IR Protocol Analyzer for Remote Controls
IR Protocol Analyzer for Remote Controls
IR Code Analyser
identify remote control codes!
Point any IR remote controller at this nifty device and its in-built micro-
controller will quickly analyse the signal and reveal which of eight stan-
dard control protocols the controller is using.
Microcontroller
– 4 KByte ROM
– 128 Byte RAM
– 32 Byte EEPROM for user code
– 2.7 to 6 V Supply voltage
– Two 16 Bit Timer/Counter
– Integrated reset
– Internal RC Oscillator
(selectable)
– 20 mA drive current
from all the port pins
– Maximum 18 I/O-Pins,
when the internal reset and RC
oscillator is used.
– 2 analogue comparators
– I2C interface
– Full duplex UART
– Serial In-circuit Programmable
It’s a rare piece of entertainment equipment bly think of lots of applications for a tion. The chief design criteria for the
that does not come with its own remote con- discarded remote controller. For IR analyser was to produce a neat,
troller. After a few years it’s easy to accumu- example using the well-documented portable unit that would quickly
late a drawer-full of (functional) controllers RC5 or RECS80 protocol from Philips enable a check to be made of the
belonging to equipment long since consigned a simple receiver/decoder can be output signal of an unknown remote
to showrooms at your local household built using the SAA3009 or SAA3049 controller. A microcontroller decodes
amenity tip. IC from Philips if only you knew the IR message and displays the
Equipment manufacturers tend to use dif- details of the controller coding. Sim- important information on an LCD. In
ferent controller protocols so it is rare to find ilarly if you are looking for a second use the unknown IR controller
by chance a controller from one manufacturer controller for a piece of equipment its should be placed close to the
able to control equipment from another. All of not practical to lug a portable oscil- analyser’s receiver IC before a com-
the protocols used should however comply loscope to the local car boot sale to mand key is pressed. The microcon-
with one of the eight industry standards. analyse each controller on offer. troller will decode the message and
Many electronics enthusiasts can proba- This device offers the ideal solu- display information indicating the
Hardware
There are no surprises in the circuit diagram of
Figure 1. Flash mode signal (a) modulated mode signal at 36 kHz (b). the IC code analyser shown in Figure 3.
The infra red signal is detected by IC2. Infi-
neon have ceased production of their receiver
protocol used and the command shown on the display. IC but any one of the compatible devices
sent. A good source of detailed infor- specified in the parts list would be suitable.
mation about the different IR proto- 2. Key press: Command This device contains a highly sensitive infra
col formats can be found in the This hexadecimal value indicates the red receiver, amplifier, filter and demodulator
March and April 2001 edition of Elek- type of command that was sent in tuned to an IR carrier frequency of 36 kHz. A
tor Electronics. the message. A 10hex (16dec) for data sheet for this device can be down
This analyser is only suitable for example in RC5 coding indicates loaded from:
decoding modulated signals in the that the command will increase vol- ([Link]/cmc_upload/0/000/
range of 30 - 40 kHz. Fortunately all ume of the controlled equipment. 008/562/[Link]).
the common control protocols use The inverted demodulated received signal is
this frequency range. 3. Key press: Complete code connected directly to an input port of the
Some (older) controllers use flash The contents of the entire message microcontroller IC1. IC2 is relatively sensitive
mode where the message informa- are displayed in hexadecimal. The to supply rail disturbances so R2 and C2 are
tion is conveyed by switching on the hex value assumes that the data is used to form a low pass filter, decoupling any
sender diode for a short period sent in the order Bit 7 to Bit 0. Some interference.
rather than modulating it at 36 kHz manufacturers (e.g. Sony) however The core of the microcontroller is based on
(see Figure 1). The analyser’s IR reverse the bit order. In this case the the Intel 51 architecture that lends itself to
receiver chip will only respond to values are corrected before display. simple low-cost program development by
modulated signals so that flash using any of the available Shareware devel-
mode messages will be ignored. 4. Key press: Type of Code opment tools. The 87LPC764 is produced by
This displays the protocol type of the Philips and is described as a Low power, low
last received message e.g. RC5, price, low pin count microcontroller. Decoding
Operation SIRCS or RECS80.
Once the analyser is switched on the When the display shows
message ‘CODE ANALYSER VER 1‘ UNKNOWN this indicates that the
will be displayed and then ‘WAIT- received message does not conform
ING...‘ indicating that the analyser is to any of the eight standard proto-
ready and waiting to receive an IR cols. It could also indicate however
controller message. As soon as a that the signal was too weak or too
message is received the analyser distorted. The IR receiver IC2 is opti-
will display the type of coding sent mised for reception of a 36 kHz mod-
by the controller and pressing push- ulated signal so its sensitivity to
button S1 will display further infor- some signal protocols at the
mation about the received message. extremes of the 30-40 kHz band will
be greatly reduced (see Figure 2 ).
1. Key press: Address Always place the output diode of the
This hexadecimal value indicates the handheld controller as close as pos-
type of equipment that the controller sible to IC2 of the analyser to ensure
was originally designed to control. a good signal. LED D2 will blink to
As an example, if the controller uses indicate signal reception irrespective
RC5 protocol format and the address of the type of protocol so it gives a
0 is displayed this indicates that good indication that the controller is
controller will control a TV. Some sending out a signal. If the diode
manufacturers do not use the does not blink try a new set of bat-
address field in the message so in teries in the controller. Items at car Figure 2. The sensitivity of the IR receiver falls
this case two lines (—) will be boot sales rarely have batteries fit- off sharply either side of its centre frequency.
9V +
Power for the analyser is provided
R1 +5V
220Ω by a 9 V battery and zener diode D1
20mA
R2 R3
R4 P1 regulates this on-board to 5 V. Resis-
100k
tor R1 limits the supply current and
100Ω
1k2
10k K1 overall consumption is approxi-
VSS
C1
D1 mately 20 mA.
VDD
Vo
10µ C2 D2
16V 5V1
100µ 16V
15
RS
R/W
Display
E
12 1 D0
The display is a standard 1x16 LCD
P1.0 P0.0
11 20 D1 (indicating 1 row of 16 characters).
P1.1 IC1 P0.1
IC2 1 10
P1.2 P0.2
19 D2 This display is a standard item from
9
P1.3(INT0) P0.3
18 D3
many manufacturers. It has a built-
3 8 17 D4
4
P1.4(INT1) P0.4
16 D5
in controller using a standard com-
P1.5 P0.5
SFH505A 2
3
P1.6
87LPC764 P0.6
14 D6 mand set. All of the compatible dis-
SFH505A 2
P1.7 P0.7
13 D7 plays mentioned in the parts list
Dot Matrix have identical pin-outs, RAM
X1 X2
Display addresses and multiplex rate. The
5 6 7
X1 1 x 16
S1 information generated by this
analyser could be displayed on a four
C3 6MHz C4
1 3 line LCD but to reduce costs it was
2
0 15p 15p decided to employ a single line dis-
010029 - 11
play and use a pushbutton to toggle
through the information. The display
control software is simplified by
Figure 3. Only two IC’s are used in the analyser circuit diagram. using eight controller port pins. P1 is
a variable resistor, allowing adjust-
ment of the display contrast.
the IR message is relatively processor inten- 1 µs. The main features of this
sive so a clock rate of 6 MHz is used for the processor are summarised under the
microcontroller giving a machine cycle of heading ‘microcontroller’. Software
All the relevant data for the follow-
ing protocols are integrated into the
software so that they can be
matched to the incoming signal:
Semiconductors:
D1 = zener diode 5V1, 1 W
1-920010 010029-1
D2 = LED, high-efficiency, red ROTKELE )C( (C) ELEKTOR
IC1 = 87LPC764 (programmed, C1 0
order code 010029-41)
H1
D1
IC2 = SFH505A (TSOP1736, C2 X1 R1 +9V
SFH5110-36, PIC26043SM, C4 C3
R2
IS1U60, TFMS5360) S1
Miscellaneous:
R3
R4
IR Remote Control
Codes (1)
formats, protocols and
(in)compatibility
By A.N. Other
Its almost impossible to buy a TV today that is subject to interference from other with a reduced range. In the upper
doesn’t have a IR remote controller and its IR sources in the vicinity. These half of the picture a single telegram
only when we temporarily mislay this device include heaters, incandescent lamps is shown and in the lower half a con-
that we realise how useful they are. Back in and other heat generators. One stan- tinuous key-press is shown. The out-
1975 when the first remote controllers dard method of rejecting this put of the IC goes low when the
appeared they used ultra sonic signals to unwanted interference is to modulate modulated signal is detected.
send the control information, these were later each transmitted bit with a stable It is important to note that the
superseded by the controllers that we are carrier frequency in the range of 30 to equipment manufacturer is entirely
familiar with today using infra red. The infra 40 kHz. Another method is the so- at liberty to choose a transmitter
red devices offer lower production costs, wide called flash mode, this technique is clock frequency and as such the tim-
operating range and good communication employed by the Plessey MV500 chip ing given here may not be accurate
security. A look inside a typical remote con- (described in the February 1991 edi- under all conditions. The timings of
troller will show that it consists of only one tion of Elektor Electronics). This pulse lengths may also be affected
IC. The IC interprets each key press and method outputs data in the form of by the sample clock in the
sends a coded data signal to the transmitter 17 µs short flashes of IR light fol- TFMS5360 and could have an error of
IR diode. A simple resonator is also used to lowed by different off periods. Nokia ±160 µs (Temic data sheet).
supply a stable clock. On the receiving side also use this method with their The communications formats
in the equipment being controlled we find a IRT1250 IC. This system has however described are the most popular but
IR detector and demodulator which is nor- not gained wide acceptance and the it does not represent all the possible
mally integrated into the same device. The vast majority of remote controllers formats that you are likely to find.
SFH505-xx family of devices from Siemens use the modulation technique. Many firms have devised their own
contains the receiver, demodulator and out- The accompanying oscilloscope control format, sometimes in order to
put driver so that the received data can be pictures show each of the described reduce costs or sometimes to incor-
connected directly to a micro controller or transmission formats received by the porate different control features that
control decoder. Unfortunately the actual con- Temic TFMS5360 receiver IC. This are not catered for with the existing
trol protocol used by each manufacturer are device is optimised for reception of a standards. If you use a mask pro-
mostly incompatible. signal modulated at 36 KHz but can grammable micro controller for cod-
The IR message transmitted by the controller also detect other frequencies albeit ing and decoding you will be com-
pletely at liberty to devise your own the equipment manufacturer is that Code Manufacturer
protocol which may be more suited for future equipment development
RECS80 Thomson, Nordmende
to your own particular hardware of you need not wait for a chip manu-
software. This method also ensures facturer to produce a controller using NEC Harman/Kardon, Yamaha,
that a manufacturer will not need to a particular IR coding standard. It is Canon
worry about licencing fees or possi- now possible to select the best or DENON Denon
ble patent infringement. cheapest integrated equipment con- SIRCS Sony
Some modern remote IR con- troller and be sure that the IR remote
RC5 Loewe, Philips, Grundig,
trollers transmit the message a num- controller will produce compatible
ber of times using different message control signals. Marantz
formats. For example the controller So which manufacturer and which MOTOROLA Grundig, Kathrein
will first send out the Japanese code coding system? This article JAPAN Panasonic, Loewe
and then 50 ms later sends out the describes some of the most popular SAMSUNG Samsung
same command but this time using IR coding standards currently in use. DAEWOO Daewoo
RC 5 code. The advantage here for (010023-1)
RC5 Code
The most widely used coding method for IR control in Europe
is the RC 5 code. This was originally developed by Philips and
has the capacity to send 2048 different commands. 32 address-
able groups each with 64 commands. Each piece of equipment
has its own address so that for example adjusting the volume
of your audio system will not affect the sound level of your TV.
One complete message has a length of 14 bits and is com-
posed of the following bits:
The toggle bit changes its value every time a new key is
pressed and is used to tell the difference between pressing Figure 1. RC5 code at the output of the receiver IC TFMS5360.
the key again and holding the key down. The five address bits
follow the toggle bit and indicate which piece of equipment is Table 1 shows in decimal the correspondence between the
being controlled. Lastly the six command bits contain the con- equipment and command codes used for this format.
trol information.
1 1 1 0 0 0 0 1 0 1 1 1 0 0
889us
Transmitter: "0" "1"
SIRCS/Control S Code
error is detected. SIRCS message coding is identical to CNTRL
S, but SIRCS modulates the code at 40 kHz ready to be sent to
an IR diode. CNTRL-S is the baseband (unmodulated) signal
and is used between equipment where a communications
cable is fitted. Sony produce the following IC:
Transmitter:
KIE RA275 S42
The Sony
008 . . . . . . . . . . . . . . .9 button 064 . . . . . . . . . . . . . . .Select input video1
009 . . . . . . . . . . . . . . .10 button/0 button 065 . . . . . . . . . . . . . . .Select input video2
011 . . . . . . . . . . . . . . .Enter 066 . . . . . . . . . . . . . . .Select input video3
codes: 016
017
018
. . . . . . . . . . . . . . .Channel up
. . . . . . . . . . . . . . .Channel down
. . . . . . . . . . . . . . .Volume up
074
078
079
. . . . . . . . . . . . . . .Noise reduction on/off
. . . . . . . . . . . . . . .Cable/broadcast
. . . . . . . . . . . . . . .Notch filter on/off
Equipment address codes (decimal): 019 . . . . . . . . . . . . . . .Volume down 088 . . . . . . . . . . . . . . .PIP channel up
Address Equipment type 020 . . . . . . . . . . . . . . .Mute 089 . . . . . . . . . . . . . . .PIP channel down
1 . . . . . . . . . . . . . . . . .TV 021 . . . . . . . . . . . . . . .Power 091 . . . . . . . . . . . . . . .PIP on
2 . . . . . . . . . . . . . . . . .VTR1 022 . . . . . . . . . . . . . . .Reset TV 092 . . . . . . . . . . . . . . .Freeze screen
4 . . . . . . . . . . . . . . . . .VTR2 023 . . . . . . . . . . . . . . .Audio mode: 094 . . . . . . . . . . . . . . .PIP position
6 . . . . . . . . . . . . . . . . .Laserdisc mono/SAP/stereo 095 . . . . . . . . . . . . . . .PIP swap
7 . . . . . . . . . . . . . . . . .VTR2 024 . . . . . . . . . . . . . . .Picture up 096 . . . . . . . . . . . . . . .Guide
11 . . . . . . . . . . . . . . . .VTR3 025 . . . . . . . . . . . . . . .Picture down 097 . . . . . . . . . . . . . . .Video setup
12 . . . . . . . . . . . . . . . .Surround sound 026 . . . . . . . . . . . . . . .Colour up 098 . . . . . . . . . . . . . . .Audio setup
processor 027 . . . . . . . . . . . . . . .Colour down 099 . . . . . . . . . . . . . . .Exit setup
16 . . . . . . . . . . . . . . . .Cassette deck, tuner 030 . . . . . . . . . . . . . . .Brightness up 107 . . . . . . . . . . . . . . .Auto program
17 . . . . . . . . . . . . . . . .CD Player 031 . . . . . . . . . . . . . . .Brightness down 112 . . . . . . . . . . . . . . .Treble up
18 . . . . . . . . . . . . . . . .Equaliser 032 . . . . . . . . . . . . . . .Hue up 113 . . . . . . . . . . . . . . .Treble down
164 . . . . . . . . . . . . . . .TV digital effects 033 . . . . . . . . . . . . . . .Hue down 114 . . . . . . . . . . . . . . .Bass up
(8 bit device code) 034 . . . . . . . . . . . . . . .Sharpness up 115 . . . . . . . . . . . . . . .Bass down
035 . . . . . . . . . . . . . . .Sharpness down 116 . . . . . . . . . . . . . . .+ key
keycodes: 036 . . . . . . . . . . . . . . .Select TV tuner 117 . . . . . . . . . . . . . . .– key
code key Function 038 . . . . . . . . . . . . . . .Balance left 120 . . . . . . . . . . . . . . .Add channel
000 . . . . . . . . . . . . . . .1 button 039 . . . . . . . . . . . . . . .Balance right 121 . . . . . . . . . . . . . . .Delete channel
001 . . . . . . . . . . . . . . .2 button 041 . . . . . . . . . . . . . . .Surround on/off 125 . . . . . . . . . . . . . . .Trinitone on/off
002 . . . . . . . . . . . . . . .3 button 042 . . . . . . . . . . . . . . .Aux/Ant 127 . . . . . . . . . . . . . . .Displays a red RtestS
003 . . . . . . . . . . . . . . .4 button 047 . . . . . . . . . . . . . . .Power off on the screen
004 . . . . . . . . . . . . . . .5 button 048 . . . . . . . . . . . . . . .Time display
005 . . . . . . . . . . . . . . .6 button 054 . . . . . . . . . . . . . . .Sleep timer
006 . . . . . . . . . . . . . . .7 button 058 . . . . . . . . . . . . . . .Channel display
007 . . . . . . . . . . . . . . .8 button 059 . . . . . . . . . . . . . . .Channel jump
RECS80 Code
this time period will be represented by a burst of carrier fre-
quency. If configured to flash mode the IR transmitter will be
flashed on at this time. A ‘0’ has a space of 5.06 ms while a
‘1’ has a space of 7.60 ms (derived from a 455 kHz resonator in
the remote control transmitter). Although the length of the
data packet is dependent on the commands sent, the time
between two messages is fixed at 121 ms. The modulation fre-
quency is 38 kHz.
Transmitter:
SAA3004, SAA3007 and SAA3008 (Philips)
M3004, M3005, M3006 (ST Microelectronics)
Internet Links
Nec Format:
[Link]
Philips semiconductor:
[Link]
[Link]/pip/SAA3049AP
Motorola Home-Page:
Next month: [Link]
Motorola-Format:
– NEC [Link]
– DENON
Samsung Home-Page:
– MOTOROLA
– JAPAN [Link]
– SAMSUNG /Microcontroller/product_guide.html
– DAEWOO
IR Remote Control
Codes (2)
Part 2
By A.N. Other
121ms
start bit toggle address (bit 2 … bit 0) command (bit 5 … bit 0) stop bit
140.8us
"0" "1"
010023 - 20
5.06ms 7.6ms
Figure 5. RECS80 code at the output of the TFMS5360 receiver IC. Figure 6. RECS80 code message format
Denon Code
the second time 65 ms after the first. During the second time
the command field bits are inverted. The receiver will only
accept commands when the second message is identical to
the first after the command field bits are inverted. The address
field is always sent uninverted. Bit 16 is a stop bit.
The modulation frequency is 32 kHz and the bit coding is: 275us
"0" "1"
To reduce the effects of interference the message is sent twice, Figure 8. Denon code message format
NEC Code
The NEC code operates with a carrier frequency of 38 kHz and 0: 0.56 ms Pulse, 0.565 ms space
uses pulse position modulation (PPM). Transmission begins A new message is sent 108 ms after the start of the preced-
with a 9 ms long start bit, followed by a 4.5 ms space. The ing message. A special current saving feature is implemented
message information is contained in the following 32 bits if a key is held down on the controller. In this case the mes-
which consists of a 16 bit manufacturer field and a 16 bit com- sage consists of a 9 ms start bit followed by a 2.25 ms space
mand field. The 8 bit wide data is sent twice, the second time and a 0.56 ms pulse.
inverted. A complete message is 67.5 ms long. Each bit is sent Sanyo supply ICs that generate codes using this format but
using the following format: have a 13 bit manufacturers code.
1: 0.56 ms Pulse, 1.69 ms space
67.5ms
108ms 108ms
Bit 0 Bit 7
9ms 4.5ms manufacturer code manufacturer code data code data code
27ms 27ms
0.56ms
"0" "1"
010023 - 18
1.125ms 2.25ms
Figure 9. NEC code at the output of the TFMS5360 receiver IC Figure 10. NEC code message format
Motorola Code
the controller will cause three messages to be transmitted.
Each message consists of a pre-bit, a pre-bit-pause, a start-
bit and nine data bits. The pre-bit and the start-bit are always
a logical 1. The pre-bit is used by the receiver to set the AGC
gain level of the IR receiver.
Japanese Code
Similar to the way in which the RC5 code has been standard-
ised in Europe, the Japanese Association for Electric Home
Appliances has produced a standard for IR control. This sys-
tem is called (uninspiringly) the ‘recommended standard for 47.7...64.6ms 42.2ms
SAMSUNG Code
The Samsung code consists of a start bit followed by a 12 Bit 60ms
manufacturers code and an 8 bit command code. The message
is always sent a minimum of twice.
A digital zero is represented by a ‘1‘ of 0.56 ms followed by
a ‘0‘ of 0.56 ms. A digital one is represented by a ‘1‘ of 0.56 ms
4.5ms 4.5ms
followed by a ‘0‘ of 1.69 ms. A continuous key press will cause start bit manufacturer code (bit 0 … bit 11) command (bit 0 … bit 7) stop bit
the message to be repeated every 60 mS. The carrier fre-
0.56ms
quency used for this code is 38 kHz. "0" "1"
1.125ms 2.25ms
system. A microcontroller is generally used to generate the
code e.g. the data sheet of the KS51840 from Samsung gives
an application for remote control use. Figure 14. Samsung code message format.
Daewoo Code
60ms
0.55ms
"0" "1"
010023 - 26
1ms 2ms
Figure 15. Daewoo code at the output of the TFMS5360 Figure 16. Daewoo code message format.
receiver IC
A digital zero is represented by a ‘1‘ of 0.55 ms followed by a ‘0‘ 38 kHz. A 4 ms space separates the address field from the
of 0.45 ms. A digital one is represented by a ‘1‘ of 0.55 ms fol- command field.
lowed by a ‘0‘ of 1.45 ms. This uses a carrier frequency of (010023-2)