Details of EV1527 Protocol

Looking for someone who can answer questions regarding the elusive EV1527 protocol as used in 433 MHz UHF remote controls. Sample question: If I understand correctly, the transmitter 20-bit ID is burned into an OTP chip at the factory. Would that be the chip manufacturer factory or the remote transmitter manufacturer factory? And what determines which "port" (D0-D3) is activated when a message is received?

Presumably it's just a micro-contoller, it 'might' be OTP, it might not - it doesn't really make any difference.

As for where it's programmed?, it could be either - again it makes little difference - and Micro-controller manufacturers will provide their chips pre-programmed if required.

If you are not not knowledgeable on the matter please don't tell us what's obvious, and spare us your opinions about what makes any difference while ignoring the really important question about what determines the port. For your information, it IS an OTP micro-controller and somebody at the manufacturing end starts with the lowest address and burns each chip with a different fixed address (whether sequentially or randomly I don't know) so that the end user has to "learn" the transmitter address with his smart learning receiver in order to use it, a fascinating approach to minimizing interference from other transmitters.

From the manufacturers data, here:

Each IC EV1527 has gauranteed unique 1 million code possibility preprogrammed one time into it during manfacturing.

Click to expand...

The overall data frame protocol consists a preamble of all zero bits, then the the serial number, then the four bits representing the inputs, in whatever combination they are set on the transmitter chip.

If it's being used with directly connected buttons, then the four input bits represent the button or buttons pressed.

Bits are sent using pulse width encoding, a short pulse for a zero and a long pulse for a one, in fixed duration timeslots.

Transmit data diagram:


ps. For info, there is nothing new about devices with factory set unique addresses - we use DS2400 / DS2401 "silicon serial numbers" in some of our products to give them unique identities.

Finally, some comments with constructive information from rjenkinsgb, who obviously knows what he's talking about. I was familiar with the Sunrom EV1527 specifications but when you said "If it's being used with directly connected buttons, then the four input bits represent the button or buttons pressed" it was as if someone turned on a light in the dark. I went back and re-read the specs, then opened up a few remote transmitters in my collection to look at the PCBs. Two of them were labeled EV1527 on the back, and both had the 8-pin chip clearly so marked. One of the receivers was a 3-button unit and I could see where the pushbuttons were wired to three input pins of the chip. Using a 4-channel learning receiver to learn the chip serial number, I was able to confirm the channel output from each pushbutton. The other transmitter was a 1-button model, but if you look closely at the attached pic you can see there are four soldered jumper locations for inputs to the chip, with a zero ohm resistor in the D0 position at far right.

I can't tell you how grateful I am for your putting me on the right track. Now I think I know everything I need to know about how EV1527 works.