Wireless Remote Control Switch

Wireless remote control switch modules can be purchased for a few US dollars (around $7 for one pair).  They come with coil antennas.  They controls 4-channel output with Learning Code 1527, and can be programmed (using button presses) to operate in the momentary, toggle and latched mode.  The Learning Code 1527 has 20-bit identifiers(for over 1 million possibilities) and followed by 4-bit button code (for 16 states).    Most of the inexpensive modules have no marking on the ICs, so there is little information about the circuitry.

We can capture the RF wave using a oscilloscope with a loop antenna.

It appears the modulation is OOK.  Every burst is about 30ms.  It continuously transmits as long as the button is pressed.  It can be observed that the last few bits change depending on which key is pressed.  It appears that the bits are decoded according to the pulse duration or PWM encoded.  The bit 0 is a short duration of 0.3ms, and the bit 1 is about 0.9ms.   The total bit time is 1.2ms.  I counted total of 25 bits instead of expected 24 bits. Possibly the first bit is for synchronization only.

Something is also interesting about the 20-bit identifier code.  I was able to turn on and off using a key FOB from a different vendor and the code pattern is clearly different, but the receiver decodes it nevertheless, so it may not actually enforce the code or only subset of the code, or there is a master code.