Table of Contents
FPGA Fan Controller
My Ceiling fan is controlled by a Hunter Fan Co 27185 remote control, which transmits control messages over RF at 350MHz.
Internally the device uses a HT12E encoder chip driving a 350MHz LC oscillator.
It has a 4-bit DIP switch that controls the id of the fan that will be controlled.
Capture
Gqrx
I used my RTLSDR and Gqrx to capture transmissions from the remote, which revealed the following things…
- When buttons are pressed, bunches of packets are transmitted in OOK (On-off keying).
- The carrier frequency is not at all accurately tuned to 350MHz, and drifts significantly based on the transmitter's relative to other objects, and to temperature. This is to be expected with an LC oscillator with no accurate frequency reference.
Inspectrum
Inspectrum is a promising open source project that enables very quick and easy analysis of narrow-band signals contained in IQ-data captures.
Analysis of the transmissions captured by Gqrx revealed that the packets are sent in a PWM (pulse-width modulation) scheme over OOK.
GNU Radio
With the modulation of the packets now known, I used GNU radio to construct a real-time version of the Inspectrum demodulator.
Packet Format
Data is transmitted by a 2/3rd / 1/3rd PWM scheme at ~2000bps.
| Command | Preamble | 4-bit Fan Id | 7-bit Payload | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Off | 0 | 0 | LSB | ⋅ | ⋅ | MSB | 1 | 1 | 1 | 1 | 0 | 0 | 1 |
| Speed 1 | 1 | 1 | 1 | 0 | 0 | 0 | 1 | ||||||
| Speed 2 | 1 | 1 | 1 | 0 | 0 | 1 | 0 | ||||||
| Speed 3 | 1 | 1 | 1 | 0 | 1 | 0 | 0 | ||||||
| Lamp On/Off | 1 | 1 | 1 | 1 | 0 | 0 | 0 | ||||||
iCE40 FPGA Implementation
I wanted to make use of the Yosys/Arachne-PNR/IceStorm open FPGA synthesis tool-chain for the iCE40, a small FPGA made by Lattice.
Because of the simple modulation scheme, it's possible to transmit the 350MHz packets by simply wiggling a pin with a flying lead attached, which acts as a monopole antenna.
The source is available on github. The final implementation allows the fan to be controlled through push-buttons and over serial-over-USB via the board's FT2232 USB interface.
Performance
The ideal quarter-wave antenna length for a monopole 350MHz is ~214mm. With a flying lead of this length, I found that the FPGA could transmit to a distance of 150m. This range is quite excessive, so I trimmed the antenna to ~50mm which the reduced the transmission range to a more reasonable distance.
Given that there are only 16 id-codes possible with the 4-bit DIP switch, and that the transmit range is so long, and that the fans in my housing complex are presumably all the same type, it would be easy to prank the neighbors in the housing complex by transmitting random commands to all the ids at once.