits/s
Inside the RCswitch.ccp file i found this:
/**
* Sends a "1" Bit
* ___
* Waveform Protocol 1: | |_
* __
* Waveform Protocol 2: | |_
*/
/**
* Sends a Tri-State "0" Bit
* _ _
* Waveform: | |___| |___
*/
/**
* Sends a Tri-State "1" Bit
* ___ ___
* Waveform: | |_| |_
*/
/**
* Sends a Tri-State "F" Bit
* _ ___
* Waveform: | |___| |_
*/
/**
* Sends a "Sync" Bit
* _
* Waveform Protocol 1: | |_______________________________
* _
* Waveform Protocol 2: | |__________
*/
Each Tri-State consist of 8 bits.
I set the jumpers like this:
1 .......|.... L
2 .......|...| N
3 ...........| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FFF0FFFFFFF
I run the pulses in Openbench Logic Sniffer, a logic analyzer for Arduino. The baud jumper is set to 4.7. With the waveforms above I was able to decode the signal, and I used a graphic app to draw the decoding into the puls schema.
Conclution
The jumpers A0-A7 is used to connect the sensor to a spesific central unit and the D0-D3 is used to separate different sensors connected to the central unit.
This should be enough to start developing my RF communication B)
To be continued.....
Usefull links:
http://tickett.wordpress.com/2012/06/27/more-433mhz-rf-hacking/
https://code.google.com/p/rc-switch/wiki/KnowHow_LineCoding
http://www.hkvstar.com/technology-news/how-to-program-wireless-detectors-to-alarm-system.html
The first task is to discover what those sensor are sending out. Since they are sending on 433MHz I bought some wireless senders and receivers:
I soildered a 17,3 cm long antenna on the devices and hooked the RX module up to my Arduino Uno port 2. Then I programmed my Arduino with the RCswitch example ReceiveDemo_Simple sketch and opened serial monitor in the Arduino programmer to see what the activated door sensor was sending out.
This is the message i got 10 times in my serial monitor :
Received 13981015 / 24bit Protocol: 1
Then I progammed my Arduino with RCswitch example ReceiveDemo_Advanced sketch and the message was like this:
Decimal: 14112085 (24Bit)
Binary: 110101110101010101010101
Tri-State: 1FF1FFFFFFFF
PulseLength: 542 microseconds
Protocol: 1
Raw data: 16828,1596,564,1596,568,512,1652,1596,564,516,1648,1600,560,1600,564,1596,568,512,1648,1596,568,512,1652,1592,568,516,1648,1596,568,516,1648,1596,568,512,1652,1596,564,512,1652,1592,568,516,1652,1592,568,512,1656,1592,568,
The switches inside the door sensor looked like this:
I moved one of the jumpers around and get different Tri-State messages in the Arduino serial monitor when I activated the sensor:
1 ............ L
2 ........|..| N
3 ........|..| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FF1FFFFFFFF
1 ........|... L
2 ........|..| N
3 ...........| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FF0FFFFFFFF
1 ............ L
2 |..........| N
3 |..........| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FFFFFFF1FFF
1 ............ L
2 ...|.......| N
3 ...|.......| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FFFFFFFFFF1
Then I moved the jumper marked: 1.5, 3.3, 4.7. This jumpers have inpact on the baud rate (bits pr second). This is the result:
Jumper set on 4.7 gives PulseLength: 542 microseconds
Jumper set on 3.3 gives PulseLength: 373 microseconds
The PulseLength is the single bit-length of the signal. This gives the baud rate of 1/PulseLength:
Jumper set on 4.7 gives baudrate of: 1845 bits/s
Jumper set on 3.3 gives baudrate of: 2680 bits/s
Jumper set on 1.5 gives baudrate of: 5649 bits/s
Inside the RCswitch.ccp file i found this:
/**
* Sends a "1" Bit
* ___
* Waveform Protocol 1: | |_
* __
* Waveform Protocol 2: | |_
*/
/**
* Sends a Tri-State "0" Bit
* _ _
* Waveform: | |___| |___
*/
/**
* Sends a Tri-State "1" Bit
* ___ ___
* Waveform: | |_| |_
*/
/**
* Sends a Tri-State "F" Bit
* _ ___
* Waveform: | |___| |_
*/
/**
* Sends a "Sync" Bit
* _
* Waveform Protocol 1: | |_______________________________
* _
* Waveform Protocol 2: | |__________
*/
Each Tri-State consist of 8 bits.
I set the jumpers like this:
1 .......|.... L
2 .......|...| N
3 ...........| H
DDDDAAAAAAAA
321076543210
Tri-State: 1FFF0FFFFFFF
I run the pulses in Openbench Logic Sniffer, a logic analyzer for Arduino. The baud jumper is set to 4.7. With the waveforms above I was able to decode the signal, and I used a graphic app to draw the decoding into the puls schema.
The jumpers A0-A7 is used to connect the sensor to a spesific central unit and the D0-D3 is used to separate different sensors connected to the central unit.
This should be enough to start developing my RF communication B)
To be continued.....
Usefull links:
http://tickett.wordpress.com/2012/06/27/more-433mhz-rf-hacking/
https://code.google.com/p/rc-switch/wiki/KnowHow_LineCoding
http://www.hkvstar.com/technology-news/how-to-program-wireless-detectors-to-alarm-system.html
Tuesday, January 22, 2013
NAS server with 6 x 3TB disks, small case, quiet and low power consumtion
After a numbers of disk crashes, and loss of files, I decided to buy a NAS-server. After a quick search I found that a prebuilt 6 disk solution was rather expensive. I would like to build my own, and it has to be quiet and power cheap. This is what i Ordered:
Disks: 6 stk. WD30EFRX - Western Digital 3 TB Red 3,5" 6 Gb/s costing NOK: 1 095 each
Power: 1 stk. BN104 - be quiet! Pure Power BQT L7 350W PSU/nätagg BN104 costing NOK: 356
Motherboard: 1 stk. C60M1-I - ASUS C60M1-I costing NOK: 553
Memory: 2 stk. KVR1333D3N9/4G - 4Gb 1333Mhz DDR3 NON-ECC CL9 DIMM costing: 149
Case: 1 stk. PC-Q08B - LIAN LI Lian LI PC-Q08B Mini Tower - Black costing: 681
Total NOK: 8 848 including delivery, thats about 1 580 USD.
All the items where found at deal.no in Norway.
In addition i used 6 SATA data cables and had to bought one Y-cable: 1 x female IDE power to 2 x male SATA power cable costing NOK: 150 or 27 USD
After building the server I installed FreeNAS on a 4GB USB-stick, plugged it in and powered on the system. I configured it with Raid5, that tolerate 1 defect disk.
The FreeNAS was easy to configure, but I have to tweek users and groups a little to get access to my CIFS (Windows shared folders).
The system is small, really quiet and produce allmost no heat. The space available is aprox 13, 6 TB.
Disks: 6 stk. WD30EFRX - Western Digital 3 TB Red 3,5" 6 Gb/s costing NOK: 1 095 each
Power: 1 stk. BN104 - be quiet! Pure Power BQT L7 350W PSU/nätagg BN104 costing NOK: 356
Motherboard: 1 stk. C60M1-I - ASUS C60M1-I costing NOK: 553
Memory: 2 stk. KVR1333D3N9/4G - 4Gb 1333Mhz DDR3 NON-ECC CL9 DIMM costing: 149
Case: 1 stk. PC-Q08B - LIAN LI Lian LI PC-Q08B Mini Tower - Black costing: 681
Total NOK: 8 848 including delivery, thats about 1 580 USD.
All the items where found at deal.no in Norway.
In addition i used 6 SATA data cables and had to bought one Y-cable: 1 x female IDE power to 2 x male SATA power cable costing NOK: 150 or 27 USD
After building the server I installed FreeNAS on a 4GB USB-stick, plugged it in and powered on the system. I configured it with Raid5, that tolerate 1 defect disk.
The FreeNAS was easy to configure, but I have to tweek users and groups a little to get access to my CIFS (Windows shared folders).
The system is small, really quiet and produce allmost no heat. The space available is aprox 13, 6 TB.
Subscribe to:
Posts (Atom)