Reverse Engineering Ritter 8341C Protocol for ESP3866

by ml17950 in Circuits > Remote Control

645 Views, 2 Favorites, 0 Comments

Reverse Engineering Ritter 8341C Protocol for ESP3866

ritter-sockets.png

Hi @all.

For my own small home automation I use primary 433 MHz controlled sockets. I own 3 sets with DIP switches to adjust the adress. These were working fine. But some time (one or two years) ago, i purchased a set of sockets from "ritter". I didn't read the description before, and after unpacking I realized, than there were no DIP switches and also the rcswitch libary for ESP didn't "speak" the correct protocol. So I used them only with the remote control.

Now, in my vacation, I startet to change this... an here I want to document this project. I hope, it will help somebody else with the same or a similar problem.

Record Signals

20180812_222356~01.jpg
Screenshot 2018-08-12 22.27.27.png

To record the signals I connected a 433 MHz receiver module to an ESP8266 (only a power supply shoulb be ok) and hooked my Hantek 6022 oscilloscope to the data pin.

Then I pressed the button on the remote an recorded the signal train.

Pulse/Delay Measurement

Screenshot 2018-08-12 22.28.28.png

After recording the signal, I searched for start and end of one burst. Normally a socket remote control sends 3 times the same burst or sometimes, as long the button is pressed.

Now, I measured the pulse/delay-times and wrote it down. This I repeated for all six signal-trains (3 x on + 3 x off).

Compare Signals for Socket 1,2,3 and Find the Difference

20180813_212508~01.jpg

After some measurements, I compared the HIGH's and LOW's + signal durations. The changes were the different commands. The other signals were something like protocol-/manufacturer-codes. Also every burst had an start- and end-sequence.

The signal consists of "START + NOT CHANGING SEQUENCE + ON/OFF COMMAND + DEVICE ADDRESS + END"

Write Code for Testing

Screenshot 2018-08-12 22.32.11.png

After a while I had all the (theoretical) information I needed. So I created a short test-sketch for an ESP8266 and a 433 MHz sender. In loop all three socket are switchin on/off with an delay between the commands.

Test the Code With a Basic Sender

20180813_215250~01.jpg
20180817_142823~01.jpg

I connected a battery to the ESP an went in the living room. 5 of 6 commands were working, and after fixing a writing mistake in a command sequence, all codes were working.

Fine, now I can switch all 12 rc-sockets (9 with a DIP adress + the 3 new ritter ones) with my ESP8266 RC Controller.

You can find demo-code on GitHub