Decoding IR Remote Control

Another Christmas vacation meant spending time at my in-law's dining room table working on a project. This year, I decided to try to figure out the IR communication protocol being used by this retired Insignia portable DVD player remote control. The kids never really used the remote control and it still looks like new. My heart for re-purposing electronics wouldn't allow me to throw it away. Here's what the button layout looks like on the front of the remote.


I decided to use my USB Oscilloscope to read the data coming out of the remote control. My oscilloscope is made by Parallax and has two channels along with a very nice user interface.

I attached an IR LED to the Oscilloscope leads as follows:


I don't really know why using an IR LED works so well to capture IR signals, but it definitely works. I tried using an IR Transistor first to no avail - so this really did work best with the LED.

After the typical fiddling that goes along with grabbing new signals on an oscilloscope, I was able to capture this IR burst of data using the trigger capabilities of my oscilloscope.

I was able to zoom in on the header to figure out the carrier signal. As you can see in the lower right hand corner of my oscilloscope UI, there's a box called "Cursors". I was able to use cursors (or markers) to measure the length of a signal wave and discovered that it's approximately 35.7KHz. A little internet research will show that the typical commercial remote control uses a carrier signal of 36 to 38 KHz - so my measurements weren't too far off. This carrier signal is sometimes referred to as the "Center Frequency".


Next, I decided to measure the header signal along with the following break in the signal. This is used to indicate the beginning of a message or stream of data to the receiver. It appears the header is approximately 9 ms (milliseconds) or rather 9000 us (microseconds). This is followed by a 4500 us pause before the first bit appears.


Now we only need to understand what a bit is, and how to measure a "1" from a "0". I was able to discover that a "0" is a 55 us high followed by a 55 us low. The "1" is a 55 us high followed by a 165 us low. Either way, each bit is either 110 or 220 us long.


I then started counting bits and found out that the data transmitted from the IR remote control is 4 bytes long, with each byte being 8 bits long, adding up to 32 bits of data being sent each time a button is pressed. Here's a summary of my findings (I only analyzed number buttons 0 .. 9 on the remote control).

Carrier Signal = 36Kh
Header = 9000 us
Break = 4500 us
Off Bit = 1100 us
On Bit = 2200 us

"1" = 01000000 11111111 10100000 01011111 = 5
"2" = 01000000 11111111 01100000 10011111 = 6
"3" = 01000000 11111111 11100000 00011111 = 7
"4" = 01000000 11111111 10010000 01101111 = 9
"5" = 01000000 11111111 01010000 10101111 = 10
"6" = 01000000 11111111 11010000 00101111 = 11
"7" = 01000000 11111111 10110000 01001111 = 13
"8" = 01000000 11111111 01110000 10001111 = 14
"9" = 01000000 11111111 11110000 00001111 = 15
"0" = 01000000 11111111 01001000 10110111 = 18


I figured out that the 3rd byte contains the data and the 4th byte has the "not", presumably for error checking the data. So, for example, pressing the "1" key on the remote control sends the data stream 01000000 11111111 10100000 01011111 where 10100000 equals 5 in decimal.

I hope this is helpful to you. If you take time to decode your remote control - let me know how it goes for you! :)