Xantech IR-X10 commands Introduction The Xantech IR-X10 receives an infrared remote control signal and converts/transmits it into a standard X10 Powerline Carrier (PLC) bus signal. The IR-X10 has the ability to control all possible X10 devices (1-16) on all possible house codes (A-P). Any remote control programmed with these codes, has the ability to send X10 commands to the Xantech IR-X10 reciever. However, not all remote controls have this capability, and Xantech will not publish their IR-X10 receiver command set encoding. At this time, only the Xantech remote controls have the ability to send commands to the IR-X10. All other remotes must “learn” these commands from one of the Xantech remote control products. These Xantech remote controls range in price from $180 to $220, and without one of these remotes at your disposal to “teach” your preferred remote control, you have no other choice, except to buy the appropriate Xantech remote. That is, until now. The Xantech remotes are programmed with their “Dragon Drop” software. You first chose which X10 commands you want assigned to which buttons on the remote control, and the “Dragon Drop” software will program the RC across its RS-232 interface. After this process is completed, you must teach your preferred RC these control codes, one at a time. These days, my preferred RC is the Home Theater Master MX-3000. However, there aren’t really any user/enthusiast tools that allow me to manipulate the IR codes on the MX-3000. Luckily, I have a Marantz RC-9200 also at my home; the RC-9200 is essentially the same RC as the Philips Pronto-Pro, in a slightly different physical package and different firmware. They are identical enough, that either RC can be programmed with each other’s software. So for this reverse-engineering project, I’ll be using the Marantz RC-9200 (Philips Pronto). But first things first: let’s learn an IR code into the RC-9200 and see what it looks like.

Learning IR-X10 commands After “learning” my first IR-X10 into my RC-9200, I looked at a dizzying array of hex codes. I was expecting a simple RC5 or RC6 style IR code (5 or 6 words long). Instead, the IR-X10 codes were a dizzying 136 words long – mostly consisting of repeated patterns of 0x002C_002B and 0x002C_0081. How on earth was I going to figure this out, especially when I have no knowledge of IR remote control encoding? With the aid of some pronto IR software as a hint, I was able to quickly deduce that every occurrence of 0x002C_002B corresponded to a “0” data bit; and every occurrence of 0x002C_0081 corresponded to a “1” data bit. By pasting my learned IR code into Windows notepad, I replaced each of these occurrences with a corresponding 0 or 1. Conveniently, I noticed that all of the bits numbered 64. It’s very nice to know that I’m

off to a good start since all of the data bits add up to standard computer data size (64bits). Next I notice that the data is composed of four distinct data bytes, each immediately followed by its corresponding binary complement (a type of checksum). The binary complement is the logical “not” of the preceding command byte. For example, if the command byte is 0x46 (00100110 binary), then its binary complement is 0xB9 (11011001 binary). As mentioned above, the eight data bytes are composed of four command and four “complement” bytes. Each command byte is immediately followed by its corresponding complement. Therefore the entire 8-bytes of data have the following format: B1, ~B1, B2, ~B2, B3, ~B3, B4, ~B4 For me, being most familiar with x86 (Intel) microprocessors, my biggest difficulty was figuring out that this data was stored in “big-endian” format, not “little-endian” as used by x86 microprocessors; but in reality, this took me no more than 15 minutes to figure out. Now that I’ve got all of this figured out, it shouldn’t be too hard to figure out the command structure itself. To tackle this task, I taught my RC-9200 one command from each house code (A-P), plus one command from each device code (1-16). Then I added commands for ON, OFF, DIM, Bright, All Units On, All Lights On, All Lights Off, and some extended commands to set lights to a pre-set brightness level. I only needed forty commands to crack the entire IR-X10 command set, and I made no attempt to try to reverse-engineer their scene commands. Reverse engineering the scene commands will be left as an exorcize for the reader. The remainder of this article will be dedicated to discussing these findings. I will assume use and familiarity of the Philips Pronto “learned” IR codes in this discussion.

Philips Pronto IR code format The Philips learned IR codes contain a preamble, lead-in, IR data, and lead-out in most cases. The Xantech IR-X10 receiver IR packet has the following Philips IR profile:

Word

Value

Desciption

0 1

0000 006B

2

0042

3

0000

4-5 6-133

0x00AE_0056 0x002C_002B 0x002C_0081 0x002C_0056

“Learned” IR code Carrier Frequency. This value corresponds to a 38.7397 KHz carrier frequency. Length of data word pairs. 0x0042 equals 66 decimal (64bits) plus two more, presumably for lead-in, and lead-out. Repeat value. For the Xantech IR, this will be zero because IR repeat codes are not used for this device. Lead-in. 64 Data bit pairs.

134-135

Lead out.

Xantech IR-X10 command format Once the 64 Data bit pairs are collected and converted from their hex word pairs into bigendian data bits, the IR-X10 receiver command set was a breeze to decipher. Unlike what Xantech would want you to believe, their IR-X10 receiver format isn’t inherently proprietary. Their IR-X10 receiver command set closely follows the original X10 Powerline Carrier (PLC) specification and is almost bit-for-bit identical. After all, when the IR-X10 transmitter sends the X10 command on the PLC bus, it must adhere to the X10 specification. Therefore, it only made sense for Xantech to keep the IR-X10 receiver as simple as possible. There are some slight differences however. In the original X10 specification, the unit code and command code are combined into a single 5-bit field. These five bits allow 32 unique combinations: 16 unit codes, plus 16 command codes. The IR-X10 receiver requires that this 5-bit field be broken down into two 4-bit fields: each four bit field supporting 16 unique combinations (16 unit codes, plus 16 command codes). The IR-X10 receiver accepts the codes in this 4x4 format, but actually combines them into the standard X10 format before transmitting them onto the PLC bus. The IR-X10 receiver also requires some extra bits in the command stream as “hints” to their hardware decoder. Knowing that the Xantech IR-X10 receiver closely follows the X10 specification, I quickly noticed that their Dragon Drop software only supports eight of the standard X10 commands (using a 3-bit command), whereas the X10 specification supports sixteen commands (a 4-bit command). One could hypothesize that the IR-X10 receiver does not block out the fourth command bit and would transmit it directly to the PLC bus. If the IR-X10 did this, then by encoding the IR-X10 receiver codes yourself, you could gain more X10 capabilities than even Xantech supports in their $200 remote control and software package. I tested this theory by encoding my own IR-X10 command codes with these extra bit set and analyzing the results on an X10 bus analyzer. My hypothesis was proven correct: The IR-X10 does not block the 4th command bit, and this allows for extra programming capabilities than Xantech supports in their own $200 RC/software package.

Command Byte

Value

B1 [07:04] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 B1 [03:02]

B1 [01:00] B2

00 01 10 11 00 ~B1

Description House Code House Code-M House Code-E House Code-C House Code-K House Code-O House Code-G House Code-A House Code-I House Code-N House Code-F House Code-D House Code-L House Code-P House Code-H House Code-B House Code-J Command Type (hardware hints) Extended X10 Command Unknown House Bank Command Normal X10 Command Unused Logical not of B1

Command Byte

Value

B3 [07:04]

Description

B4

~B3

Unit Number Unit-13 Unit-5 Unit-3 Unit-11 Unit-15 Unit-7 Unit-1 Unit-9 Unit-14 Unit-6 Unit-4 Unit-12 Unit-16 Unit-8 Unit-2 Unit-10 Unused Normal X10 Command All Units Off* All Lights On* On Off Dim Bright All Lights Off* Use Extended Data Hail Request** Hail Acknowledge** Preset DIM (D8=0)** Preset DIM (D8=1)** Extended Data (analog)** Status=ON** Status=OFF** Status Request** * These commands are always encoded in conjunction with Unit Number-10. ** These extra X10 commands are not programmable through the Xantech Dragon Drop software. Logical not of B3

B5 [07:00] B6

Hex data ~B5

Extended X10 data Logical not of B5

B7 [07:00] B8

Hex data ~B7

Extended X10 Command Logical not of B7

B3 [03:03] B3 [02:00]

0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 0 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111

Conclusions Using this description of the Xantech IR-X10 receiver commands, it is now possible to write utilities to generate these codes, and incorporate them into your preferred remote control device. I have modified the IRTool available from remotecentral.com to generate all possible IR-X10 receiver commands, including those not supported by the Dragon Drop software. This tool is available from www.rcollins.org/xantech, or by downloading the latest IRTool from remotecentral.com. It should also be possible to use this description to modify other IR utilities such as ProntoUtil. The use of either of these tools will allow the user to to generate these codes and download them directly into a Pronto IR Database.

About the Author This author has considerable experience reverse-engineering the internal workings of the industry leading computer microprocessors, and has published 36 magazine articles on the subject. When I discovered that Xantech would not publish their IR-X10 command set, nor would cooperate with other Universal Remote Control companies to allow them to integrate the IR-X10 commands into their IR databases, I was preterbed. I had already purchased the IR-X10, and now I was faced with purchasing a $200 remote control that I didn’t need for any other purpose other than to “teach” my preferred RC the IR-X10 command codes. Therefore I purchased this product with the intent to reverse engineer the command set and publish the results.

Reference • X10 Powerline Carrier (PLC) Technology: http://www.x10.com/support/technology1.htm • IRTool: http://www.remotecentral.com/cgibin/files/dl.cgi?file=utilities/irtool.zip&area=pronto • Decode CCF: http://www.remotecentral.com/cgibin/files/dl.cgi?file=utilities/decodeCCF.zip&area=pronto • DecideIR.DLL: http://www.remotecentral.com/cgibin/files/dl.cgi?file=utilities/decodeir.zip&area=pronto • ProntoUtil: http://www.remotecentral.com/cgibin/files/dl.cgi?file=utilities/prontoutil.zip&area=pronto