Reverse engineering ELRO DB280 Doorbel

From Randomdata wiki
Revision as of 11:40, 12 December 2012 by Fish (Talk | contribs)

Jump to: navigation, search

Elro db280.png

The ELRO DB280 is a doorbel system with a wireless remote. The system has a fixed code, although it can be changed quite easily by changing some "solder bridges"

We analyzed the wireless signal with an Logic analyzer and a 433 receiver.

The jumpers are set:


After analysing the pulses with the logic analyzer we do see the following


If we invert the set jumpers and we the code 1 character we see the following:

 0 1 1 1 1 0 1 1

We can conclude:

  • Every pulse uses a 0 in front
  • The code is inverted (or it's default up unless it's brought to the ground)
  • There is a trailer: "010101010"
 This is Fish_ his DoorbelGOon code 0.1
 More info check @fish_ on twitter
int rfout=12; //rf output pin
int status=13; //status pin
int longwait=0; // declare the longwait int

void setup() {
  // Open serial debug communications and wait for port to open:
  pinMode(rfout, OUTPUT);  //Define rf 433 transmitter pin
  pinMode(status, OUTPUT); //Define status LED
  digitalWrite(rfout, LOW); //extra check that output is LOW

void loop() {

  // Set up a Pulse String of the doorbel
  String stringOne = "0001010101000101010101010"; //first digit is ignored
  int highpulse=750; // Length of the 1 pulse
  int highbreak=300; // Length of the 1 break
  int lowpulse=250; // Length of the 0 pulse
  int lowbreak=900; // Length of the 0 break

  int offtime=1; // Declare the offtime integer
  int ontime=1;  // Declare the ontime integer
  int pulselength=25;

  Serial.println(stringOne); //Debug output
  Serial.println(); //Debug enter

  int pulses=0;  // Declare the pulses integer
  //This Block gets the 0 or 1 of the string and sets the pulse and break time
  while(pulses < pulselength) {
    if (stringOne.substring(pulses,(pulses+1)) == "0") {
      } else {

  //This Block sends the output to the 433 transmitter
  digitalWrite(rfout, HIGH);    // pulse on

  digitalWrite(rfout, LOW);   // put pulse on low

  digitalWrite(rfout, LOW);   // be sure the puls is off (INVERTED!!)
  delay(10);               // delay for next pulse series
  longwait++; // add 1 to the longwait value.
  if (longwait>10) {longwait=0; delay(500);} //used for send the next batch of pulses