Introduction: Reverse Engineering Ritter 8341C Protocol for ESP3866

By
About: Just a father, who (tries to) create things in his free time.

Hi @all.

For my own small home automation I use primary 433 MHz controlled sockets. I own 3 sets with DIP switches to adjust the adress. These were working fine. But some time (one or two years) ago, i purchased a set of sockets from "ritter". I didn't read the description before, and after unpacking I realized, than there were no DIP switches and also the rcswitch libary for ESP didn't "speak" the correct protocol. So I used them only with the remote control.

Now, in my vacation, I startet to change this... an here I want to document this project. I hope, it will help somebody else with the same or a similar problem.

Step 1: Record Signals

To record the signals I connected a 433 MHz receiver module to an ESP8266 (only a power supply shoulb be ok) and hooked my Hantek 6022 oscilloscope to the data pin.

Then I pressed the button on the remote an recorded the signal train.

Step 2: Pulse/Delay Measurement

After recording the signal, I searched for start and end of one burst. Normally a socket remote control sends 3 times the same burst or sometimes, as long the button is pressed.

Now, I measured the pulse/delay-times and wrote it down. This I repeated for all six signal-trains (3 x on + 3 x off).

Step 3: Compare Signals for Socket 1,2,3 and Find the Difference

After some measurements, I compared the HIGH's and LOW's + signal durations. The changes were the different commands. The other signals were something like protocol-/manufacturer-codes. Also every burst had an start- and end-sequence.

The signal consists of "START + NOT CHANGING SEQUENCE + ON/OFF COMMAND + DEVICE ADDRESS + END"

Step 4: Write Code for Testing

After a while I had all the (theoretical) information I needed. So I created a short test-sketch for an ESP8266 and a 433 MHz sender. In loop all three socket are switchin on/off with an delay between the commands.

Step 5: Test the Code With a Basic Sender

I connected a battery to the ESP an went in the living room. 5 of 6 commands were working, and after fixing a writing mistake in a command sequence, all codes were working.

Fine, now I can switch all 12 rc-sockets (9 with a DIP adress + the 3 new ritter ones) with my ESP8266 RC Controller.

You can find demo-code on GitHub