woensdag 1 oktober 2014

Decoding Itho RF Protocol

My objective was to control my Itho CVE Eco Fan RF-enabled mechanical ventillation. I bought an RTL-SDR device to decode the protocol. I found that my RF switch sends a signal on 868.260Mhz. I'm not quite sure what the protocol is: * It looks like it creates chirps which slightly increase or decrease in frequency * Some chirps are longer I've made a sample with a samplerate of 3.200.000 Hz. * With each press of a button 3 chirps will be transmitted. * Each chirp constists of +/- 49688 samples. * Between two chirps is a pause of 1577538 samples. * The chirp uses a sine wave with a length of approx 16,5 samples * Most of the time every 400 samples there is a rude phase shift, With Audacity I scrolled through one chirp from start to end and saw a difference in sine frequency. The change in frequency made it look like some parts of the signal "moved" left and others to the "right". This alternated and switched with every phase shift. I've took notes: L= meant moving left, R= meant moving right. I got the following pattern: RLRLRLRLRLRLRLRLRLRLRLRLRLRLRLRRLRLRLRLRLRLRLRLRLRLRLRLRLLRLRRLLRLRRLRLLRRLRLLRLRRLRLRLRLLRRLRLRLRLRLRLRLRLRLLRLRLRRLLRLRRLRLRL 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 1 2 3 4 5 6 7 8 9 0 1 2 3 In the pattern i noticed that sometimes the phase shift didn't occur. The "moving left/right" of the sines is because the frequency moved up/down. In "Wavelet Explorer" i made a spectral analysis and got the following picture: This picture is the best indication of how the protocol works. Notes: At a samplerate of 3.200.000Hz every 400 samples a phase-shift occurs. If every part betwee phase-shifts (400 samples) is a bit. This would mean that the data rate would be: 3200000/400=8000bps

When Googling some more on the used K110 IC, i found: "K110 B3 is an Infineon TDK5110 ASK/FSK Transmitter 868/433 MHz" (http://www.domoticaforum.eu/viewtopic.php?f=7&t=127&start=45)
---
It's working.
I've used a HopeRF Miniwireless 868 RF69W module, soldered between pin D7 (Arduino) and DIO2 (RF69) a wire. With this wire it's possible to use "Continuous Mode". In this mode the signal is directly controlled by the Arduino.


  if (!rf69.init()) Serial.println("init failed");

  if (!rf69.setFrequency(868.260)) Serial.println("setFrequency failed");

  RH_RF69::ModemConfig t = { 0x60,  0x06, 0x83, 0x00, 0x9D, 0xf4, 0xf4, 0x00};
  rf69.setModemRegisters( &t );
  pinMode(7, OUTPUT);

void loop() {
        // WC beneden
      int signalConnect1[] =    {15,41,43,45,57,59,63,73,75,95,99,101,103}; // might not be correct
      int signalDisconnect1[] = {15,41,43,45,57,59,63,73,75,91,93,95,97,107,109};  // might not be correct
      int signalLow1[] =        {15,41,43,45,57,59,63,73,75,95,99,101,103};
      int signalMedium1[] =     {15,41,43,45,57,59,63,73,75,93,97,101,105,107,109};
      int signalHigh1[] =       {15,41,43,45,57,59,63,73,75,91,93,95,97,107,109};
      int signalTimer1[] =      {15,41,43,45,57,59,63,71,73,79,81,89,91,93,95,105,109};
      int signalLength1 = 113;

      // Wc boven
      int signalConnect3[] =    {15,49,53,59,61,63,65,73,75,95,99,101,103,107,109}; // might not be correct
      int signalDisconnect3[] = {15,49,53,59,61,63,65,79,95,101,107,109};
      int signalLow3[]=         {15,49,53,59,61,63,65,73,75,95,99,101,103,107,109};
      int signalMedium3[]=      {15,49,53,59,61,63,65,73,75,93,97,101,105};
      int signalHigh3[] =       {15,49,53,59,61,63,65,73,75,91,93,95,97};
      int signalTimer3[] =      {15,49,53,59,61,63,65,71,73,79,81,89,91,93,95,105,107};
      int signalLength3 = 113;    


      // Badkamer
      int signalConnect2[] =    {};
      int signalDisconnect2[] = {};
      int signalLow2[]=         {31,57,61,63,67,71,73,77,81,89,91,111,117,119,123};
      int signalMedium2[]=      {31,57,61,63,67,71,73,77,81,89,91,109,113,115,117,121,125};
      int signalHigh2[] =       {31,57,61,63,67,71,73,77,81,89,91,107,109,111,113,125};
      int signalTimer2[] =      {31,57,61,63,67,71,73,77,81,87,89,95,97,105,107,109,111,115,121,123,125};
      int signalLength2=129;
     
     
      int signalConnectRepeats =4 ;
      int signalDisconnectRepeats =4 ;
      int signalTimerRepeats =3;

      int* signal = signalLow1;
      int signalRepeats = signalTimerRepeats;
      int signalLength = signalLength1;

    for (int idx2=0;idx2<3 idx2="" p="">    {
      rf69.setOpMode(RH_RF69_OPMODE_MODE_TX);
   
      int flip = LOW;
      int bc = 0;
      for (int idx=0;idx        if  (signal[bc]==idx)      
        {
          bc ++;
        } else
        {
          flip = !flip;
        }
        digitalWrite(7,flip);
        delayMicroseconds(110);
      }  
      rf69.setOpMode(RH_RF69_OPMODE_MODE_STDBY);
      delay(500);
    }
   
    delay(20000);

Looking at the data i've gathered. I suspect the bitstream is manchester encoded. It will try to switch from "Continous Mode" to "Packet Mode" as this would save energy when listening for a signal.
-- to be continued --

Reviving an old Barbie doll'd up Nail Printer

I bought on eBay the Barbie doll'd up nail printer for my girlfriend and daughter. These nail printers are long out-of-production and also the ink cartridges are scarce. Also the software is hard to install on modern operating systems. Problem 1: Installing the Nail printer software I downloaded the Windows 7 software package "Nail_Printer_Update_v1.0.0.24.exe" from http://service.mattel.com/us/technicalproductdetail.aspx?prodno=V5152&siteid=27&catid=506. When i tried to install it onto my Windows 7 x86 laptop it gave an "error -1603" when installing the printer driver. The main application installed fine. I traced the problem to a multi-lingual issue in the package. The package supports multiple language, but misses the files for languages other than english. My solution was to duplicate some folder for language of my operating system (dutch). 1. Execute "Nail_Printer_Update_v1.0.0.24.exe" which you downloaded from service.mattel.com 2. Navigate with Windows Explorer to your temp folder during installation, for me: C:\Users\Laptop\AppData\Local\Temp\ 3. During installing two temporary folders will appear. In one of the folder there are two installation files: "Barbie Doll'd Up Nails Printer Driver (x86).exe" and "Barbie Doll'd Up Nails Printer Driver (x64).exe" 4. Copy the "Barbie Doll'd Up Nails Printer Driver (???).exe" to a temporary location, for instance the "desktop" 5. Execute the "Barbie Doll'd Up Nails Printer Driver (???).exe" from the desktop 6. Again watch the temp-folder for a file: "Barbie Doll'd Up Nails Printer Driver.msi" and copy it to your "desktop" 7. Execute from command-line: msiexec /a "Barbie Doll'd Up Nails Printer Driver.msi" /qb /targetdir=c:\barbie This will extract the contents of the MSI to disk 8. Navigate with Windows Explorer to "C:\barbie\program files\Mattel\Barbie Doll'd Up Nails Printer Driver\MLDOprc\i386" 9a. Make a copy of the folder "English" and rename the copy to your language. Possible languages: english, arabic, chi_simp, chi_trad,czech,danish,dutch, finnish,french,german,greek,hebrew, hungaran,italian,japanese,korean,norwegan, polish,portibrn,portbrzl,russian,spanish,swedish,turkish 9b. Another option is to modify the file "MLDOprc.inf". Look for "%LANG_PATH%" and replace all occrences with "English". Problem 2: My ink cartridges were dry as a desert I made holes in the ink cartridge and injected hot water with a syringe. Because of the hot water the ink became liquid again. The water also ruined the ink. I had to make a hole for Yellow. The holes for Magenta and Cyan were already marked on the cartridge with an identation. The two identation closest to the printhead-connectors were for the color Magenta (Redish). The identation in the right-bottom corner is for Cyan (blueish). Next to the Cyan identation i had to make a hole without a marker, but there is the Yellow ink compartment. I looked at the pictures here to drill holes: http://www.printerfillingstation.com/Refill-Instructions/Lexmark/L8.htm Problem 3: How to get good ink in it. I drained the ink cartridges with the syringe and took ink from some Pixma MX870 ink cartridges. Although this did work somewhat, the quality was very poor. Some good tips: * Cover the other holes during refilling otherwise the ink might flow into the chambers of the other colors. I've ordered Lexmark 43 cartridges as these seem quite similar. It will arrive in a few days and i hope it will work. The Lexmark 43 XL cartridges do seem to work. I've not yet tested it thouroughly though. Problem 4: How to get rid of the humongous AC/AC Converter. My printer came with a US adapter, with a AC/AC Converter (230V->115V). If i get the ink cartridge to work correctly it needs to be replaced. AC adapter: DC24V, 500mA, Connector: yet to be determined, inner +, outer -