Judul Skripsi :
UNIVERSAL REMOTE CONTROL FOR AIR CONDITIONERS with BACKLIT
LCD
Penulis : ANTONIUS SETYO (5235122716)
Tahun
: 2012
Email : anthonychoppers@gmail.com
Email : anthonychoppers@gmail.com
Bidang Studi : JURUSAN
TEKNIK ELEKTRO
FAKULTAS TEKNIK
UNIVERSITAS NEGERI JAKARTA
FAKULTAS TEKNIK
UNIVERSITAS NEGERI JAKARTA
Dosen :
Dr. Bambang
DharmaPutra, M.Pd
Introduction
Acquiring data
At first, i had to get somehow
the IR data sent by the remote control. The simplest method was with a TSOP1838
IR receiver, the same i used for the long
range IR beam break detector circuit.. With the proper trigger setting on
my oscilloscope, i managed to capture the IR beam...
This is the TSOP
1838
|
I connected the
oscilloscope to capture the data sent
|
With the proper
trigger settings, here is what the remote sends upon button press
|
Air
condition remote controls have a very long protocol
Air condition remote controls with built-in LCD have a long protocol because they carry all the settings
There is a great difference
between typical TV, radio, DVD and other remote control protocols with the
air-condition remote controls, and more specifically the remote controls with
the LCD screen. That is because the settings are stored on the remote control
itself rather than the air-condition unit. This means that each time a button
is pressed, the remote control must send not only this button press, but the
complete set of parameters such as temperature, fan settings, swing, operation
and others.
It was rather impossible to analyze the protocol directly from the oscilloscope's screen because of its length. So what I've done was to connect the oscilloscope with the PC through USB. With a special software i download the data from the oscilloscope to the PC. Luckily, this software can export a long set of measurements in excel format. I made a small software that reads these data, filters the results and draws an inverted rectangular waveform according to the data:
It was rather impossible to analyze the protocol directly from the oscilloscope's screen because of its length. So what I've done was to connect the oscilloscope with the PC through USB. With a special software i download the data from the oscilloscope to the PC. Luckily, this software can export a long set of measurements in excel format. I made a small software that reads these data, filters the results and draws an inverted rectangular waveform according to the data:
My oscilloscope
can be connected with the PC through USB
|
The software
exports a long series of serial data of the waveform in excel format
|
I made a small
software which can analyze this serial data, filter the results and export a
bitmap with the filtered waveform
|
Identifying
the transmission protocol modulation
The oscilloscope's screen shows
the signal inverted and i did not recognize the modulation type immediately.
But when i saw the filtered and inverted waveform on the screen, i immediately
recognized the modulation type: It is Differential
Pulse Position Modulation. I've written a detailed theory regarding the PPM
and the D-PPM modulation in this
page.
So, now i know exactly which parameters to measure: i need to measure the duration of the short and long pulse interval, the pulse duration, the initial pulse interval and the carrier frequency of the signal:
So, now i know exactly which parameters to measure: i need to measure the duration of the short and long pulse interval, the pulse duration, the initial pulse interval and the carrier frequency of the signal:
The short pulse
duration is 320uSec
|
The long pulse
duration is 1.16mSec
|
The pulse
duration is 540uSec
|
The initial
pulse duration is 3.1mSec
|
As for the carrier signal, i need to change the receiver circuit. the TSOP has built-in filters and outputs only pulses without the carrier signal. So i replaced it with a simple IR diode like the one i used in this IR Short Distance Beam Cut Detector circuit.
I used a simple
IR diode to detect the carrier signal
|
Now the carrier
frequency is visible
|
By decreasing
the horizontal time/div of the oscilloscope, the carrier wave is measurable.
It is 37.3KHz
|
Now i know everything regarding the modulation. I can proceed with the protocol identification...
The last byte was the hardest
At first, i thought that the last byte
represents the temperature change, because if you notice, the last byte is
change whenever the temperature is changed. One degree of change in the
temperature equals to one change in the last byte. But then i noticed that the
last byte changes not only with the temperature. As a matter of fact, any
change that is done the last byte changes as well. So, the last byte is
something like error correction. But what kind of error correction?
I tried to XOR bytes to see if there is a logical result, but i failed. After many observations and tests, i remembered that the the last byte is changed by one when the temperature is changed by one. There is one mathematical function which can achieve this; The addition!
At first, i inverted all the bits because it seemed to be more logical. Then i added the bytes 7-8 and 9 for all the previous samples. To my surprise, when i subtracted this result from the last byte, i always had a constant result of decimal 57, with one exception: The OFF command. This command gave me a different result. Obviously, the 6th byte had to be included in the addition.
So i added all bytes fro 6 to 9. To my surprise, everything looked prettier now! By subtracting the result of this addition from the last byte, i always had constant subtraction result of 21! Normally, this would be the end! To re-create the last byte, i only had to add the bytes form 6 to 9 and then add another 21 and that's all. But since my curiosity always overcomes my practical instincts, i had to find out where this "21" comes from.
The bytes 10 to 13 have no interest since they are all 0 (remember that i invert all bits). So the secret should be hidden somewhere in the first bytes. Unfortunately, none of them is 21. And if i add all these bytes, the result was very high...
BYTE 1: 11000100 = 35
BYTE 2: 11010011 = 203
BYTE 3: 01100100 = 38
BYTE 4: 10000000 = 1
BYTE 5: 00000000 = 0
Addition result = 277
And then, after and hour of tests and research, it just came to me! What if i just ignore the 9th bit of the previous addition which results from the 8-bit overflow???
277 - 256 = 21
I tried to XOR bytes to see if there is a logical result, but i failed. After many observations and tests, i remembered that the the last byte is changed by one when the temperature is changed by one. There is one mathematical function which can achieve this; The addition!
At first, i inverted all the bits because it seemed to be more logical. Then i added the bytes 7-8 and 9 for all the previous samples. To my surprise, when i subtracted this result from the last byte, i always had a constant result of decimal 57, with one exception: The OFF command. This command gave me a different result. Obviously, the 6th byte had to be included in the addition.
So i added all bytes fro 6 to 9. To my surprise, everything looked prettier now! By subtracting the result of this addition from the last byte, i always had constant subtraction result of 21! Normally, this would be the end! To re-create the last byte, i only had to add the bytes form 6 to 9 and then add another 21 and that's all. But since my curiosity always overcomes my practical instincts, i had to find out where this "21" comes from.
The bytes 10 to 13 have no interest since they are all 0 (remember that i invert all bits). So the secret should be hidden somewhere in the first bytes. Unfortunately, none of them is 21. And if i add all these bytes, the result was very high...
BYTE 1: 11000100 = 35
BYTE 2: 11010011 = 203
BYTE 3: 01100100 = 38
BYTE 4: 10000000 = 1
BYTE 5: 00000000 = 0
Addition result = 277
And then, after and hour of tests and research, it just came to me! What if i just ignore the 9th bit of the previous addition which results from the 8-bit overflow???
277 - 256 = 21
Bytes 1-4: Device ID. In my
case this is 00100011 11001011 00100110 00000001
Byte 5: 0
Byte 6: 00100100 during normal operation, 00100000 to turn off the Air-Condition
Byte 7: 0000xxxx - MODE:
Byte 5: 0
Byte 6: 00100100 during normal operation, 00100000 to turn off the Air-Condition
Byte 7: 0000xxxx - MODE:
00000001 -
HEAT
00000010 -
DRY
00000011 -
COOL
00000111 -
FAN
00001000 -
AUTO
Byte 8: 0000xxxx - TEMPERATURE. The temperature is calculating by subtracting this value from the number 31. For example, if this value is 00000000, the temperature is 31 (31-0=31), if it is 15 (00001111), the temperature is 16 (31-15=16).
Byte 9: 00yyyxxx - FAN and SWING:
Byte 8: 0000xxxx - TEMPERATURE. The temperature is calculating by subtracting this value from the number 31. For example, if this value is 00000000, the temperature is 31 (31-0=31), if it is 15 (00001111), the temperature is 16 (31-15=16).
Byte 9: 00yyyxxx - FAN and SWING:
00yyy000 -
AUTO
00yyy010 -
LOW
00yyy011 -
MID
00yyy101 -
HIGH
00000xxx -
NO SWINGING
00111xxx - SWING ENABLED
Bytes 10 through 13:Reserved for SLEEP and TIMER functions (i have not worked yet with these bytes)
Byte 14: Error correction. To generate this byte, simply add all the previous bytes (1 through 13) and ignore any overflow from the 8th bit and above.
Bytes 10 through 13:Reserved for SLEEP and TIMER functions (i have not worked yet with these bytes)
Byte 14: Error correction. To generate this byte, simply add all the previous bytes (1 through 13) and ignore any overflow from the 8th bit and above.
References :
- Dosen-dosen pengajar Fakultas Teknik Universitas
Sam Ratulangi, Kumpulan Catatan Kuliah Dasar dan Teknik Pengontrolan, Teknik
Elektro Universitas Sam Ratulangi, Manado, 2000 – 2004.
- http://www.jaycar.com.au/productView.asp?ID=AR1731
- Reverse Engineering oleh Fidji Air Conditioning IR Remote Controls
- Jan F. Kreider. Handbook of heating, ventilation, and air conditioning. CRC press. ISBN 0-8493-9584-4.
- Winnick, J (1996). Chemical engineering thermodynamics. John Wiley and Sons. ISBN 0-471-05590-5.
1 comments:
Yth : Bapak/ Ibu . Bagian Pembelian
Memperkenalkan kami CAN ELECTRONIC INDONESIA Distributor produk
1. Electronic Test & Measurement Instrument
(muleteer, clamp meter, earth tester, insulation, Power quality, OTS , Battery tester)
2. Education Test /peraga pendidikan Elektro, Laboratorium
(Oscilloscope, power supply, function generator, spectrum analyzer, LCR meter)
3. Enviroment measuring instrument test
(udara, air, gas, suara, geteran, temp., humidity, moisture, distance neter, dan lain )
4. OIL & GAS measuring instrument test
( Process meter, loop calibrator, temp. calibrator, pressure calibrator, holiday detector )
Merek utama produk yang kami distribusi antara lain :
AZ INSTRUMENT LUTRON
ATTEN GW-INSTEK
MEGGER FLUKE
KYORITSU KITAMOTO
ATAGO G-WON
A&E Lab ELMED
Produk :
Airflow, Temp., Datalogger , Gas Meter (CO2, CO ), Sound Level, Water Quality Tester ( PH/Conductivity, SALT/D.O/ TDS, ORP)
Oscilloscope (analog/digital), Spectrum Analyzers, Signal Sources, Power Supplies, Training Kit, Multimeter
High Voltage Insulation Tester, Power Quality Analyzer, Earth Tester, Digital MegOhm Tester, Digital Clamp meter, Loop Calibrator, Process Meter
Digital / analog Oscilloscope, Thermohygrometer, Vibration meter, Coating Thickness Gauge
Refractometer , Pocket Refractometer, Clinical (Salt, Sugar, oil, fruit,.)
Spectrophotometer, Flame photometer, Whiteness Meter, Melting Point Device
Grain Moisture / Flour Moisture meter( Paddy, Rice, Soy Bean, Barley, Wheat, Maize/Corn, Paddy in Dryer, Red Pepper, Coffee )
Apabila ada pertanyaan atau kebutuhan jangan ragu menghubungi kami di,
CAN ELECTRONIC INDONESIA
Lindeteves Trade Center Lt.2 Blok C18 No.3
Jl. Hayam Wuruk 127 Jakarta 11180
Telp (021) 6232 0266, 2607 1120, 2607 1126 | Fax (021) 2607 1120
HP : 0812-8239968 | 0878-78798632 | 0816 1423158
Email : canelectronic.ind@gmail.com | sales@canelectronic.com
Website : canelectronic.com
Post a Comment
Thanks for read my post. good readers always leave a footstep