Go Down

Topic: "hacking" the Mira Platinum wireless shower controller (433 MHz) (Read 798 times) previous topic - next topic

Monkey3

Hi all and thanks in advance for any advice.

I have a Mira Platinum wireless controller and would like to have it control something other than the Mira Platinum mixer unit.

The main issue is that I have no idea where to start with interacting with it.

I believe, from here, that the operating frequency is 433.05 MHz to 434.79.

So I'm sure I could grab a wireless module and hook it up to an Arduino but then what?

I think I need to "pair" with the controller, but how would I go about that?

I could ask Mira and I'm sure they'll give me all the information I need, but failing that, any ideas?

Thanks again for any help.

Russell.

Paul_KD7HB

And you need to know what modulation method they use, what data is sent and possibly returned.

Paul

mauried

Very difficult task to do what you are asking.
You will need far more information about the wireless controller, and even then , unless the manufacturer will give you the details of how it works , most wont , you will have an almost impossible task to reverse engineer the protocol used.

Monkey3

And you need to know what modulation method they use, what data is sent and possibly returned.

Paul
Thanks Paul,

Is it not possible to figure that out or is this something that I'd need to know or the project is effectively a non-starter?

Very difficult task to do what you are asking.
You will need far more information about the wireless controller, and even then , unless the manufacturer will give you the details of how it works , most wont , you will have an almost impossible task to reverse engineer the protocol used.

Ok, that sounds a little more disheartening.

I'm up for a challenge but I'll see if I can get any information from the manufacturer first.

Thanks.

Riva

Assuming the device is using that frequency, is using an OOK protocol, is not a rolling code, is not encrypted then maybe try using the same methods as one would for decoding weather sensors.

A link the the device your talking about may help but if it's the one I found then you may need to capture RF traffic from the pump/mixer as well (if it sends any)
Don't PM me for help as I will ignore it.

Monkey3

Assuming the device is using that frequency, is using an OOK protocol, is not a rolling code, is not encrypted then maybe try using the same methods as one would for decoding weather sensors.

A link the the device your talking about may help but if it's the one I found then you may need to capture RF traffic from the pump/mixer as well (if it sends any)
That's a lot of ifs - :O

Good idea, here's the link to the unit (also added to the first post):
https://www.mirashowers.co.uk/showers/digital-showers/mira-platinum-dual-wireless-controller/

I don't have the mixer unit, rather I want to have the controller controlling with something else.
I guess the concern is that the controller and the mixer must handshake and that I'd need the mixer unit to work out how they do that.

Paul_KD7HB

Thanks Paul,

Is it not possible to figure that out or is this something that I'd need to know or the project is effectively a non-starter?

Ok, that sounds a little more disheartening.

I'm up for a challenge but I'll see if I can get any information from the manufacturer first.

Thanks.
OF course it's possible to figure it out. Use your spectrum analyzer to look at the transmitted output and determine the modulation method.

Then use a matching receiver for that frequency and modulation and record the data output with your recording oscilloscope. The trace will tell you the data coding structure and possibly the actual data stream.

Now you can program your Arduino and the receiver to actually read the data with the Arduino and print it on the IDE monitor.

And there you go!

Paul

Monkey3

OF course it's possible to figure it out. Use your spectrum analyzer to look at the transmitted output and determine the modulation method.

Then use a matching receiver for that frequency and modulation and record the data output with your recording oscilloscope. The trace will tell you the data coding structure and possibly the actual data stream.

Now you can program your Arduino and the receiver to actually read the data with the Arduino and print it on the IDE monitor.

And there you go!

Paul
err yep.
I might have to rethink that one then.
I have another, non-wifi option so I may ask some questions about that on another post.

Thanks again Paul.

Riva

OF course it's possible to figure it out. Use your spectrum analyzer to look at the transmitted output and determine the modulation method.
You could go cheap and use an SDR dongle instead of the spectrum analyser :)
Don't PM me for help as I will ignore it.

Monkey3

You could go cheap and use an SDR dongle instead of the spectrum analyser :)
wow. Ok, maybe I'll come back to this project sooner than I thought then...

Thanks

mauried

All an SDR dongle will tell you is the modulation format, and what the demodulated output looks like.
It wont help you decode it which is the tuff part without manufacturer help.

KallumD

Hi,

I've been looking at doing the same thing for a while now but never got around to looking at it until now.

I have the same shower and thought I may be able to add it to my home automation system (using Home Assistant on an Rpi3).

I was looking at doing a few other bits with 433Mhz so, about 2 weeks ago I purchased the Sonoff RF Bridge and a 433Mhz keyfob. I flashed the RF bridge with Tasmota and once set up, I was able to receive the button presses from the keyfob.

Once I confirmed the bridge was receiving the events, I turned my attention to the shower controller. Unfortunately, I was unable to see any events when pressing the on/off button or the temperature control buttons. It looks like it may be using rolling codes and/or a different protocol.

I'm not all that good with electronics, I'm focused more around the computing side so wouldn't know where to start reverse engineering it, but I might attempt to contact Mira to see if they are willing to release any information, but I very much doubt they will.

My only other hope is if someone who is better at all of this than I am is able to figure it out.

Riva

Maybe start with Universal Radio Hacker to see if/what it can capture. It should soon confirm if rolling codes are used and if not may help in decoding the signals.
Don't PM me for help as I will ignore it.

mauried

Theres a few ways of guessing what kind of control protocols radio devices use.
Firstly the simplest types are merely on/off devices which only have 2 states, on and off.
The RC switch protocol is this type and can detect a lot keyfobs if they provide this functionality.
However devices that need some kind of proportional control, like winding things up and down by holding buttons down wont use RC switch, so these are the ones that are hard to work out.
So if your controller can wind temperatures up and down in a linear fashion, you have a tuff job ahead to figure this out.


NeilB

Hi,

I've been having a go at trying to work out the protocols as well.
I haven't progressed very far to be honest.

My goal was to try and produce some kind of way of controlling the shower via an Arduino or similar.  I've emailed Mira but they are very very reluctant to part with any detailed information.

They did confirm it was using 433 Mhz but wouldn't comment on protocols for fear of safety and security.

I have dismantled one of the controllers and discovered it was using a 433Mhz modem chip. I'll try and post some photos of the dismantled controller in case that can be of use.

On some of the controllers there is an ISP header (under a yellow stopper, under the battery compartment) but Im not sure how you would go about trying to extract any information that way?

Go Up