Reverse Engineering the 433MHz Cixi Yidong Electronics protocol

The 40 bits Cixi Yidong Electronics protocol is used by remote control switches sold here in Finland, and perhaps in many other countries under different brands (AXXEL, Telco, EVOLOGY, CONECTO, mumbi, Manax etc.).
A main reason I wanted to learn the protocol of this switches, to control them using ESP8266 based board with an RF transmitter, running MQTT gateway software OpenMQTTGateway and my Node-red based home automation solution.
The advantage of these switches, compared to WiFi controlled remote switches, that they are available with IP44 housing, which makes it good to use outdoor (e.g. to heat the car), the other reason to use them, that I had few of those at home already.

Unfortunately the rc-switch library, used by the OpenMQTTGateway, did not include the support for the protocol of the Cixi Yidong Electronics switches, so i needed to reverse engineer it and code it. I turned on my oscilloscope, and started to study the captured data. I also forked the rc-switch library, and extended with the support of the protocol.
Here is the result:

The Cixi Yidong Electronics protocol is a bit “tricky”:

  • It sends special sync pattern.
  • the 40 bits message has the 16+16+8 bits pattern
    where the first 16 bits is the remote ID, the next 16 is the inverse of the first 16 bits, the last 8 bits is the button and command (ON/OFF) ID.
  • Seems so that button/command odd numbers means ON,
    the inverse of that is OFF for the same button (enough to learn by the switch only the ON or OFF)
  • The value 0b10100101/0xA5/165 means all ON, value 0b01011010/0X5A/90 means all OFF, assigned to the same remote ID.

Share