This page is about reverse engineering protocols used in simple AM RF modules at 433 MHz.
This frequency is very popular for various inexpensive RF wireless things, like: Knowledge of the protocol for these kinds of applications could be used to add RF capabilities to hobby projects.

Hama remote shutter trigger CA-1

Protocol: When receiving about 250 full-press codes in a row, the receiver unit goes into 'bulb' mode. The example on the right shows the codes for a half-press and a full-press (dip switch 4 was on, rest off)

Haehnel remote shutter trigger HW 433 N80

This device can be used for remote control of the autofocus/shutter of a photo camera. Protocol: The example on the right shows the codes 00000001.00001110.0 and 00000001.11001110.0, which encode for a half-press and a full press respectively in normal/bulb mode on with channel code 1000.

Cactus v2 remote flash

Gadgetinfinity sells the Cactus V2, a remote RF flash trigger with 4 'channels', configured by 2 dip switches. This thing sends a code to a remote flash by turning a 433 MHz SAW oscillator on and off in a certain pattern. Out of curiosity I tried to reverse engineer the protocol.

RF recording

At first I simply used a 433 MHz receiver module, connected the output to my sound card and recorded the signal shown at the right

We see 20 pulses of about 2 ms each (on the left you see some noise that these 433 MHz receivers typically output in absence of data). However the pulses on the left don't look the same as the pulses on the right, there seem to be some kind of dips in it. I thought this is because my RF receiver module is not really fast enough, so I decided to measure directly in the Cactus transmitter itself.

Recording at the transmitter

The picture on the left shows the signals I recorded directly inside the Cactus V2 transmitter for the four different channels (1st = OFF-OFF, 2nd = ON-OFF, 3rd = ON-ON, 4th = OFF-ON). What we see is the following:

Remote controlled wall socket

There's a lot of relatively inexpensive remote controlled wall socket adapters available, also working on 433 MHz. They are based on the PT2262 encoder (in the transmitter) and PT2272 decoder chips (in the receiver). A well-known implementation of this is the KaKu (klik-aan klik-uit) system.

The one that I have uses the following protocol (I didn't fully reverse engineer this myself):

It seems the receiver has to receive at least two pulses to switch the socket on or off. The image on the right shows an example of this kind of signal (this signal was actually made by a microcontroller and not the actual transmitter unit).

Wireless thermometer

I also have a wireless thermometer, with an outdoor unit that transmits the temperature to an indoor unit. The protocol seems quite simple. The example on the right shows a code of, or a temperature of 24.9 degrees on channel 1. I haven't figured out the parity code yet.

Unknown 433 MHz signal

Here's a recording of some unknown signal appearing at the output of my 433 MHz RF receiver module every 30 seconds or so, probably a weather station. Analysis:
This page was last updated May 23, 2009