RF-Bridge-EFM8BB1
The Sonoff RF Bridge is only supporting one protocol with 24 bits.
The Idea is to write a alternative firmware for the onboard EFM8BB1 chip.
All original commands 0xA0 to 0xA5 are supported!
There are the pins C2 & C2CK on the board. With a Arduino you can build a programmer to read/erase and program the flash.
Software for the Arduino: https://github.com/conorpp/efm8-arduino-programmer
C2 Interface
Use this header to program the firmware on the EFM8BB1.
RS232
Use this RS232 connection for debug/testing. Put the switch S2 to OFF when connecting.
For normal operation the switch S2 have to be in ON position.
The project is written with Simplicity Studio 4. The resulting *.hex file can be programmed on the EFM8BB1.
The reading of RF signals is already working:
Sending start sniffing: 0xAA 0xA6 0x55
Receiving AKN: 0xAA 0xA0 0x55
Sending stop sniffing: 0xAA 0xA7 0x55
Receiving AKN: 0xAA 0xA0 0x55
If your remote can't be sniffed with the command 0xA6 please use command 0xB1.
This will do bucket sniffing and give maybe a result like this:
Hex: AA B1 04 0439 01C5 0BAE 1C3E 01 10 10 10 10 01 01 01 10 10 01 01 10 10 01 01 01 10 01 01 10 10 10 10 23 55
0xAA: uart sync init
0xB1: bucket sniffing
0x04: bucket count including sync bucket
0x0439: Bucket 1 length: 1081µs
0x01C5: Bucket 2 length: 453µs
0x0BAE: Bucket 3 length: 2990µs
0x1C3E: Bucket 4 length: 7230µs
0x01-0x23: RF data received (high/low nibbles denote buckets)
0x55: uart sync end
If the data is only including 01, 10 and 23 at the end than it should be possible to decode the signal by command 0xA6.
But for this the protocol have to be defined in the RF_Protocols.h file.
01 means:
BIT_HIGH_TIME is 1081µs.
BIT_HIGH_DUTY = 100% / (1081µs + 453µS) * 1081µs =~ 70%.
10 means:
BIT_LOW_TIME is 453µs.
BIT_LOW_DUTY = 100% / (1081µs + 453µS) * 453µs =~ 30%.
23 means:
SYNC_HIGH is 2990µs.
SYNC_LOW is 7230µs.
SYNC_BIT_COUNT is default 0.
The bitcount can be counted like this:
| data 1 | data 2 | data 3 | data 4 | data 5 | data 6 | data 7 | data 8 | data 9 | data 10 | data 11 | data 12 | data 13 | data 14 | data 15 | data 16 | data 17 | data 18 | data 19 | data 20 | data 21 | data 22 | data 23 | data 24 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | 10 | 10 | 10 | 10 | 01 | 01 | 01 | 10 | 10 | 01 | 01 | 10 | 10 | 01 | 01 | 01 | 10 | 01 | 01 | 10 | 10 | 10 | 10 |
| bit 1 | bit 2 | bit 3 | bit 4 | bit 5 | bit 6 | bit 7 | bit 8 | bit 9 | bit 10 | bit 11 | bit 12 | bit 13 | bit 14 | bit 15 | bit 16 | bit 17 | bit 18 | bit 19 | bit 20 | bit 21 | bit 22 | bit 23 | bit 24 |
BIT_COUNT = 24.
REPEAT_DELAY is default 0.
If you get a response to this command the EFM8 chip is running this alternative firmware
Hex: AA FF 55
Receiving AKN: AA xx 55
The xx is the firmware version (0x00-0xFF)
0xAA: uart sync init
0xA6: sniffing active
0x06: data len
0x02: protocol identifier
0xD0-0x55: data
0x55: uart sync end
STOP:
Binary: 10101010 10100110 00000110 00000001 11010000 11111001 00110010 00010001 01010101 01010101
Hex: AA A6 06 02 D0 F9 32 11 55 55
DOWN:
Binary: 10101010 10100110 00000110 00000001 11010000 11111001 00110010 00010001 00110011 01010101
Hex: AA A6 06 02 D0 F9 32 11 33 55
Light ON:
Binary: 10101010 10100110 00000100 00000011 00110010 11111010 10001111 01010101
Hex: AA A6 04 03 32 FA 8F 55
This is the original implemented RF transmit command
Hex: AA A5 24 E0 01 40 03 84 D0 03 58 55
0xAA: uart sync init
0x24-0xE0: Tsyn
0x01-0x40: Tlow
0x03-0x84: Thigh
0xD0-0x58: 24bit Data
The high time of the SYNC get calculated by the Tsyn (SYNC low time),
duty cycle of the high bit is 75% and 25% of the low bit.
With the command the standard PT226x sniffing gets disabled and the sniffing of the defined protocols in RF_Protocols.h is starting.
Hex: AA A6 55
Example of a received decoded protocol:
Hex: AA A6 04 03 32 FA 80 55
0xAA: uart sync init
0xA6: sniffed RF data
0x04: data len
0x03: protocol identifier (Seamaid_PAR_56_RGB)
0x32-0x80: data
0x55: uart sync end
Stop the 0xA6 sniffing and restart the PT226x sniffing.
There is a new command in the firmware to be able to send RF data.
Hex: AA A8 06 02 D0 F9 32 11 33 55
0xAA: uart sync init
0xA8: transmit RF data
0x06: data len
0x02: protocol identifier (ROHRMOTOR24)
0xD0-0x33: data
0x55: uart sync end
Universal transmit by command 0xA8
Hex: AA A8 0D 7F 12 C0 05 DC 02 BC 46 01 2C 1E 08 1E 55
0xAA: uart sync init
0xA8: transmit RF data
0x0D: data len
0x7F: protocol identifier 0x7F
0x12-0xC0: SYNC_HIGH
0x05-0xDC: SYNC_LOW
0x02-0xBC: BIT_HIGH_TIME
0x46: BIT_HIGH_DUTY
0x01-0x2C: BIT_LOW_TIME
0x1E: BIT_LOW_DUTY
0x08: BIT_COUNT + SYNC_BIT_COUNT in front of RF data
0x1E: RF data to send
Hex: AA A9 55
With the new learning the RF Bridge will scan for all predefined protocols. The first received RF code will be sent by OK 0xAB. If a timeout happens 0xAA will be sent.
This command accommodates RF protocols that can have variable bit times. With this command, up to 16 time buckets can be defined, that denote the length of a high (mark) or low (space) transmission phase, e.g. for tri-state mode RF protocols. This command also accommodates code repetition often used for higher reliability.
Hex: AA B0 20 04 1A 0120 01C0 0300 2710 01212122012201212121212121220121212201212203 55
0xAA: uart sync init
0xB0: transmit bucketed RF data
0x20: data len: 32 bytes
0x04: number of buckets: 4
0x19: number of repetitions: (transmit 1+25 = 26 times)
0x01-0x20: Bucket 1 length: 288µs
0x01-0xC0: Bucket 2 length: 448µs
0x03-0x00: Bucket 3 length: 768µs
0x27-0x10: Bucket 4 length: 10ms (sync)
0x05-0xDC: SYNC_LOW
0x02-0xBC: BIT_HIGH_TIME
0x01-0x03: RF data to send (high/low nibbles denote buckets to use for RF high (on) and low (off))
0x55: uart sync end
Please note that currently, there is no learning mode for this! However, you can use, e.g., an Arduino with the RFControl library to learn the bucket times and sequences (the compressed example gives you everything you need if you convert the decimal numbers to hex).
This command will do bucket sniffing.
Hex: AA B1 04 0120 01C0 0300 2710 01212122012201212121212121220121212201212203 55
0xAA: uart sync init
0xB1: bucket sniffing
0x04: bucket count including sync bucket
0x01-0x20: Bucket 1 length: 288µs
0x01-0xC0: Bucket 2 length: 448µs
0x03-0x00: Bucket 3 length: 768µs
0x27-0x10: Bucket 4 length: 10ms (sync)
0x01-0x03: RF data received (high/low nibbles denote buckets)
0x55: uart sync end
Hex: AA C0 xx xx 55
Do beep xxxx miliseconds (uint16_t). Like AA C0 03 E8 55 will beep for ~1000ms.
Add ESPurna support:
A new protocol have to be implemented to support more RF signals -> have to be defined!