Cloning 433 Mhz RF signal from remote controlled outlets

Projects Networking, Protocols, and Devices
1

Hi everyone,

A few weeks ago, I have bought some cheap wireless electric sockets (YC-4000B) working on 433 MHz RF.
I have also bought an RF 433MHz transmitter and a receiver.

In order to decode the signals sent by the remote, I connected the receiver to my Arduino (also tried with a Raspberry Pi and I got the same following results) : To get the actual signal value, the remote needs to be very close to the receiver (about 1cm) which seems very short range.

I then tried to send the values I got from my remote (5393 and 5396) using the transmitter. When doing so, the receiver gets the same values as with the remote, but the actual socket does not switch.

Does anyone has any idea why ?

Is it possible that the sockets are actually on another frequency than 433MHz ? (although that's what's said on the box).

I have added a 17.3cm antenna to by transmitter module but that didn't change anything.

If you have any idea or if you have already played around with RF 433Mhz and managed to make some wireless sockets working I'll be interested to hear your experiences / thoughts :slight_smile:

Thanks

2

I'll bet you didn't read "How to use this forum"!

Post your code, using code tags.

3

I don't understand why you are saying this. Network & protocol sections seemed appropriate for an RF related question. For the subject line I must admit I wasn't very inspired. I can try to find a better one if you think this one is misleading or inefficient.

I didn't post any code because I was sure the problem was related to my code (as it's very simple) or if it was related to my misunderstandard or the misfunction of my wireless sockets.

But here it is. I am using the RC-switch library and doing a very simple blinky-like sketch :

#include <RCSwitch.h>
#include <MicroView.h>
    
RCSwitch mySwitch = RCSwitch();

void setup() {
  pinMode(2, OUTPUT);
  mySwitch.enableTransmit(2);  
}

void loop() {
    mySwitch.send(5396, 24);
    delay(1000);
    mySwitch.send(5393, 24);
    delay(1000);
  
}
4

If you're trying to control a commercial product, it may have encoded a particular timing for message to be received
Explain your process for decoding the signals sent by the OEM remote, and your results.

5

The equipment I am trying to control is a very cheap one I got from Amazon. They even have DIP switches you can use to change the codes sent from the remote and received by the outlets (so that two outlets acts to the same button for example).

For the reception side I am using a Raspberry Pi with a program called RFSniffer. It gives me numerical values corresponding to the bits detected by the receiver.

To check those values, I also used Piscope, a sort of oscilloscope software for Raspberry Pi. I have linked a screenshot (as remote_piscope) to the output of piscope to this post. Assuming the last bit is a stop bit, the code can be read as 0000 0000 0001 0101 0001 0001(0) which is equal in demical to the 5393 I got from RFSniffer.

I tried to upload the ReceiveDemo sketch from rc-switch to my Arduino to see the receiver's values on the Arduino but unfortunately this didn't work : the switch.available() always returns 0.

To reproduce the RF from the remote, I use the code I put earlier. When this is running, I have on piscope something very similar (attached as arduino_transmit_received_piscope) although with what I would assume is parasites (see the last 2 bits).

Looking a bit further, it seems that both signals are not transmitter using the same pulse length. This might be the reason why it's not working. I'll try to sent the pulse length on the transmitter sketch and get back.

EDIT : I checked the total duration of each message : From the remote, a message seems to be 31765 µs. By default, rc-switch gave me a message of 34489 µs. I started using setPulseWidth to try to get closer to the expected duration. With setPulseWidth(321), I end up with 31656 µs and with setPulseWidth(322), I have 31776. When I use setPulseWidth, the parasites we can see on the second screenshot seem to disappear (or at least they can't be seen on piscope).

remote_piscope.png
remote_piscope.png1920×1051 28.2 KB

arduino_transmit_received_piscope.png
arduino_transmit_received_piscope.png1920×1051 29.6 KB

6

The remote is probably not using the RCSwitch library protocol. You have to make sure you understand the transmitted protocol before you can hope to decode it.

7

Do you have any suggestion on how I can understand the protocol of my remote apart from looking at the frames sent ?

EDIT : By opening the remote, I noticed an IC identified as HX2262 2012T. From what I have seen, this is the encoder used for transmitting the messages to the radio. It is listed on the rc-switch website as one of the encoder supported by the library