No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download
Latest commit 71e7134 Oct 8, 2018

README.md

RF-Bridge-EFM8BB1

RF-Bridge-EFM8BB1

The Sonoff RF Bridge is only supporting one protocol with 24 bits.
The Idea is to write a alternative firmware for the onboard EFM8BB1 chip.

All original commands 0xA0 to 0xA5 are supported!

Hardware

There are the pins C2 & C2CK on the board. With a Arduino you can build a programmer to read/erase and program the flash. Software for the Arduino: https://github.com/conorpp/efm8-arduino-programmer
RF Bridge v1.0 RF Bridge R2 v1.0
C2 Interface
Use this header to program the firmware on the EFM8BB1.

RS232
Use this RS232 connection for debug/testing. Put the switch S2 to OFF when connecting. For normal operation the switch S2 have to be in ON position.

Software

The project is written with Simplicity Studio 4. The resulting *.hex file can be programmed on the EFM8BB1.

First results

The reading of RF signals is already working:
Sending start sniffing: 0xAA 0xA6 0x55
Receiving AKN: 0xAA 0xA0 0x55

Sending stop sniffing: 0xAA 0xA7 0x55
Receiving AKN: 0xAA 0xA0 0x55

Defining new RF protocols in RF_Protocols.h

If your remote can't be sniffed with the command 0xA6 please use command 0xB1.
This will do bucket sniffing and give maybe a result like this:
Hex: AA B1 04 0439 01C5 0BAE 1C3E 01 10 10 10 10 01 01 01 10 10 01 01 10 10 01 01 01 10 01 01 10 10 10 10 23 55

0xAA: uart sync init
0xB1: bucket sniffing
0x04: bucket count including sync bucket
0x0439: Bucket 1 length: 1081µs
0x01C5: Bucket 2 length: 453µs
0x0BAE: Bucket 3 length: 2990µs
0x1C3E: Bucket 4 length: 7230µs
0x01-0x23: RF data received (high/low nibbles denote buckets)
0x55: uart sync end

If the data is only including 01, 10 and 23 at the end than it should be possible to decode the signal by command 0xA6.
But for this the protocol have to be defined in the RF_Protocols.h file.

01 means:

BIT_HIGH_TIME is 1081µs.
BIT_HIGH_DUTY = 100% / (1081µs + 453µS) * 1081µs =~ 70%.

10 means:

BIT_LOW_TIME is 453µs.
BIT_LOW_DUTY = 100% / (1081µs + 453µS) * 453µs =~ 30%.

23 means:

SYNC_HIGH is 2990µs.
SYNC_LOW is 7230µs.
SYNC_BIT_COUNT is default 0.

The bitcount can be counted like this:

data 1 data 2 data 3 data 4 data 5 data 6 data 7 data 8 data 9 data 10 data 11 data 12 data 13 data 14 data 15 data 16 data 17 data 18 data 19 data 20 data 21 data 22 data 23 data 24
01 10 10 10 10 01 01 01 10 10 01 01 10 10 01 01 01 10 01 01 10 10 10 10
bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 bit 8 bit 9 bit 10 bit 11 bit 12 bit 13 bit 14 bit 15 bit 16 bit 17 bit 18 bit 19 bit 20 bit 21 bit 22 bit 23 bit 24

BIT_COUNT = 24.
REPEAT_DELAY is default 0.

Firmware identify by command 0xFF

If you get a response to this command the EFM8 chip is running this alternative firmware
Hex: AA FF 55

Receiving AKN: AA xx 55

The xx is the firmware version (0x00-0xFF)

RF decode from Rohrmotor24.de remote (40 bit of data):

0xAA: uart sync init
0xA6: sniffing active
0x06: data len
0x02: protocol identifier
0xD0-0x55: data
0x55: uart sync end

STOP:
Binary: 10101010 10100110 00000110 00000001 11010000 11111001 00110010 00010001 01010101 01010101
Hex: AA A6 06 02 D0 F9 32 11 55 55
DOWN:
Binary: 10101010 10100110 00000110 00000001 11010000 11111001 00110010 00010001 00110011 01010101
Hex: AA A6 06 02 D0 F9 32 11 33 55

RF decode from Seamaid_PAR_56_RGB remote (24 bit of data):

Light ON:
Binary: 10101010 10100110 00000100 00000011 00110010 11111010 10001111 01010101
Hex: AA A6 04 03 32 FA 8F 55

Transmiting by command 0xA5

This is the original implemented RF transmit command
Hex: AA A5 24 E0 01 40 03 84 D0 03 58 55

0xAA: uart sync init
0x24-0xE0: Tsyn
0x01-0x40: Tlow
0x03-0x84: Thigh
0xD0-0x58: 24bit Data

The high time of the SYNC get calculated by the Tsyn (SYNC low time),
duty cycle of the high bit is 75% and 25% of the low bit.

Sniffing by command 0xA6

With the command the standard PT226x sniffing gets disabled and the sniffing of the defined protocols in RF_Protocols.h is starting.

Hex: AA A6 55

Example of a received decoded protocol:
Hex: AA A6 04 03 32 FA 80 55

0xAA: uart sync init
0xA6: sniffed RF data
0x04: data len
0x03: protocol identifier (Seamaid_PAR_56_RGB)
0x32-0x80: data
0x55: uart sync end

Stop sniffing by command 0xA7

Stop the 0xA6 sniffing and restart the PT226x sniffing.

Transmiting by command 0xA8

There is a new command in the firmware to be able to send RF data.

Hex: AA A8 06 02 D0 F9 32 11 33 55

0xAA: uart sync init
0xA8: transmit RF data
0x06: data len
0x02: protocol identifier (ROHRMOTOR24)
0xD0-0x33: data
0x55: uart sync end

Universal transmit by command 0xA8
Hex: AA A8 0D 7F 12 C0 05 DC 02 BC 46 01 2C 1E 08 1E 55

0xAA: uart sync init
0xA8: transmit RF data
0x0D: data len
0x7F: protocol identifier 0x7F
0x12-0xC0: SYNC_HIGH
0x05-0xDC: SYNC_LOW
0x02-0xBC: BIT_HIGH_TIME
0x46: BIT_HIGH_DUTY
0x01-0x2C: BIT_LOW_TIME
0x1E: BIT_LOW_DUTY
0x08: BIT_COUNT + SYNC_BIT_COUNT in front of RF data
0x1E: RF data to send

Learning by command 0xA9

Hex: AA A9 55

With the new learning the RF Bridge will scan for all predefined protocols. The first received RF code will be sent by OK 0xAB. If a timeout happens 0xAA will be sent.

Bucket Transmitting using command 0xB0

This command accommodates RF protocols that can have variable bit times. With this command, up to 16 time buckets can be defined, that denote the length of a high (mark) or low (space) transmission phase, e.g. for tri-state mode RF protocols. This command also accommodates code repetition often used for higher reliability.

Hex: AA B0 20 04 1A 0120 01C0 0300 2710 01212122012201212121212121220121212201212203 55

0xAA: uart sync init
0xB0: transmit bucketed RF data
0x20: data len: 32 bytes
0x04: number of buckets: 4
0x19: number of repetitions: (transmit 1+25 = 26 times)
0x01-0x20: Bucket 1 length: 288µs
0x01-0xC0: Bucket 2 length: 448µs
0x03-0x00: Bucket 3 length: 768µs
0x27-0x10: Bucket 4 length: 10ms (sync)
0x01-0x03: RF data to send (high/low nibbles denote buckets to use for RF high (on) and low (off))
0x55: uart sync end

Please note that currently, there is no learning mode for this! However, you can use, e.g., an Arduino with the RFControl library to learn the bucket times and sequences (the compressed example gives you everything you need if you convert the decimal numbers to hex).

Bucket sniffing using command 0xB1

This command will do bucket sniffing.

Hex: AA B1 04 0120 01C0 0300 2710 01212122012201212121212121220121212201212203 55
0xAA: uart sync init
0xB1: bucket sniffing
0x04: bucket count including sync bucket
0x01-0x20: Bucket 1 length: 288µs
0x01-0xC0: Bucket 2 length: 448µs
0x03-0x00: Bucket 3 length: 768µs
0x27-0x10: Bucket 4 length: 10ms (sync)
0x01-0x03: RF data received (high/low nibbles denote buckets)
0x55: uart sync end

0xB1 to 0xB0 helping tool

After learning how bit bucket works from here https://github.com/Portisch/RF-Bridge-EFM8BB1/issues/23 this is a python script to help calculate the right 'B0' message to send using 'RfRaw' command in Tasmota from the received 'B1' sniffing message.

BitBucketConverter.py by gerardovf

In the command line give the 'B1' message string and the retries value (in decimal):
i.e. BitBucketConverter.py "AA B1 04 07EB 0157 00FD 3EBC 010101010101101001010101101010100103 55" 20

Command Line : "AA B1 04 07EB 0157 00FD 3EBC 010101010101101001010101101010100103 55" 20
Result: 'RfRaw AAB01C041407EB015700FD3EBC01010101010110100101010110101010010355'

For support/help take a look here or contact gerardovf.

Beep by command 0xC0

Hex: AA C0 xx xx 55

Do beep xxxx miliseconds (uint16_t). Like AA C0 03 E8 55 will beep for ~1000ms.

Next Steps

Add ESPurna support:
A new protocol have to be implemented to support more RF signals -> have to be defined!