1
\$\begingroup\$

I'm trying to control a 2.4GHz remote for LED panels. Inside there is a keyboard decoder chip and an RF chip, the markings don't return any immediate results. I've decoded the data with a logic analyzer but I'm having a hard time replicating the results with an Arduino, i.e. talking directly to the RF chip.

I'm not sure if the chip is a slave or a master, since it seems to generate its own clock (SCK).

birds-eye view I can detect 5 pins that are actively used:

  • D0 seems to be a "command set" signal. Seems to be an input.
  • D2 looks like an SCK at 1MHz, but sometimes it has long pulses. Seems to be driven by the RF
  • D4 seems to contain the data that the RF needs as input, clocked on D2
  • D5 seems to return a "1" when a byte has been sent on D4, when clocked on D2
  • D7 slave/chip select?

zoomed in

When driving the D0 line with an Arduino, using around the same timing as the keyboard chip, I can see the LED on the remote flashing in rhythm and all the other lines wake up with a digital signal on them.

I've tried bit-banging D0 + D2 + D4 + D7, then just D0 + D4, but I have the feeling there's some need for interactivity.

The chips are really small and close together, I cannot really isolate them (such as adding resistors for determining direction.

Is this some kind of an SPI protocol? Does this look like something commercial or for which there's an Arduino (slave?) library? Are any of my assumptions wrong?

Edit: added a PCB photo PCB detail

\$\endgroup\$
  • \$\begingroup\$ Not so sure. SCLK would be clocking constantly. \$\endgroup\$ – Marko Buršič Feb 18 at 21:47
  • 2
    \$\begingroup\$ No SCK does not necessarily clock continuously. There might be a wait for some kind of handshake or INT pin to know a chip is ready for next byte or transaction. The host may not be able to send data back to back either. It would be better to have zoomed signals to know if there are 8 clocks between a gap and multiple of 8 bits in a transaction. It sure does look awfully lot like SPI to me. \$\endgroup\$ – Justme Feb 18 at 22:10
  • \$\begingroup\$ A 30-day link for one of the sigrok files: easyupload.io/xr81s4 \$\endgroup\$ – brainwash Feb 18 at 23:27
  • \$\begingroup\$ Could D0 be the transmitting vs receiving indicator? First part, it is low => Transmitting data to LED panel. Second part, it is high => Receiving data back from LED panel. D7 could also be data sent/received indicator, based on the data input/output buffers (which seems to be 3 bytes here). \$\endgroup\$ – eeintech Feb 19 at 12:18
2
\$\begingroup\$

I think I may have found the answer, after some more digging. The RF chip seems to be PL1167.

Going through the register datasheet, I can see that register 0x23 is power management (first message that gets sent in my remote), 0x34 is FIFO pointer, 0x32 is FIFO data, 0x07 is TX enable, which coincides very well with what I'm seeing on the traces.

The inspiration came while looking at the MiLight reverse-engineering effort: https://hackaday.io/project/5888/logs and this led me to the Group discussing this chip https://groups.google.com/forum/#!msg/openhab/ayFUwuABpcE/ThiUv94bq9QJ

enter image description here

| improve this answer | |
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.