Reverse engineering ELRO HA51 wireless

From Randomdata wiki
Revision as of 21:37, 30 July 2012 by Fish (Talk | contribs)

Jump to: navigation, search

What is it

It's a alarm system, used with wireless accessories. We have a central and a remote control:

Elro HA51.jpgElro HA51 remote.jpg

Setup

We opened the device, no internal alarm trigger's where used. The system contains 2 board:

  • Logic board
  • 433 receiver

We hooked up a logic analyzer on the 433 receiver board to "snif" the datastreams:
We opened the remote to change the dipswitches:
Elro HA51 remoteinside.jpgElro HA51 remoteinsidedips.jpg

Results

After sniffing a few times this the result:
"Put alarm off" with all dips off:
Elro HA51 433 alloff alarmoff.png
"Put alarm off" with all dips on:
Elro HA51 433 allon alarmoff.png
As you can see, the first pulse is always short, the next 8 pulses is the code of the system, dip "off" is a small pulse, a wide pulse is dip "on".

Also we have seen the last 4 pulses are used to control the system: Wide=1 Small=0

System off: 1100 System on: 1110 System Delayed on: 1011 Panic button: 0011 Other codes will be added after analysing (PIR, door detection etc)