4
\$\begingroup\$

I have a remote for a sound system sub woofer (a quite expensive, set I would say) with 16 buttons and half of them suddenly stopped working. A broken remote is not usually the end all, but the people who made the thing thought it would be a good idea to not have physical buttons on the thing. Now I can not turn on the subwoofer beacause the power button is one of the buttons that stopped working.

I opened the remote. I could not find anything wrong with it, no broken traces. It might be the IC failing, but I could not find a replacement IC also that is accessable to me. I found the IC datasheet SICORE CX6121-001, but it is in Chinese. It looks like it follows standard IR remote controls patterns. This is where I need you help, as you might be familiar with it.

Each transmission seems to look like this: A 9ms HIGH followed by a 4.5ms LOW, 8bit control(?) , 8 bit iverted control, 8bit data, 8 bit data inverted. In pulse position modulation (PPM) format. Am I correct?

enter image description here

The frequency is 38kHz

enter image description here

There are 32 combinations of data listed on page 6-7. Not bad it will be easy to remap all 16 buttons on the new DIY remote.

The one thing I could not find, though, is the C- bits (control.) I could not find any mention of it. Am I missing something here?

UPDATE:

I was able to borrow a logic analyzer and so far everything lines up to what you have all said. Spot on 9ms followed by 4.5ms

enter image description here

@Polynomial is also spot on the frequency

enter image description here

I have attempted to decode the command, correct me if im wrong C- bits is 1000 0000 and the data for this one is 0010 0000.

enter image description here

\$\endgroup\$
2
  • 1
    \$\begingroup\$ C-bits might probably be a user code, it is a unique combination of bits that the receiver will only listen to. This is used so that the remote will only control that specific receiver and not other devices eg a second identical subwoofer system. Just a theory though. In order to get this you can either brute force all 255 combinations and see which works or probe the remote with the remaining working buttons and decode the PPM \$\endgroup\$ Commented Feb 12, 2023 at 15:15
  • \$\begingroup\$ what make and model is the sound system? ... there may be info about the IR protocol available on the internet \$\endgroup\$ Commented Feb 12, 2023 at 17:35

2 Answers 2

Reset to default
6
\$\begingroup\$

That remote is using the NEC protocol, a standard used for decades now.

The C bits are the "device code", i.e. the code your device receives and other devices don't. The other bits are the button code.

You can simply try sending button codes with Arduino, and you can figure out the device and button codes from the working buttons, with Arduino as receiver, or oscilloscope, or logic analyzer.

\$\endgroup\$
3
  • \$\begingroup\$ It was able to borrow a logic analyzer which worked great, Do you know any great guides for decoding the device code? with that i have everything i need to replicate the signal. So far what im understanding long intervals between pulses is a 1 and short interval is a 0 \$\endgroup\$ Commented Feb 12, 2023 at 19:15
  • \$\begingroup\$ What great guides you need? You have the data pulses, you know how to decode them, and the logic diagram looks correct. It's really that simple. \$\endgroup\$ Commented Feb 12, 2023 at 20:53
  • \$\begingroup\$ Note that there is a pretty comprehensive library for sending infrared codes for Arduino. \$\endgroup\$ Commented Feb 13, 2023 at 11:28
6
\$\begingroup\$

If you download the PDF (direct link) you can put it through a translation service.

Encoding method. A frame code transmitted by CX6121 contains a pilot code, 16-bit user code and 8-bit key data code. The one's complement of the key data code is also transmitted at the same time. The following figure shows the structure of this frame code. (The figure shows a boot code pulse followed by the lower 8-bit user code, high 8-bit user code, 8-bit key data code, and inverse code of 8-bit key data code.) The pilot code consists of a 9ms carrier waveform and a 4.5ms off time, which serves as a pilot for subsequent codes. In this way, when the receiving system is composed of a microprocessor, it can more effectively deal with the timing relationship between code reception and detection and other various controls. Encoding adopts pulse position modulation (PPM). The time interval between pulses is used to distinguish between 0 and 1. Every time 8-bit codes are transmitted, their inverse codes are also transmitted to greatly reduce the bit error rate of the system.

I'm going from a machine translation here, but it looks like each message consists of an initial sync pulse followed by a 16-bit user code (8-bit low, 8-bit high), then an 8-bit key code followed by its inverse.

The 8-bit key code tells you what key was pressed. There are 32 possible single-key codes. The button presses are scanned as a 4x8 key matrix, which is specified in figure 2.

The table on page 6 tells you what key codes you get for each pressed key. The D7 bit is either 0 or 1 depending on whether the SEL pin is pulled low or high. This allows you to have 64 codes instead of 32 by toggling SEL to high or low.

The keys on the KI/O5 line support double-press, i.e. you can press K21 along with one of K22, K23, or K24 at the same time and you'll get a special key code that represents the double-press. Table 4 shows what these values are, in the same format as the single-key press table on page 6. Again the SEL pin allows you to double up, so you get 6 possible codes instead of 3 for the double key values.

The 16-bit user code is partially set by ROM and partially set by 100k pullup resistors on the KI/O0 to KI/O7 pins. The datasheet doesn't specify whether the user-settable portion goes in the high or low half of the code. The part comes in two variants: CX6121-001, which has its ROM zeroed, and CX6121-002, which has a factory-customised ROM value.

The encoding is PPM at a 455kHz nominal clock rate. The sync pulse consists of 9ms of carrier (the clock divided by 12) followed by 4.5ms of low signal. A bit value of 0 is transmitted as 0.56ms of carrier followed by 0.56ms of low, totalling 1.125ms. A bit value of 1 is transmitted as 0.56ms of carrier followed by 1.69ms of low, totalling 2.25ms.

If you do the maths, 0.56ms corresponds to 256 clock pulses at 455kHz, so a 0 bit is essentially just "transmit the carrier for 256 clock cycles, then transmit low for 256 clock cycles". A bit value of 1 is then "transmit the carrier for 256 clock cycles, then transmit low for 768 clock cycles". The carrier itself is the clock divided by 12, so this ends up being about 21.25 carrier cycles being transmitted at the start of each bit.

Note: the timing diagram at the top of page 6 appears to be drawn incorrectly. As drawn, it looks like it's showing the high time for the pulse (8.77us) and then the time between the rising edge of one pulse and the falling edge of the next pulse, i.e. 26.3us. This would make sense, because 8.77us times 3 is 26.3us, but if you then calculate what the period is for a 36kHz clock it's also 26.3us. Since the pulse is drawn as having a longer low time than high, I can only presume that this is a mistake and there's actually a 33% duty cycle on the carrier, and one carrier cycle is actually 26.3us.

\$\endgroup\$
3
  • \$\begingroup\$ I have updated the post to include logic analyzer capture, and so far you are so spot on. All i need now is to decode the bits, then i can replicate them \$\endgroup\$ Commented Feb 12, 2023 at 19:11
  • \$\begingroup\$ @Polynomial I took the liberty to add the translated image to your answer, I think it makes it easier to follow. Even without PDF, images can be translated by clicking the camera symbol on images.google.com \$\endgroup\$ Commented Feb 13, 2023 at 8:51
  • \$\begingroup\$ @jpa Thanks. In future, though, please make sure that any images you post have alt-text so that people who use screen readers can access the content. I've added some for accessibility. \$\endgroup\$ Commented Feb 13, 2023 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.