Reverse-engineer wired remote control

[neroic]

I have a remote control that comes with the projector. The remote control has not just an IR emitter but also a female 3.5mm jack for wired control purpose.
Some digging and I found that the remote control is an OEM product from http://www.parex.com.tw/new/product_common_romote_control_2508.htm

The projector accepts control (on/off, menu, etc) from the remote control:

• wirelessly through IR receiver. [Remote Control]--------[IR Signal]-------->[Projector IR Receiver]
• wired through remote control jack/port. [Remote Control]--------[3.5mm cable with male jack on both ends]-------->[Projector IR Remote Port/3.5mm female]

I have an Arduino and I have no problem learning and replicating the IR code using IRremote library. What I am trying to figure out is how does the wired control works and to eventually replicate how it work using Arduino. Any pointers?

PS: I am not sure what tools I'd need to find this out but I have a Saleae Logic 4 and Fluke 179 Multimeter.

[jonovid]

I have a remote control that comes with the projector.

name and band of projector ?
someone may have the schematics for it.

I am trying to figure out is how does the wired control works and to eventually replicate how it work using Arduino. Any pointers?

wired control uses a resistor level set by the buttons that control v+ thresholds of schmitt triggers if its like the old VCRs
added this
LB1475 remote wired control  but not knowing the projector band ?

[neroic]

name and brand of projector ?
someone may have the schematics for it.

Thanks Jonovid! The said projector :DP HL Laser  http://bit.ly/2fmLMpA

wired control uses a resistor level set by the buttons that control v+ thresholds of schmitt triggers if its like the old VCRs

Now that you said it, I hooked up another remote to Saleae Logic 4 with following pins:
1. Tip       : Channel 2
2. Ring      : Channel 1
3. Sleeve   : GND

Got the reading in the screenshot after short pressing the ON button on the remote control.
Can I convert the reading into resistor level, maybe using Arduino, if it's possible at all?

[jonovid]

here is video that may help

EEVblog #506 - IR Remote Control Arduino Protocol Tutorial

[neroic]

here is video that may help

EEVblog #506 - IR Remote Control Arduino Protocol Tutorial

Thanks again Jonovic!

I think I saw that video before but I think it's not really applicable for the wired option, unless I am wrong?
It was more for infrared modulation and demodulation which I have no problem of. In fact, I had built a number IR decoder and extender projects using the awesome IRremote libary by Ken Shirriff.

But for measuring and reproducing the fluctuation of resistor level or schmitt trigger or voltage, I really have no idea and that I really need help at. 

[PA0PBZ]

If I had to design this and already had the IR stuff I think I'd try to use the same signal that is used to modulate the IR beam.
Do you have a picture of the inner side of the remote?

[neroic]

Here are some photos from the inner side of a separate remote — there's an IC on one end of the second photo which has 24 pins (left/right) labeled:
OHS6688F246A
AC0816
CX4404.00

[PA0PBZ]

I can't find any info for the IC apart from "Universal Remote Controller" which we already guessed. There's another IC in the middle of the PCB but it's easy to miss.
If you have a scope I'd like to see the IR drive and the wired connector in the same shot.

[macboy]

Try viewing the output of the remote's minijack on channel 1 of the scope, and the output of an IR demodulator which is looking at the signal from the remote on channel 2. I am certain that you will find a very interesting correlation between them.

[neroic]

I can't find any info for the IC apart from "Universal Remote Controller" which we already guessed. There's another IC in the middle of the PCB but it's easy to miss.
If you have a scope I'd like to see the IR drive and the wired connector in the same shot.

I don't have the remote with me at the moment, will post the scale up picture with the middle IC model soon.

Try viewing the output of the remote's minijack on channel 1 of the scope, and the output of an IR demodulator which is looking at the signal from the remote on channel 2. I am certain that you will find a very interesting correlation between them.

If the wired connector/mini jack is plugged in, the IR will be disabled so it's either one, not both. I guess I'll try to measure them one at time next week and compare the IR (modulation/demodulation chart) with the wired (voltage fluctuation) and see if I can derive any correlation between them.

[amyk]

The IC is probably this rather obscure 8051-core MCU or one of the other DC6688x:
http://www.dragonchip.com/TechDoc/DC6688FST/HELP/Documents.htm

The signal you observed with the LA looks very much like a modulated IR code, so I would start from there and feed it directly into the Arduino which you said you could figure out the IR with already.

[John Coloccia]

If I had to design this and already had the IR stuff I think I'd try to use the same signal that is used to modulate the IR beam.
Do you have a picture of the inner side of the remote?

I would have assumed this too...same signal, with some appropriate buffering on either side so you can transmit over a wire. May not even need anything special on the transmitter side since there's already something capable of driving an LED. Wouldn't it be funny if the receiver side just hooked up the wire to an internal LED? That's just a little bit of wishful thinking because it would make for a funny teardown.

[neroic]

I can't find any info for the IC apart from "Universal Remote Controller" which we already guessed. There's another IC in the middle of the PCB but it's easy to miss.
If you have a scope I'd like to see the IR drive and the wired connector in the same shot.

Here are one shot with IC number clearly visible and another shot showing both sides of the IR and jack connectors on PCB. I run through the connectors with multimeter and I don't think they are connected.

[neroic]

One more info on the source of power when operating:

• If the remote is operated using wireless IR signal, the remote draws power from the batteries.
  If the remote is operated using wired mini-jack, the remote draws power from the projector through the mini-jack cable (this is confirmed when batteries are removed from the remote and the remote can still work).

So this validates that the wiring on the IR LED transmitter cathode/anode and the mini-jack are on different line.

[amyk]

The 74AC08 is quad 2-input AND, not sure what the 305A is.

[neroic]

It's been a while and I bumped into this remote again at home. Managed to hash out some details from memory.
Now I've got a logic analyzer and managed to capture some sample when pressing a key on the wired remote. The sample showed up like this on my logic analyzer window:



The captured data is at: https://filebin.ca/3NlMPFPxNMGI/ir-wired-remote-12MHz60MSamples6.logicdata

Now I'd like to correct a wrong assumption that I had before — the infrared and wired remote are within the same remote housing but they works differently. The infared in this remote generates standard 38khz signal but the wired remote isn't. When connected to the projector, the remote control is charged by it, both the tip and ring of the wired remote stayed constantly at around 4 or 5 volts. And when pressed, generate a certain kind of pulses as shown in above image.

Given the sample data above, is there a way for me to translate or generate that kind of pulse using Arduino?

[hamster_nz]

Nice capture - was able to make a 'ruler' (see image).

Interesting that the long pulse are 2.5 times the length of the short pulses.  You will need to make quite a few captures, with different buttons pushed/commands, to see what is going on.

Given the slow speed it should be possible to generate that signal with an Arduino, using digitalWrite() and delayMicroseconds(), at least enough to prove the concept.

You might need to do a little more investigation, to see if the signal line has a pullup on it, or who is pulling it up. If it has a pullup on it, you set the pin to zero with DigitalWrite(x,LOW), and then use "pinMode(x,OUTPUT)" to drive the signal low, then "pinMode(x, INPUT)" to allow it to be pulled back up.

[hamster_nz]

Given the sample data above, is there a way for me to translate or generate that kind of pulse using Arduino?

I haven't put it into the compiler or tested it, but

Code: [Select]

const int pin = ????; // Whichever pin the signal is connected to

void setup() {
  pinMode(pin,INPUT);
  ///////////////////////////////////
  // Set it up to drag the signal low
  // when set to "OUTPUT"
  ///////////////////////////////////
  digitalWrite(pin,LOW);
}

void loop() {
  //////////////////
  // Wait a second before you send the message
  //////////////////
  delay(1000);
  ///////////////////////////////////////////////////////////
  // Start message
  //
  // pinMode(pin, OUTPUT) drags the output pin low
  // pinMode(pin, INPUT) lets the pullup pull the signal high
  ///////////////////////////////////////////////////////////

  //////////////////
  // 1
  pinMode(pin,OUTPUT); delayMicroseconds(2500);
  pinMode(pin,INPUT);  delayMicroseconds(2500);
  // 2
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 3
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 4
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 5
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 6
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 7
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 8
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 9
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 10
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(2500);
  // 11
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(2500);
  // 12
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 13
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 14
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 15
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 16
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 17
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
  // 18
  pinMode(pin,OUTPUT); delayMicroseconds(1000);
  pinMode(pin,INPUT);  delayMicroseconds(1000);
}


[neroic]

I tried the code but it doesn't seem to generate anything, as far as I can see when measuring it on the oscilloscope.

[AnalysIR]

The signal on the jack, seems to be the demodulated IR signal (with the 38kHz carrier removed). So it essentially contains the signal that the IR receiver in the projector would get via IR. I suspect the IR signal output is mechanically disabled by a switch in the jack when a cable is plugged in.

Note: This (jack) signal is inverted logic, just like the output from IR receivers.


So if you capture the actual IR signal using IRremote, then you can clean that up a bit and use it inverted to send over the cable.

It looks like your first 2 times would be 2500_2500 uSecs (Lead in Header)when cleaned up. The other timings are probably 1000_1000 (Binary 0) and 1000_25000 (binary 1) (based on the ruler image posted above)