Reverse engineering a LED strip RF remote controller

LEDs are an irresistible attraction for me. Even more LED strips. But, oh, addressable RGB LED strips! I own more than I will ever use for sure and I’m still buying them on occasion. Some of them came with a remote and a receiver capable of whatever color effect. We are talking of WS2812B LED strips of course, that can individually light every LED. Not really new anymore but still gorgeous.

A couple of the strips and receivers stayed silent in a drawer for a year or so. Then one day I realized I never investigated what was actually driving the show. The receiver is a small (31x12mm) board wrapped in heat shrink tubing. The label says RF remote control. Wow! Never noticed it was not a common infrared remote. I was fooled by the remote sporting a red LED in the place you would expect the IR led instead. Obviously to repurpose existing cases, since the light is definitely hard to see while pressing the buttons. But you can’t be too picky on a $3.19 remote and receiver set, can you? I was expecting some goo covered COB and nothing else inside. After cutting the tubing I was surprised to see two 8 pins SOIC chips instead. After much cleaning with some alcohol I could even spot some letters on one of them: IAP15W105. Thanks God not another infinite hunt for identifying an anonymous IC. But still something totally unknown, not the ATTiny I hoped for. My knowledge outside of the Atmel world is a bit shaky, so I can’t really tell you why I didn’t desist after reading that. Nevertheless after a quick search it resulted to be one of the apparently infinite enhanced 8051 implementations. It is produced by STCMicro which has many different web sites. Even an ignorant like me knows a thing or two on this famous 8 bit processor. I decided that it was worth it to step outside of my usual path and study something new. But I was sure I was bound to fail since every platform has its requirements in terms of hardware tools you need to actually put your programs on the physical devices. After finding the company’s web site and going crazy with chinese ideograms for half an hour, I downloaded a 12MB datasheet which describes an entire family of processors in a whopping 953 pages, luckily in “english”. Second surprise here: you actually need no programmer at all. According to the following schematic wich I took from the datasheet, you only need an USB to UART adapter, something I have really plenty of. Don’t be fooled by the complexity of  the diagram: everything is purely optional, you just need the adapter and some way to attach TX and RX to the MCU.

STC15Programming

Attaching the SOIC8 adapter to the chip was a bit tricky but the STC-ISP program I downloaded from the same site recognized the chip instantly. I never had such a luck not even with an Arduino board. The program itself is a strange beast. It tries to do everything, not only programming the chips. It’s a repository of examples, datasheets, code generator, assembly language help, you name it.

Before attempting the official tool I gave a try to the promising STCGAL open source flash tool. I never managed to program my device with it but the project was full of interesting information anyway.

As always I had to alternate between googling, experimenting and studying some theory. Luck stroke me once more here. The Keil IDE actually supports 8051 MCUs and I had already installed it when I started working on the bike locks. So I wrote a simple blinky program and programmed the tiny board. It worked. Sort of: no LED was actually blinking but I could check the pin level going up and down with my oscilloscope.

Obviously my next goal was actually driving the LED strip, something that took me quite some effort. The WS2812B has strict timing requirement, a well known fact in the community, something not so easy to accomplish. After that the obvious next step was actually receiving the RF remote commands. I can’t say that was easy, but with some more help from my oscilloscope some messy code did manage to get the desired results.

You might think I solved all my problems here, and I would be really glad to end this post at this point. Sadly putting the LED driving code with the RF remote receiving together was a huge pain. The small CPU even when pushed to its limits (35MHz clock) isn’t really very powerful. So receiving a remote button press while driving the WS2812 requires some careful planning. By this time I had abandoned the bulky Keil IDE in favor of SDCC, a simple command line compiler that supports 8051s – and is open source.

Well in the end my firmware does some pretty good things. You can even switch to a different remote through a learning functionality (the original firmware can do that too). Is it better than the original? Definitely not. It seems a bit less reliable and I never had the patience to 358 effects as the original firmware does. Should I call it a failure? Definitely not! Apart from the fact that I learned tons of new stuff, I now have total control of a small platform that might be really useful in the future. I would still like to design a blinking hula hoop, something I tried to do in the past with far from optimal results: with a width of only 12mm this thing is really perfect.

Messy, poorly documented and unfinished, here is the source code.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Create a free website or blog at WordPress.com.

Up ↑

%d bloggers like this: