Table of Contents
FPGA Fan Controller
My Ceiling fan is controlled by a Hunter Fan Co 27185 remote control, which transmits control messages over RF at 350MHz.
Internally the device uses a HT12E encoder chip driving a 350MHz LC oscillator.
It has a 4-bit DIP switch that controls the id of the fan that will be controlled.
Capture
Gqrx
I used my RTLSDR and Gqrx to capture transmissions from the remote, which revealed the following things…
- When buttons are pressed, bunches of packets are transmitted in OOK (On-off keying).
- The carrier frequency is not at all accurately tuned to 350MHz, and drifts significantly based on the transmitter's relative to other objects, and to temperature. This is to be expected with an LC oscillator with no accurate frequency reference.
Inspectrum
Inspectrum is a promising open source project that enables very quick and easy analysis of narrow-band signals contained in IQ-data captures.
Analysis of the transmissions captured by Gqrx revealed that the packets are sent in a PWM (pulse-width modulation) scheme over OOK.
GNU Radio
With the modulation of the packets now known, I used GNU radio to construct a real-time version of the Inspectrum demodulator.
Packet Format
| Command | Preamble | 4-bit Fan Id | Payload | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Off | 0 | 0 | LSB | ⋅ | ⋅ | MSB | 1 | 1 | 1 | 1 | 0 | 0 | 1 |
| Speed 1 | 1 | 1 | 1 | 0 | 0 | 0 | 1 | ||||||
| Speed 2 | 1 | 1 | 1 | 0 | 0 | 1 | 0 | ||||||
| Speed 3 | 1 | 1 | 1 | 0 | 1 | 0 | 0 | ||||||
| Lamp On/Off | 1 | 1 | 1 | 1 | 0 | 0 | 0 | ||||||
iCE40 FPGA Implementation
