Kambrook Remote Power Outlet & Arduino - working

Hello All,

Thanks to guides on the Internet, I was able to figure out the codes required to control the Kambrook RF3399 remote power outlet.

In Australia, this product is available from Bunnings: http://www.bunnings.com.au/products_product_kambrook-4-piece-indoor-powerpoint-kit-with-remote-control_P7030054.aspx http://www.bunnings.com.au/products_product_kambrook-single-indoor-power-point-controller_P4420192.aspx

I initially tried NewRemoteSwitch, RemoteSwitch, and RCswitch. None of these were able to detect this unit. So I used the manual analysis method by sniffing the signals.

I am happy to send these codes to anyone who wants them. I wasn't sure whether I should post it publicly in case it encourages the manufacturer to change the codes. I am very new to Arduino, and my coding skills aren't great, but it does work.

Something nice I discovered is that I can add extra codes that the Kambrook transmitter doesn't do (but still works with the outlets).. which can be handy in that it would make it difficult for a nearby neighbour to inadvertently control my outlets if he/she were to buy the same kit.

UPDATE 2: mike_linus has posted much better code for the kambrook control and sniffer. I haven't yet tried it myself, but I'm sure it's all good. Find it here: http://forum.arduino.cc/index.php?topic=178765.msg1720615#msg1720615

UPDATE: Maurie has told me that his transmitter's codes are different from mine. So based on this, I suspect all transmitters have different codes. The first 4 sets of transitions are the same with our transmitters, but the next 4 sets aren't the same. (Every 4 transitions I have grouped into a "set" .. e.g. "1101 1111 0011" is 12 transitions group into 3 sets). This is mainly a good thing, as it means you don't inadvertently control your neighbour's devices & vice versa. Arduino-wise what this means though is that if you are looking to duplicate your Kambrook transmitter's signal, you would need to sniff it first to find out what the code is. However, if you don't care what the Kambrook transmitter's code is, then you can simply use the codes in my arduino sketch and get your Kambrook GPO receivers to learn these signals. It just means you've rendered your Kambrook transmitter useless, which many wouldn't be too fussed about.

Hi there. Id appreciate the codes if possible. I started doing what you have done last week, but no point reinventing the wheel. Ive also decoded some remote control power points that Magnet Mart sell. 4 channel based on SC2262 / SC2272 chips . My email is mauried@tpg.com.au thanks

nevoz: Hello All,

Thanks to guides on the Internet, I was able to figure out the codes required to control the Kambrook RF3399 remote power outlet.

In Australia, this product is available from Bunnings: http://www.bunnings.com.au/products_product_kambrook-4-piece-indoor-powerpoint-kit-with-remote-control_P7030054.aspx http://www.bunnings.com.au/products_product_kambrook-single-indoor-power-point-controller_P4420192.aspx

I initially tried NewRemoteSwitch, RemoteSwitch, and RCswitch. None of these were able to detect this unit. So I used the manual analysis method by sniffing the signals.

I am happy to send these codes to anyone who wants them. I wasn't sure whether I should post it publicly in case it encourages the manufacturer to change the codes. I am very new to Arduino, and my coding skills aren't great, but it does work.

Something nice I discovered is that I can add extra codes that the Kambrook transmitter doesn't do (but still works with the outlets).. which can be handy in that it would make it difficult for a nearby neighbour to inadvertently control my outlets if he/she were to buy the same kit.

I have sent you a PM with my email address - i too would like the codes please

Craig

Howdy Guys, Replied to you both yesterday. Enjoy, Nev

nevoz: Howdy Guys, Replied to you both yesterday. Enjoy, Nev

Got the PM thanks Nev

Now to source the 433 modules

regards

Craig

I received this item from China very quickly - in about 12 days. China to Australia usually takes a month or more!

http://cgi.ebay.com.au/ws/eBayISAPI.dll?ViewItem&item=121144987490

They work perfectly .. and very hard to beat the price :grin:

nevoz: I received this item from China very quickly - in about 12 days. China to Australia usually takes a month or more!

http://cgi.ebay.com.au/ws/eBayISAPI.dll?ViewItem&item=121144987490

They work perfectly .. and very hard to beat the price :grin:

Ordered a couple thanks - gotta wonder how they make money on these and can then ship them for free ?

Craig

Shipping from China/HK is very cheap. But still, as you say I don't know how they can create & ship something for so little cost.

Another cheap buy - I have purchased these Arduino Pro Minis for $US3.85 shipped, and they work perfectly : http://www.ebay.com.au/itm/130839929399 (To program it you'll also need a FTDI USB to serial adaptor if you don't already have one, $AU4.68 : http://www.ebay.com.au/itm/200941246491 )

nevoz: Shipping from China/HK is very cheap. But still, as you say I don't know how they can create & ship something for so little cost.

Another cheap buy - I have purchased these Arduino Pro Minis for $US3.85 shipped, and they work perfectly : http://www.ebay.com.au/itm/130839929399 (To program it you'll also need a FTDI USB to serial adaptor if you don't already have one, $AU4.68 : http://www.ebay.com.au/itm/200941246491 )

Huh - beat you to those ones !! I bought a 5 pack and the FTDI about two weeks ago ! Just waiting for them to arrive and then i will compare my Nordic 2.4Ghz modules against the new 433Mhz ones for remote temp probes

Craig

Thanks Nev for your .h .cpp files. This is an excellent example of a purpose built library. When I first opened the .ICO file I thought where is all of the code, hidden where it really should be in the .h & .cpp files.

If anyone want's some info on decoding the Altronics similar product then send me a message & I'll give you a box.com link to my sample files.

http://www.altronics.com.au/index.asp?area=item&id=A0340

Thanks for the appreciation mate. Glad you like it.

very interesting , appreciated if you can send codes to my mail : gbui@bigpond.com

I initially tried NewRemoteSwitch, RemoteSwitch, and RCswitch. None of these were able to detect this unit. So I used the manual analysis method by sniffing the signals.

Could someone explain how sniffing works and perhaps a simple example how to do it.

kajmaya:

I initially tried NewRemoteSwitch, RemoteSwitch, and RCswitch. None of these were able to detect this unit. So I used the manual analysis method by sniffing the signals.

Could someone explain how sniffing works and perhaps a simple example how to do it.

I don't have a CRO, I put together one of these simple sound card sniffers. Worked well. http://davehouston.net/learn.htm

Also, mauried's explanation at the bottom of this thread help me: http://forum.arduino.cc/index.php?topic=148520.0

I also sniffed out a 2009 Hyundai i30 remote .. but as expected the code keeps changing every time, so had no luck in duplicating it .. which is a good thing :)

Hi

Great work. I also have these remotes and was looking at hacking the codes. If you could email them to me, that would be much appreciated. My email is: mike.thompson@linus.com.au

I am building a home automation framework based on mqtt which is ideal for sense and control systems. The remotes are a key part of that. If I can help in any way, happy to share.

Regards Mike

Hello All,

Maurie has told me that his transmitter's codes are different from mine. So based on this, I suspect all transmitters have different codes. The first 4 sets of transitions are the same with our transmitters, but the next 4 sets aren't the same. (Every 4 transitions I have grouped into a "set" .. e.g. "1101 1111 0011" is 12 transitions group into 3 sets). What this means is that if you are looking to duplicate your Kambrook transmitter's signal, you would need to sniff it first to find out what the code is. However, if you don't care what the Kambrook transmitter's code is, then you can simply use the codes in my arduino sketch and get your Kambrook GPO receivers to learn these signals. It just means you've rendered your Kambrook transmitter useless, which many wouldn't be too fussed about.

nevoz: Hello All,

Maurie has told me that his transmitter's codes are different from mine. So based on this, I suspect all transmitters have different codes. The first 4 sets of transitions are the same with our transmitters, but the next 4 sets aren't the same. (Every 4 transitions I have grouped into a "set" .. e.g. "1101 1111 0011" is 12 transitions group into 3 sets). What this means is that if you are looking to duplicate your Kambrook transmitter's signal, you would need to sniff it first to find out what the code is. However, if you don't care what the Kambrook transmitter's code is, then you can simply use the codes in my arduino sketch and get your Kambrook GPO receivers to learn these signals. It just means you've rendered your Kambrook transmitter useless, which many wouldn't be too fussed about.

Thanks for the update - it would be significant for the WAF i think - as they may still like to reach for the physical remote sometimes !!

Craig

Hi, Thanks for this. Could i please have the codes sent to my email andy.wise91@gmail.com Thanks once again!

nevoz:
I initially tried NewRemoteSwitch, RemoteSwitch, and RCswitch. None of these were able to detect this unit. So I used the manual analysis method by sniffing the signals.

Just to say I’ve had some success implementing a simple sniffer using an Uno and the 4-pin 433MHz recv unit. Sniffer sketch uses the RCSwitch lib http://code.google.com/p/rc-switch/

This isn’t for a Kambrook power socket, though, it’s appears to be “Efergy” brand (which I hadn’t heard of. These units were given to me.) So I thought I’d have a fiddle with these to see if I could get them working with an Arduino, since I already had them at hand.

I’ve hacked the sniffer sketch so it allows you to plug in the 4-pin recv unit on pins D2-D5, and sources and sinks power using pins D5 and D2. (I’m sure there will be time in purgatory for that. But it beats warming up the soldering iron.) Just make sure your recv unit is rated at < 40mA max power draw (typical appears to be ~10-20mA for these units.) Also, make sure your pins are the same as mine! (or adjust the #defines in the sketch accordingly.)

Here’s the sniffer sketch:

/*
  RF_Sniffer
  
  Hacked from http://code.google.com/p/rc-switch/
  
  by @justy to provide a handy RF code sniffer

  --

  hacked further by pico to supply power to unit from data pins (lazy!)
  just make sure your recv unit has max draw < 40mA... (typically rated 10-20mA)

  this is set up for a 4 pin recv unit GND DATA DATA VCC
  plug GND into D2, DATA into D3 and D4, and VCC into D5
*/


#include <RCSwitch.h>
RCSwitch mySwitch = RCSwitch();

#define VCC_PIN 5 // source 5V up to 40mA from this pin
#define GND_PIN 2 // sink up to 40mA on this pin
#define DATA_PIN 3 // external int 1 on Uno

void setup() {
 
  pinMode(DATA_PIN, INPUT);
  // just leave D4 tristated
  
  pinMode(GND_PIN, OUTPUT);
  digitalWrite(GND_PIN, LOW); 

  pinMode(VCC_PIN, OUTPUT);
  digitalWrite(VCC_PIN, HIGH);

  Serial.begin(9600);
  mySwitch.enableReceive(1);  // Receiver on interrupt 1 => that is pin D3
  Serial.println("rf_sniffer started");
}

static unsigned long count = 0;

void loop() {
  
  if (mySwitch.available()) {
    
    int value = mySwitch.getReceivedValue();
    
    if (value == 0) {
      Serial.print("Unknown encoding");
    } 
    else {
      Serial.print("Received ");
      Serial.print( mySwitch.getReceivedValue() );
      Serial.print(" / ");
      Serial.print( mySwitch.getReceivedBitlength() );
      Serial.print("bit ");
      Serial.print("Protocol: ");
      Serial.println( mySwitch.getReceivedProtocol() );
    }
    
    mySwitch.resetAvailable();    
    count = 0;
  }
  else {
    if (++count == 0) Serial.println("no activity");
  }
}

Here’s the output (your sniffed codes will be different, of course!)

rf_sniffer started
Received 44262 / 24bit Protocol: 1
Received 44270 / 24bit Protocol: 1
Received 44261 / 24bit Protocol: 1
Received 44269 / 24bit Protocol: 1
Received 44267 / 24bit Protocol: 1
Received 44267 / 24bit Protocol: 1
Received 44259 / 24bit Protocol: 1
Received 44263 / 24bit Protocol: 1
Received 44271 / 24bit Protocol: 1
Received 44264 / 24bit Protocol: 1
Received 44264 / 24bit Protocol: 1
Received 44264 / 24bit Protocol: 1

Only bug I’ve found is that there seems to be some sort of initialization error regarding synchronization of the recv signal. What this means is that you have to press the buttons on your remote quite a few times before it starts properly receiving the codes. Once it gets the first one OK, they all seem to be read without problem after that, so that’s why I’m assuming it’s some sort of initalization issue. I haven’t bothered to investigate further though… I’ve got my codes now, and it all works as it should.

I attached an antenna on the transmit unit to give it bit more range… just a 1/4 wavelength monopole affair (aka as a 173mm length of wire :grin:)

I’ll admit it, I did have to heat up the soldering iron for that though.

Anyway, it would be interesting to see if anyone can get the sniffer sketch to work with other remotes.

nevoz:
Hello All,

Thanks to guides on the Internet, I was able to figure out the codes required to control the Kambrook RF3399 remote power outlet.

In Australia, this product is available from Bunnings:
http://www.bunnings.com.au/products_product_kambrook-4-piece-indoor-powerpoint-kit-with-remote-control_P7030054.aspx
http://www.bunnings.com.au/products_product_kambrook-single-indoor-power-point-controller_P4420192.aspx

I initially tried NewRemoteSwitch, RemoteSwitch, and RCswitch. None of these were able to detect this unit. So I used the manual analysis method by sniffing the signals.

I am happy to send these codes to anyone who wants them. I wasn’t sure whether I should post it publicly in case it encourages the manufacturer to change the codes.
I am very new to Arduino, and my coding skills aren’t great, but it does work.

Something nice I discovered is that I can add extra codes that the Kambrook transmitter doesn’t do (but still works with the outlets)… which can be handy in that it would make it difficult for a nearby neighbour to inadvertently control my outlets if he/she were to buy the same kit.

Hi there nevoz. Well done on sniffing the codes and sharing. I have 6 of these units at home and was thinking the same thing, if you could possible forward me the codes please? I will PM you my email address.
I’d like to add feedback control to these units, not sure if at all possible. Could maybe use the existing RF equipment to do that, however I suspect it can only receive signals, and then the remote will also probably onle be able to send signals too. In this case I suspect send and pray protocol will have to suffice.

Principle is you send a command to it, and then expect a reply back indicating command successful or not.
Sending an ON/OFF command:

  1. The sender monitor the command return response for ON/OFF confirmation, and timeout.
  2. the plug unit return confirmation, relay in ON/OFF position.

Thanks,
J