Sometimes, we do reverse engineering for fun.                 

1.4 IR remote protocol for Silver Bullet helicopter from Brookstone.

  This IR  independently controls two DC motors, one direction w/PWM.  Not complicated, throttle, left-right, trim and it's it.nothing more.The same, we will not disassemble remote and look what is inside. Just will check what happens during IR transmission.

  IR transmission operates on 38 kHz sub-carrier, transmits only when  "throttle" (left handle) move up (a little). After releasing "throttle" (to '0'), it transmits codes 30 times and disables IR transmission. Interval between packages always ~145mS.

  If we stretch the code in time, for example when you released the throttle, we will see the following ('high level' - no carrier, 'low' -  38 kHz is ON). It shows width / period of pulses inside the package (burst).

  The coding of "zeros" and "ones", as before, is brilliant, because it is a simple. After the start pulse, any transition (Lo to Hi, and Hi to Lo) means the beginning of a next bit. If it is followed by a long pulse, then it is “1”, if pulse is short, then “0”. If so, then you will count, the same as for 'TurboHawk heli', 40 bits on the picture above.

  What the logic analyzer returns does not make much sense until you manually convert the pulses to zeros and ones.

  If you do this, then the encoding looks crystal clear (starts to make a sense:).
  The last byte is checksum (last 5 bits, only). I do not have time to determine the algorithm for its calculation (spent some time and gave up). If you can do this, please let me know. Thank you!


*** Any inaccuracies on this page will be corrected if you let me know (e-mail is highlighted :)  ***

12.12.2019 SKootS

Make a free website with Yola