Arduino & Sony Ericsson: Gsm Shield Hack

Hi! A while ago I wanted to remotely access my arduino to control the I/O pins, I really liked the arduino GSM shield because it would allow me to control my arduino from anywhere in the world. However such a shield does unfortunately not come cheap. I found some guides on the internet on how to send an sms with an arduino and a sony ericsson phone but i couldn't find one to read an incoming sms and that's exactly what i wanted. That way i would be able to control my arduino and its I/O pins from anywhere in the world! It took me some time but i figured out a way! And the best part: an old sony ericsson doesn't cost near that much as an expensive GSM shield! I even found one just laying around at home! It is however a bit more complicated but if you follow my steps bellow you should be fine ;-) Let's get started!

Step 1: How It Works

Oke obviously the arduino and the cellphone will need to communicate that's why we'll put the phone in PDU mode in the setup of the program. PDU is relative easy way to communicate with an older sony ericsson cellphone (see supported models in the next step). In PDU mode, all SMS messages are represented as binary strings encoded in hexadecimal characters like 31020B911326880736F40000A900. This may sound scary but relax it isn't! Such a binary string has lots of info in it but we only want to know two things:

the message sender (phone number): this way not everyone can control your arduino!
the message itself

Imagine you've got this long PDU coded sms message of 90 characters. If you know (and you know, i figured it out for you) where to find the phone number and message in that string you can get them out! Let's say the phone number is 0478368477 and the message 0BC8329BFD06DDDF723619 (=Hello World). The code will work like this:

extracting information from string

if(number = "0478368477"){

if(message = "0BC8329BFD06DDDF723619"){

//an action

}

if the number extracted from the PDU coded sms message equals the preprogrammed number and the message says hello world in PDU code, an action will be performed. An action being whatever you want ;-)

Step 2: Get a Suitable Cellphone!

Unfortunately the hack does not work with every sony ericsson. I did some research and found a list with models that should be compatible:

F series: F500, F500i

P series: P800, P802, P900, P908

S series: S700, S700i

R series: R520, R520m, R520mc, R600, R600s, R600sc

T series : T39, T39m, T39mc, T62u, T65s, T66, T68, T68i, T68m, T68mc, T68ie, T100, T102, T105, T106, T200, T202, T226, T226s,T230, T238, T250, T300, T302, T306, T310, T312, T316, T600, T610, T616, T628, T630, T650i

K series: K300, K300i, K310, K320i, K500, K510i , K530, K700, K700i, K750i

Reported not to work: K550i

W Series: W200, W300, W550, W580, W600, W610, W660, W700, W710, W800, W810, W830, W850, W880, W900, W910

Z Series: Z200, Z250, Z310, Z320, Z500, Z520, Z525, Z530, Z550, Z558, Z600, Z608, Z610, Z710, Z750, Z800, Z1010

You're probably wondering why exactly these models, well they all support something called PDU to communicate and have the right connectors to work easy with arduino (See pictures). This hack may work with other cellphone's who have PDU mode and serial data communication you'll just have to try it out. You'll also need a external power supply for your arduino to complete this instructable! The phone connected to your arduino should also have a sim card, you can't receive a sms without a sim card.. ;-)

Update: I've seen some stuff about pdu on older nokia phones on the internet, you can give it a try if you have one but i can't make any promises. Good luck!

Step 3: Prepare Your Arduino

Because the serial buffer of the arduino has a 64 byte limit and a sms in PDU mode is a larger we'll need to increase the size of the serial buffer. The procedure bellow will ad an extra arduino in your arduino software with a larger buffersize.

The solution is to create a complete copy of the arduino core code (it's really not that big and disk space is cheap), modify the buffer size in the new core code and then to create a new board which is listed in the Arduino IDE which uses this new core directory. The steps to follow are as follows..

The whole of the Arduino core code is located in a directory similar to

C:\Program Files\arduino-1.0.5\hardware\arduino\cores\arduino Make a complete copy of this directory and save it to

C:\Program Files\arduino-1.0.5\hardware\arduino\cores\arduino_256_serialbuf The hard coded buffer size is stored in a file called HardwareSerial.cpp

Here is the standard definition located near the top of the file

#define SERIAL_BUFFER_SIZE 64 Edit the HardwareSerial.cpp file in the new directory and modify the buffer size

#define SERIAL_BUFFER_SIZE 256 Now we need to add an option to the boards.txt file to use this new directory. The boards.txt file should be in a directory similar to

C:\Program Files\arduino-1.0.5\hardware\arduino Below is part of the boards.txt file. The first section is for the standard Arduino Uno. You need to add a section below it which will display in the Arduino IDE as Arduino Uno (256 Serial Buffer). You can see the core directory is referenced to our new directory with the modified file (uno256.build.core=arduino_256_serialbuf)

##############################################################

uno.name=Arduino Uno uno.upload.protocol=arduino uno.upload.maximum_size=32256 uno.upload.speed=115200 uno.bootloader.low_fuses=0xff uno.bootloader.high_fuses=0xde uno.bootloader.extended_fuses=0x05 uno.bootloader.path=optiboot uno.bootloader.file=optiboot_atmega328.hex uno.bootloader.unlock_bits=0x3F uno.bootloader.lock_bits=0x0F uno.build.mcu=atmega328p uno.build.f_cpu=16000000L uno.build.core=arduino uno.build.variant=standard

##############################################################

uno256.name=Arduino Uno (256 Serial Buffer) uno256.upload.protocol=arduino uno256.upload.maximum_size=32256 uno256.upload.speed=115200 uno256.bootloader.low_fuses=0xff uno256.bootloader.high_fuses=0xde uno256.bootloader.extended_fuses=0x05 uno256.bootloader.path=optiboot uno256.bootloader.file=optiboot_atmega328.hex uno256.bootloader.unlock_bits=0x3F uno256.bootloader.lock_bits=0x0F uno256.build.mcu=atmega328p uno256.build.f_cpu=16000000L uno256.build.core=arduino_256_serialbuf uno256.build.variant=standard

##############################################################

That's all you need to do. Now when you want a larger serial buffer (for a specific board) you just choose this as the board in the Arduino IDE and compile as normal. If you want to hack any other settings in the Arduino core, this is also an excellent way to do it without modifying the original source.

Step 4: Determine the Right Terminals and Connect Them!

The first picture above represents the contacts on your sony ericsson, each of them has a specific function:

ATMS: audio to mobile
AFMS/RTS: audio from mobile
CTS/ONREQ: CTS/Mobile station on request.
data in: data to mobile (Rx) (Tx for K300i)
data out: data from mobile (Tx) (Rx for K300i)
ACC in: Accessory control to mobile
ACC out: Accessory control from mobile
AGND: audio signal ground flash: flash memory voltage + service
flash: flash memory voltage + service
DGND: digital ground
VCC: for battery charging + External accessory powering

We are interested in 3 contacts (four if you want to charge the cell of your arduino using the 5V terminal) the numbers 4, 5, 10 and the optional 11. I suggest you get a data cable. I didn't have one but i found on amazon.

if you want to use the 5V terminal of the arduino to power your phone so the battery doesn't get empty you'll need to determine how much voltage your phone requires to charge (look it up of check out the charger) and dial the 5V of you're arduino down using a voltage divider if necessary.

For the people with a data cable: there is a small chip in the usb end of the cable that prevents us from communicating with the phone so you'll have to cut the cable! If you cut is you'll see four cables inside: white, black, green and red. Strip the cables and use a multimeter to determine which one is the data in, the data out, the ground and the Vcc using the first picture above. Then connect the ground wire to the ground of the arduino, the data out wire to the Rx of the arduino, the data in wire to the Tx of the arduino and you're good to go.

Step 5: Do a Test!

If you load the code below to you're arduino it should dial to 1234 as in the picture above if not check if you didn't make any mistakes in previous steps. You can't load anything to the arduino wiht the Tx and Rx of the board connected to the phone, you'll get an out of sync error. You'll need to disconnect the Tx and Rx connections from your arduino, load the code, reconnect the wires, unhook the arduino from your PC, connect another power supply (you'll need another power supply for your arduino the USB port interferes with the communication to the phone) and reset the arduino. Your phone should start dialing 1234 after a few seconds.

The code:

void setup(){
Serial.begin(9600);

Serial.println("AT+CMGF=0"); //puts the phone in pdu mode

delay(3000); //processing time

Serial.println("ATD1234;+ENTER");

}

void loop(){

}

Think about it: you could enter your number and let the phone dial you if a sensor is activated by example! A temperature sensor, a movement sensor, a water sensor... You name it!

Step 6: Get to Know an Online PDU Encoder

Again this may sound a bit scary and complicated but trust me, it is fairly easy. I Have been using:

http://www.twit88.com/home/utility/sms-pdu-encode-...

The encoder allows you to see how your number looks like in PDU (the numbers get mixed up) and how a message looks like in PDU. Lets start, we'll be using the second part of the page on the link above.

Fill in 0 in the SMSC area (we don't need this)
Fill in the number of the cellphone you'll be using to send a message to the sonny ericsson connected to the arduino in the receiver area, we'll use that number to prevent anyone else from accessing your arduino. Don't forget to set your country code in front of your number.
Set the Alphabet Size on 7 if it isn't already
Lets start with filling in Hello world
Press convert

I Filled in +32123456789 as receiver (+32, that's right i'm from belgium) and the result was:

0011000B912321436587F90000AA0BC8329BFD06DDDF723619

Notice can't find the number you filled in as receiver in the PDU string but... This part of the string: 2321436587F9 happens to have all the numbers but just mixed up.. It's not a happy accident trust me, find the part of the string that "matches" your number and write it down, the first two numbers (2 & 3 in my case) represent the country code you can leave them away, we won't need them (that leaves 21436587F9 in my case). We'll be using this in step7.

Now we already have the first part of the information we wanted (the number) but we of course also want the message part. I can now already tell you that 0BC8329BFD06DDDF723619. Finding out what your message part is is easy. Just fill something else in where you earlier filled in Hello world en see what part that changes. I want to control some relays so let's fill in light on and light off, you'll see the part at the end of the PDU string change, the part that changes is your message part! Result for light on: 08CCF4194D07BDDD. Result for light of: 09CCF4194D07BDCD66. You'll see that the message part is right behind the double A' in my case. You can use this method to translate anything you want to PDU and use it later in your program.

Step 7: Get to Know the Program

The encoder in step 6 is great but a real sms message in PDU code looks different, it's allot longer but the message part en the number part is the same and that's what we really need after all. A real message in PDU looks like this:

07912374151616F6040B912321436587F90000414080818403800BC8329BFD06DDDF723619

notice the underlined parts in the PDU string the first part is the number determined earlier and the second part is the message saying Hello world. The program will simply get those parts out using the substring command.

For the program to work you'll need to fill in your number (the one you should have wrote down in step 6) where the X's are (see picture above). The program works in a way the arduino will only listen if the message comes of the number you fill in where the X's are.

In the first picture above you'll see a part if(data= "+CMGR: 1,") if this occurs it means a message is being read for a second time (+CMGR: 0, means unread message) and because we delete every message after an action has been performed (see picture 2) it means an useless message has been sent. For example Liht on instead of Light on.

Download the program over here: download from dropbox (arduino - sonny ericsson gsm shield hack)

Step 8: Do Something Cool

is just a test setup i quickly put together and a you can see it works without a problem (I know I have bad filming skills).

I'm planning on building a contact box using these relays, I chose the 12V relays so i can feed them of the Vin of the arduino (I've got a 12V powersupply) and use the 5V for charging the phone so the battery never gets empty.

Step 9: Help! It Doesn't Work!

Oke let's do some troubleshooting, I'll discuss some possible problems.

Scenario 1: the phone doesn't even test dial in step 5

make sure you got the right connection, measuring them out with a multimeter is really handy! Make sure your phone supports PDU, search the internet for the pinout of the connectors of your phone and look for a possible fault. Are you using an external power supply? Feeding the arduino of a PC with usb will disturb the communication between the sony ericsson and the arduino.

Scenario 2: the phone succeeded the test dial in step 5 but doesn't work with final program.

Make sure you filled in you're PDU converted number in the program (in place of the X's). Did you disconnect the phone of the arduino for uploading the program? Did you make sure there weren't anny spaces behing your message part in the PDU encoder (step 6)? Did you send the message with the right phone? (the arduino will only listen to the preprogrammed PDU encoded number) Did you use the arduino with enlarged serial buffer (step3)?

Scenario 3: the phone succeeded the test dial in step 5, i'm sure I've done everything right and is still doesn't work.

I've wrote a little program to read a PDU string using a lcd screen (the phone is using you're serial communication) so you can read the PDU string yourself. Check if the substring commands don't need any changes for extracting the information. In my country the number is located from char 24 to 34 in the PDU string (=substring(24,34)). Maybe it's located somewhere else for your country. Do the same for the message part. notice I've been using a lcd screen with a I2C bus if you don't have any you'll need the modify the code lightly. I must say i highly doubt this problem occurring but i wanted to be complete and sure so I included it.

download the program for reading a PDU string with a lcd screen here: download from dropbox (read serial with I2C lcd)

Step 10: Some Thoughts

By this step you should be able to let an old sony ericsson cellphone read an sms, and let the phone call you using the ATD command of step 5. Participating in the remote control contest so if you like my instructable please give me a vote, I'd really appreciate it . Like I said before I'm from belgium so if made some huge writing errors let me know ;-)

I've been using the sony ericsson as a GSM-shield for weeks, sometimes I've let it run for a week and I've never had any problems. In my opinion it seems to be a good substitute for an expensive GSM-shield.

If you want you can access every function in your phone using the AT commands, it's great but it takes some getting used to. You'll need to do some research on internet though. Remember you cant use the serial connection to your computer and to your phone at the same time, is used a small lcd screen to display the serial communication between the arduino and the phone. Good luck!