Differences

This shows you the differences between two versions of the page.

--- xro:rollohack_gw60 [2015-10-09 15:09]
xro [Investigating the GW60]
+++ xro:rollohack_gw60 [2017-06-11 15:12] (current)
xro
@@ Line 33: / Line 33: @@
 ^PIN# ^ Voltage ^ Notes ^
 | 1 | GND | directly connected to GND plane on PCB and to GND of DC power supply |
-| 2 | GND | Data-Pin, can be pulled to 5V with a 100 Ohm resistor |
+| 2 | GND, DataPin | can be pulled to 5V with a 100 Ohm resistor |
-| 3 | 5V  | Data-Pin, can be pulled to GND with a 100 Ohm resistor |
+| 3 | 5V, DataPin  | can be pulled to GND with a 100 Ohm resistor |
 | 4 | 5V  | 5V Power for the ZB40, directly connected to voltage regulator on board|
 | 5 | -   | not connected to anything ??|
@@ Line 46: / Line 46: @@
 After several attempts to just toggle pins resulted in nothing, we suspected some serial interface. Opening up the GW60 again,
-I traced the lines to two 1KOhm resistors and then to the TX/RX input pins of a PIC16F90 microcontroller.
+I traced the lines to two 1KOhm resistors and then to the TX/RX input pins of a [[http://ww1.microchip.com/downloads/en/DeviceDoc/40001262F.pdf |PIC16F90]] microcontroller.
 ^PIN# ^ Use ^ Notes ^
 | 1 | GND | directly connected to GND plane|
-| 2 | RX | connected to PIC16F90 Pin 12 (RX) via 1kOhm resistor |
+| 2 | RX | connected to [[http://ww1.microchip.com/downloads/en/DeviceDoc/40001262F.pdf |PIC16F90]] Pin 12 (RX) via 1kOhm resistor |
-| 3 | TX | connected to PIC16F90 Pin 10 (TX) via 1kOhm resistor  |
+| 3 | TX | connected to [[http://ww1.microchip.com/downloads/en/DeviceDoc/40001262F.pdf |PIC16F90]] Pin 10 (TX) via 1kOhm resistor  |
 | 4 | 5V | 5V Power from voltage regulator on PCB |
@@ Line 64: / Line 64: @@
 The ZB40 can select one of three or all three rollos and send commands UP, DOWN, STOP. Simplest minimum implementation would require at least 4 bits. So I could hope that one-byte bruteforcing might still yield results. Two byte bruteforcing while also guessing the bps would be impossible in the 60s pairing mode window of the GW60. Unfortunately: NO LUCK.
-Status: grudgingly ordered a overpriced ZB40 with even more prohibitive 9,90 shipping costs from Germany.
+Yes, at this point I could just a well have soldered something on the PCB and simulated button presses. But I was curious now, so I grudgingly ordered a overpriced ZB40 with even more prohibitive 9,90 shipping costs from Germany.
 === Listening In ===
+<WRAP right>{{:xro:superrollo_zb40.jpg?direct&400 |}}</WRAP>
 Next step: Listening in on the ZB40 talking to the GW60 using my OpenBench Logic Analyzer.
+{{:xro:rollo_gw60_zb40_signal.tar.xz|OpenBench LogicSniffer recorded signals, Sigrok format}}
+Testing the included RF Remote as well as other 433MHz remotes, it would seem the ZB40 receiver just down-modulates the signal into the baseband and pipes the raw signal to the gw60. The actual signal sent by the remote look quite strange though. It's pulse-width modulation for sure.
+Seems to me that the receive (not the remote) could easy be replaced by the contents of this [[http://www.pollin.de/shop/dt/MzIyODcyOTk-/Computer_und_Zubehoer/Hardware/Maeuse_Unterlagen_Joystick/PC_Funkfernbedienung_mit_USB_Empfaenger_X10.html|Remote's USB-Stick]]
+==== Update ====
+Finally resumed the project with a different approach.
+Bought a second ZB35 remote and soldered the contacts to a ESP8266.
+Fotos [[https://galley.realraum.at/index.php?/category/ZB35RemoteSuperrollo|here]]

realraum Graz, Brockmanngasse 15, 8010 Graz, realraum - Verein für Technik in Kultur und Gesellschaft