Updated 8-Oct-2011
Short description: A 433 Mhz garage door opener was build using a PIC microcontroller. The 433Mhz signal from a garage door opener was received on a 433 Mhz receiver module for data ($3) and connected directly to the sound card of my PC. The signal was analyzed using audio editing software. On the basis of the timings of this signal a microcontroller program was written that similarly replays the signal on a 433Mhz transmitter for data ($3).
Hardware:
Below is the SKX1MD remote control, a 433MHz receiver module and the connection diagram to the PC sound card
The SKX1MD transmitter has a 9 pin dip switch that sets the receiver address and data pins. These can be set to high, low or left open. In the matching receiver there is also a 9 pins DIP switchs that must match the setting of the transmitter. I didn't want to break the plastic casing of the Tedsen Remote Control SKX1MD, but when I opened the battery container it showed PCB number PSKX4MD V5. Some researched on internet showed that the remote control could contain a Motorola/Freescale MC145026 Encoder for RF or IR remote controllers. These encoders encode 9 address/data input pins that are either high, low or open into two 9 bits words as shown in the figure below.
You can see that a high is encoded as 0111111101111111. A low is encoded as 0000000100000001 as described in the MC145026 datasheet. The 433 MHz receiver module has only three connections, DC supply, GND and a 0-5V TTL data output signal. The data output can be connected to the line in of a sound card. It must be noted that a sound card expects +/-1VAC, so the sound card would be overdriven or even damaged. However the output impedance of the receiver is a bit low and this did not damage my sound card.
Below is a picture from the signal recorded from the original 433 Mhz transmitter. You can see that the recorded amplitude is within 0.5VAC range wich means that my sound card is safe. Listen to the recorded sound.
This picture of the recorded signal showed that the receiver signal is similar to the signals as described in the MC145026 datasheet. You can see that each digit is encoded as 0111111101111111 for high and low as 0000000100000001. The time base of each 0 or 1 is approximately 285 us. Each digit is 4560 us, and each 9 bit word is 41,040 us. The time between two consequent words is 14ms.
However the IC in the SKX1MD has 28 pins and not 6 pins as described in the datasheet. I still do not know what type of IC is inside the Tedsen Remote Control SKX1MD. Anyway I was able to investigate the signal and rebuild it in a PIC microcontroller.
Below is the $4 433Mhz transmitter module and the connection diagram to the PIC microcontroller board. Ideally the transmitter and receiver have a 17 cm antenna.
Below is the code written in MikroE MicroC Pro compiler for PIC. You can see in the code that I simply toggled the output pin high and low and using simple time delays.
/* Project name: Garage door opener
* Configuration:
MCU: PIC12F629
Dev.Board: Custom experiment board
Oscillator: HS, xtal 20 MHz
Ext. Hardware: 433MHz AM transmitter (those cheap 3$ things) on GP2 pin
SW: mikroC PRO for PIC
* Note: the 433Mhz transmitter is supplied with +9V
* Note: the microcontroller supplied with GND and +5V */
sbit RFOUT at GP2_bit; //alias
char a, i, number;
void sendbit(char a){
if(a==0){ //pin low
RFOUT=1;
delay_us(2010);
RFOUT=0;
delay_us(270);
RFOUT=1;
delay_us(2010);
RFOUT=0;
delay_us(270);
}
if(a==1){ //pin high
RFOUT=1;
delay_us(270);
RFOUT=0;
delay_us(2010);
RFOUT=1;
delay_us(270);
RFOUT=0;
delay_us(2010);
}
if(a==2){ //pin floating
RFOUT=1;
delay_us(270);
RFOUT=0;
delay_us(2010);
RFOUT=1;
delay_us(2010);
RFOUT=0;
delay_us(270);
}
}
void main(){
CMCON = 0x07; // turn off comparators
TRISIO=0b111000; //set gp2 as output, rest is input (high impedance)
while(1){
gpio=0x02;
sendbit(1);//address A1 0 is low, 1 is high, 2 is floating pin
sendbit(0);//address A2
sendbit(0);//address A3
sendbit(0);//address A4
sendbit(1);//address A5
sendbit(0);//address A6 /data D6
sendbit(1);//address A7 /data D7
sendbit(0);//address A8 /data D8
sendbit(1);//address A9 /data D9
delay_ms(14);
gpio=0;
}
}
I was able to rebuild the original signal in the PIC transmitter code . Below is the original signal.
Below is the programmed signal.
Because these signals look very similar I was convinced that I could open the garage door with my own PIC program. In the final test, the garage door opened!
Below are two pictures of the garage door opener. The garage door opener has only one switch that switches ON the circuit. The transmitter is directly supplied from the 9V battery. The 17cm antenna is glued on the inside walls of the box and also fixates the pcb. By placing 6 diodes in series with the battery a 5V power supply is created for the microcontroller. The 9V battery is placed in a half 4xAA battery container which is glued to the bottom. A sponge glued to the upper side of the box holds the battery on position. The range of the transmitter is approximately 100 meter. The total cost was less than $10.