Some companies may not like you reverse engineering their products. So make sure to check if everything you are doing is legal, if you want to do this on a large scale.
I will make the assumption here that Silverlit will not mind me using this at home.
IR remote control?IR sensors are easy to use in your home-made project. If you are using Arduino (and the ESP8266), you probably came across the IRrecvDemo example, which shows you how to use an IR sensor and remote control. 'Remote control' mostly indicates a TV remote control or any other typical remote control from a device that has gone out of service.
Remote control as in 'toy remote control'But there are also a lot of small toys that use IR in their remote control: 'remote control' being one with control sticks and only a few buttons. Reusing these would be great to control our own remote controlled vehicles.
Now there are some articles out there with similar projects and even one with a silverlit protocol:
These were a great help in finding the solution, but they discuss particular cases and not a complete end-to-end guide on how to do this on your own. This project is going to give you the complete picture.
The Remote controllersI have 2 Silverlit helicopters at home which use an IR remote.
The Silverlit Picoo Z 85615
This remote control has:
- 2 control sticks: throttle and left/right
- a slider button with 3 options: channel A, B or C
- a trim button
And the Silverlit Dauphin EC155
This helicopter is more advanced and the remote control has:
- 2 control sticks which each can be used in 2 direction (up/down and left/right)
- a slider button with 2 options: channel A or B
- rotating button for trim
- 1 button for turning the light on or off
Off course you need an IR sensor. I got mine from a cheap LED lightbulb: you can control the light via a built in IR sensor. Apparently you should not unscrew these lights when the power is on, I learned that the hard way.
Taking one of these lights apart, I could recover the IR sensor, which is the big black thing in the center.
My sensor has the following pinout:
I am using a Wemos D1 mini which is based on the ESP8266.
The circuit is very easy:
- VCC pin on the 3.3V
- GND on the GND (yes, really!)
- IR Out pin on the D6 pin of the Wemos
So I started off by using this example program and it works great! When you press a button on the remote control which can with the lights, it dumps a code on Serial output.
Using the Picoo Z remote, I gently moved the throttle up and I received a bunch of codes: 15 to be exact, which would be logical for a 4 bit encoding.
- 566B0127
- 3E7BE7AC
- 52709A6C
- 5C90B45F
- AEA0AD2C
- 2355532C
- 60A154C7
- 416A1FDF
- 1ADE316C
- B8EA2647
- ccded907
- 2103E4A4
- 2ba64a5F
- A05AF05F
- 27ABE3A4
The left/right stick appeared to have a resolution of 3 bits (so 7 different codes). But off course, the codes for left/right are different for each step in the throttle!
At this point I contemplated on just trying to find each code, which would mean 15 x 7 codes, not taking the other buttons into account. But I soon gave up on this.
IRrecvDumpV2On to the next program which dumps some more interesting data:
Encoding : SONY
Code : 30000 (20 bits)
Timing[41]:
+1950, - 650 + 700, - 650 + 700, - 650 +1250, - 650
+1250, - 600 + 650, - 550 + 650, - 600 + 650, - 600
+ 650, - 600 + 650, - 600 + 650, - 550 + 650, - 600
+ 600, - 550 + 650, - 600 + 600, - 600 + 600, - 600
+ 650, - 600 + 650, - 600 + 650, - 550 + 600, - 550
+ 700
uint16_t rawData[41] = {1950,650, 700,650, 700,650, 1250,650, 1250,600, 650,550, 650,600, 650,600, 650,600, 650,600, 650,550, 650,600, 600,550, 650,600, 600,600, 600,600, 650,600, 650,600, 650,550, 600,550, 700}; // SONY 30000
uint32_t address = 0x0;
uint32_t command = 0xC;
uint64_t data = 0x30000;
From reading the first article referenced above, we know IR signals use PWM to encode the message: so a 1 is a long pulse, a 0 is a short pulse. The timings seem to suggest 0's and 1's, but we don't have a readable format yet.
Getting to the good partSo I wrote the following function which will dump out all the values in the raw buffer of the IR result:
The method takes a parameter level: since my remote may use longer or shorter pulses than yours, we first need to define what the difference is between a long and a short pulse.
First we use this method with value '0' as level: the output is below.
We see the same values as in the timings section of the IRrecvDumpV2 output, but there the values are expressed in milliseconds, here we have the rawvalues. We conclude that '1' is everything above 16 and '0' is everything below.
Let's run the same method again with level set to 16: while running we move the throttle up:
A clean pattern emerges with 6 digits reacting when moving the throttle. All bits seem to be duplicated, which may be for some modulation reason.
Parsing the valueTo retrieve the value for the IR code, use the following method:
First we get the indexes of the digits we need. Since they are duplicated, we will select 15, 17, 19 and 21. Note the digits a grouped by 10, the index is 0-based!
Calling the method like this and it will return the throttle value in an int value:
Repeating the same for the left-right stick, the channel and the trim button, we get to this setup:
This code gives us the following output:
The Dauphin remote is more complex: let's try if we can repeat our analysis...
Running the DumpIRBinaryValue method while moving the left stick up, gives the following result:
Since it has more complexity (2 2-directional sticks), the code is longer, but we easily see the location of the stick value: this is a 5 digit code. We also see that the bits are not duplicated in this case (vs the Picoo Z).
After some analysis, we get to:
- Download the .ino file from the attachments
- Modify it to run on your board if needed
- Run the program with DumpIRBinaryValue with level 0
- Check the output: high values are 1, low values are 0. Determine a value in between: this will be your level value
- Run DumpIRBinaryValue again with the level value set.
- Move one of the controls on your remote and check the output to determine the indexes of the digits linked to this control. Use these indexes with the ParseIRValue function to retrieve the value.
- Repeat this step for each of the controls on your remote
Next step: get the Tiny Tank (https://www.hackster.io/JBijnens/tiny-tank-drive-around-forever-7b817e
) to use the IR remote!
Comments