Arduino Forum

Topics => Home Automation and Networked Objects => Topic started by: johanm on Nov 29, 2013, 11:08 am

Title: rf433 code for ELRO Flamingo home devices (FA500)
Post by: johanm on Nov 29, 2013, 11:08 am
Hallo,

Has somebody already decoded the RF433 protocol for the ELRO Flamingo home devices (model numer starts with FA500)?
In the Netherlands o.a. sold by the Kruidvat stores.

If have tried it to decode by using the receive and transmit code from both the RemotSwitch and RCSwitch libraries. Without any succes. With both I receive a code but when I try to resend these code the devices do not react. The code received by Remoteswith differs from the RCSwitch.

Anyone any ideas how I can solve this?
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: spch on Nov 30, 2013, 07:50 pm
Hi,

I've used NewRemoteSwitch (http://"https://github.com/hjgode/homewatch/tree/master/arduino/libraries/NewRemoteSwitch") library for similar switches.

Regards,
Sergey.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: johanm on Dec 02, 2013, 04:32 pm
Sergey thanks for your response.

I do receive a code from my remote with the ShowReceivedCode from NewRemoteSwith library, the result:

Addr 20496 unit 1 off, period: 271us.

But when I try to send an On or Off signal to the device with the LightShow sketch provided as demo, the device does not recognise this signal and does not switch. 

Did you do something special to send out the signal? I use:

NewRemoteTransmitter transmitter(20496, 11, 271, 3);
transmitter.sendUnit(1, true);

My old Kaku and X10 devices working fine with this setup.

Regards,
Johan

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Haenzel on Dec 06, 2013, 10:29 am
Are you aware that you probably will have to link the device within 10 seconds after plugging the switch into the socket? Not sure, but the manual says so to be able to operate it with the standard remote control. Imagine the same is applicable for your arduino transmitter....
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: johanm on Dec 07, 2013, 10:43 pm
The device can be programmed with the remote controller ( multiple remotes /codes per device supported).

I have tried to analyse the signal with a digital analyser and it seem to be the 24 bits protocol that I also had detected witb RCSwitch showcode scetch. But when I tried to sent the same signal the device does not react. I found a diffrence in the sync /start signal. RCRemote use 1 pulse high and 31 pulses low. My remote send 1pulse high and 15 pulses low. But when I changed that the device still does not react.

I need to do more investigation work I supose :-(
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: probono on Jun 29, 2014, 11:43 am
Possibly the FA500 remote control is sending more required data than just the 24 bit code.

Using the Arduino sketch from the RCSwitch library, I get:

Code: [Select]
# A on

Decimal: 4260117 (24Bit) Binary: 010000010000000100010101 Tri-State: F00F000F0FFF PulseLength: 329 microseconds Protocol: 1
Raw data: 10232,392,928,988,332,388,924,388,932,388,928,384,940,380,928,988,336,380,928,384,940,380,928,384,940,384,928,380,940,384,932,980,340,380,932,376,948,376,932,984,340,376,940,976,348,372,936,980,344,


However, when I analyze the same signal using the rtl_433 tool from https://github.com/merbanan/rtl_433 (https://github.com/merbanan/rtl_433), I get:

Code: [Select]
# A on

*** signal_start = 38594077, signal_end = 38825145
signal_len = 231068, pulses = 614
Iteration 1. t: 161 min: 73 (528) max: 249 (86) delta 245
Iteration 2. t: 161 min: 73 (528) max: 249 (86) delta 0
Pulse coding: Short pulse length 73 - Long pulse length 249

Short distance: 197, long distance: 1237, packet distance: 2528

p_limit: 161

[00] {182} 13 72 39 b0 9b 91 cd 84 dc 8e 6c 26 e4 73 60 00 00 00 00 00 00 00 00 : 00010011 01110010 00111001 10110000 10011011 10010001 11001101 10000100 11011100 10001110 01101100 00100110 11100100 01110011 01100000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[01] {66} 00 00 00 00 00 00 00 00 00 : 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[02] {66} 00 00 00 00 00 00 00 00 00 : 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[03] {1} 00 : 00000000
[04] {58} 00 00 00 00 00 00 00 00 : 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[05] {58} 00 00 00 00 00 00 00 00 : 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[06] {58} 00 00 00 00 00 00 00 00 : 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[07] {25} 41 01 15 00 : 01000001 00000001 00010101 00000000
[08] {25} 41 01 15 00 : 01000001 00000001 00010101 00000000
[09] {25} 41 01 15 00 : 01000001 00000001 00010101 00000000
[10] {25} 41 01 15 00 : 01000001 00000001 00010101 00000000
[11] {25} 41 01 15 00 : 01000001 00000001 00010101 00000000


What seems suspicious is that the Arduino code apparently is only concerned with lines [07] to [11] above, totally ignoring lines [01] to [11]. Possibly this is why we cannot get sending to work using the the RCSwitch library.

Does anyone know that lines [01] to [11] could be? Interestingly, some bits in these lines change every time while others do not. Could it be some sort of collission protection scheme?

I have put more log output and an Arduino sending sketch on https://gist.github.com/probonopd/331674026839b96cd8d7 (https://gist.github.com/probonopd/331674026839b96cd8d7).
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: johanm on Jun 30, 2014, 08:40 pm
When I saw your post I did realize that I have not post my last experiences with these devices. I manage to decode the signal. It was very hard because the remote controller of the FA500 send out a sequence of 4 different codes (each code also sent multiple times). With RCSwitch / Remoteswitch and Newremote switch you can "catch" some of these codes but node the ones that switches the FA500.

I first tried to "catch" the codes with OLS, Open Bench Logic sniffer (ols.lxtreme.nl ) with  arduino as sump client (https://github.com/gillham/logic_analyzer). It is very hard to start the analyser and the remote at the same time but I managed to receive 3 different codes. But none of these codes was able to switch the FA500.

At the end I tried it with audacity and the soundcard as Analyser: (see: http://hblok.net/blog/posts/2012/09/02/home-automation-on-433-92-mhz-with-arduino/ and http://davehouston.net/learn.htm) . Then I realize there was one code more in the signal. That first code in the sequence switches my FA500.

Attached schreen picture of the audacity output voor all codes and a detail picture of the first code (the one FA500 uses).

I manage to detect all 8 codes (4 units on/off for 2 remotes). I did not manage to find the logic behind these codes. I hard coded them in my arduino and can switch now my FA500 devices.

Below  the "subroutine code" I use in my Arduino domotica program (als use for X10 and Klik aan / Klik Uit switching).
Because of that I more or less standardised the call of these routine:

Flamingo_Send(house, unit, command);

Where housecode is A-D (code on the remote, like x10/KAKU housecode) and unit is remote unit number (0 or 1, like x10 / KAKU unit number)). Command is 0 or 1 (on or off).

I have added also a lot of debug stuf because it was not easy to get it working.
Hope you can use this the switch your FA500 devices.

Regards,
Johan


/******************************************************************************
** Flamingo_send                                                             **
**                                                                           **   
**       Flamingo device commands (on/off)hard coded (not deciphered yet)    **
**       code is 28 byte long. To transfer it in 32 bit code 4 *0            **
**       is added to the left. For programming reason hex code representation**
**       of device code is used. E.g. Remote 0,C,On:                         ** 
**         code 28 bits: 0001100110111111110100100110                        **
**         code 32 bits: 00011001101111111101001001100000                    **
**         Hex:          19BFD260                                            ** 
**                                                                           **   
**        "Sync" 1 pulse High, 15 pulse low                                  **   
**        "1"    1 pulse High, 3 pulse low                                   **   
**        "0"    3 pulse High, 1 pulse low                                   **   
**        "end"  N/A                                                         **   
**                                                                           **   
**       For internal ref: Unit 0 = white remote , unit 1 = black remote     **
**                                                                           **   
******************************************************************************/
//Compiler only coding
#define FREMOTE 2                                  /*amount supported remotes */
#define FUNITS  4                                  /* Amount of units supported per remote */
#define FCMDN   2                                  /* Amount of CMD 0 = AAN, 1 = UIT */

//define device codes:

uint32_t fdev[FREMOTE][FUNITS][FCMDN] = {0xD9762A10,            /* Remote 0, Unit A, Aan */
          0xDAA47850,                                           /* Remote 0, Unit A, Uit */
          0xDBDA22E0,                                           /* Remote 0, Unit B, Aan */
          0xDBA27220,                                           /* Remote 0, Unit B, Uit */ 
          0x19BFD260,                                           /* Remote 0, Unit C, Aan */
          0x195EEAA0,                                           /* Remote 0, Unit C, Uit */ 
          0x984CC650,                                           /* Remote 0, Unit D, Aan */ 
          0x9A8C1050,                                           /* Remote 0, Unit D, Uit */ 
          0xDBFFFE90,                                           /* Remote 1, Unit A, Aan */
          0xD91CEF10,                                           /* Remote 1, Unit A, Uit */ 
          0xDBC52FA0,                                           /* Remote 1, Unit B, Aan */
          0xD9E35160,                                           /* Remote 1, Unit B, Uit */ 
          0x19B0FE60,                                           /* Remote 1, Unit C, Aan */
          0x19682B20,                                           /* Remote 1, Unit C, Uit */ 
          0x9924E7D0,                                           /* Remote 1, Unit D, Aan */
          0x9BA928D0};                                          /* Remote 1, Unit D, Uit */ 


//Define Flamingo_send variables / constants

  int fpulse = 300;                              /* Pulse witdh in microseconds */
  int fretrans = 5;                              /* Code retransmission         */
  uint32_t fsendbuff;
  uint32_t fdatabit;
  uint32_t fdatamask = 0x80000000;

void Flamingo_Send(int fhousec, int funitc, int fcmd)
  {

  //Test if used codes are valid
 
  if ((funitc < 1) || (funitc >  2)){                   // check if unit code between 1-2 (Remote 0 of 1)
            sendcmd_error = true;                      // no => command error             
           #if defined DEBUG
            Serial.print("Unit error: ");
            Serial.println(funitc);
            #endif
            return;
            }     
      else  {
            funitc = funitc - 1;                        //To address right code in array
      }   
     
  if ((fhousec < 0) || (fhousec >  3)){                // check if house code between 1-4 (A-D)
            sendcmd_error = true;                      // no => command error             
            #if defined DEBUG
               Serial.print("House error: ");
               Serial.println(fhousec);
            #endif   
            return;     
            }   
//      else  {
//            fhousec = fhousec - 1;                      //To address right code in array
//      }
     
if ((fcmd < 0) || (fcmd > 1)){                        // check if command = 0 (off) or 1 (on)
          #if defined DEBUG
            Serial.print("Command error: ");
            Serial.println(fcmd);
          #endif 
          sendcmd_error = true;                      // no => command error             
          return;     
          }
  //End test used codes       
         
#if defined DEBUG
    Serial.println("Send Flamingo command ");
    Serial.print("Flamingo House/Device code = :");
    Serial.println(fhousec);
    Serial.print("Flamingo Unit/remote code = :");
    Serial.println(funitc);
    Serial.print("command = :");
    Serial.println(fcmd);
    Serial.println();
  #endif   
 
  //Zend Command
 
    for (int nRepeat=0; nRepeat <= fretrans; nRepeat++) {
 
    fsendbuff = fdev[funitc][fhousec][fcmd];
     
  // send SYNC 1P High, 15P low     
  //    Serial.println("Zend sync");
 
      digitalWrite(rfPin, HIGH);
      delayMicroseconds(fpulse * 1);         
      digitalWrite(rfPin, LOW);
      delayMicroseconds(fpulse * 15);
     
  // end send SYNC
 
  // Send command
 
    for(int i = 0; i < 28; i++)                                  //Flammingo command is only 28 bits */
       {                                             
         //read data bit         
         fdatabit = fsendbuff & fdatamask;                         //Get most left bit
         fsendbuff = (fsendbuff << 1);                            //Shift left
                     
         if (fdatabit != fdatamask)
           {                                                   //Write 0 
            digitalWrite(rfPin, HIGH);
            delayMicroseconds(fpulse * 3);         
            digitalWrite(rfPin, LOW);
            delayMicroseconds(fpulse * 1);     
           }
         else
           {                                                   //Write 1
            digitalWrite(rfPin, HIGH);
            delayMicroseconds(fpulse * 1);         
            digitalWrite(rfPin, LOW);
            delayMicroseconds(fpulse * 3);   
           }
        }
    }
}
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: probono on Jun 30, 2014, 11:20 pm
Hi Johan,

thanks for your reply. You are a great example of why I love the Arduino community :) Maybe I will keep the Flamingo set after your encouraging post (was thinking of returning it to the shop).

Unfortunately, your code is not compiling for me, I get

Quote
Flamingo_send.ino: In function 'void Flamingo_Send(int, int, int)':
Flamingo_send:59: error: 'sendcmd_error' was not declared in this scope
Flamingo_send:71: error: 'sendcmd_error' was not declared in this scope
Flamingo_send:87: error: 'sendcmd_error' was not declared in this scope
Flamingo_send:112: error: 'rfPin' was not declared in this scope


Like this, I get it to compile:

Code: [Select]

/******************************************************************************
** Flamingo_send                                                             **
**                                                                           **
**       Flamingo device commands (on/off)hard coded (not deciphered yet)    **
**       code is 28 byte long. To transfer it in 32 bit code 4 *0            **
**       is added to the left. For programming reason hex code representation**
**       of device code is used. E.g. Remote 0,C,On:                         **
**         code 28 bits: 0001100110111111110100100110                        **
**         code 32 bits: 00011001101111111101001001100000                    **
**         Hex:          19BFD260                                            **
**                                                                           **
**        "Sync" 1 pulse High, 15 pulse low                                  **
**        "1"    1 pulse High, 3 pulse low                                   **
**        "0"    3 pulse High, 1 pulse low                                   **
**        "end"  N/A                                                         **
**                                                                           **
**       For internal ref: Unit 0 = white remote , unit 1 = black remote     **
**                                                                           **
******************************************************************************/
// Compiler only coding
#define FREMOTE 2                                  /*amount supported remotes */
#define FUNITS  4                                  /* Amount of units supported per remote */
#define FCMDN   2                                  /* Amount of CMD 0 = On, 1 = Off */

int rfPin = 10;

// define device codes:

uint32_t fdev[FREMOTE][FUNITS][FCMDN] = {0xD9762A10,                                           /* Remote 0, Unit A, On  */
                                        0xDAA47850,                                           /* Remote 0, Unit A, Off */
                                        0xDBDA22E0,                                           /* Remote 0, Unit B, On  */
                                        0xDBA27220,                                           /* Remote 0, Unit B, Off */
                                        0x19BFD260,                                           /* Remote 0, Unit C, On  */
                                        0x195EEAA0,                                           /* Remote 0, Unit C, Off */
                                        0x984CC650,                                           /* Remote 0, Unit D, On  */
                                        0x9A8C1050,                                           /* Remote 0, Unit D, Off */
                                        0xDBFFFE90,                                           /* Remote 1, Unit A, On  */
                                        0xD91CEF10,                                           /* Remote 1, Unit A, Off */
                                        0xDBC52FA0,                                           /* Remote 1, Unit B, Aan */
                                        0xD9E35160,                                           /* Remote 1, Unit B, Off */
                                        0x19B0FE60,                                           /* Remote 1, Unit C, On  */
                                        0x19682B20,                                           /* Remote 1, Unit C, Uit */
                                        0x9924E7D0,                                           /* Remote 1, Unit D, On  */
                                        0x9BA928D0                                            /* Remote 1, Unit D, Uit */
                                       };                                          


// Define Flamingo_send variables / constants

int fpulse = 300;                              /* Pulse witdh in microseconds */
int fretrans = 5;                              /* Code retransmission         */
uint32_t fsendbuff;
uint32_t fdatabit;
uint32_t fdatamask = 0x80000000;

void Flamingo_Send(int fhousec, int funitc, int fcmd)
{

 // Test if used codes are valid

 if ((funitc < 1) || (funitc >  2)) {                  // check if unit code between 1-2 (Remote 0 of 1)
   Serial.print("Unit error: ");
   Serial.println(funitc);
   return;
 }
 else  {
   funitc = funitc - 1;                               // To address right code in array
 }

 if ((fhousec < 0) || (fhousec >  3)) {               // check if house code between 1-4 (A-D)
   Serial.print("House error: ");
   Serial.println(fhousec);
   return;
 }

 if ((fcmd < 0) || (fcmd > 1)) {                       // check if command = 0 (off) or 1 (on)
   Serial.print("Command error: ");
   Serial.println(fcmd);
   return;
 }
 
 //End test used codes

 Serial.println("Send Flamingo command ");
 Serial.print("Flamingo House/Device code = :");
 Serial.println(fhousec);
 Serial.print("Flamingo Unit/remote code = :");
 Serial.println(funitc);
 Serial.print("command = :");
 Serial.println(fcmd);
 Serial.println();


 // Send Command

 for (int nRepeat = 0; nRepeat <= fretrans; nRepeat++) {

   fsendbuff = fdev[funitc][fhousec][fcmd];

   // send SYNC 1P High, 15P low
   Serial.println("Send sync");

   digitalWrite(rfPin, HIGH);
   delayMicroseconds(fpulse * 1);
   digitalWrite(rfPin, LOW);
   delayMicroseconds(fpulse * 15);

   // end send SYNC

   // Send command

   for (int i = 0; i < 28; i++)                                 // Flamingo command is only 28 bits */
   {
     // read data bit
     fdatabit = fsendbuff & fdatamask;                         // Get most left bit
     fsendbuff = (fsendbuff << 1);                             // Shift left

     if (fdatabit != fdatamask)
     { // Write 0
       digitalWrite(rfPin, HIGH);
       delayMicroseconds(fpulse * 3);
       digitalWrite(rfPin, LOW);
       delayMicroseconds(fpulse * 1);
     }
     else
     { // Write 1
       digitalWrite(rfPin, HIGH);
       delayMicroseconds(fpulse * 1);
       digitalWrite(rfPin, LOW);
       delayMicroseconds(fpulse * 3);
     }
   }
 }
}

void setup() {
 Serial.begin(9600);
}

void loop() {
 Flamingo_Send(0, 1, 1);
 delay(1000);
 Flamingo_Send(0, 1, 0);
 delay(3000);
}


Unfortunately, my Flamingos do not react. Do you have any way to determine, based on my information on https://gist.github.com/probonopd/331674026839b96cd8d7 what I need to change?

Thanks!
probono
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: johanm on Jul 01, 2014, 11:17 am
At first sight the code looks fine to me. At this momment I cannot test it on my Arduino (maybe later this week).

Just te be sure: Have you programmed the Flamingo device to listen to this code?

Regards,
Johan
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: probono on Jul 01, 2014, 06:31 pm
Hi Johan,

you are absolutely right -- I was (wrongly) assuming that pressing "A on" on my physical remote control would send the same code as your sketch (which did not work). After programming the Flamingos to listen to the sketch, it is now working wonderfully.

Out of curiosity, is it possible to translate the codes I have sniffed into the notation your sketch is using?

Thanks,
probono
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: johanm on Jul 01, 2014, 07:59 pm
Oke I am glad it is working.

You now have the codes of my two remote controllers. I hope you do not live nearby :-)

As you proably know It is possible to program a flamingo device to listen to multiple code's. So you can program it to react to your remote controller and my codes via the arduino.

I do not think that you have received the right codes with the standards tools to detect the codes the remote is sending for the flamingo devices. As described before the flamingo remote controller is sending out 4 different codes. The one you received with the rcswitch (or other tools) is code 2,3 or 4. I was only possible to detect the first code, the flamingo code, using audacity and the aux in of the soundcard as analyser.  It took me some days to recognized this.

So if you want the detect the codes of your remote then you have put some effort in it. Maybe with the knowledge I have now can write a detection utility but don't count on it.

If you can read dutch I can send you my notes on my "flamingo journey" with some exploination about the detected codes /protocols.

Regards,
Johan
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: probono on Jul 08, 2014, 08:59 pm
...or so I tought.

In the end I was able to switch them on but not off. I decided to return my Flamingos to the shop because I don't like the fact that there are not physical switches to encode the addresses. It feels like I can never be sure which codes they react to, and the whole addressing thing feels a bit fragile to me.

Still, I would be interested in reading your full Flamingo journey with the help of Google translate.

Thanks,
probono
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: laurensV on Sep 06, 2014, 05:54 pm
I don't have an arduino, but this was the only forum mentioning this problem. I am trying to setup the ELRO Flamingo switches (FA500) in Domoticz on the raspberry PI. Is there any way to fix this problem for domoticz? I am using a rfxcom transceiver. It can 'learn' the signal from the remote, but then when I am transmitting the signal back to the Flamingo switches, they do not respond to that signal.


@johanm: Any way I can convert your code to work on the raspberry pi with domoticz (or some other platform)?

PS. @johanm I am also dutch by the way.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: mmooren94 on Nov 03, 2014, 07:14 pm
@johanm,

Dear johanm,
i have also purchased some flamingo FA500. But when i use your sketch i can't 'teach' my arduino to your codes. I have emptied the memory of the flamingos, but no result. Can you please help me?

btw i'm also Dutch:)

greeting,
Michel
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: timleferink on Dec 20, 2014, 02:43 pm
I'm also trying to use these switches in my microcontroller, but I have a weird problem.
We checked all the signals sent out by the remote using an osciloscope and tried all protocols using a modified RCSwitch library. After these tests we determined that the second protocol that is sent out; is the correct one for the switches.
So after this we wanted to connect a few devices, and see if everything worked.
Only we noticed at this point, that when we assign A to outlet1, B to outlet2 and C to outlet3, no matter what channel we choose, all switches turn on and off at all channels!!
So when I press A on, all devices turn on, and C off, all devices turn off. All switches seem to have accepted all codes. And all of this is happening using the original remote! When we try to use the Arduino we have the exact same problem.

Is there anyone else that has had this problem? And is there a way to fix it? It allmost seems like the switches have some kind of ROM that has been written to.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Jan 18, 2015, 11:02 pm
Hello,
I had a look at the code above and managed to write a sketch that prints the 28Bit codes of your remote control. As a start I had a look at the RCSwitch library to find out how the interuptHandler finds the start of the telegrams. Then the library is also able to send the codes which is very similar RCSwitch does. In the end I think this could be protocol 4 of the RCSwitch lib in future  :)

Everytime you push a button on your remote control the code is printed in the following way:

Code: [Select]

Code: 0x24613E20 (28Bit) Binary: 0010010001100001001111100010 PulseLength: 330 microseconds
Raw data: 4988,292,1016,292,1020,936,372,284,1020,288,1032,928,372,284,1024,284,1024,284,1024,936,372,932,296,216,296,216,1320,216,1316,216,304,1320,216,1316,220,292,220,292,220,1320,216,292,1312,220,288,224,1312,228,284,224,1316,1312,228,288,220,1316,220,




Btw I think that you misinterpreted what's Bit 1 and Bit 0:
- Bit 0 is 1 pulse HIGH and 3 pulses LOW
- Bit 1 is 3 pulses HIGH and 1 pulse LOW
but that didn't matter as your send routine simply did the same mistake leading to the right waveform again. (See also send1() and send0() routines in the RCSwitch lib).


Using audacity to analyze the waveforms you can see that the remote control sends:
- 4 times a 28Bit code
- 6 times (unknown code)
- 6 times a 24Bit code
The last one is printed by the RCSwitch library but this one does not work with the switches. The right one is the first one which is printed by my program. I don't know why the remote control sends 3 different codes, probably it is able to support 3 different switch-models.

The lib can be found here
https://github.com/windkh/flamingoswitch

Thank you all for your effort it helped me alot.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Feb 05, 2015, 09:19 pm
In germany you can buy the switches from mumbi m-FS300
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Feb 21, 2015, 09:45 pm
Hello everybody.

MANY MANY thanks for your Sketches. I also bought some new "mumbi m-FS300" remote plugs in Germany. They also do not have those little switches to set them up.
3 evenings of testing now and I found a reliable and stabel solution to drive the switches:
1. You have to send 3 of 4 commands (yes I tested it!) from the sketch for turning one device on/off (not one single send-command)
2. To get these 4 commands, you can use the sketch attached at the bottom
3. You then - and that was my goal - can drive the plugs via RCSwitch (with the changes from FlamingoSwitch - THANKS for that!!!) also attached at the bottom (you have to add a 4th protocol)

To get all 4 commands for one device (on or off) - you have to push the button often, so that all 4 commands are shown in the Serial Monitor while playing the Sketch from the attached archive.

Edited RCSwitch.cpp in the archive, so that you can send commands like:
Code: [Select]
mySwitch.setProtocol(4);
         mySwitch.setRepeatTransmit(1);
        mySwitch.setPulseLength(300);
        mySwitch.send("0010011011100001011110011001");
        mySwitch.send("0010011101011111101011111001");
        mySwitch.send("0010011010011111010011000101");
        mySwitch.send("0010011010011000100010010001");
        delay(500);



I hope this helps some of you not to also spend some evenings with this stuff :)

One sad point: powering off does not always work - I don't know why... perhaps ou have a clue.

EDIT: When setting the pulseLength to 220 also shutting off works. I think that's the parameter, which everybody has to find out for themselves.

Greetings
   Wex
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Mar 13, 2015, 11:44 pm
The pulse length is around 300... I wonder that 220 also works.
I noticed that sending one code also works very well. Probably this depends on how you teached the switches. Nice to hear that you made progress...
Should I ad your changes to the flamingo repository?
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Mar 25, 2015, 07:00 pm
Hello guys, thanks for your precious information. I made some measurements and hope that the following will help (if so, let me know !).

My goal isn't to control plugs but to create kind of plugs controlled by the remote I bought.

I mesure thanks to an Ikalogic digital analyser directly on the remote, to avoid external disturbance.

1 frame = 4+6+6 blocs that I'll call A,B,C

A bloc: 4 times a 28 bit code
B bloc: 6 times a 32 bit code
C bloc: 6 times a 24 bit code

Given your comments, each bloc may refer to a bunch of reveiver models. Each would only interpret the bloc of the frame that is interesting for it.
At the moment, I didn't confirm the lines bellow by generating such frames and controlling the plug reacts. So I can't tell if all A, B and C blocs are needed.

---- A bloc ----

Sync : 1 pulse High, 15 pulse Low
1 : HLLL
0 : HHHL
Length of a pulse : 326 to 328µs

The A bloc is a 4 times repetition of the same 28 bit code (ex : A1A1A1A1).
If I push many times the button, the code will be A1, then A2, then A3, etc and it rolls back to A1.
The A1 code is the one I have after powering on the remote.

Bellow, spaces intend to show similar parts in codes.

A codes (28 bits) for Aon :
A1 : s001001 11010001001001000111 10
A2 : s001001 01100011000101111101 10
A3 : s001001 11001011111001111000 10
A4 : s001001 01011000010010110101 10

A codes (28 bits) for Aoff :
A1 : s001001 00010011100010100001 10
A2 : s001001 00011010001011001110 10
A3 : s001001 00001101101100110110 10
A4 : s001001 01010010111110000011 10

A codes (28 bits) for Bon :
A1 : s001001 11011010100011110001 01
A2 : s001001 11010010111000010100 01
A3 : s001001 11011011111111000110 01
A4 : s001001 00011011000110101110 01

A codes (28 bits) for Boff :
A1 : s001001 11011110010011001010 01
A2 : s001001 01100001111001100111 01
A3 : s001001 10110101000000100101 01
A4 : s001001 10110100110111110011 01

A codes (28 bits) for Con :
A1 : s111001 10011011010111000100 01
A2 : s111001 11001101101001000110 01
A3 : s111001 01111011001101101100 01
A4 : s111001 00011100010101001110 01

A codes (28 bits) for Coff :
A1 : s111001 10010101011101101101 01
A2 : s111001 11001010110011110101 01
A3 : s111001 11000011001100110011 01
A4 : s111001 01100110111011110111 01

A codes (28 bits) for Don :
A1 : s011001 10001110000101000000 10
A2 : s011001 10100000010010010001 10
A3 : s011001 10100011110110011010 10
A4 : s011001 01011110010101110110 10

A codes (28 bits) for Doff :
A1 : s011001 10010001000110001110 10
A2 : s011001 00110010010001111100 10
A3 : s011001 10101111011001100010 10
A4 : s011001 00010110010010001101 10

Possible interpretation would be :
[6 bits address][20 bits for not understood command][2 bits maybe for something like row / column stuff]
It would be great to discover how the mysterious parts are generated
About the address part, I saw in this forum thread that another user has the same. This could be a coincidence or just a synchronisation preamble.

---- Bloc B ----

Sync : 1 pulse High, 40 pulses Low, then 1 pulse High and 10 pulse Low
0 : HLHLLLLL
1 : HLLLLLHL
Length of a pulse : 255µs

The B bloc is a 6 times repetition of the same 32 bit code (ex : BBBBBB).
If I push many times the button, it is always the same code that is sent.

Bellow, spaces intend to show similar parts in codes.

B code (32 bits) for Aon  : s000010100110101000000000100 1 00 00
B code (32 bits) for Aoff : s000010100110101000000000100 0 00 00
B code (32 bits) for Bon  : s000010100110101000000000100 1 00 01
B code (32 bits) for Boff : s000010100110101000000000100 0 00 01
B code (32 bits) for Con  : s000010100110101000000000100 1 00 10
B code (32 bits) for Coff : s000010100110101000000000100 0 00 10
B code (32 bits) for Don  : s000010100110101000000000100 1 00 11
B code (32 bits) for Doff : s000010100110101000000000100 0 00 11

The obvious interpretation would be :
[29 bits address (and sync preamble ?)][On 1/Off 0][00][Button number 0 to 3]
The "00" might be the extension of the button number so that it is not only 0 to 3 but 0 to 15 buttons available.

---- C bloc ----
Similar to A bloc.

Sync : 1 pulse High, 30 pulses Low
1 : HLLL
0 : HHHL
Length of a pulse : 326 to 328µs

The C bloc is a 6 times repetition of the same 24 bit code (ex : CCCCCC).
If I push many times the button, it is always the same code that is sent.

Bellow, spaces intend to show similar parts in codes.

C code (24 bits) for Aon  : s00010101000 00001 0001010 1
C code (24 bits) for Aoff : s00010101000 00001 0001010 0
C code (24 bits) for Bon  : s00010101000 00100 0001010 1
C code (24 bits) for Boff : s00010101000 00100 0001010 0
C code (24 bits) for Con  : s00010101000 00101 0001010 1
C code (24 bits) for Coff : s00010101000 00101 0001010 0
C code (24 bits) for Don  : s00010101000 10000 0001010 1
C code (24 bits) for Doff : s00010101000 10000 0001010 0

The obvious interpretation would be :
[11 bits address (and/or sync preamble ?)][5 bits for not understood button identification, except that the binary value increases][7 more bits for address (group ?)][On 1/Off 0]

-----------
I would be very happy if you post your own codes, so that we might perform better code interpretation.

Please leave a comment if anything helped or if you've got an idea.

Atb

renArD


Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Mar 28, 2015, 08:13 am
I only have the 28Bit codes of my remote control at hand:

0x24DC206, 0x267C51A, 0x25C90CE, 0x277193A  // (28Bit) A OFF
0x25B25B6, 0x24613E2, 0x27263DE, 0x24E77D6  // (28Bit) A ON

0x275BADD, 0x26933A9, 0x27F3115, 0x2440F0D  // (28Bit) B OFF
0x2717B51, 0x2547C99, 0x26585B9, 0x259A085  // (28Bit) B ON

0xE4936D5, 0xE73720D, 0xE616D1D, 0xE4D49F5  // (28Bit) C OFF
0xE56BF91, 0xE56EB71, 0xE62AF39, 0xE4FBCD9   // (28Bit) C ON

0x65B67B6, 0x64C8BFA, 0x6504C32, 0x6526F4A  // (28Bit) D OFF
0x65F1C2A, 0x670319A, 0x65E1942, 0x643F986   // (28Bit) D ON

Binary:
A OFF
0x24DC206 --> 1001 00110111000010000001 10
0x267C51A --> 1001 10011111000101000110 10
0x25C90CE --> 1001 01110010010000110011 10
0x277193A --> 1001 11011100011001001110 10

A ON
0x25B25B6 --> 1001 01101100100101101101 10
0x24613E2 --> 1001 00011000010011111000 10
0x27263DE --> 1001 11001001100011110111 10
0x24E77D6 --> 1001 00111001110111110101 10

The first 4 bits are probably an address for the Button (A = 1001) here.



Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Mar 31, 2015, 08:36 pm
Thanks Karl for this contribution !
I compared your codes to mine (in binary). Here is the comparison (Let's copy it to notepad to have it perfectly aligned)

A codes (28 bits) for Aon :
me  A1 : s001001 11010001001001000111 10
you A1 : s001001 01101100100101101101 10
me  A2 : s001001 01100011000101111101 10
you A2 : s001001 00011000010011111000 10
me  A3 : s001001 11001011111001111000 10
you A3 : s001001 11001001100011110111 10
me  A4 : s001001 01011000010010110101 10
you A4 : s001001 00111001110111110101 10

A codes (28 bits) for Aoff :
me  A1 : s001001 00010011100010100001 10
you A1 : s001001 00110111000010000001 10
me  A2 : s001001 00011010001011001110 10
you A2 : s001001 10011111000101000110 10
me  A3 : s001001 00001101101100110110 10
you A3 : s001001 01110010010000110011 10
me  A4 : s001001 01010010111110000011 10
you A4 : s001001 11011100011001001110 10

A codes (28 bits) for Bon :
me  A1 : s001001 11011010100011110001 01
you A1 : s001001 11000101111011010100 01
me  A2 : s001001 11010010111000010100 01
you A2 : s001001 01010001111100100110 01
me  A3 : s001001 11011011111111000110 01
you A3 : s001001 10010110000101101110 01
me  A4 : s001001 00011011000110101110 01
you A4 : s001001 01100110100000100001 01

A codes (28 bits) for Boff :
me  A1 : s001001 11011110010011001010 01
you A1 : s001001 11010110111010110111 01
me  A2 : s001001 01100001111001100111 01
you A2 : s001001 10100100110011101010 01
me  A3 : s001001 10110101000000100101 01
you A3 : s001001 11111100110001000101 01
me  A4 : s001001 10110100110111110011 01
you A4 : s001001 00010000001111000011 01

A codes (28 bits) for Con :
me  A1 : s111001 10011011010111000100 01
you A1 : s111001 01011010111111100100 01
me  A2 : s111001 11001101101001000110 01
you A2 : s111001 01011011101011011100 01
me  A3 : s111001 01111011001101101100 01
you A3 : s111001 10001010101111001110 01
me  A4 : s111001 00011100010101001110 01
you A4 : s111001 00111110111100110110 01

A codes (28 bits) for Coff :
me  A1 : s111001 10010101011101101101 01
you A1 : s111001 00100100110110110101 01
me  A2 : s111001 11001010110011110101 01
you A2 : s111001 11001101110010000011 01
me  A3 : s111001 11000011001100110011 01
you A3 : s111001 10000101101101000111 01
me  A4 : s111001 01100110111011110111 01
you A4 : s111001 00110101001001111101 01

A codes (28 bits) for Don :
me  A1 : s011001 10001110000101000000 10
you A1 : s011001 01111100011100001010 10
me  A2 : s011001 10100000010010010001 10
you A2 : s011001 11000000110001100110 10
me  A3 : s011001 10100011110110011010 10
you A3 : s011001 01111000011001010000 10
me  A4 : s011001 01011110010101110110 10
you A4 : s011001 00001111111001100001 10

A codes (28 bits) for Doff :
me  A1 : s011001 10010001000110001110 10
you A1 : s011001 01101101100111101101 10
me  A2 : s011001 00110010010001111100 10
you A2 : s011001 00110010001011111110 10
me  A3 : s011001 10101111011001100010 10
you A3 : s011001 01000001001100001100 10
me  A4 : s011001 00010110010010001101 10
you A4 : s011001 01001001101111010010 10

I again put spaces to show similar parts.

One thing interresting is to notice that your remote and mine have the same 6 bits header and 2 bits tails (so it can't be the remote address). Otherwise, I don't think that the header bits are intended to tell which button pair (A, B, C or D) had been pressed because A and B have the same header. But considering header + tail, it would be enough to recognize the button pressed.

I hope someone will post his codes so that we can try to guess how the main and curious part works.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Mar 31, 2015, 11:06 pm
Good Job,
yes you are right it seems like a frame with header + "some code" + tail.
I thought that the switch needs to recognize at least 1 of the 4 codes to turn on or off. But wex_storm reported that his switches need to see at least 3 of 4 codes to turn on or off. It this is true then probably the following codes must correlate to each other.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Mar 31, 2015, 11:26 pm
Thanks !

According to my measures, only one button push is enough to switch the plug. One push will send 4 times the same code. The next push will send 4 times another code.

I think wex_storm said that in case 1 of the 4 (same) codes isn't good, there will still be 3 codes least, which seems to be the limit for the plug to consider the command (if 2 codes ok and 2 codes wrong, it doesn't switch on/off).
I wish I'll someday give it a try.

But I still think that the codes are correlated because the plug has to know that the remote configured with one push has to work with other pushs (and with other buttons !).
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 01, 2015, 10:02 am
Note : I may have exchanged 1 and 0 in my codes (interpreting HLLL as 0 instead of 1).


I've almost finished my reception software. I can notice that, even if my remote sends pulses between 308 and 345µs, my RF receiver interprets them as 240 to 432µs !

As a consequence, I enlarge my receiver tolerance which is consequently more eager to false sync detections.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Apr 11, 2015, 11:33 am
Hi folks,
Just a few thoughts on the above.  First, if it is possible to have two remotes that don't interfere and have a registering process between the remote and the switches, then it is likely that the switches have a rolling code number that is random and is initialised  When they are 'Connected'.  The code is probably determined when the batteries are first put in the transmitter, and subsequently the switches are 'taught' the code. If you remove, wait, and replace the Remote's batteries does the system fail to work? Do the switches have to be re-paired with the Remote?

The data at the beginning of the samples, before the sync section is just the Arduino+Rx stabilising to the sync pulses and the AGC is trying to find the mid way for the signal from the Remote control. I would ignore that section, I am sure the real data you are after is in the section after the synch.  The data is repeated multiple times as this is a basic way to validate the data, if same data is received say 4 times it is trusted, so it must be sent that same way from the Arduino to work the switch, not just once.

Having different data structures present in a Tx's packet may allow for different models of switches being worked by that same controller(as mentioned above).

If there is a rolling code then 'hardwired' bit patterns from one setup to another setup unlikely to work as they will have different rolling codes.  The Arduino program could be programmed to ignore that part in the bit patterns, but at the risk some other non-paired Tx may take control. A suggestion is the Arduino is given a switch that allows it to extract the rolling code from the next signal received from the Remote Control, it stores it in EEPROM and uses it as a base to make it's own transmissions. Obviously the Remote control and Switches would also need to be paired to establish the agreed rolling code.

For this suggestion Arduino would need both a Tx and Rx module.  If the remote was never to be used then just pairing the switch with the Arduino' choice of rolling code could be done and then only a Tx module would be needed.

Sorry, I apologise in advance if I have gone over old ground and contributed nothing new, R.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 12, 2015, 02:02 pm
Hi robwlakes, thanks for sharing your opinion !

Quote
If you remove, wait, and replace the Remote's batteries does the system fail to work? Do the switches have to be re-paired with the Remote?
If you remove the battery and replace it, it is the same code "A1" that is sent. And the plug still works with it. The second time you push the button, it will be A2, etc.

It's the occasion to mention that the pairing process doesn't need the 4 codes of a button, neither the off button to be received. That is to say A1 or A2 or A3 or A4 of the "on" button is enough for the plug to understand all codes of this "on" button, and also all codes of the corresponding "off" button.
As a reminder, if the off button is pressed during pairing process, it tells the plug to "unpair".

Quote
The data at the beginning of the samples, before the sync section is just the Arduino+Rx stabilising to the sync pulses and the AGC is trying to find the mid way for the signal from the Remote control. I would ignore that section, I am sure the real data you are after is in the section after the synch.  The data is repeated multiple times as this is a basic way to validate the data, if same data is received say 4 times it is trusted, so it must be sent that same way from the Arduino to work the switch, not just once.
Yes, we agree that all similar parts between codes are something like synchronization or telling it is a Flamingo remote. Then the still-strange part is remote-dependant and probably button-dependant.

If I missed something please tell me.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 12, 2015, 02:08 pm
EDIT : reorganizing some codes, we can split one more time

As I had a second remote, I decided to sniff its codes. Here is the compilation of data we have. If you have such a remote, please share your codes until a genius finds the trick to generate/understand them !

Code: [Select]
A codes (28 bits) for Aon :
renArD n°1  A1 : s001001 1101000100100100 0111 10
renArD n°2  A1 : s001001 0001010011011001 0111 10
Karl-Heinz  A1 : s001001 1100100110001111 0111 10

renArD n°1  A2 : s001001 0110001100010111 1101 10
renArD n°2  A2 : s001001 0000110011110011 1101 10
Karl-Heinz  A4 : s001001 0110110010010110 1101 10

renArD n°1  A3 : s001001 1100101111100111 1000 10
renArD n°2  A3 : s001001 0011111101001011 1000 10
Karl-Heinz  A3 : s001001 0001100001001111 1000 10

renArD n°1  A4 : s001001 0101100001001011 0101 10
renArD n°2  A4 : s001001 1101001100110101 0101 10
Karl-Heinz  A2 : s001001 0011100111011111 0101 10


A codes (28 bits) for Aoff :
renArD n°1  A1 : s001001 0001001110001010 0001 10
renArD n°2  A1 : s001001 1101111111100100 0001 10
Karl-Heinz  A1 : s001001 0011011100001000 0001 10

renArD n°1  A2 : s001001 0001101000101100 1110 10
renArD n°2  A2 : s001001 1110110111110101 1110 10
Karl-Heinz  A4 : s001001 1101110001100100 1110 10

renArD n°1  A3 : s001001 0000110110110011 0110 10
renArD n°2  A3 : s001001 1010011000111011 0110 10
Karl-Heinz  A2 : s001001 1001111100010100 0110 10

renArD n°1  A4 : s001001 0101001011111000 0011 10
renArD n°2  A4 : s001001 0100011011101001 0011 10
Karl-Heinz  A3 : s001001 0111001001000011 0011 10


A codes (28 bits) for Bon :
renArD n°1  A1 : s001001 1101101010001111 0001 01
renArD n°2  A2 : s001001 1100110110110101 0001 01
Karl-Heinz  A4 : s001001 0110011010000010 0001 01

renArD n°1  A2 : s001001 1101001011100001 0100 01
renArD n°2  A3 : s001001 0101101010001001 0100 01
Karl-Heinz  A1 : s001001 1100010111101101 0100 01

renArD n°1  A3 : s001001 1101101111111100 0110 01
renArD n°2  A4 : s001001 1111101110010101 0110 01
Karl-Heinz  A2 : s001001 0101000111110010 0110 01

renArD n°1  A4 : s001001 0001101100011010 1110 01
renArD n°2  A1 : s001001 0101010000110011 1110 01
Karl-Heinz  A3 : s001001 1001011000010110 1110 01


A codes (28 bits) for Boff :
renArD n°1  A1 : s001001 1101111001001100 1010 01
renArD n°2  A3 : s001001 1100010011100101 1010 01
Karl-Heinz  A2 : s001001 1010010011001110 1010 01

renArD n°1  A2 : s001001 0110000111100110 0111 01
renArD n°2  A4 : s001001 1011101100110000 0111 01
Karl-Heinz  A1 : s001001 1101011011101011 0111 01

renArD n°1  A3 : s001001 1011010100000010 0101 01
renArD n°2  A1 : s001001 1111101010100000 0101 01
Karl-Heinz  A3 : s001001 1111110011000100 0101 01

renArD n°1  A4 : s001001 1011010011011111 0011 01
renArD n°2  A2 : s001001 0010110101010100 0011 01
Karl-Heinz  A4 : s001001 0001000000111100 0011 01


A codes (28 bits) for Con :
renArD n°1  A1 : s111001 1001101101011100 0100 01
renArD n°2  A1 : s111001 1100000010111010 0100 01
Karl-Heinz  A1 : s111001 0101101011111110 0100 01

renArD n°1  A2 : s111001 1100110110100100 0110 01
renArD n°2  A2 : s111001 1000100010011111 0110 01
Karl-Heinz  A4 : s111001 0011111011110011 0110 01

renArD n°1  A3 : s111001 0111101100110110 1100 01
renArD n°2  A3 : s111001 0100101110001111 1100 01
Karl-Heinz  A2 : s111001 0101101110101101 1100 01

renArD n°1  A4 : s111001 0001110001010100 1110 01
renArD n°2  A4 : s111001 0000000010000001 1110 01
Karl-Heinz  A3 : s111001 1000101010111100 1110 01


A codes (28 bits) for Coff :
renArD n°1  A1 : s111001 1001010101110110 1101 01
renArD n°2  A2 : s111001 1011010011001100 1101 01
Karl-Heinz  A4 : s111001 0011010100100111 1101 01

renArD n°1  A2 : s111001 1100101011001111 0101 01
renArD n°2  A3 : s111001 1011111100010110 0101 01
Karl-Heinz  A1 : s111001 0010010011011011 0101 01

renArD n°1  A3 : s111001 1100001100110011 0011 01
renArD n°2  A4 : s111001 1100000110111011 0011 01
Karl-Heinz  A2 : s111001 1100110111001000 0011 01

renArD n°1  A4 : s111001 0110011011101111 0111 01
renArD n°2  A1 : s111001 1110011010100101 0111 01
Karl-Heinz  A3 : s111001 1000010110110100 0111 01


A codes (28 bits) for Don :
renArD n°1  A1 : s011001 1000111000010100 0000 10
renArD n°2  A1 : s011001 0110000010011010 0000 10
Karl-Heinz  A3 : s011001 0111100001100101 0000 10

renArD n°1  A2 : s011001 1010000001001001 0001 10
renArD n°2  A2 : s011001 1110111110100001 0001 10
Karl-Heinz  A4 : s011001 0000111111100110 0001 10

renArD n°1  A3 : s011001 1010001111011001 1010 10
renArD n°2  A3 : s011001 1100100010000010 1010 10
Karl-Heinz  A1 : s011001 0111110001110000 1010 10

renArD n°1  A4 : s011001 0101111001010111 0110 10
renArD n°2  A4 : s011001 0011100001110001 0110 10
Karl-Heinz  A2 : s011001 1100000011000110 0110 10


A codes (28 bits) for Doff :
renArD n°1  A1 : s011001 1001000100011000 1110 10
renArD n°2  A1 : s011001 0111100101101101 1110 10
Karl-Heinz  A2 : s011001 0011001000101111 1110 10

renArD n°1  A2 : s011001 0011001001000111 1100 10
renArD n°2  A2 : s011001 1111100011101011 1100 10
Karl-Heinz  A3 : s011001 0100000100110000 1100 10

renArD n°1  A3 : s011001 1010111101100110 0010 10
renArD n°2  A3 : s011001 1010001111000011 0010 10
Karl-Heinz  A4 : s011001 0100100110111101 0010 10

renArD n°1  A4 : s011001 0001011001001000 1101 10
renArD n°2  A4 : s011001 0101000011110010 1101 10
Karl-Heinz  A1 : s011001 0110110110011110 1101 10


As mentioned before, A1 or A2 or A3 or A4 of "on" button is enough to understand the other codes and the four "off" codes. A postal card to the one who finds the cyphering process ! ;)
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Apr 12, 2015, 04:20 pm
excellent work. I'm going to order a further set today... to get my hands on a new remote control. I'll post the codes as soon as they arive.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Apr 15, 2015, 08:49 pm
Here are the codes for the new remote control that just arrived:


Code: [Select]

A codes (28 bits) for Aon :
renArD n°1  A1 : s001001 1101000100100100 0111 10
renArD n°2  A1 : s001001 0001010011011001 0111 10
KH     n°1  A1 : s001001 1100100110001111 0111 10
KH     n°2  A2 : s001001 0111000100110000 0111 10

renArD n°1  A2 : s001001 0110001100010111 1101 10
renArD n°2  A2 : s001001 0000110011110011 1101 10
KH     n°1  A4 : s001001 0110110010010110 1101 10
KH     n°2  A3 : s001001 1110111000100101 1101 10

renArD n°1  A3 : s001001 1100101111100111 1000 10
renArD n°2  A3 : s001001 0011111101001011 1000 10
KH     n°1  A3 : s001001 0001100001001111 1000 10
KH     n°2  A4 : s001001 1001000000111100 1000 10

renArD n°1  A4 : s001001 0101100001001011 0101 10
renArD n°2  A4 : s001001 1101001100110101 0101 10
KH     n°1  A2 : s001001 0011100111011111 0101 10
KH     n°2  A1 : s001001 1110110110100000 0101 10


A codes (28 bits) for Aoff :
renArD n°1  A1 : s001001 0001001110001010 0001 10
renArD n°2  A1 : s001001 1101111111100100 0001 10
KH     n°1  A1 : s001001 0011011100001000 0001 10
KH     n°2  A2 : s001001 0100111010110101 0001 10

renArD n°1  A2 : s001001 0001101000101100 1110 10
renArD n°2  A2 : s001001 1110110111110101 1110 10
KH     n°1  A4 : s001001 1101110001100100 1110 10
KH     n°2  A3 : s001001 0010011100110011 1110 10

renArD n°1  A3 : s001001 0000110110110011 0110 10
renArD n°2  A3 : s001001 1010011000111011 0110 10
KH     n°1  A2 : s001001 1001111100010100 0110 10
KH     n°2  A4 : s001001 1011010010010101 0110 10

renArD n°1  A4 : s001001 0101001011111000 0011 10
renArD n°2  A4 : s001001 0100011011101001 0011 10
KH     n°1  A3 : s001001 0111001001000011 0011 10
KH     n°2  A1 : s001001 0110001001010100 0011 10


A codes (28 bits) for Bon :
renArD n°1  A1 : s001001 1101101010001111 0001 01
renArD n°2  A2 : s001001 1100110110110101 0001 01
KH     n°1  A4 : s001001 0110011010000010 0001 01
KH     n°2  A3 : s001001 1010101011100100 0001 01

renArD n°1  A2 : s001001 1101001011100001 0100 01
renArD n°2  A3 : s001001 0101101010001001 0100 01
KH     n°1  A1 : s001001 1100010111101101 0100 01
KH     n°2  A4 : s001001 0101111000010000 0100 01

renArD n°1  A3 : s001001 1101101111111100 0110 01
renArD n°2  A4 : s001001 1111101110010101 0110 01
KH     n°1  A2 : s001001 0101000111110010 0110 01
KH     n°2  A1 : s001001 1001110000111011 0110 01

renArD n°1  A4 : s001001 0001101100011010 1110 01
renArD n°2  A1 : s001001 0101010000110011 1110 01
KH     n°1  A3 : s001001 1001011000010110 1110 01
KH     n°2  A2 : s001001 0000100011110101 1110 01


A codes (28 bits) for Boff :
renArD n°1  A1 : s001001 1101111001001100 1010 01
renArD n°2  A3 : s001001 1100010011100101 1010 01
KH     n°1  A2 : s001001 1010010011001110 1010 01
KH     n°2  A4 : s001001 0111001001101011 1010 01

renArD n°1  A2 : s001001 0110000111100110 0111 01
renArD n°2  A4 : s001001 1011101100110000 0111 01
KH     n°1  A1 : s001001 1101011011101011 0111 01
KH     n°2  A1 : s001001 1100100011011001 0111 01

renArD n°1  A3 : s001001 1011010100000010 0101 01
renArD n°2  A1 : s001001 1111101010100000 0101 01
KH     n°1  A3 : s001001 1111110011000100 0101 01
KH     n°2  A2 : s001001 0100101000110101 0101 01

renArD n°1  A4 : s001001 1011010011011111 0011 01
renArD n°2  A2 : s001001 0010110101010100 0011 01
KH     n°1  A4 : s001001 0001000000111100 0011 01
KH     n°2  A3 : s001001 0110100011101001 0011 01


A codes (28 bits) for Con :
renArD n°1  A1 : s111001 1001101101011100 0100 01
renArD n°2  A1 : s111001 1100000010111010 0100 01
KH     n°1  A1 : s111001 0101101011111110 0100 01
KH     n°2  A1 : s111001 1110101110010111 0100 01

renArD n°1  A2 : s111001 1100110110100100 0110 01
renArD n°2  A2 : s111001 1000100010011111 0110 01
KH     n°1  A4 : s111001 0011111011110011 0110 01
KH     n°2  A3 : s111001 1000101010010000 0110 01

renArD n°1  A3 : s111001 0111101100110110 1100 01
renArD n°2  A3 : s111001 0100101110001111 1100 01
KH     n°1  A2 : s111001 0101101110101101 1100 01
KH     n°2  A4 : s111001 1111010110110100 1100 01

renArD n°1  A4 : s111001 0001110001010100 1110 01
renArD n°2  A4 : s111001 0000000010000001 1110 01
KH     n°1  A3 : s111001 1000101010111100 1110 01
KH     n°2  A1 : s111001 0100011101001110 1110 01


A codes (28 bits) for Coff :
renArD n°1  A1 : s111001 1001010101110110 1101 01
renArD n°2  A2 : s111001 1011010011001100 1101 01
KH     n°1  A4 : s111001 0011010100100111 1101 01
KH     n°2  A3 : s111001 0001001011001010 1101 01

renArD n°1  A2 : s111001 1100101011001111 0101 01
renArD n°2  A3 : s111001 1011111100010110 0101 01
KH     n°1  A1 : s111001 0010010011011011 0101 01
KH     n°2  A4 : s111001 0011011100101010 0101 01

renArD n°1  A3 : s111001 1100001100110011 0011 01
renArD n°2  A4 : s111001 1100000110111011 0011 01
KH     n°1  A2 : s111001 1100110111001000 0011 01
KH     n°2  A1 : s111001 0001000000010101 0011 01

renArD n°1  A4 : s111001 0110011011101111 0111 01
renArD n°2  A1 : s111001 1110011010100101 0111 01
KH     n°1  A3 : s111001 1000010110110100 0111 01
KH     n°2  A2 : s111001 1000111001010011 0111 01


A codes (28 bits) for Don :
renArD n°1  A1 : s011001 1000111000010100 0000 10
renArD n°2  A1 : s011001 0110000010011010 0000 10
KH     n°1  A3 : s011001 0111100001100101 0000 10
KH     n°2  A2 : s011001 0100110101110110 0000 10

renArD n°1  A2 : s011001 1010000001001001 0001 10
renArD n°2  A2 : s011001 1110111110100001 0001 10
KH     n°1  A4 : s011001 0000111111100110 0001 10
KH     n°2  A3 : s011001 0100010011001110 0001 10

renArD n°1  A3 : s011001 1010001111011001 1010 10
renArD n°2  A3 : s011001 1100100010000010 1010 10
KH     n°1  A1 : s011001 0111110001110000 1010 10
KH     n°2  A4 : s011001 0001000100001101 1010 10

renArD n°1  A4 : s011001 0101111001010111 0110 10
renArD n°2  A4 : s011001 0011100001110001 0110 10
KH     n°1  A2 : s011001 1100000011000110 0110 10
KH     n°2  A1 : s011001 0010100010011101 0110 10


A codes (28 bits) for Doff :
renArD n°1  A1 : s011001 1001000100011000 1110 10
renArD n°2  A1 : s011001 0111100101101101 1110 10
KH     n°1  A2 : s011001 0011001000101111 1110 10
KH     n°2  A1 : s011001 0000110111110111 1110 10

renArD n°1  A2 : s011001 0011001001000111 1100 10
renArD n°2  A2 : s011001 1111100011101011 1100 10
KH     n°1  A3 : s011001 0100000100110000 1100 10
KH     n°2  A2 : s011001 1111001010000101 1100 10

renArD n°1  A3 : s011001 1010111101100110 0010 10
renArD n°2  A3 : s011001 1010001111000011 0010 10
KH     n°1  A4 : s011001 0100100110111101 0010 10
KH     n°2  A3 : s011001 0011000000100001 0010 10

renArD n°1  A4 : s011001 0001011001001000 1101 10
renArD n°2  A4 : s011001 0101000011110010 1101 10
KH     n°1  A1 : s011001 0110110110011110 1101 10
KH     n°2  A4 : s011001 1111010001011011 1101 10


Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 16, 2015, 05:15 pm
great, thank you !
any idea about the curious part ?
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Apr 17, 2015, 02:47 am
Is there the possibility the 'curious' section is a Rolling Code (http://en.wikipedia.org/wiki/Rolling_code)?

This has a good explanation of a car door or garage style controller that uses a Rolling Code Remote Entry (http://auto.howstuffworks.com/remote-entry2.htm).

What do you think?

Cheers, Rob

Edit: Sorry I did not mean that the codes rolled on every press.  That has been shown not to be so, but I was thinking the 'curious' section have some how been obfuscated by a cryptographic algorithm so it scrambles the bits beyond simple human (I am a great example) pattern recognition?
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 17, 2015, 12:54 pm
Thanks for the interesting links

The goal of rolling key process is no to be captured (I admit that I don't understand why because 256 times later, a captured code would work) but in our case, if you capture a key you just have to reproduce it and it works. We might also build a device that tries all the codes for a specific button (the curious part is only 16 bits, and there are 4 solutions to switch the plug, so it's only 65536/4 = 16384 codes to try).

This two files :
http://skory.z-net.hu/alkatresz/PT2262_1.pdf (many timing stuffs comparable to our plugs)
http://www.ti.com/lit/ds/slws011d/slws011d.pdf (about the rolling codes)
but none explain how to "decode" what has been received

About the link you provided (in which I found the second above link), I'm wondering why rolling key systems would be so robust to hacker replication. It seems you just have to record enough frames (let's hide a scanner for a long time or have access to the emitter) to be able to unlock the receiver.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Apr 17, 2015, 03:16 pm
The reason why is that that 16 bit or 16384 combinations are traveled though in defined pathways where the algorithm visits any particular number maybe a number of times, but depending on where it is in the algorithm sequence will certainly branch off to non sequential (pseudo random) numbers.  So while there may only be 16 bits and hence 16384 combinations, if there is a  distinct 'pathway' but a secret pathway, sequencing through the 16384 points then it makes it much harder to guess what sequence point is next if only one point is 'sniffed'.

I don't think now that these remotes do rolling codes (or their code would change on each key press and would not be static as you have shown), but to use my experience  with the Oregon Scientific Weather Station, the sensors send out a signal that is nibble (4bit) based, but each nibble has the significance of the bits reversed.  So the Tx sends a 4 bit number where the ABCD is normally decimal weighted 1,2,4,8 whereas when this is reversed for each nibble where we swap the significance to DCBA and we weight the numbers as 8,4,2,1 suddenly the bytes can be seen to represent the data on the LCD console.
So once the nibble boundaries are determined, and the reversal of significance is applied to each byte, the weather data is observable.  Numbers become recognisable in either BCD (eg humidity)  or pure binary +conversion maths (eg windspeed). Until this processing is applied the bit pattern is just a meaningless jumble. (I would like to give kudos to whoever worked this out for my weather station, but I just don't know exactly who figured it out!!!) Plus the Checksum works on nibbles not bytes.

The other possibility is that there is also a checksum or cyclic redundancy involved where the integrity of the bit pattern is tested for by the receiver.  I think one of the contributors above said that sending a single burst of a bit pattern was sufficient to trigger a response.  If that is the case then my previous comments about repeating 4 times to validate it are wrong, and the burst of 4 times would be just hoping that at least one got through (am I right here?).  But it also points to some other means of validating a successful transmission occurring so that erroneous transmissions can be eliminated.  Fairly important when switching things connected to the mains power!!!

It maybe the case that the 'curious' bit satisfies some validity checking algorithm and does not have much else to do with the switching data. So while you are cloning transmitters successfully, it maybe as much as you can do to manually determine codes for each separate one purchased.  So the learning mode maybe just something put in place to assign an earlier factory randomisation of transmitters, ie to create the uniqueness of the association of the Tx's to multiple Rx's, with no other generality involved.  That is each Tx is sent out with a "unique" random 16bit number, or what ever number of bits, that does not change in a transmission, but they take the chance that the very close neighbours don't have the same number???  So for 16bits by 16bits = 1 in 268,435,456 chance of sharing the same number??? Reasonable odds in a capitalistic world??

However if there is a checksum or CRC of say 4 bits then that reduces the number of combinations of 16 bits being checked to 12 (4096 combos? chance of neighbours sharing =16,777,216).  There is no free lunch, but still pretty good.

I hope this helps and stimulates some brilliant inspiration on someone else's part!!

Rob

 
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Apr 17, 2015, 10:47 pm
Thanx for sharing your thoughts.

I just played around to cross-check some theories.

1. Just 1 of the 4 codes is enough to teach-in the switch.
--> The switch automatically recognizes the remaining 3 ON of the same button codes without having seen 'em.
--> The switch automatically recognizes the 4 correct OFF codes.

2. The switch is able to listen to more than one button. I repeated the teach sequence for all buttons A-D.
Then the switch could be turned off and on by any of those.
--> More than one code is stored in the switch (if required).

3. The switch can be teached to listen to any other remote control
--> There is no factory side pairing.

4. Clearing the teached codes only succeeds using the remote control that was used when teaching the switch.



I think this is not a rolling code based on large lists of data with secret paths and such stuff. The device is simply too cheap for storing large data.
If you just need any of the 4 ON codes to know the other 3 ON codes AND the 4 OFF codes then this should be a kind of algorithm that is able to decode in any direction:

lets imagine you have 4 ON codes (only the curious 16 bit)

A ON 
0x1001
0x1002
0x1003 (<- you know only this code but you are able to calculate the rest)
0x1004 

and the corresponding 4 OFF codes

A OFF
0x2001
0x2002
0x2003
0x2004

If the switch sees 0x1003 during the teach in process, then the switch is able to
predict the other codes 0x1001, 0x1002, 0x1004 and even the OFF codes
0x2001, 0x2002, 0x2003, 0x2004. But this also works for any of the remaining 3 ON codes.

It could be a kind of symmetric chiffre algorithm that delivers the remaining codes based on just 1 input code. To keep the code simple this could also be a kind of filter operation with XOR and shift operators...


BUT:
why should someone send 4 different codes per button when one is enough for switching?




Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Apr 18, 2015, 02:14 am
To respond to the last question first, I think the extra codes are designed to operate either alternative or legacy receivers as well.  For example the same chipset in the Tx could interact with a very different Rx in a garage door or gate control using the 'other codes', without having to reprogram a whole new remotes.  Just package up the chip with a new plastic coat and we may never realise that it is the same remote, unless it is analysed as you have done.  What else does that company (or the chipset manufacturer) make that is RF controlled, I wonder?

I agree with everything above.  Just to further explain (sorry about the longish post, a bad habit of mine being a now retired teacher) I agree the coding system for the switches appears simple enough and I am happy with your explanation of how 1 key can set the other 3. What I am suggesting is the 'curious' bits are a permanent (not rolling) unique factory number randomly chosen so it is very unlikely that a batch of remotes would ever have the same 'curious' bits and hence the same signature that is learned by the switches. (My weather station has an 8bit rolling code that is freshly chosen every time the power is lost, eg changing batteries, the sensor must then be re-registered with the base station, grrrr.  But it does mean there is a 1/256 chance of another sensor belong to someone else interfering.  This would not be unacceptable for controlling power switching in a house, but acceptable for low cost weather stations.)

However I think I am right in saying - someone above tested the switching by just sending the one pattern, and only sent it once, and it still worked?  If that is true then I would guess there is some error checking code in the 'curious' bits.  If not, then it is possible the same pattern has to be received say at least 3 times (out of the 4, or all 4) to be considered valid, in which case there would be little need for a checksum concept in the 'curious' bits.

Another thought is if the number (eg 1-4 switches) assigned to the signal the power switch (is apparently attached to the end of the bit packet) it would need to be incorporated into the preceding 'curious' bits if it was to act as an error checking system, otherwise it would not work.

Either way, if I was designing a receiver to listen to the remote I would just accept the whole pattern as a given, put any further diagnosis aside, program the Rx to learn the pattern, and then listen for at least 3 identical packets and use that as the validity check. Pretty crude, but I reckon it would be ok.

Cheers, Rob
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 20, 2015, 10:37 pm
Quote
why should someone send 4 different codes per button when one is enough for switching?
Good question ! As mentioned above, for other systems the codes are sent 6 times for enough redundancy. Here we just have four codes. Maybe the designer considered one code might not work for any RF reason and that would be a great idea not to persist in sending the same one. This is quite complicated for this poor reason, I admit.

Quote
To respond to the last question first, I think the extra codes are designed to operate either alternative or legacy receivers as well.
There are two things to consider :
- my remote sends 3 types of codes (not HK's which only send the first type) : 4 times the first type, 6 times the second, 6 times the third. We are here discussing about the first type of code. The others codes may indeed be designed to operate with other devices
- considering the first type of code, each button is associated to 4 different "curious parts". If the "extra codes" you're mentioning are the 3 apparently-usefulness-codes, then it would mean your remote works one time every four pushes.

Quote
What I am suggesting is the 'curious' bits are a permanent (not rolling) unique factory number randomly chosen
This bits are permanent in the remote (even if you remove the battery).
This code may have been generated randomly in factory but it has to be "curiously-associated" to 7 other codes (3 on, 4 off) through an algorithm we'd like to understand.
If the 8 codes of two buttons are indeed generated randomly (no correlation between them), then it implies every receiver knows all the remotes that could exist. A single remote would mean to be able to store 8(buttons)x4(codes)x16(bits)=512Bytes. I don't know how many different remotes the factory would like to implement, but I guess it will soon be a huge memory. However, today memory costs nothing...

Quote
However I think I am right in saying - someone above tested the switching by just sending the one pattern, and only sent it once, and it still worked?
I did not test it personally, but you're right. Sending on of the 4 codes associated to one button, whatever the codes sent before and whatever the code used for the pairing process, will turn the switch.

Quote
the same pattern has to be received say at least 3 times (out of the 4, or all 4) to be considered valid, in which case there would be little need for a checksum concept in the 'curious' bits.
I think it's this philosophy here !

Quote
Either way, if I was designing a receiver to listen to the remote I would just accept the whole pattern as a given, put any further diagnosis aside, program the Rx to learn the pattern, and then listen for at least 3 identical packets and use that as the validity check. Pretty crude, but I reckon it would be ok.
Yes, it's what I'm doing despite of understanding our famous algorithm. But it would be so interesting to understand and to program something cleverer :)

ATB
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Apr 21, 2015, 12:58 am
It seem like we agree 100%.  The 'curious' bits are indeed enticing morsels of technology, but if just random assignments, to give each remote an identity then trying to crack it maybe superfluous, however if that was the approach mankind to every unsolved technological problem we would still be sitting in dark, dank caves eating woolly mammoths roasted on an open fire.

I think there is a clever bit of programming to be revealed here, but we will probably be unable to crash through at this stage.  I think if you put it aside and let a few things settle out while you concentrate on the other parts of the project, something might gel and the answer will hit you on the head like the proverbial falling apple!!  I often would tell my students I would have to forget some question they had asked me, usually a problem in their programs, before working it out later on.  It was ten times harder in class, but once I had gone home and relaxed it was a whole lot easier. I used to say "We have done enough today I will talk to you tomorrow about it". (My most infuriating bit of problem solving was a processor board my student had beautifully soldered together that was really unreliable, in fact would barely work at all.  I checked very joint, component and track probably 10 times over 3 weeks, tried all sorts of things.  We had made 40-50 of the boards and they were well tested.  Turned out he had put a battery in reverse and instead of getting 6V to run it off it had 4.5V-1.5=3V!!  How simple, but stumbled on it at home, quietly, quietly... the language afterwards was not!)
Quote
These bits are permanent in the remote (even if you remove the battery).
This code may have been generated randomly in factory but it has to be "curiously-associated" to 7 other codes (3 on, 4 off) through an algorithm we'd like to understand.
If the 8 codes of two buttons are indeed generated randomly (no correlation between them), then it implies every receiver knows all the remotes that could exist. A single remote would mean to be able to store 8(buttons)x4(codes)x16(bits)=512Bytes. I don't know how many different remotes the factory would like to implement, but I guess it will soon be a huge memory. However, today memory costs nothing...
All the Remote factory would need to do would be make list of the numbers they had issued and make sure they did not use the same one twice.  If they used a pseudo random number generator, they would only need to know how far through the list they were for the next remote. This number I would suggest is hidden in the 'curious' bits and relate to a checksum, but as it is static and they oblige us with repeating it 4 times, I think a very good project can be made without worrying about any hidden codes (even if they do exist). (Someone coming from a totally different viewpoint may crack it for us?)

I really like your excellent project as switching mains voltages is always a difficult task and if these manufacturers have created cheap little boxes that conveniently do it all for us then that is a real bonus and combining it with thoroughly researched Arduino technology (as you have now done) is a great outcome.  I will now patiently await news of the apple!!!   ;D
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 26, 2015, 06:59 pm
We could also have fun in cracking all the codes that works. To do so, we could just generate all combinations and see if the plug switches.
Something "sad" is that the plugs first have to be paired. It's just a bit longer.
All of this could easily be done by :
- switching the receiver chip power. It is in pairing process.
- sending it a code (start with the first one...). It doesn't even need any remote, just connect an MCU to it.
- trying to switch it again with the same code and also try the 65535 others. Record when it works.
- do it again

Hum, will I do it... later maybe !
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Apr 26, 2015, 07:26 pm
I thought about nearly the same procedure, but it seems to take very long time.
Maybe I will try to pair the switches with 0x0000 or 0xffff for the curious part in the middle.
If it is possible to use this code for pairing then the resulting 3 other codes will hopfully
point into the right direction ...
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 26, 2015, 07:55 pm
True !
Looking forward to hear back from your experiment  :smiley:
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Apr 27, 2015, 12:55 am
Agreed, excellent!  ;)
Even the just first 16, $0000-$00010 could be interesting.  If the ELRO switch turned on a spare 5V phone adapter that the Arduino detects, could you could just leave it running and log any discovered "switching" results?
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Jul 06, 2015, 06:07 pm
I have also been working on this little challenge :)
Here are my findings:

I have measured the signal with an Ikalogic analyser.
I see 3 different waveforms coming fro mthe remote control.

Method 1: 28Bit code
Method 2: Automatic Code learning (AC) KAKU compatible code
Method 3: 24Bit manchester code resulting in a final 12 bit code

Method 2 and 3 are straight forward and easy to replicate.
Indeed the remote is able to control different kind of devices.
As mentioned, the FA500S (Switch) only responds to the first signal which is the one we are interested in.

For clarity:
FA500S Flamingo Switch
FA500DSS Flamingo Dimmer
FA500WD Flamingo Outdoor
FA500R Flamingo Remote Control

I agree with most of the findings posted earlier, like that there is probably some base number like address/button number that is twisted into the magic numbers.
I did a bit of number crunching with the info from the thread and a set I have here.
However, I always seem to get stuck. For sure when adding data from this thread into the calculation mix.

After some more digging I found the following PCB markings on the FA500R's: (can be seen through the battery door)
    50027.01B FLF-130105
KT50039.01A FLF-13-06-03 Chip marking: S007V0.1
KT50040.01A FLF-13-06-04 No marking on the chip
there might be more.

If one assumes that the first code is always the same code (for a single RC) and the order of the four codes is also always the same then there could be some base value that is -for example- shifted with the "curious" part. However, it is possible that the different PCB versions use slightly different "tricks" to form the curious part. So perhaps we need to first work with results from the same PCB versions to rule out version differences.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Jul 06, 2015, 07:13 pm
My remote control 1:
KT50040.01A FLF-13-06-04
Lot No 08SA14

My remote control 2:
KT50040.01A FLF-13-06-04
Lot No 11SA13

Mine seem to be of the same type.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Jul 07, 2015, 07:53 am
One more, PCB: KT50040.01A FLF-13-06-04
A On:                 
001001 0010100011111101 0111 10 
001001 1110110010011110 1101 10
001001 0001010100001110 1000 10
001001 0101100001101101 0101 10

A Off:
001001 0001100000000010 0011 10
001001 1010111011100110 0001 10
001001 1011010100101111 1110 10
001001 0011010011000110 0110 10

B On:
001001 1111111111001010 0110 01
001001 0001001110100000 1110 01
001001 0100111100001101 0001 01
001001 0011001111010101 0100 01

B Off:
001001 0100010010100111 0111 01
001001 1010010010000001 0101 01
001001 1001100001011101 0011 01
001001 1010100110100001 1010 01

C On:
111001 1001110001011000 1110 01
111001 1111110111111111 0100 01
111001 0110100101100111 0110 01
111001 1000111000110111 1100 01

C Off:
111001 0100100111110111 0101 01
111001 0100101001010110 0011 01
111001 0101010000000001 0111 01
111001 1111101010011000 1101 01

D On:
011001 0111010100110110 1010 10
011001 0010000100010100 0110 10
011001 1110100011001101 0000 10
011001 1010011000001000 0001 10

D Off:
011001 0110000111000101 0010 10
011001 0000110110010110 1101 10
011001 0001000101100100 1110 10
011001 1101001100000110 1100 10
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Jul 07, 2015, 08:23 am
                 
A  On 1:001001 0010100011111101 0111 10 001001 1110110010011110 1101 10
B  On 1:001001 1111111111001010 0110 01 001001 0001001110100000 1110 01
C  On 1:111001 1001110001011000 1110 01 111001 1111110111111111 0100 01
D  On 1:011001 0111010100110110 1010 10 011001 0010000100010100 0110 10

A  On 2:001001 0001010100001110 1000 10 001001 0101100001101101 0101 10
B  On 2:001001 0100111100001101 0001 01 001001 0011001111010101 0100 01
C  On 2:111001 0110100101100111 0110 01 111001 1000111000110111 1100 01
D  On 2:011001 1110100011001101 0000 10 011001 1010011000001000 0001 10

A Off 1:001001 0001100000000010 0011 10 001001 1010111011100110 0001 10
B Off 1:001001 0100010010100111 0111 01 001001 1010010010000001 0101 01
C Off 1:111001 0100100111110111 0101 01 111001 0100101001010110 0011 01
D Off 1:011001 0110000111000101 0010 10 011001 0000110110010110 1101 10

A Off 2:001001 1011010100101111 1110 10 001001 0011010011000110 0110 10
B Off 2:001001 1001100001011101 0011 01 001001 1010100110100001 1010 01
C Off 2:111001 0101010000000001 0111 01 111001 1111101010011000 1101 01
D Off 2:011001 0001000101100100 1110 10 011001 1101001100000110 1100 10


I have just chopped them up and moved them around for comparison between switches, apart from that I am non the wiser....

Could you share your capturing code with us? pls?

Rob






Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Jul 07, 2015, 05:27 pm
Hello Rob,

I am capturing the code with my own Arduino Mega project.
You can find all about it here: https://sourceforge.net/projects/rflink/


Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Jul 09, 2015, 03:56 pm
The Flamingo wall sockets (FA500S) also can be controlled with Home Easy HE842 (and equivalent) switches.
The HE842 sends, similar to the Flamingo Remote (FA500R), a bunch of different RF packet types.
Among them also the 28 bit and 24 bit packets.
Here also the 28 bit packet is used by the wall socket to switch its state.

Of course that does not bring us any closer to knowing what the "curious bits" are. But it provides more resources to dig through as you can examine any recent HomeEasy EU/non-flamigo Elro device that carries the 28 bit RF packet..

The FA500S PCB holds two 8-pin chips. On one of them the ID was removed. The other chip seems to contain the marking "HD HDC02". Btw, the RF receiver is a seperate print connected with 3 pins to the main PCB (VCC/Data/Ground). There does not seem to be any antenna connected so adding a piece of wire might increase the range.

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Oct 19, 2015, 05:15 pm
Hi guys,

I know it has been a long time, but now I got back to this thread. Hopefully my findings of the four codes sent by the transmitter did work for some of you. Now I desperately try to find a coherence of the on and the off codes.
I'm using a fhem-Server and I'm running several Homematic Devices (Switches and Blind-Switches) and on top 9 Flamingo Switches like them mentioned in this Thread. The FlamingoSwitches  are controlled by a customized Script, which sends the four codes via rcswitch. This works really flawlessly.
Now I really want to use the Transmitters also for my other devices controlled by fhem so that I can give the plugs any four on-Codes and any four off-Codes.
My first attempt was to make up 4 codes and switch on a switch. Magically that worked (which would speak against a coherence in the four sent codes, I think). But as you can imagine, the off-codes have to fit and I did not really find any similarity in the codes.
Are you guys a step further?
If you are interested in the Code for fhem, let me know.

Cheers wex_storm (Bjoern)

BTW, here are my codes:
Code: [Select]

Remote A

A on
0010010010011000110010011110
0010010101111111001001110110
0010010111101100111001100010
0010011000110011011001010110

A off
0010011001111001110111000110
0010010010101001001001111010
0010011101011010001001011010
0010011101100011001110001110

B on
0010011101011111101011111001
0010011010011111010011000101
0010011010011000100010010001
0010011011100001011110011001

B off
0010010001011001000111001101
0010011100110011001111101001
0010010101111001011000011101
0010011101001011101110010101


C on
1110010100001000111101011001
1110010110101011110101110001
1110011100001010100111111001
1110011010100110000100010001
C off
1110010010010111001011110101
1110011011110001001100010101
1110011100000110100001001101
1110010000110110111100011101

D on
0110010011101000000111101010
0110010110001000010000011010
0110011101110111000011000010
0110011110111110111011000110

D off
0110011000111000011011001010
0110010111000000001010110110
0110010000111000101110111010
0110010001100111000100110010


Remote B

A on
0010011010110001111001010110
0010011000010110010010011110
0010011101111110111001110110
0010011011000100101001100010

A off
0010010101111110001110001110
0010010101001010110111000110
0010010101111000011001111010
0010010001110101101001011010

B on
0010010101011011011110011001
0010010111011001011011111001
0010010001001011000011000101
0010011111011110110010010001

B off
0010011100010010111000011101
0010011110101110011110010101
0010011001101100010111001101
0010010011010100001111101001

C on
1110011000000001100111111001
1110010101100101110100010001
1110011010111100101101011001
1110010000001011010101110001

C off
1110011111000010010001001101
1110010001000000011100011101
1110010011110011011011110101
1110011011010010011100010101

D on
0110011100100110100000011010
0110010101000111010011000010
0110010100010101111011000110
0110010100010011000111101010

D off
0110010000111001101010110110
0110010110011010101110111010
0110010111100100110100110010
0110011011110000001011001010


Remote C

A on
0010011011010010001011100010
0010010101101110010101010110
0010011000101010001001011110
0010010111010000110011110110

A off
0010011011100110101011011010
0010011111011011111001001110
0010010111111011010100000110
0010011001010100100101111010


B on
0010010100010011011001010001
0010010101001100110101011001
0010011111110011110011111001
0010010111110001000101000101

B off
0010010101011011000101101001
0010011011110000010000011101
0010011111001010010000010101
0010010001111111110100001101

C on
1110011011001111111111110001
1110010001111011110001111001
1110010101010001111010010001
1110010111100100101111011001

C off
1110011111000110010110010101
1110010110100100011011001101
1110011011111101010101011101
1110010010000001101100110101

D on
0110011101111000010010101010
0110010000001100010001011010
0110010010101000011010000010
0110011001100000100001000110


D off
0110011000110010000011001010
0110011101110001010010110110
0110011010100111011101111010
0110010000011111001011110010
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Oct 19, 2015, 05:37 pm
At the moment, I'm digging deeper into the binary codes... I think I found something (based on 12 Remote Channels :) )
I took all Codes from all Remotes for switch A. On and Off... I found some strange similarities:
You can find (as you found out) the first 6 Bits for all switches exactly the same. (in my case 001001, which could really stand for switch A), but what made me more curious: the last 6 bits are also repeated.
I grouped the codes of all A on and Off Buttons.


Code: [Select]

A on (chunks of 3 for each Remote one line):
001001 1000110011011001 010110
001001 1010110001111001 010110
001001 0101101110010101 010110

001001 0010011000110010 011110
001001 1000101010001001 011110
001001 1000010110010010 011110

001001 0101111111001001 110110
001001 1101111110111001 110110
001001 0111010000110011 110110

001001 0111101100111001 100010
001001 1011000100101001 100010
001001 1011010010001011 100010


A off (chunks of 3 for each Remote one line):
001001 1101100011001110 001110
001001 0101111110001110 001110
001001 1111011011111001 001110

001001 1001111001110111 000110
001001 0101001010110111 000110
001001 0111111011010100 000110

001001 1101011010001001 011010
001001 0001110101101001 011010
001001 1011100110101011 011010

001001 0010101001001001 111010
001001 0101111000011001 111010
001001 1001010100100101 111010
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Oct 20, 2015, 11:28 am
Congratulations on your perseverance wex_storm, I admire that in a person.

Just to add my 0.02 of (name your own currency), I reckon there must be some sort of checksum in these numbers somewhere so that the likely hood of some "signal" causing a random event and things turning on/off when they were not meant to is very minimal(eg the Neighbours have the same system as you) .  The 22 bits in the middle maybe a signature that validates the rest of the signal???  However I think you are suggesting that you can 'invent' the 22bits in the middle and as long as the start 6 bits and end 6 bits are OK you can control the devices???, or do you have to replicate exactly all 22 bits 3 times over in the order shown above (ie copy some sort of validation process, even though not knowing what it is) to get the system to respond?  the bits that change at the end may just be the checksums for that sequence of bits, and they change for each input, but are not actually the unique identification of the port, though they appear as they are.  Ie we are identifying the ports by their checksums, rather than the underlying data structure??  I hope that is clear???

Just going on a general idea that checksums usually occur at the end of a data sequence, though there is no rule to say that is so.  The checksum could be sent first and data second if they wanted to.

Cheers!

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Oct 21, 2015, 11:55 am
Hello wex_storm, thanks for going deeper in finding the mystery !

Quote
My first attempt was to make up 4 codes and switch on a switch. Magically that worked (which would speak against a coherence in the four sent codes, I think)
If I well understood you, you created a random code. This code was accepted in the pairing process but only for switching on, and you're wondering (as we others) how to have the codes to switch off. If so, you made half of the process I'd like to do sometime !

To discover the "off code" you could just generate all the codes that exist and send them to the plug until it switches off. Then you'll find the pair on/off !

My project was the same (I would also like to generate all codes) but I also want to discover the "on codes". So I proposed to send the codes one after another (from 00000... to...) and observe when the pairing process finally works (that is to say, a valid "on code" has been received). After that, the game would have been the same as mentioned above : send codes from 0000 to ... and observe when it switches off, and then conclude for the on/off pair.
After that pairing process, we could find the three other pairs by the same process (send codes until the plug switches on/off).

I hope I'm clear !
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Oct 22, 2015, 09:16 am
Ok so it is possible to set up the pairing with a random "ON" code, but behind this there should be an "OFF" code in a related algorithmic process that does not need to be set.  So your question is what is the relationship between any given "ON" code and its "OFF" code?  Don't you see both of those if you trap a remote-2-base communication  for "ON" and "OFF", so you can compare them?  I guess I am more concerned with how to make a paired Tx and Rx unique enough (surely that is a contradiction???  :) ) that a nearby Tx can't accidentally trigger a response, hence the idea of unknown bits being some sort of checksum set up during the pairing??
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Oct 22, 2015, 11:45 am
Hi,

Initially I used a solution based on the first 6 bits and the last 2 bits to figure out the button number. On top of that I used the fact that the FA500R transmits 4! different protocols and lifted the on/off bit from one of the other protocols.
That was a solution within my RFLink Gateway project (http://sourceforge.net/projects/rflink/), similar to the things posted early in this thread.
To control switches it send out generic codes..
However, that was of course not the real solution.

The real solution is based on xoring and shifting the received bits with a large 'key'.
Probably that key is a customer/dealer based value, the factory could issue a different key to each brand that sells the same devices. It would then not be possible to control a brand A switch with a brand B remote etc.
With the algorithm and key you can extract the address, button number, on/off command and a 1/2/3/4 counter. Indeed all buttons will then give the same address. So there is your "relation".
Obviously, the reverse of the algorithm goes from that information to the RF data bits which is  accepted by the socket when send to it. This works for FA500, Elro 800, Mumbi and possibly others.

The transmit of 4 different protocols might be related to some batches of the remote only.
Possibly others only do 3.. In any case, my analyser shows:
4 x Protocol method 1 - 28 bit code (58 pulses) - Same as used on HE800
3 x Protocol method 2 - AC compatible (132 pulses)
3 x Protocol method 3 - HE compatible (116 pulses)
5 x Protocol method 4 - 24/12 bit code (24 pulses)

I am now working on the Unitec/Intertek remotes that seem to follow a similar but different algorithm. The remotes send 4 different codes when you press the same button, no on/off bit present in the received bits etc. So it seems very similar.

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Oct 22, 2015, 01:03 pm
That sounds pretty comprehensive. Do you think you will be able to determine a 'brand' key for a given product?

Excellent work.... all the same..
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Oct 22, 2015, 01:59 pm
Yes, it is possible to calculate the 'keys'
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Oct 22, 2015, 05:32 pm
Wow great,

I think we will soon be able to calculate our own codes :)
Once again some of my research results:
1. I got in contact with a technician of flamingo. They do not know anything about encoding of the Remotes.
2. I wrote an e-Mail to the company who is actually manufacturing the switches - let's see if that helps.
3. I sent the following codes to the switch:
Code: [Select]

1110010000000000000000110001
1110010000000000000000111001
1110010000000000000000010001
1110010000000000000000011001

and

0000000000000000000000000000
0000000000000000000000000001
0000000000000000000000000010
0000000000000000000000000011

which was learned by the switch and also gave me the ability to switch it on with my homeautomation server. So the 16 bits have obviously NOTHING in common. Which leaves us again with the question:
how are the off-codes calculated. Could they really be included in the other commands which are sent by the remote. Let's assume the remote sends our 4 codes (28 bits) bit as Stuntteam found out also other codes to tell the switch how to shut off? Perhaps you can give the remote any code for learning, but only some predefined working codes for on and off (which are deeply programmed into the chips of the remotes).
4. I wrote a little php-script wich gets
    - the "middle" 16 bits of two of the A-Button Commands
    - all 4 middle 16 bits of the off buttons
Now I tested all possibilities of XOR combinations (0b0000000000000000 to 0b1111111111111111) - sadly, no success. None of the "keys" were the same. I took the middle 16 bits and not all 28, because the result in the middle would be the same. So we can ignore the first and last 6 bits.
5. I just tried some other things:
- Sending 4 same Codes in a row also works...
- Sending 4 Codes with three incorrect, but one correct also seemed to work now

There HAS to be an algorithm and together we will find it :)

Cheers,

   Bjoern
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Oct 22, 2015, 08:00 pm
Yes, it is possible to calculate the 'keys'
Does this mean you already managed to calculate the key? Could you share that algorithm?


I tried XORing the 16Bit portion of my on and off codes, but with all permutations I could not find anything like a "key".

Based on the thesis that the OFF code is calculated from the ON code using a key and XOR.
"Received ON Code" XOR "KEY" = "OFF Code"

You can reverse calculate the key by knowing the on and off code like

int ON_code = 0x11110000;
int magicKey = 0x11001100;
int OFF_code = ON_code ^ magicKey;

int calculatedKey = OFF_code ^ ON_code;

Well but unfortunately that thesis did not work.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Oct 22, 2015, 11:53 pm
Yes, I can calculate any code I want and have the algorithm and 'key'

Simplified:

28bit RF value  ------>[Algo+key]-----> device address, on/off command, button number, counter 1/2/3/4


device address, on/off command, button number, counter 1/2/3/4 --->------>[Algo+key]-----> 28bit RF value


Flamingo would be a distributor and would not have knowledge of how the internals work.
Most likely they were simply told the devices are unique to their brand.

Another brand can be given the same hardware devices, same device number range etc. and it still will not work together with the Flamingo hardware.



                               

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Oct 23, 2015, 12:23 am
If I have got this right, Stuntteam, you can generate an original "ON" bit pattern for the switch to learn and then be able correctly calculate and anticipate the "OFF" pattern.  So it should not be necessary to do what what people have been doing, which is to snoop on the remote to find the official matching "ON" and "OFF" paired patterns and then replicate both of them with their Tx'ers.  That is, the Arduino would be able to replicate the primary "pairing process" for a given brand of switches??

If so, you have done some very good work!!  :D
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Oct 23, 2015, 01:45 am
Thats correct.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Oct 23, 2015, 06:58 am
@Stuntteam: so, why won't you tell us?

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Oct 23, 2015, 07:07 am
@stuntteam
right now my library has to store all codes, which requires more memory on an arduino. If you would provide the algorithm for calculating the key things could be implemented a lot easier?
Please share your code!
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Oct 23, 2015, 04:04 pm
I will consider it.. you could of course just use the rflink gateway..
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Oct 23, 2015, 07:58 pm
Is it compatible with fhem running on a raspberry pi?
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Oct 24, 2015, 04:25 pm
Hi again,

I'm all the time playing around with the switches. Again I found something strange:
I sent 4 times the same code to a plug to teach a channel (before I removed all other teachings).
That gave me the ability to switch the plug on and off with ALL other codes (also sent four times per code).
So, there is not one code for on connected to one code off - they are all based on a calculation one to another, which means, that there has to be an algorithm which calculates 7 codes out of one (in every direction).

Pretty strange.

I think, Stuntteam will not share his findings with us. However, a little hint would have been be nice.

Cheers,
    Bjoern
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Oct 24, 2015, 05:06 pm
Is it compatible with fhem running on a raspberry pi?
No, it works directly with Domoticz. But help me to get it compatible with FHEM..
The RFLink Gateway software sends and receives data in ascii via the USB/Serial port.
Any plugin/module I need to modify for that?


Hi again,
So, there is not one code for on connected to one code off - they are all based on a calculation one to another, which means, that there has to be an algorithm which calculates 7 codes out of one (in every direction).
No, that is incorrect.
The 28 bits will, after calculation give you a base address. a button number, on/off command and a calculation number.  The device only stores that information and does not do 7 calculations.. that is not needed.
 



Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Oct 24, 2015, 10:32 pm
@stuntteam:
I had a look at your rflink library and was a little bit astonished.
1. I could not find anything that looks like an algorithm. The Plugin_12.c source does not even send the
code received from the serial interface, but it sends predefined codes. So how should that work?

2. You obviously copied portions of my code from the flamingo switch library (end even the comments) into your rflink lib.

Don't you think it is time to lay the cards on the table?

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Stuntteam on Oct 25, 2015, 01:02 am
The source is not up to date.. i guess you did not try the last code release...

@wex_storm:
Forget about "first 6 bits, last 6 bits and 16 bits in the middle".
If you follow that path, you will not get any further.
All you can get from that is a false (incomplete) relation.
You are looking for a button number and on/off command in these high and low bits.. You need to see the 28 bits as a whole.. otherwise you miss important bits.

There is also a FA500DSS Dimmer.. It might be that "direct dim level" support is possible as well.. (meaning it will not just send on/off but also level) I will try to find a dimmer to test that..
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: voidpipe on Oct 26, 2015, 01:51 am
Hey guys,

I was searching FOR HOURS until I finally found this thread  :o.
I am very glad to know that there are people trying to get an algorithm for this specific protocol!
Karl-Heinz's library works very well and I want to use it as part of my own project. But after playing around with the code for some time, I accidentally sent my first A ON key to one of my devices while it was in learning mode. Since then, I am unable to remove this code from it. It does not even respond to the respective OFF code :/
Is there a way to remove all codes at once? Or alternatively, is it possible to override the code by sending other ones to the device?

However, I think my codes might help you.
Here you are:
Code: [Select]

A ON
0010010001001011000100010110
0010011100001011101011011110
0010011111000110000100110110
0010010011111100011010100010

A OFF
0010010011101100111100001110
0010010010010110000010000110
0010011011101000010110111010
0010011000001011110010011010

B ON
0010010011010100001000000101
0010011011110000001100010001
0010010011110100010100011001
0010010001101001100100111001

B OFF
0010010111000001000011001101
0010011001100000110110101001
0010011100110010001111011101
0010010000010111011111010101

C ON
1110010000111111001100011001
1110010011101001001100110001
1110011010111100101010111001
1110011110100101100001010001

C OFF
1110011010001110011101110101
1110010110001101010010010101
1110010001001111001111001101
1110010110011110000110011101

D ON
0110011010101100001101000110
0110010011010010100001101010
0110010101110011001010011010
0110011010011001101000000010

D OFF
0110010110101010110010110010
0110011100011111000111001010
0110010100001001110001110110
0110011101011110100000111010

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Oct 26, 2015, 07:07 am
hi voidpipe,
As far as I remember clearing the code is done the following way:
Send off code to remote so that it is switched off
Disconnect the switch from the power and wait a few seconds
Connect the switch again and send the off code while it is in learning mode.
After the learning mode is finished the switch should be in its initial state

But that should also be documented in the manual of the switches.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: voidpipe on Oct 26, 2015, 09:18 am
Hi Karl-Heinz,

thats what I would normally do. But the device does not respond to any of my A OFF codes. Maybe an error occured while I was teaching the code to it. Thereby, a wrong code has been saved and now I am unable to remove it because I do not know the respective OFF code. But that was my fault and due to a missing  "memory reset" function I will have to accept that.

Anyway, thanks for your help. I really hope that someone will find an algorithm and publish it here!

voidpipe
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Oct 26, 2015, 05:06 pm
Hi voidpipe,

if you sent a "wrong" code (there must have been simply one bit switched) the corresponding off-codes will not work anymore.
At the moment I am trying another way to find similarities.

Cheers
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: robwlakes on Nov 06, 2015, 11:47 am
No cards on the table yet?

An intriguing problem indeed, even for us onlookers....

Rob
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: wex_storm on Nov 06, 2015, 03:39 pm
Hey Rob,

We found some other similarities. Unfortunately they do not seem to bring us anyway nearer to a solution.
Stuntteam says that you have to see the whole 28 bit code. I found similarities that could leed to just 16 bit that would be necessary for identiffication. I think there is some sort of real strange algorithm behind that you cannot decrypt in an easy was.
Drop me a pm for further information.

Cheers
    Bjoern
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: barish on Dec 22, 2015, 10:32 am
Thanks all for making it possible to switch the Flamingo switches! It saved me a lot of work (or from taking the switches back to the shop).

So at least I want to make a small contribution in sharing my remote codes:

Code: [Select]

A on
0010011000101011101111010110
0010010110110011001111011110
0010011111100100100110110110
0010010011110010101111100010

A off
0010010100001110100011001110
0010011010111011111000000110
0010010100100111100100111010
0010011001100001000100011010

B on
0010011110100100010010011001
0010010000100100110110111001
0010010011011101010010000101
0010011101000011001101010001

B off
0010011000010001001011011101
0010010110001000100100010101
0010011110111110001100001101
0010011111111111011110101001

C on
1110010110011011011100111001
1110011000000000011110010001
1110010001101000010011011001
1110011010011000011101110001

C off
1110010100100000101000001101
1110010101011110010100011101
1110011101101010110111110101
1110010011110101101011010101

D on
0110010010001111010110011010
0110010000101011010101000010
0110011001000001000110000110
0110010011111010100000101010

D off
0110011011100001101110110110
0110011100010110111111111010
0110011111101010000000110010
0110011111111011011101001010
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Dec 22, 2015, 10:44 am
Thanks !

To all : sorry for being silent but as soon as I have time, I'll continue to explore the mystery :)
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Dec 22, 2015, 10:48 am
Thanks for the codes! Same with me, too many other projects :)
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: potzli on Dec 31, 2015, 02:44 pm
Hello,

I have also a FLF-130105 433 Tx.
The Flamingo reader see nothing. (RCswitch doesn't too).
I checked the frequency, the receiver with RCswitch decoding and an older remote, it is ok.

What is wrong ?

Thanks
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Jan 02, 2016, 03:16 pm
Hello,
I'm not sure I well understood you, but I believe I have read that RCswitch library doesn't work for this protocol. That's why you might have troubles using it to decode such remotes. This thread is more or less to understand how the codes sent by the remotes are built.

ATB

Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: WJ4TandA on Mar 20, 2016, 11:57 am
Some observations from my side:
• The switches from action (Intertek 3 for 10 euro), Flaminco FA500x and all Elro HE8xx are self-learning and work with the Elro Home Easy IP box; so sharing a similar protocol?
• These switches have at least 2 to 3 memory slots because they can be controlled by multiple devices: remote control, Elro Home Easy IP box, movement sensor
Ok, perhaps all know and nothing new;-)

My question: Was someone already successful to send a binary code to these devices?

I found this blog https://www.raspberrypi.org/forums/viewtopic.php?t=67909 however I still too big of a novice on my Raspberry to make successful changes;-).
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Apr 09, 2016, 06:38 pm
Hi, sorry for late answer. Thanks for your information about other devices that look compatible.

Unfortunately I still not had the time to look deeper in this project.

I don't think it's difficult to send a binary code to these devices... as far as you know which one you want to send (this is the main subject here : how to choose a good binary code). If you just want to duplicate your remote or use one of the codes mentioned in this thread, this should work perfectly.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: WJ4TandA on May 14, 2016, 10:50 pm
Hi the internet is one big treasure; however a newbie like me sees no difference between glass or diamonds.
So I am looking for some guidance; As soon as the examples give me info about;
* Environment? Raspberry or Arduino only
* which library it needs
* how to compile
* how to run
I have basis to do my own variations, before that i am only dazed and confuesed.

In example I know by experience that the Flamingo switches are working identical with the self learning switches who can be bought in the Áction stores (Intertek 75006.14) for 10 euro the 3.

Anyone able to help?
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Nov 28, 2016, 10:17 pm
It seems that this link provides the answer to all questions:
https://forum.fhem.de/index.php/topic,36399.60.html

I extracted the decrypt algorithm and tried to crosscheck it on my codes which were previously released in this thread. See the results below.

The algorithm produces reasonable results. So including this code in an arduino sketch is only a matter of minutes. The original code can be found at http://cpp.sh/9ye4

I don't know where the code comes from nor who wrote it, but a "great stuff! and thanks alot!" goes to the unknown author!!!



TXID 0EC1

REC = Receiver ID
ROL = Rolling Number 0..3

// (28Bit) A OFF
0x24DC206 = REC 1 OFF ROL 1
0x267C51A = REC 1 OFF ROL 3
0x25C90CE = REC 1 OFF ROL 0
0x277193A = REC 1 OFF ROL 2

// (28Bit) A ON
0x25B25B6 = REC 1 ON ROL 2
0x24613E2 = REC 1 ON ROL 3
0x27263DE = REC 1 ON ROL 1
0x24E77D6 = REC 1 ON ROL 0

 // (28Bit) B OFF
0x275BADD = REC 2 OFF ROL 0
0x26933A9 = REC 2 OFF ROL 3
0x27F3115 = REC 2 OFF ROL 1
0x2440F0D = REC 2 OFF ROL 2

 // (28Bit) B ON
0x2717B51 = REC 2 ON ROL 3
0x2547C99 = REC 2 ON ROL 0
0x26585B9 = REC 2 ON ROL 1
0x259A085 = REC 2 ON ROL 2

 // (28Bit) C OFF
0xE4936D5 = REC 3 OFF ROL 3
0xE73720D = REC 3 OFF ROL 0
0xE616D1D = REC 3 OFF ROL 1
0xE4D49F5 = REC 3 OFF ROL 2

// (28Bit) C ON
0xE56BF91 = REC 3 ON ROL 1
0xE56EB71 = REC 3 ON ROL 3
0xE62AF39 = REC 3 ON ROL 0
0xE4FBCD9 = REC 3 ON ROL 2

// (28Bit) D OFF
0x65B67B6 = REC 4 OFF ROL 0
0x64C8BFA = REC 4 OFF ROL 1
0x6504C32 = REC 4 OFF ROL 2
0x6526F4A = REC 4 OFF ROL 3

 // (28Bit) D ON
0x65F1C2A = REC 4 ON ROL 3
0x670319A = REC 4 ON ROL 0
0x65E1942 = REC 4 ON ROL 1
0x643F986 = REC 4 ON ROL 2
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: renard-ad on Dec 28, 2016, 08:48 pm
whaouh, incredible ! Thanks for finding and sharing it ! And thanks to the author (I wonder how he found the algorithm... or maybe it's a leak from the main company)
I did not try it yet, but it's already interesting to read.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: betmon on Feb 03, 2017, 02:09 am
Hello :) ,
Thanks to this thread I can communicate an arduino with the FA500S and be able to activate / deactivate through a web interface, I have the problem at the time of pairing through the web this does not work, sending the code how the remote but this does not work, I don't understand, the only mode I know is with the remote but I would like to do it without using the remote, does anyone know how to do it through an arduino UNO and a TX 433Mhz?, thanks for sharing both the codes published here as much information.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Erlz on Feb 20, 2017, 09:33 pm
Hi there,

I've bought also some of these self learning Promax socket switches from the dutch action.
Little did I know of their complexity, thought it could work following one of the many tutorials on the web.

There is alot of information scattered all arround the web on dutch, german and english forums.
Getting enthusiastic reading this thread, reading some people say they have it working. Sadly not for me.

This is what I have done:

I've done my best in effort to retrieve the correct code/protocol but I think my problem is not finding the right code.

receiving:
Flamingoreader:
Code: [Select]
Bin: 0010011110010011111001110110

Counter: 0 Code: 39230050 Code: 0x2569A62 Bin: 0010010101101001101001100010 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 3 TransmitterId: 0x9DA9
Counter: 1 Code: 41657942 Code: 0x27BA656 Bin: 0010011110111010011001010110 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 0 TransmitterId: 0x9DA9
Counter: 2 Code: 40312990 Code: 0x267209E Bin: 0010011001110010000010011110 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 1 TransmitterId: 0x9DA9
Counter: 3 Code: 41500278 Code: 0x2793E76 Bin: 0010011110010011111001110110 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 2 TransmitterId: 0x9DA9
Scan complete.


RCswitch Receive advance demo:
Code: [Select]
Decimal: 41500278 (28Bit) Binary: 0010011110010011111001110110 Tri-State: not applicable PulseLength: 493 microseconds Protocol: 2
Raw data: 10260,272,236,1288,240,268,240,1288,240,272,236,1288,268,240,1288,244,264,240,1288,240,1284,268,240,1288,240,268,240,1288,240,268,240,1288,268,240,1288,240,1280,244,272,240,240,268,244,1284,240,1284,240,272,240,268,240,1284,244,260,288,256,284,
 
Decimal: 1065216 (24Bit) Binary: 000100000100000100000000 Tri-State: 0F00F00F0000 PulseLength: 316 microseconds Protocol: 1
Raw data: 9808,316,984,312,988,312,988,960,340,312,988,312,988,312,988,308,988,312,988,960,340,312,988,312,988,956,344,308,992,308,996,960,336,960,344,308,992,960,340,312,992,308,992,960,340,960,340,312,988,
 
Decimal: 39229952 (28Bit) Binary: 0010010101101001101000000000 Tri-State: not applicable PulseLength: 493 microseconds Protocol: 2
Raw data: 10256,236,2552,244,240,268,240,1292,236,268,240,1284,244,188,16,220,3612,240,2240,120,192,244,244,1284,240,268,240,1288,240,264,244,1284,244,268,240,1284,1364,260,284,264,1360,264,1368,256,1368,280,264,164,380,1368,256,1368,260,1372,256,256,288,
 
Decimal: 41657942 (28Bit) Binary: 0010011110111010011001010110 Tri-State: not applicable PulseLength: 493 microseconds Protocol: 2
Raw data: 10260,272,236,1288,240,268,240,1288,240,268,240,1288,272,240,1284,240,272,236,1288,240,1284,268,240,1288,240,268,240,1288,240,268,240,1284,268,240,1292,236,1284,240,272,240,240,264,244,256,1272,268,240,1284,244,1284,240,268,244,256,288,256,288,
 
Decimal: 1065237 (24Bit) Binary: 000100000100000100010101 Tri-State: 0F00F00F0FFF PulseLength: 316 microseconds Protocol: 1
Raw data: 9816,312,988,312,988,312,988,960,340,312,988,312,992,308,988,312,988,312,988,960,344,308,992,312,988,308,992,308,988,316,988,960,340,312,988,312,988,312,992,956,344,308,992,960,340,312,988,960,348,
 


Some Python script to graph analyser:
(http://i65.tinypic.com/2hs3def.jpg)

And tried Piscope:
(http://i65.tinypic.com/6jew6r.jpg)

So far the receiving part.

Sending:
For the sending part I've tried:
- clean RCswitch install
- flamingosend
- sending multiple codes per button
- sending just one
- modified RCSwitch.cpp in arduino library with protocol 4 (Ive used the RCswitch send with my own binairy key)

For RX/TX I use these cheap china things.
- Cheap china RX/TX
(http://i01.i.aliimg.com/wsphoto/v0/558259953/Free-shipping-433Mhz-RF-link-kit-for-Arduino-ARM-MCU-Wireless-transmitting-receiving-module-For-theft.jpg)

Can someone please help me telling me how you can control these socket switches?
- What code needs to be retrieved via which program?
- How to send forced code to the switches via Arduino with RX/TX shown above?

I hope my english is good enough.

Many thanks in advance.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Feb 20, 2017, 09:48 pm
The flamingo reader output seems to be reasonable. You can repeat the test and crosscheck if the button number and on off matches the one you pressed on the remote control. You should also upload a photo of the remote control.

The hardware you use is ok. You can solder an antenna (something around 17cm I guess) to the units to increase the range. The sender can be powered with more than 5V (but not the receiver).

You simply have to replace the original codes in your sketch with the ones you received using the sniffer.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Erlz on Feb 21, 2017, 08:43 pm
Servus Karl,

Thank you for the quick reply.
In the attachments I've uploaded all my flamingoreader captured keys per key, on and off status.

My remote:
(http://i.imgur.com/WFbYqgj.jpg)

(http://i.imgur.com/HVe7b11.jpg)

(http://i.imgur.com/w3hMsWP.jpg)

I've soldered these antenna's to the RX/TX.

My RX:
(http://i.imgur.com/A2eiPvb.jpg)

My TX:
(http://i.imgur.com/asoWrST.jpg)

The sketch Im using is:
Code: [Select]
/*
  Example for different sending methods
 
  https://github.com/sui77/rc-switch/
  Button 1 aan

  Credits will be added when the code is working
*/

#include <RCSwitch.h>

RCSwitch mySwitch = RCSwitch();

void setup() {

  Serial.begin(9600);
 
  // Transmitter is connected to Arduino Pin #10 
  // Optional set pulse length.
  // mySwitch.setPulseLength(320); 
  // Optional set protocol (default is 1, will work for most outlets)
  // mySwitch.setProtocol(2); 
  // Optional set number of transmission repetitions.
  // mySwitch.setRepeatTransmit(15);
 
mySwitch.enableTransmit(10);
mySwitch.setProtocol(4);
mySwitch.setRepeatTransmit(1);
mySwitch.setPulseLength(300); // and used 220, 316, 493
}

void loop() {
        mySwitch.send("0010010101101001101001100010");
        mySwitch.send("0010011110111010011001010110");
        mySwitch.send("0010011001110010000010011110");
        mySwitch.send("0010011110010011111001110110");
        delay(500);
}


I have replaced my rcswitch.cpp file in the arduino library with the one posted by wex_storm.
But the switches still wont respond on my arduino.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: WJ4TandA on Feb 21, 2017, 11:01 pm
Hi,

You might have not yet learned your switch to respond on the Arduino commands.
It is also possible that the switch is not accepting an additional code because it is full (6 codes can be stored); You can deprogram the switch, see your documentation

I am working myself with the Action switches and have three sets of them.
I know for sure all sets works with different codes and the codes are different from the ones allready in this sketch.

Based upon the collective knowledge I have created a Cayenne project which can handle up to 8 switches.
The biggest change I did from my side was to reshuffle the table so it became easier inside cayenne.

You can find it here:
http://community.mydevices.com/t/home-automation-with-self-learning-433-power-switches/1879

Hope this is useful.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Karl-Heinz on Feb 21, 2017, 11:14 pm
Hi erlz,
thanks for the pictures and the codes:


You have to sort the codes according to the rolling code number:

You used the ones in the following order: 3 then 0 then 1 then 2
Please try to send the codes in the following order 0,1,2,3:
        mySwitch.send("0010011110111010011001010110");
        mySwitch.send("0010011001110010000010011110");
        mySwitch.send("0010011110010011111001110110");
        mySwitch.send("0010010101101001101001100010");

Then you should play a little bit around with the pulse length: I am using 330 right now.



       
Counter: 0 Code: 39230050 Code: 0x2569A62 Bin: 0010010101101001101001100010 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 3 TransmitterId: 0x9DA9
Counter: 1 Code: 41657942 Code: 0x27BA656 Bin: 0010011110111010011001010110 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 0 TransmitterId: 0x9DA9
Counter: 2 Code: 40312990 Code: 0x267209E Bin: 0010011001110010000010011110 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 1 TransmitterId: 0x9DA9
Counter: 3 Code: 41500278 Code: 0x2793E76 Bin: 0010011110010011111001110110 Button: 1 ON/OFF/DIM: 1 Rolling-Code: 2 TransmitterId: 0x9DA9
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Erlz on Feb 22, 2017, 02:18 pm
Dear WJ4TandA,

I've used the keys captured by my remote.
On the remote I've used the button 1 on/off.

The switch is paired with this button 1. It should be the same code as Im trying to send with RCSwitch.

I do have an update.
I left my arduino running the entire night (forgot to turn it off).
When I woke up I saw the light burning and the switch being toggled on.
Or I have a ghost in my house, or it looks like its working sometimes.
Altho the script is now running for hours without any effect.

What this means is I have to fine-tune the adeptation of RCswitch protocol 4.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: WJ4TandA on Feb 22, 2017, 07:14 pm
Hi Erlz,

Great it is working now, I never tried to decrypt my remotes. I only utilize work done by others. I also think there are two objectives (perhaps maybe three)
1) switch the switch with an Arduino sketch
2) Find additional codes (in case your neighbour switches your lights) :)
3) create a complete library.

Because I only troubled myself with point 1 I have a sketch which can switch 6 switches.
I simplified the sketch as mentioned before only how the switches are addressed.
This sketch is doing its job for months now with an occasionally flaw
As you can see there are more entries in the library, but only the first 6 are working in my case.

With this version of the sketch you can learn your switches an additional code.
Because each switch can handle multiple codes no urgent need to decrypt the remote.
But new codes are welcome.

As attachments the simplified sketch, library and picture of Action remote/switch.
I think the library is suitable for other self-learning switches.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Erlz on Feb 22, 2017, 11:06 pm
Hi Karl-Heinz,

I've tried your approach but the response was not good.
I adapted your theory and made 4x4 4-rows variation of the binairy codes.
Im using each posible combination on this way.

Im playing with the setPulseLength and found the "most frequent" results between 320 and 330.
Nevertheless, its very unreliable. Sometimes the switches trigger after just a couple of seconds after my arduino boots. Sometimes it takes minutes before it to react.

I've got 2 switches in my test setup. one 1 meter away, the other 4 meters away.
The strange thing is that the 4 meter away switch triggers more often.
So weird.

Im putting this in the loop, so (except for the delay) there is a constant stream of 443mhz traffic.

What I can conclude out of this:
IT works! but not very functional.
It will be hard "programming" stuff with switches that respond so bad.

Im very curious what I can "tweak" further to improve the results.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: sash on May 02, 2017, 11:27 am
Got it working..... :)

found this scatch on Github:

https://gist.github.com/probonopd/331674026839b96cd8d7 (https://gist.github.com/probonopd/331674026839b96cd8d7)

seems that RCSwitch ignoring some codes, and this script also sync the remote to the plug.
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: Felste on Jun 04, 2017, 12:52 am
I'm new to the topic.. so can someone explain if and how it is possible to run this script on a raspberry pi?
What ist the effect and how do you control the switches after the configuration via Script in rc switch?

Thanks in advance :)
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: st3f0 on Jul 07, 2017, 11:33 pm
Since this took me a little while to realize, I want to point out here, that there is another type of flamingo rf-devices. The SF-500s. In my case I'm talking about some rf-controlled sockets (https://www.amazon.de/gp/product/B002UJKW7K/ref=oh_aui_detailpage_o07_s00?ie=UTF8&psc=1), I bought on amazon. The vicious thing is, that according to the article description, I even bought m-FS300 and they also look exactly the same. But apparently they are not and they do not use the same rf-codes (at least if I'm not completely mistaken here). They are SF-500s (according to the inscription on the sockets). Maybe it's the next generation or so.

I was not able to receive any signal at all from my remote control with the flamingoswitch library and the rc-switch library. Only the rfcontrol library (https://github.com/pimatic/RFControl) was able to detect the rf-signals correctly/at all. (I guess because it's too many bits or too many states for the other libraries.)

Now that I have the possibility to detect the code, it does not seem to be such a big deal to work with it. The code seems pretty trivial compared to the stuff, that I read in this topic. However, I wanted to share this inforation here. Maybe it is helpful to somebody.

If you're interested in it, here's the code, that I receive from one of the buttons of my remote control (in the two representations as I getthem from the examples of the rfcontrol-library):

b: 264 2556 1300 10720 0 0 0 0
t:010200000200020200000200020200000200020002020000020200020002000200000200020002000200020002000200020002000200020200000200020002020003



252 2564 264 1288 260 272 272 276 268 1288 268 276 260 1296 260 1292
256 284 268 280 256 1296 256 280 272 1288 264 1292 252 284 264 284
256 1300 252 288 260 1296 252 288 256 1300 256 1292 260 284 260 284
264 1296 252 1292 256 288 260 1300 252 292 248 1312 236 292 256 1316
236 292 252 296 244 1304 248 288 260 1300 256 292 248 1304 244 292
256 1304 248 284 264 1304 236 300 252 1304 252 284 260 1296 256 292
244 1304 256 284 252 1304 248 296 252 1300 252 296 244 1308 248 1300
248 300 248 288 252 1308 244 296 256 1296 256 1296 248 292 260 292
244 1308 248 10816
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: sheierhoff on Feb 11, 2019, 01:38 pm
Thanks @st3f0 for pointing this out. I was struggling with flamingoswitch and rc-switch, as well. With RfControl, I was able to get our set of m-FS300 working.

Code inspired by Link (https://github.com/pimatic/RFControl/blob/master/examples/compressed/compressed.ino) and Link (https://github.com/sui77/rc-switch/issues/103#issuecomment-296813445):

Code: [Select]

#include <Arduino.h>
#include <RFControl.h>

void setup() {
  Serial.begin(9600);
  Serial.println("Initialized");

  RFControl::startReceiving(5);

  unsigned long buckets[] = {848, 308, 10364, 0, 0, 0, 0, 0};
  char compressTimingsAon[] =     {"01101010101001100101010110010110101010100101010110101010100110011012"};
  char compressTimingsAoff[] =    {"01101010101001100101010110010110101010100101011010101010100110101012"};
  char compressTimingsBon[] =     {"01101010101001100101010110010110101010100101100110101010100101101012"};
  char compressTimingsBoff[] =    {"01101010101001100101010110010110101010100101101010101010100101011012"};
  char compressTimingsCon[] =     {"01101010101001100101010110010110101010100110010110101010101010011012"};
  char compressTimingsCoff[] =    {"01101010101001100101010110010110101010100110011010101010101010101012"};
  char compressTimingsDon[] =     {"01101010101001100101010110010110101010101001010110101010011010011012"};
  char compressTimingsDoff[] =    {"01101010101001100101010110010110101010101001011010101010011010101012"};
  char compressTimingsAllon[] =   {"01101010101001100101010110010110101010101001101010101010011001011012"};
  char compressTimingsAlloff[] =  {"01101010101001100101010110010110101010100110101010101010101001011012"};

  RFControl::sendByCompressedTimings (4, buckets, compressTimingsAon, 8);
  delay(1000);
  RFControl::sendByCompressedTimings (4, buckets, compressTimingsAoff, 8);
}

void loop() {
  if(RFControl::hasData()) {
    unsigned int *timings;
    unsigned int timings_size;
    unsigned int pulse_length_divider = RFControl::getPulseLengthDivider();

    RFControl::getRaw(&timings, &timings_size);
    unsigned int buckets[8];
    RFControl::compressTimings(buckets, timings, timings_size);
    Serial.print("b: ");
    for(int i=0; i < 8; i++) {
      unsigned long bucket = buckets[i] * pulse_length_divider;
      Serial.print(bucket);
      Serial.write(' ');
    }
    Serial.print("\nt: ");
    for(int i=0; i < timings_size; i++) {
      Serial.write('0' + timings[i]);
    }
    Serial.write('\n');
    Serial.write('\n');
    RFControl::continueReceiving();
  }
}
Title: Re: rf433 code for ELRO Flamingo home devices (FA500)
Post by: sheepofspades on May 11, 2020, 12:22 am
For what it's worth:
I was trying to get my FA500 switches to work this weekend and stumbled onto this forum.
I have noticed that a lot of people had the same issue: switching ON works, but switching OFF doesn't.
It's not clear to me if a solution has been posted here, but this is what I did to make it work:

I recorded the pulse widths with a simple program into an array. Then I played back the array on the send pin to see if I had captured the A-OFF signal correctly. Once I had a recording that worked, I trimmed away the unnecessary pre- and post pulses by trail and error. So in the end I was left with the minimal sequence of pulses that was needed to trigger the A-OFF. This is the minimal sequence I ended up with:
0100 S 0010 0100 0110 0110 0100 1100 0110 S 0010 0100 0110 0110 0100 1100 0110

S = the start symbol: 1 15
0 = the bit 0 symbol: 1 3
1 = the bit 1 symbol: 3 1

I used a unity pulse width of 330 microseconds.

So it looks like the first start symbol requires an extra 0100 prefix AND the 28 bit sequence needs to be sent 2 times.

I have not yet tested this on the B, C and D buttons yet, so I am not sure if the prefix is the same, or if it is even the same for all devices. So you may need to determine the prefix for your specific device.

I hope this is helpful for anyone out there.
Cheers!