I got a sun roof here. One of those with pivoting slats. The hardware is from a company in the Czech Republic. The controls are from Italy: Teleco.
Teleco makes several remote control systems, so this project may be used differently.
The control box has an arm processor.
You can connect several remote inputs to it. There are also connections for a wind gauge, a rain gauge, a temperature gauge, so the system can open and close itself when there is snow or rain. Or too much wind.
But what bugs me: There is no connection to an APP. Something that a supplier of this kind of system should have nowadays. And this system is from 2020!
Thus came the thought of building an app that could take over the remote control. One method is to use wires to connect a uP to the remote controller switches. Another method is to capture the RF signals and examine them because a processor can simulate them so you can use them to control the roof.
Now a tool exists: URH, or Universal radio hacker. Free to download. For Windows I got a warning the URH would contain a virus. So I created Federora in Virtualbox and installed URH on it. Does URH indeed contain a virus, it can do no harm in the Vbox environment.
The operation of URH is simple. Need a DVB-T stick which can be bought for 15 euros. You set URH's spectrum analyser to search in the ISM band 430 and 868. One press on the remote control, and the transmission frequency is displayed right away.
Then a recording can be made by clicking on the remote controller a few times. After filtering the signal, URH indicates that the transmission frequency of the Teleco remote control is 868.265mhz, FSK.
Analysis and filtering by URH then returns a bistream in which the starting pulse can be recognised: 2ms. Each pulse thereafter is 500us or 1ms.
This series of pulses is reminiscent of the OOK protocol that many appliances work with. Perhaps Teleco first made a 433mhz OOK transmitter, and then used the same software in the 868mhz version. These series of pulses are easy to decode:Low is 500us. High is 1ms. When we next look at the output after decoding, 8 bytes come out. With AVR and an at mega88a, the decoder was made to capture the code words.
A6,A4,BC,52,E4,00,07,BD
D9,60,98,90,66,00,07,32
F2,10,9D,41,24,00,07,F5
D4,34,AC,83,66,00,07,5C etc.....
The bitstream is as follows:
Byte0..4 : random numbers,pairing / control codes
Byte 5: always 0
Bytes 6: switch which is pressed
byte 6
1=slats closed
2=slats full open
3=slats midposition
4=slats ¼ open
5=1 step open
7=stop
8=1 step closing
Bytes 7: 0x100- checksum over byte0..6.
For each button, we need to capture bytes 0-4. Bytes 0..4 is a stream containing 3 fields:
14 bits field1. 10 bits field2, 10 bits field3. The numbers are quasi random, but analysis in exel shows that there are links between the button pressed and the bit patterns generated.There are 6 more bits reserved which are apparently used for other groups of the remote control. (6 groups of 7 switches=total of 42 codes)
Since it is of no further interest to examine the coding, we use the codes as received. The system is not Keelloq coding. A received code word can be used again. The motor control receiver can simply be learned that the ESP generated signals should be accepted as new contoller.
In B4r, an encoder was created that then makes the RFM22b send a signal to which the sunroof controller responds.
In b4a, an app was created that controls the esp8266 via MQTT. If the messages run through the public channel, another user could also control the screen. Therefore, a check is built in. The app sends a command via Mqtt. The esp then sends a random number back to the app. The latter makes a calculation based on a given Hash and sends the answer back to the esp. The esp compares the calculation with the internal calculation, and when the result is the same, the signal is sent to the sunscreen. A message is then also sent back to the app so the user gets a notification of accepted.
attached: B4a example program. You need to specifiy your MQTT provider creditals. In case you are not on a public channel the hash control can be removed.
B4r program for the ESP8266 D1 mini clone. Schematic how to connect the ESP to the RFM22b. (note: RFM22b is a old chip from Hope. You can replace it by a modern type, but some rework on the programming should be done)
(the b4a program was too big to upload, so stripped only the files needed. You need to resetup it together with other files needed B4aPages)
Teleco makes several remote control systems, so this project may be used differently.
The control box has an arm processor.
But what bugs me: There is no connection to an APP. Something that a supplier of this kind of system should have nowadays. And this system is from 2020!
Thus came the thought of building an app that could take over the remote control. One method is to use wires to connect a uP to the remote controller switches. Another method is to capture the RF signals and examine them because a processor can simulate them so you can use them to control the roof.
Now a tool exists: URH, or Universal radio hacker. Free to download. For Windows I got a warning the URH would contain a virus. So I created Federora in Virtualbox and installed URH on it. Does URH indeed contain a virus, it can do no harm in the Vbox environment.
The operation of URH is simple. Need a DVB-T stick which can be bought for 15 euros. You set URH's spectrum analyser to search in the ISM band 430 and 868. One press on the remote control, and the transmission frequency is displayed right away.
Then a recording can be made by clicking on the remote controller a few times. After filtering the signal, URH indicates that the transmission frequency of the Teleco remote control is 868.265mhz, FSK.
Analysis and filtering by URH then returns a bistream in which the starting pulse can be recognised: 2ms. Each pulse thereafter is 500us or 1ms.
This series of pulses is reminiscent of the OOK protocol that many appliances work with. Perhaps Teleco first made a 433mhz OOK transmitter, and then used the same software in the 868mhz version. These series of pulses are easy to decode:Low is 500us. High is 1ms. When we next look at the output after decoding, 8 bytes come out. With AVR and an at mega88a, the decoder was made to capture the code words.
A6,A4,BC,52,E4,00,07,BD
D9,60,98,90,66,00,07,32
F2,10,9D,41,24,00,07,F5
D4,34,AC,83,66,00,07,5C etc.....
The bitstream is as follows:
Byte0..4 : random numbers,pairing / control codes
Byte 5: always 0
Bytes 6: switch which is pressed
byte 6
1=slats closed
2=slats full open
3=slats midposition
4=slats ¼ open
5=1 step open
7=stop
8=1 step closing
Bytes 7: 0x100- checksum over byte0..6.
For each button, we need to capture bytes 0-4. Bytes 0..4 is a stream containing 3 fields:
14 bits field1. 10 bits field2, 10 bits field3. The numbers are quasi random, but analysis in exel shows that there are links between the button pressed and the bit patterns generated.There are 6 more bits reserved which are apparently used for other groups of the remote control. (6 groups of 7 switches=total of 42 codes)
Since it is of no further interest to examine the coding, we use the codes as received. The system is not Keelloq coding. A received code word can be used again. The motor control receiver can simply be learned that the ESP generated signals should be accepted as new contoller.
In B4r, an encoder was created that then makes the RFM22b send a signal to which the sunroof controller responds.
In b4a, an app was created that controls the esp8266 via MQTT. If the messages run through the public channel, another user could also control the screen. Therefore, a check is built in. The app sends a command via Mqtt. The esp then sends a random number back to the app. The latter makes a calculation based on a given Hash and sends the answer back to the esp. The esp compares the calculation with the internal calculation, and when the result is the same, the signal is sent to the sunscreen. A message is then also sent back to the app so the user gets a notification of accepted.
attached: B4a example program. You need to specifiy your MQTT provider creditals. In case you are not on a public channel the hash control can be removed.
B4r program for the ESP8266 D1 mini clone. Schematic how to connect the ESP to the RFM22b. (note: RFM22b is a old chip from Hope. You can replace it by a modern type, but some rework on the programming should be done)
(the b4a program was too big to upload, so stripped only the files needed. You need to resetup it together with other files needed B4aPages)
Attachments
Last edited:
