"hacking" the Mira Platinum wireless shower controller (433 MHz)

Hi all and thanks in advance for any advice.

I have a Mira Platinum wireless controller and would like to have it control something other than the Mira Platinum mixer unit.

The main issue is that I have no idea where to start with interacting with it.

I believe, from here, that the operating frequency is 433.05 MHz to 434.79.

So I'm sure I could grab a wireless module and hook it up to an Arduino but then what?

I think I need to "pair" with the controller, but how would I go about that?

I could ask Mira and I'm sure they'll give me all the information I need, but failing that, any ideas?

Thanks again for any help.

Russell.

And you need to know what modulation method they use, what data is sent and possibly returned.

Paul

Very difficult task to do what you are asking.
You will need far more information about the wireless controller, and even then , unless the manufacturer will give you the details of how it works , most wont , you will have an almost impossible task to reverse engineer the protocol used.

Paul_KD7HB:
And you need to know what modulation method they use, what data is sent and possibly returned.

Paul

Thanks Paul,

Is it not possible to figure that out or is this something that I'd need to know or the project is effectively a non-starter?

mauried:
Very difficult task to do what you are asking.
You will need far more information about the wireless controller, and even then , unless the manufacturer will give you the details of how it works , most wont , you will have an almost impossible task to reverse engineer the protocol used.

Ok, that sounds a little more disheartening.

I'm up for a challenge but I'll see if I can get any information from the manufacturer first.

Thanks.

Assuming the device is using that frequency, is using an OOK protocol, is not a rolling code, is not encrypted then maybe try using the same methods as one would for decoding weather sensors.

A link the the device your talking about may help but if it's the one I found then you may need to capture RF traffic from the pump/mixer as well (if it sends any)

Riva:
Assuming the device is using that frequency, is using an OOK protocol, is not a rolling code, is not encrypted then maybe try using the same methods as one would for decoding weather sensors.

A link the the device your talking about may help but if it's the one I found then you may need to capture RF traffic from the pump/mixer as well (if it sends any)

That's a lot of ifs - :open_mouth:

Good idea, here's the link to the unit (also added to the first post):

I don't have the mixer unit, rather I want to have the controller controlling with something else.
I guess the concern is that the controller and the mixer must handshake and that I'd need the mixer unit to work out how they do that.

Monkey3:
Thanks Paul,

Is it not possible to figure that out or is this something that I'd need to know or the project is effectively a non-starter?

Ok, that sounds a little more disheartening.

I'm up for a challenge but I'll see if I can get any information from the manufacturer first.

Thanks.

OF course it's possible to figure it out. Use your spectrum analyzer to look at the transmitted output and determine the modulation method.

Then use a matching receiver for that frequency and modulation and record the data output with your recording oscilloscope. The trace will tell you the data coding structure and possibly the actual data stream.

Now you can program your Arduino and the receiver to actually read the data with the Arduino and print it on the IDE monitor.

And there you go!

Paul

Paul_KD7HB:
OF course it's possible to figure it out. Use your spectrum analyzer to look at the transmitted output and determine the modulation method.

Then use a matching receiver for that frequency and modulation and record the data output with your recording oscilloscope. The trace will tell you the data coding structure and possibly the actual data stream.

Now you can program your Arduino and the receiver to actually read the data with the Arduino and print it on the IDE monitor.

And there you go!

Paul

err yep.
I might have to rethink that one then.
I have another, non-wifi option so I may ask some questions about that on another post.

Thanks again Paul.

Paul_KD7HB:
OF course it's possible to figure it out. Use your spectrum analyzer to look at the transmitted output and determine the modulation method.

You could go cheap and use an SDR dongle instead of the spectrum analyser :slight_smile:

Riva:
You could go cheap and use an SDR dongle instead of the spectrum analyser :slight_smile:

wow. Ok, maybe I'll come back to this project sooner than I thought then...

Thanks

All an SDR dongle will tell you is the modulation format, and what the demodulated output looks like.
It wont help you decode it which is the tuff part without manufacturer help.

Hi,

I’ve been looking at doing the same thing for a while now but never got around to looking at it until now.

I have the same shower and thought I may be able to add it to my home automation system (using Home Assistant on an Rpi3).

I was looking at doing a few other bits with 433Mhz so, about 2 weeks ago I purchased the Sonoff RF Bridge and a 433Mhz keyfob. I flashed the RF bridge with Tasmota and once set up, I was able to receive the button presses from the keyfob.

Once I confirmed the bridge was receiving the events, I turned my attention to the shower controller. Unfortunately, I was unable to see any events when pressing the on/off button or the temperature control buttons. It looks like it may be using rolling codes and/or a different protocol.

I’m not all that good with electronics, I’m focused more around the computing side so wouldn’t know where to start reverse engineering it, but I might attempt to contact Mira to see if they are willing to release any information, but I very much doubt they will.

My only other hope is if someone who is better at all of this than I am is able to figure it out.

Maybe start with Universal Radio Hacker to see if/what it can capture. It should soon confirm if rolling codes are used and if not may help in decoding the signals.

Theres a few ways of guessing what kind of control protocols radio devices use.
Firstly the simplest types are merely on/off devices which only have 2 states, on and off.
The RC switch protocol is this type and can detect a lot keyfobs if they provide this functionality.
However devices that need some kind of proportional control, like winding things up and down by holding buttons down wont use RC switch, so these are the ones that are hard to work out.
So if your controller can wind temperatures up and down in a linear fashion, you have a tuff job ahead to figure this out.

Hi,

I've been having a go at trying to work out the protocols as well.
I haven't progressed very far to be honest.

My goal was to try and produce some kind of way of controlling the shower via an Arduino or similar. I've emailed Mira but they are very very reluctant to part with any detailed information.

They did confirm it was using 433 Mhz but wouldn't comment on protocols for fear of safety and security.

I have dismantled one of the controllers and discovered it was using a 433Mhz modem chip. I'll try and post some photos of the dismantled controller in case that can be of use.

On some of the controllers there is an ISP header (under a yellow stopper, under the battery compartment) but Im not sure how you would go about trying to extract any information that way?

Some decent pictures and maybe the numbers off the chips will help to figure out the transmission method but will not help in decoding the protocol used.
I would have been tempted to buy a remote for the fun of hacking it but £70 is lot to much for the fun of it.

I'm actually getting one of these showers installed in a few months, so I'd be interested in the outcome of this thread. If there isn't a solution by the time I get mine installed, I might be able to assist with chip information.

Apologies for the lack of comms on this thread but I've moved to attempting to use a wired vado unit instead so this will be parked for the time being.

https://forum.arduino.cc/index.php?topic=564171.0

If I don't have any success over there then I may come back to this...