Generic RF Tx for the HAH

Requires a CHIP upgrade to the 328 (all kits from the Shop now ship with this)

Historically, the RF handling in the HAH was limited to a single protocol type, chosen from those that were supported. This was an annoying limitation. Further, we held rather a lot of 'static' data on the micro to define the pattern of the bits that were sent.

We needed a generic approach to allow most any 433MHz RF device to be controlled. We might define a xAP message that completely specifies the format and characteristics of the RF stream that requires to be transmitted.

If we use a 'scope to see what the output from an RF transmitter looks like, we see something like this: 4300443364_a34023c2da_d.jpg

Notice that there are quite a few transitions in this 'burst' of data. A burst is typically associated with pressing a button on a transmitter device, or perhaps caused by walking in front of a PIR unit. This image shows a single burst. In practice, there will be multiple repeats of the same burst pattern with a carefully timed gap between each burst. It isn't unusual to see the same burst pattern repeated 10 (or more) times with the same 'inter burst gap' timing.

Now, look at the various pulses that makeup the bitstream. We define a 'pulse' as a 'hi', followed by a 'low'. A pulse always starts with a 'hi'. The duration of the high part of the pulse, together with the duration of the following low part of the pulse is the way that a single bit of information is encoded. Depending on the type of RF device, there might be a number of different pulse definitions.


Looking at the above image, we can see that there are three different patterns of pulses.

So, what do we need to be able to specify?

  • bitsperframe - A Frame is a PULSE sequence of HI/LO as defined by the pulsedef. Valid values 1,2,4
  • pulsedef - Hex string to define a HI/LO pulse definition. A Pulse requires two WORDS of information. These WORD's are the number of microseconds (uS) of HI followed by LO.
  • burstcount - Number of times to send the RF stream
  • interburstdelay - Delays between bursts in Microseconds (uS) Range: 0 - 2^24
  • frames - Number of frames, or pulse definitions, in the STREAM.
  • stream - RF Stream

GUI extended so up to 32 different RF devices can be controlled. This is an arbitrary maximum there is no limit but I figure it will do for now until somebody asks for more. The RF Delay allows multiple RF units to be controlled (in a single action) from the web GUI. It inserts a delay, default of 500 milliseconds, before issuing each command.

Sample 2-bit encoding

We are going to define a protocol that needs 2 bits of information to define the pulse type, which means there will be 4 pulse types available.

Bits per Frame is 02 the first byte of the pulse definition. Next define the size of each PULSE index

 AS HEX     IDX   HI     LO
0113,0A73 - (0) - 275us, 2675us
0113,0113 - (1) - 275us, 275us
0113,04C9 - (2) - 275us, 1225us
0113,0000 - (3) - 275us, 0


How many times to send the RF stream. Most transmitters send the stream at least six times per activation.


How long to wait between bursts (in this example, 10mS) Inter burst delay specified in microseconds (uS)


Number of frames or pulse definitions to send.


Encoding the RF bit stream
Bit stream to send as indexes into the pulse definition lookup table.

0 2 1 1 2 1 2 2 1 3

Encoded to binary.

     0  2  1  1 |  2  1  1  1 |  1  3
    00 10 01 01 | 10 01 10 10 | 01 11 -- --
HEX      25     |    9A       |  70

Note we don't care about the last 4 bits but we still must provide a valid byte definition. 7F, 74, 72 these would all be acceptable however if they are unused either F or 0 should be used.


Put it all together into an xAP message


HAH xAP control

First we build a header


and append one of two possible body syntaxes.


and a packed format. When packed the FIRST byte is a RF codec VERSION currently always 01.


RF Definition helper

May be downloaded and used off line too.

Decoded RF receivers

Sold by ADSA. Model number RCS-K09

The Transmitter uses this chip


There is a single button on the front to the unit. Training is started by pressing and holding this button for a few seconds. The red LED will flash slowly. Then, send an 'On' command - the LED will blink rapidly, then go out. Subsequent On/Off commands will now be honoured. A quick touch of the button turns the socket On/Off.

Note that the burstcount of 12 is required to be used when 'training' the socket (training sometimes takes a couple of attempts). Thereafter, a burstcount of 4 to 6 will give solid operation.

:!:Also note that whilst these units are relatively inexpensive, there is quite a nasty limitation on this type of device. If mains power is lost for more than about 30secs, the unit forgets its training and needs to be re-trained. :!:

Pulse definition

Encoding HI LO
0 300 887
1 887 300
stream Description
B956BF00 Unit ON
B956B700 Unit OFF

Up to 16 sockets can be supported by altering the hex digit '9' in the above sequence thru '0'..'9' and 'A' .. 'F'.

Devices tested include the HE109 and the HE302. The HE302 sockets are interesting in that they can be trained to respond to both the BBSB and the HE Advanced protocol. However, the HE109 twin sockets will only respond to this 'advanced' version of the protocol.

Re the message protocol itself. This always starts with a latch signal of 275uS hi and 2675uS low. Then a unique 'group code' which is 26bits long (each bit being two 'wire bits'). The last 4 bits are the device code … these can be altered to address upto 16 devices on the given group code.

HE302 HE109


Pulse definition

Encoding HI LO
0 275 2675
1 275 275
2 275 1225
3 275 0
stream Description
19A6599A59A59A6659A5A666599A65A5B0 Unit ON
19A6599A59A59A6659A5A6665999A5A5B0 Unit OFF

Fully packed string that is entered into the HAH UI (on the Automation/Configure Tab, RF section)

ON =  010201130A7301130113011304C9011300000C0127104219A6599A59A59A6659A5A666599A65A5B0
OFF = 010201130A7301130113011304C9011300000C0127104219A6599A59A59A6659A5A6665999A5A5B0 

Simply change the last hex digit to be in the range 0..9, A-F to address upto 16 devices.

Non-UK, European users might like to know that this Nexa RF socket has been successfully tested with the HAH.

HAH user kema01 supplied these as working with a HE109

off=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A659999999A40 on=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A65999A599A40

off=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A65999999A580 on=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A65999A59A580

off=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A65999999A640 on=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A65999A59A640

off=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A6599999A5980 on=010200FA09C400FA00FA00FA044C000000000A012710421999999999A65999A6599A65999A5A5980

Arduino code here and here (note that we've not actually used any of this code, just referred to the comments for info on the protocols used).

Devices tested include the HE206 (dimmable ceiling rose) and the HE307 (dimmable wall socket). The HE307 sockets have 'on' 'off' control and 15 distinct dim levels with an 'auto dim' function.


Pulse definition

Encoding HI LO
0 250 2500
1 250 250
2 250 1100
3 250 0

For simple ON/OFF control, the protocol itself is built up as follows:

A “0” Bit is sent as 250Hi 250Lo then 250Hi 1100Lo (i.e. two frames, 1 then 2 from above)

A “1” Bit is sent as 250Hi 1100Lo then 250Hi 250Lo (i.e. two frames, 2 then 1 from above)

The stream is made up of:

A latch signal to start – 250hi 2500lo = frame 0 from above

Then 26 group code bits – i.e 272946 or in binary 00000001000010101000110010

Which gives: 1,2,1,2,1,2,1,2,1,2,1,2,1,2,2,1,1,2,1,2,1,2,1,2,2,1,1,2,2,1,1,2,2,1,1,2,1,2,1,2,2,1,2,1,1,2,1,2,2,1,1,2 as frames, using 0 = 1,2 and 1 = 2,1 as shown above.

There is next a group ID bit, I set this to 0. i.e. 1,2 as frames (not sure what this is for!).

Then comes the on/off code bit. On = 1 which is 2,1 as frames, Off = 0 which is 1,2 as frames.

Next follows a four bit address code, I used 1010 or 2,1,1,2,2,1,1,2 as frames.(I assume you can change this for different devices)

Finally we send the latch signal again, frame 0

Add together and you get 33 bits or 66 frames in total.

If you use the RF helper to pack this up as follows:

Stream = 1999999A5999A5A5A599A659A59A65A580
PulseDef = 0200FA09C400FA00FA00FA044C00FA0000
Burst count  = 12
Interburst delay = 10000
Frames = 66

You should get: 010200FA09C400FA00FA00FA044C00FA00000C012710421999999A5999A5A5A599A659A59A65A580

For dimming, the protocol is altered as follows:

Change the on/off bit from either 2,1(on) or 1,2(off) to 1,1(the dim setting)

After the four ID bits but before the end latch signal add four further bits as follows:

Convert dim setting (0-15) to binary then to frames;


level 7 = 0111, which is 1,2,2,1,2,1,2,1 as frames or

level 5 = 0101, which is 1,2,2,1,1,2,2,1 as frames.

While experimenting with RF helper I have found that 'odd' addresses always have the same dim suffix and 'even' addresses have another common set.

Odd addresses (bit 0 set to 1) Even address (bit 0 set to 0)

Odd Suffix Even Suffix Level
599A40 999A40 DIM 1
59A580 99A580 DIM 2
59A640 99A640 DIM 3
5A5980 9A5980 DIM 4
5A5A40 9A5A40 DIM 5
5A6580 9A6580 DIM 6
5A6640 9A6640 DIM 7
659980 A59980 DIM 8
659A40 A59A40 DIM 9
65A580 A5A580 DIM 10
65A640 A5A640 DIM 11
665980 A65980 DIM 12
665A40 A65A40 DIM 13
666580 A66580 DIM 14
666640 A66640 DIM 15

Some example codes;

Socket address 11 (1011)

stream Description
010200FA09C400FA00FA00FA044C00FA00000C012710421999999A5999A5A5A599A659A599A5A640 OFF
010200FA09C400FA00FA00FA044C00FA00000C012710421999999A5999A5A5A599A659A59A65A640 ON
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6 PREFIX
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6599A40 DIM 1
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A659A580 DIM 2
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A659A640 DIM 3
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A65A5980 DIM 4
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A65A5A40 DIM 5
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A65A6580 DIM 6
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A65A6640 DIM 7
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6659980 DIM 8
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6659A40 DIM 9
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A665A580 DIM 10
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A665A640 DIM 11
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6665980 DIM 12
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6665A40 DIM 13
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6666580 DIM 14
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A6666640 DIM 15

Socket address 10 (1010)

stream Description
010200FA09C400FA00FA00FA044C00FA00000C012710421999999A5999A5A5A599A659A599A5A580 OFF
010200FA09C400FA00FA00FA044C00FA00000C012710421999999A5999A5A5A599A659A59A65A580 ON
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5 PREFIX
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5999A40 DIM 1
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A599A580 DIM 2
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A599A640 DIM 3
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A59A5980 DIM 4
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A59A5A40 DIM 5
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A59A6580 DIM 6
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A59A6640 DIM 7
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A59980 DIM 8
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A59A40 DIM 9
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A5A580 DIM 10
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A5A640 DIM 11
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A65980 DIM 12
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A65A40 DIM 13
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A66580 DIM 14
010200FA09C400FA00FA00FA044C00FA00000C0127104A1999999A5999A5A5A599A659A59965A5A66640 DIM 15

Tested on a BBSB4AW unit.



Pulse definition

Encoding Measured HAH
0 375 1125 385 1170
1 1125 375 1170 385

Stream definition

stream Description
00001500 Unit ON
00001400 Unit OFF
>urf 01010177046504650177060127101900001400
Bits per Frame: 1
Burts to send: 6
Frames per byte: 8
Pulse Encodings: 2
Interburst delay: 10
Frames: 25
Streambytes: 4
mask/shift 1: 01 0
mask/shift 2: 02 1
mask/shift 3: 04 2
mask/shift 4: 08 3
mask/shift 5: 10 4
mask/shift 6: 20 5
mask/shift 7: 40 6
mask/shift 8: 80 7
Pulse 1: HI 385 LO 1170
Pulse 2: HI 1170 LO 385
RF sent

Use to generate more combinations.

It has been found that Byron RS3/RS17 RF Plugs and Byron RS61 ceiling switches respond to BBSB codes. The Home Easy HE322W units also work with these codes.



Tested on a RC-710 unit.

Note that on this unit, you must switch the unit On then hold in the 'teach-in' button whilst sending the 'On' RF burst.


Pulse definition

Encoding HI LO
0 800 600
1 1500 600
2 1500 1300
3 800 1200

Stream definition

Stream Description
15CB1555561600 Unit ON
15CB1555555540 Unit OFF

As entered into the HAH UI (remember that we always start the string with '01' - the version number of our RF protocol).

rf1.on 01020320028A05DC028A05DC0514032004B00C029C4015CB1555561600 01020320028A05DC028A05DC0514032004B00C029C4015CB1555555540
rf2.on 01020320028A05DC028A05DC0514032004B00C029C4015CB1555861B00 01020320028A05DC028A05DC0514032004B00C029C4015CB1555855840
rf3.on 01020320028A05DC028A05DC0514032004B00C029C4015CB1555B21840 01020320028A05DC028A05DC0514032004B00C029C4015CB1555B15B00
rf4.on 01020320028A05DC028A05DC0514032004B00C029C4015CB1555621540 01020320028A05DC028A05DC0514032004B00C029C4015CB1555615600
rf5.on 01020320028A05DC028A05DC0514032004B00C029C401515B155561600 01020320028A05DC028A05DC0514032004B00C029C401515B155555540
rf6.on 01020320028A05DC028A05DC0514032004B00C029C401515B155861B00 01020320028A05DC028A05DC0514032004B00C029C401515B155855840

Tested on a JSJSLW561BC unit.

Note that on this unit, you must pair the bulb with the HAH. See the user guide that comes with the bulb for pairing info. Entering the 'pairing' mode involves repeatedly switching power to the bulb off/on four times. You must perform the off/on switching very quickly for the mode to be entered.

The 'mood' facility is nice. You use the remote control to get the required brightness level on the bulb. Next, you hold down the mood button until the light flashes. Thereafter, you can xmit the mood string from the HAH to cause the bulb to goto the trained level.


Pulse definition

Encoding HI LO
0 300 250
1 300 1260

Stream definition

stream Description
050A144D00A90514A0 Unit ON
050A142D00A90514A0 Unit OFF

As entered into the HAH UI (remember that we always start the string with '01' - the version number of our RF protocol).


mood1 string =0101012C00FA012C04EC0601271048221540550122460C18
mood2 string =0101012C00FA012C04EC0601271048221940550122460C18
mood3 string =0101012C00FA012C04EC0601271048222340550122460C18 

Some notes on LightwaveRF from Paul Cooper:

From what I can make out the packet starts with a single 'start bit' followed by 10 'groups' of bits each having a 'start bit' and then ends with another 'bit', (see the diagram below).

With changing between remotes I think I've worked out which groups of bits are associated with what. There appear to be 6 groups for the unique remote ID, 1 group for the remote function (on, off etc.), 1 group for the switch on the remote (device) and 2 groups for the dim level.

Each group of bits appears to have 16 states.

I haven't managed to work out what encoding is being used for the bit groups but with your URF this doesn't really matter as I can just convert the bit patterns :-) .


Pulse def: 01024407C6024401CC
Burts to send: 20
Interburst delay: 5880
Frames: 13

Pulse definition

Encoding Measured HAH
0 540 1920 580 1990
1 540 460 580 460
Stream Description
3638 Unit ON
3AB8 Unit OFF

For Channel CH3


N.B. These little nightlights have built in 'hysteresis' when responding to commands. You are advised not to try to change the state of these more than once a minute.

This is small, inexpensive, RF controlled relay that is powered by an external 12VDC supply. Sold on eBay by long standing seller 'rfremotech'. I used the 'latching' type of unit.

Inter burst gap is 2.92mS
Frame is 25bits long
Burstcount is 12

0 is a short hi 0.11mS followed by a longer lo 0.32mS
1 is a long hi 0.32mS followed by a short lo 0.09mS

Pattern for red button is :

Pattern for grey button is 

HAH URF code string for 'on' (red button) is 0101006E01400140005A0C010B68195555C000
HAH URF code string for 'off' (grey button) is 0101006E01400140005A0C010B681955553000

These codes work with the 'default' setting of the unit. If you solder up the jumpers to change the Id of your unit, you will have to rework the codes for yourself.

Note that the red LED on the relay module is illuminated when 12V power is applied. It doesn't indicate the on/off state of the relay.

Decoded RF transmitters

Pulse definition

0 370 2600
1 350 200
2 350 1200
Contact Stream
Apart 199999999A659A6599A6599A599A659A50
Close 199999999A659A6599A6599A5999A59A50


Apart 010201720A28015400C8015404B0000000000A01271042199999999A659A6599A6599A599A659A50
Close 010201720A28015400C8015404B0000000000A01271042199999999A659A6599A6599A5999A59A50
  • livebox/universalrf.txt
  • Last modified: 2014/06/08 09:20
  • by minerva9