Nexa 433MHz RF-light switch protocol reverse engineered

nexa_lights_protocol.md

Nexa RF switch protocol reverse-engineered

I connected a 433MHz receiver directly to computer microphone port and powered it on (aka poor man's oscilloscope). Then I used Audacity to record at 48kHz the raw signal coming in and pressed the different buttons on the remote.

A sample of what a single broadcast looks like:

RF protocol

Resolution 48000 Hz - 1 sample is 20.83us

form	samples	duration	symbol
Up	16	333us	U
Short down	10	208us	-
Long down	58	1208us	D

Words?

Start

 U      D      D
 _
| |_________________

"Zero" bit

 U   U    D
 _   _
| |_| |_______

"One" bit

 U    D    U
 _         _
| |_______| |_

End

 U
 _
| |

Light 1 on

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UDU UUD UUD UUD UUD U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   1   0   0   0   0

Light 2 on

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UDU UUD UUD UUD UDU U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   1   0   0   0   1

Light 3 on

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UDU UUD UUD UDU UUD U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   1   0   0   1   0

Light 2 off

UDD UUD UUD UDU UUD UDU UUD UUD UDU UDU UUD UUD UUD UDU UDU UUD UDU UUD UUD UUD UUD UDU UDU UDU UDU UDU UUD UUD UUD UUD UUD UUD UDU U
 S   0   0   1   0   1   0   0   1   1   0   0   0   1   1   0   1   0   0   0   0   1   1   1   1   1   0   0   0   0   0   0   1

Side by side

                                                              on/off   channel
L1 on   0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 1  0 0 0 0
L2 on   0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 1  0 0 0 1
L3 on   0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 1  0 0 1 0
L2 off  0 0 1 0  1 0 0 1  1 0 0 0  1 1 0 1  0 0 0 0  1 1 1 1  1 0 0 0  0 0 0 1

Protocol

• Each press of a button transmits four times the same message
• Each message starts with the start sequence and then has 8 * 4 bits payload, followed by a single end sequence
• 6 * 4 bits header
• 4 bits on/off command (1001 on, 1000 off)
• 4 bits channel designation
• There's a 10ms break between messages
• One message is about 71ms long

Helpful resources

• https://hblok.net/blog/posts/2012/09/02/home-automation-on-433-92-mhz-with-arduino/
• http://rayshobby.net/interface-with-remote-power-sockets-final-version/
• https://deeplyembedded.wordpress.com/2016/12/24/sniff-433-mhz-radio-packets-using-sound-card/