Menu
DVD UI Hack
Analyzing remote control IR messages
The IR-Reciever photo diode
Most remote controls transmits their messages by rapidly flashing an infrared emitting diode. In order to make the transmission reliable and unaffected by other IR sources, the message is modulated with a carrier frequency. Fortunately there is common way to do this modulation, and it is not necessary to dwelve into how the details - one can just use a standard remote control IR-Reciever chip, which is a photo diode combined with the required circuitry to bandpass filter and amplify the signal into a TTL compatible digital signal.
The IR-Reciever used for this analysis is a SFH5110 device from Osram:
IR Analyzer
To analyze the digital signal from the IR reciever, a test setup was created on breadboard. A microcontroller (ATMega88) was fed the signal on an external interrupt which was configured to create interrupt requests on both falling and rising edge.
Nothing was assumed about the digital signal. The microcontroller was just programmed to measure the timing of low and high state and transmit these timings over the UART, which was connected to a PC (using a MAX232 for level shifting). It should be noted that the signal is default high. This is an example output from IR analyzer, padded with some helping text:
Everything is x 10^-6 seconds
Technics remote: PRESET ^
HI time LO time Sum
New msg.
3.419 3.419
1.673 446 2.119
389 457 846
1.241 460 1.701
386 459 845
388 461 849
387 459 846
400 446 846
389 460 849
387 460 847
387 458 845
390 459 849
390 458 848
387 442 829
406 458 864
1.252 426 1.678
407 440 847
411 439 850
421 426 847
408 440 848
407 438 845
432 421 853
418 425 843
1.272 424 1.696
413 436 849
1.274 425 1.699
412 439 851
410 438 848
1.274 424 1.698
434 416 850
412 435 847
423 422 845
412 436 848
411 436 847
413 434 847
414 432 846
1.287 392 1.679
447 419 866
1.266 431 1.697
1.265 433 1.698
413 430 843
430 418 848
418 429 847
415 431 846
416 433 849
416 432 848
1.286 389 1.675
459 409 868
417 430 847
1.290 407 1.697
50 <- length
54.692 <- time total
DENVER Eject
HI time LO time Sum
New msg.
8.743 8.743
4.445 520 4.965
563 523 1.086
582 526 1.108
1.664 542 2.206
567 540 1.107
563 515 1.078
556 550 1.106
566 527 1.093
580 514 1.094
1.674 524 2.198
1.659 551 2.210
565 541 1.106
1.639 551 2.190
1.674 519 2.193
1.670 525 2.195
1.655 552 2.207
1.662 528 2.190
1.673 525 2.198
573 526 1.099
1.672 541 2.213
1.646 542 2.188
565 542 1.107
566 514 1.080
565 527 1.092
568 536 1.104
582 499 1.081
1.691 523 2.214
571 530 1.101
552 551 1.103
1.662 526 2.188
1.671 547 2.218
1.633 552 2.185
1.669 519 2.188
39.075 8.780 47.855
2.194 561 2.755
36 <- length
117.044 <- time total
So, the Technics remote (RAK-SU180WH) signal for "Preset Up" has 50 pulses and lasts about 55 ms. The Denver signal has fewer pulses and lasts about the same (disregarding the last two pulses which indicates that the button is held).
To decode this kind of signal, I decided to use the sum of the low and high time and compare it with a threshold value of 1400 and a maximum value of 4000. This simple decoding will pick out information for both the Denver and Technics signals. The IR analyzer program has an option to show the result of this decoding instead of the raw timings as seen above.
You can download the source of IR analyzer here:
- main.c
The IR signal decoding and the main program logic of IR analyzer. - uart.c uart.h
Simple driver for sending and recieving over UART - util.c util.h
Utility functions, mainly for converting numbers to ascii. - Makefile
- iranalyzer.zip
A zip with above files.
It should be noted that the decoding in ir.c of the final DVD UI HACK source is more refined.
Previous: Introduction - Next: The hardware