"Set up" radio-controlled sockets without a remote

Quite by chance I stumbled upon the Ch-i-D catalog on an attraction of unprecedented generosity. Now additional wireless sockets for the Velleman 7500-3B kit cost only 100 rubles apiece. But this is a power outlet without a remote control, that is, with somewhat unclear prospects for its use, because before opening it is not very clear what is inside, and there is no sample control codes. If, however, pledged to the console, the proposal immediately ceases to be so interesting.

Despite some risk (although what is there those hundred rubles ?!), it became interesting than this product, and it is in this configuration, that will help the socialist revolution on the scale of one single household.
')
Before visiting the store, I theoretically boot. That is, I looked for what is on our Internet on the subject of these sockets. I practically calmed down when I found out that they are compatible (Velleman WRS3B) with the RC-Switch library, which I have been using in my home controller for a long time to control sockets, execute commands from radio control signals and exchange data with peripherals.

It was hopeful.



. Here is the packaging

Small preface

Typically, sockets (and consoles) of this type are performed on specialized encoding and decoding chips of the 2262/2272 family. And before the numbers can be completely different indices: PT, SC, HS. And the indices after the numbers determine the mode of operation and the configuration of the address lines and data. And most often chips with 8 bits of the address and 4 data bits are used, although options are possible - up to 12 bits of the address or up to 6 bits of data.

Within the protocol used, a bit can take one of three values: 1, 0 and F. Together, the address and data bits (12 bits in total) make up a codeword that is repeated 4 times for reliability, which, respectively, is a single frame. To be honest, the problem is that even reading datasheets did not bring me closer to understanding the order in which the bits are located in the code word, and what is meant by the mysterious state F.

So from two hours of reading, I brought about the following.

The basic principle of operation lies in the fact that the same address is set for transmitting commands at the transmitter (encoder) and receiver (decoder), and, as a rule, control is exercised over data lines. That is, each button on the remote has one supposedly unique address.

A typical implementation also includes two data bits, which tell us what to do with the peripherals at a specific address — turn it on or off.

. downside

Rich inner world

Opening the object, fortunately, justified the hope for the popular chip of the 2272 family. More specifically, the HS2272-L4 ( one and two times ), which means encoding with 8 bits of the address, 4 bits of data and latching state. Those. For each address, there are two static state change commands. In the case of a power outlet, this means that we turn on with one button, and turn it off with another.



Unlike my radio receivers, there are not 4 channels here, but as many as 8 - there is where to roam. Channel change is implemented using, so to speak, a hardware converter from the decimal system to the binary one.

. the plastic is soft, the encoder is hard, the marker pointer sockets are almost imperceptible. I had to tint with a marker.


The encoder is a rotary sleeve with contacts “whiskers” and its counterpart is a board with a pattern of tracks, the closure of which is “whiskers” and determines the state of three of the 8 bits of the address. It is easy to guess that these three bits determine the 8 control channels.



A cursory familiarization with the slap-dyed board reveals the following picture:



1) Address lines A0, A4 - A7 are immediately planted on the ground (i.e., the corresponding bits are set to 0).

2) Address lines A1 - A3 on one side are pulled to + 5V through resistors, and on the other, they are planted on the ground with an encoder (i.e. they take values ​​from 000 to 111).

3) Data lines D1 - D3 are also connected to ground, and the control bit is left at the mercy of D0.

This is perhaps the most interesting. Of the less interesting is the type of relay, by which it can be seen that stated in the characteristics of kilowatts, it must withstand.

Guess the melody

Yeah, these bits! Want some street reverse engineering?

Of course, the sockets did not respond to my remote controls - but it’s good. Of course, blindly pick up at least one code failed. But no, I lie - in the process I accidentally came across one of the codes of the outlets that were already working for me. That's really lucky. In parallel, I pondered why the author of RC-Switch talks about a protocol with three states of bits, although in the examples he uses only two: 0 and F.

This, as well as the claimed compatibility with the library, was somewhat confusing. Therefore, I decided to go the simple way, i.e. get rid of extra bits and states. The logic of the encoder operation clearly hinted that it has a position with three guaranteed zeros in the address bits responsible for selecting the control channel. Add to this the rest of the address lines planted on the ground - and we get 8 zeros. It only remains to calculate the control bits of the data line.

It's funny, but the multimeter showed the mentioned three zeros, if you set the encoder to the eighth channel position. Those. The encoding was “backwards”:

8 - 000
7 - 100
6 - 010
5 - 110
4 - 001
3 - 101
2 - 011
1 - 111

And here, by the way, a third condition was discovered, which is not found in practical examples of the RC-Switch. In other words, the address consists of 0 and 1, but F is not used.

As for the data lines, judging by the pinout in the datasheets, the control bits with the same degree of probability could be D0 and D3. But in practice it is still D0 (judging by the codeword scheme).

As a result of further experiments, it turned out that the on command is F000, and the off command is 0000 on the data line.

Summary

What I wanted - and got it. Sockets are quite suitable for home use, the command system was guessed by heroic efforts (again I guessed instead of gaining knowledge) and is easily implemented using the RC-Switch library in the code for the Arduino. The remote is not needed.

Total - up to 8 extremely cost-effective remote control channels out of the box and the prospect of their increase due to the use of additional address lines (you just need to cut the tracks and pull them to either positive or to the ground (the main thing is not to allow the address space to intersect with the equipment that is controlled by same data bits).

Obvious disadvantages are a single (from the same box) address space and command system for all sockets. That is, if your neighbor buys the same ones, you will click each other’s sockets, unless, of course, someone guesses to correct the addresses.

In general, you can use.

ps. The described witchcraft on guessing may not work if a cardinally different chip comes along, or its algorithm implemented in a separate microcontroller (usually some PIC) without such visual address lines and data. In these cases, you really have to attach the head.