RF decoding

[thatthat21]

I have seen a few sites and topics about decoding the RF signal from remote devices and using a "computer" (pc, mac, arduino, PI(3.14)...) to broadcast the RF signal to the RF device. Has any one here done something like this that might be able to help some one else? I have a airspy mini and a yardstickone, but trying to follow everything I have read and watched on the internet I have not been able to decode the shock collar I have. I have learned a lot about RF doing this, but just want to get to the next step in my project, but can't seem to get past this part. even being able to just replay the signal would be great I have no problem recording them all if that is all I can do, but would love some help if any one knows anything about this.

Thank you

[lj]

I may be wrong, but I suspect you are throwing too much technology at this problem.

A shock collar or similar simple device will almost certainly simply use a short data packet to send the commands to the collar. Some long time ago I reverse engineered the control data packets for a digital cassette recorder (so it was a long time ago!) and whilst this is a different task, the underlying principles are the same.

I have very limited expereince with SDR, so apologies if this part of what I say is rubbish!

If you can find the transmission from the collar controller, I expect you to be able to see a series of 1 and 0 which will be different for each control functions. The packet will likely start with a header, a body of data and a tail.

The header will be an identifier for the particular collar, perhaps a bit of data to detail the content following eg how many bytes it contains, then the body of data, and finally the tail, containing a check-sum. You don't actually need to know any of the data content from start to finish. All you need is to record the sequence for each control function and be able to re-play the sequence via a suitable transmitter

OR - the crude and simple way !

I assume you want to be able to subject a victim, perhaps yourself, to a random or other sequence of shocks. Again, I have to make an assumption, you possess the controller as well as the collar. You could modify the controller - after all, you press buttons to cause the collar to shock, so that means you are closing a contact every time you press a button. So use the Arduino to "press" the button. The simplest way would be to use some of the output ports to act as button pressers. This sidesteps all the RF messing about. You might need some FETs to act as electronic pushbuttons, or the ports may already be compatible.

[Gregovic]

You might be interested in what others have done working on the same problem.
See here:
https://github.com/dpmartee/arduino-shock-collar
http://deviant-designs.co.uk/2019/03/29 ... ck-collar/
https://github.com/smouldery/shock-collar-control
https://github.com/flash89y/Arduino/tre ... DogCollar2

That last one also contains code to automagically determine/capture the correct code for your device, see the instruction page.

While figuring it out yourself can be very rewarding sometimes it's just more satisfying to borrow someone else's code and get it working.

[thatthat21]

I am all for using code that someone else did. Just seems like all most every one has the cheap models ( I get it, it is cheaper), but I had to go with the nicer models that had a bit more range. But that was what I was after at the time.

I will look over the links.

Now I want to device/server that some one could connect to and push a button (or send a text message to(I know how to get all of this setup)) to trigger a shock. I would also have the option to program it as well, but have to figure out how to send the signal.

Yes, This could be done by just some how pushing the buttons on the remote, but then I have to keep the remote with power all the time as well. Yes, this could all be worked out as well. For some reason looking at everything every one makes it look easy to decode the RF. Might be that my office just has to much RF background noise as well.

[Gregovic]

I am all for using code that someone else did. Just seems like all most every one has the cheap models ( I get it, it is cheaper), but I had to go with the nicer models that had a bit more range. But that was what I was after at the time.

I will look over the links.

Now I want to device/server that some one could connect to and push a button (or send a text message to(I know how to get all of this setup)) to trigger a shock. I would also have the option to program it as well, but have to figure out how to send the signal.

Yes, This could be done by just some how pushing the buttons on the remote, but then I have to keep the remote with power all the time as well. Yes, this could all be worked out as well. For some reason looking at everything every one makes it look easy to decode the RF. Might be that my office just has to much RF background noise as well.

I'm sure RF decoding is one of those things that certain people make look really easy, but are actually really difficult. I've even seen results of people tracing an RF signal through the audio port and decoding the signal through the plots in audacity.. How they managed is still a mystery to me, but they took one look at the result and went: "Oh thats simple OOK control, see, that's the start bit, theres the end bit, this is the data." Sure, if you say so Don't be discouraged by those who have mastered the dark arts. Most of us mere mortals struggle with it the same.

It seems the 433 Mhz modules ramp up the sensitivity when no signal is detected and spew out a lot of garbage on the data pin, so you have find a 100ms or so of silence after a signal is received, then look at what follows immediately after (most transmitters send a command a few times in a row to ensure it's received). That should give you a cleaner signal. (explained here: https://www.electroschematics.com/433mhz-rf-sniffer/)

Further possibly helpful links:
https://www.instructables.com/id/Decodi ... -Arduino-/
https://nickwhyte.com/post/2017/reversi ... rf-blinds/

[GeneralError]

I also bought such a nice shock collar and played around with it. Off course I not fastened the collar around my dogs neck but to the base of my cock snuggly behind my balls. Then I tried the operation modes.
a) just make a noise signal -> ok funny. The kink potential is low. Maybe it can be used a heads-up warning, that some more painful might follow
b) vibration -> nice. The kink potential is still low. The vibration is nice but it is still more a signal, that the device has been activated
c) electric shock -> this is wow! The kink potential is phantastic. The intensity can be regulated in a range from 0 to 100%. Depending on the moisture of the skin, already a 20% strength stroke results in my full attention but is not yet really painfull.
This makes the shock collar an ideal device to motivate a reluctant delinquent to fullfill any tasks. And my kinky fantasy sees lots of tasks here
So I eagerly started to hack into the device to make it computer controllable. But then the trouble starts. I set up some rf receiver (RX-5V and Arduino) to analyze the communication. But it received nothing. After a while I found out, that my receiver was just broken. I used another one and managed it to proof that it works by receiving signals from two remote controls of wireless sockets I have. But still no signal from the shock collar sender
It seems, that is not a question of cheap or expensive model. It is more a question of the frequency the communication is running on. The already mentioned GitHub projects and home automation tutorials are using the widely spread 433MHz senders and receivers. The collar must fit to that! Mine seems to just work on a different frequency and off course I got no specification or manual that documents the frequency.
But I want to bring such a device to working. I will keep you updated on any progress. Or if someone here has it working, please let us know.

[lj]

433MHz units don't all operate on the same frequency - I have some that can use any of 40 channels all in the legal non-licenced band. Unless you have a frequency counter or a tuneable UHF receiver it will be luck if you find the right receiver frequency. Which frequency, 433MHz or other, will depend upon the regulations in your country, and anyway the transmitter may use an illegal frequency so it could be almost anything!

The better receivers have an output port that gives a measure of the received signal strength (RSSI), you monitor that with the microprocessor and only take note of the data when the RSSI is high enough to guarantee clear data. You also have to use a packet structure that allows validation of the data.

Incidentally, my suggestion of directly controlling the controller/sender with eg Arduino, does mean powering the controller, but the power could easily come from the Arduino which will also need powering.

[GeneralError]

yeah, I got it working!
First I opened my sender unit and found a chip

LR433T2_small.jpg (40.03 KiB) Viewed 6317 times

. This is definetely a 433 MHz sender. So my assumption that my device is working on a different frequency was obviously wrong. The fact that my first approach could successfully receive signals from 433MHz remote controls of wireless sockets but did not reveive anything from my shock collar must have been caused by something different. So I went back to my setup and reworked it.
I followed the intructions from flash89y on https://github.com/flash89y who created the magical GetUniqueKey sample. This unique key is important. It is a hard wired identification of the sender module. When sender and receiver are paired, the receiver gets the key and so knows to which sender it belongs. (Otherways one button press on your sender could zap lots of dogs and kinksters in a radius of several hundred meters). So this key is the key for any step further.
I setup my hardware using an Arduino Nano V3 and an RF receiver XY-MK-5V like this:

The yellow jumper wire is the data wire. It is connected to D2 on the Arduino Nano. Within the source code of "GetUniqueKey" this results in #define RECEIVE_PIN 4. In other Arduinos this might be different. I checked my setup with my power socket remote controls. They prooved that rf transmissions sucessfully triggered the program.
Now I pressed the buttons on my shock collar sender and this time it worked. I received logging messages with the desired unique key that flash89y's program magically extracted. It is a string with 34 characters for example loocking like this 2112122112122112211212122121121221 (in this format a "21" stands for a binary "0" and a "12" stands for a binary "1"; so the real binary unique key is 17 bits long).
The next step is to setup the RF sender using a XY-FST. Btw. sender and receiver are sold as a kit for less than 2 euros. They look like this:

.
I just plugged the sender module on the same breadboard using the same Arduino as before. The senders data wire is green and connected to Arduinos D7 pin.

On the Arduino I uploaded DogCollar2-SimpleTest.ino from flash89y. The programm cycles through the different shock collar modes. And really i heard my collar receiver beeping and vibrating. And after verifying that the shock intensity of the test programm was set to only 20% I tried it on my leg. And yeah, I got a nice zap

[lj]

Well done !

If you have the time, do an article for this site so others can use the same method

[sweh]

FWIW, a lot of these collars can be re-sync'd to a new transmitter. With mine, for example, you hold the power button on the collar for around 5 seconds. That puts it into pairing mode, and the first transmitter that sends will be the one it pairs to.

So if you're not worried about being able to use the remote _and_ the arduino at the same time then you don't need to decode the unique key.

It's interesting comparing this code to https://github.com/ToshieCosed/ShockDuino - the Johonis analysis (which ShockDuino is based on) doesn't have consistent timing, and they didn't properly analyse the protocol (split up the wrong way). But, at the end of the day, a "shock" message would send

S1 000 0001 11010010011100110 ....... 0111 111 00

(where "......" is the power). Which matches the protocol "ch1, shock" with transmitter ID 11010010011100110.

flash89y's code is a lot cleaner!

[GeneralError]

So if you're not worried about being able to use the remote _and_ the arduino at the same time then you don't need to decode the unique key.

Very good point. All this complicated unique key extraction is not really required. The arduino (or any other alternate remote control) can just be paired as a different remote control with a different randomly set unique key. I first thaught that the magical pairing process is a complicated cryptografic communication. But in fact it seems to be very simple. The receiver cannot send anything back. It is really only a receiver. If the receiver is in pairing mode (i.e. after battery insertion) it is just accepting any senders command with _any_ unique key in it. It just receives a first command submission, extracts that key and remembers it (until the batteries are removed).
I have tested this based on flash89y's 'DogCollar-SimpleTest.ino' and with an Arduino Nano and with an esp8266 controller. As rf-sender I again used a xy-fst.
I started the program with a randomly set unique key. I put the batteries into the collar receiver. Et voilá, it paired immediately and worked.

[IcarusBurned]

This post of mine would perhaps have been better in this thread, I did a decode of the Petrainer 900B collars and wrote an Arduino sketch to emulate the transmitter with all functions:
viewtopic.php?f=28&t=11968&start=15#p91931

[IcarusBurned]

I posted previously my decode of the Petrainer 900B e-collar which is cheap, well made and waterproof Chinese e-collar that I bought off Aliexpress. It was only $45 USD for the "3 dog system" which includes 3 e-collars and claims to have a 1000m range. The link to the collar is here, there is also a demo video on the page: https://www.aliexpress.com/item/1959757426.html

The original post is here: viewtopic.php?f=28&t=11968&start=15#p91931

I thought it might be worth explaining in a bit more detail how I decoded the protocol for anyone trying to do a similar thing for a different device.

I had seen Deviant Designs code for a different model from the same manufacturer and I knew that was 433mhz, so I thought there was a good chance that this also used 433mhz, (as indeed it does). The thing about this model is that it is able to send commands including zap, vibe and beep all in one command - so I knew the protocol must be completely different, but at this price it was worth a go.

The first thing I tried was simply to record the signal and play it back. I did this using a very cheap and dirty hack and where I soldered a 433mhz transmitter and receiver module to a cheap USB audio card that I had laying around, and then plugged it into my laptop. I connected the 5v and GND connections of the modules to the 5v USB supply and the respective grounds of the audio jacks and connected their data pins to one of the audio channels in each audio jack. This allowed me to hear the signal that was being transmitted as sound and then record it, the setup looked like this:

Using this crude setup, I was able to record the signal using Audacity and also play it back through the 443mhz transmitter module. This turned out to be very good for recording, but pretty unreliable for transmitting, (it worked maybe 1 time in 5), I think it is likely that the audio output from my laptop was simply not a high enough voltage for the 5v Tx module to send a clear signal. But it did give me a chance to have my first look at what was actually being transmitted. There was a sequence being repeated over and over again which looked like this:

You can see that there is one very long pulse, followed by a series of long and short pulses, then a gap before the sequence repeats.

With the playback not working, the next thing I tried was connecting the 433 receiver module to the Arduino and using various "automatic" protocol decoding tools/sketches which I downloaded - but unfortunately none of them worked for this protocol.

With that I was bit stuck.

Finally I found an Arduino sketch that just listened to the 433 module and output the raw data as a series of timings which it sent over serial, it finally gave me the data, the (very useful) tool is here: https://github.com/sui77/SimpleRcScanne ... canner.ino

The hardware setup for this is also very simple, just a 433MHz Rx module connected to an Arduino, like this:

Using the port monitor I was able to copy the output to a .txt file, and with a little tweak to the Arduino sketch, I replaced the spaces between each value with a comma, so that I could save them as .csv files and open them in excel. Using excel, I found the first long pulse, deleted all the columns before it, found the next long pulse and deleted all the columns after it and, so I was left with just a clean copy of each sequence.

The data for each trimmed sequence was just a series of numbers, like this:

Code: Select all

1428,440,308,392,312,384,668,436,316,384,664,440,316,384,316,392,308,388,664,436,668,436,316,384,316,388,312,388,316,392,656,440,664,440,664,440,308,392,660,444,308,388,664,440,664,436,316,384,316,388,664,444,660,436,664,440,312,388,316,384,312,388,668,444,656,440,660,440,664,440,308,388,316,388,312,392,660,444,660,444,304,392,312,388,664,440,660,444,308,388,312,388,668,432,316,1184,1428,444,308,388,312,384,668,436,316,388,664,436,316,388,312,392,308,392,660,440,664,440,312,388,312,388,316,388,312,392,656,440,664,440,664,440,308,392,660,444,308,388,668,436,664,436,316,388,312,384,668,444,660,436,664,436,312,388,316,388,312,388,664,448,656,440,660,440,664,436,312,388,312,388,316,392,660,440,660,448,304,388,312,388,668,436,664,440,308,392,312,388,664,432,320,1180,1428,444,308,388,312,388,664,436,316,388,660,440,316,384,316,392,308,392,660,440,664,440,312,384,316,392,308,392,308,392,660,436,668,440,664,436,312,392,660,444,308,384,668,440,660,440,312,388,316,384,664,448,656,436,668,440,308,388,312,388,316,388,664,444,656,444,660,440,660,444,308,388,312,388,312,392,664,436,664,444,308,384,316,384,668,440,660,444,308,388,312,388,668,432,316,1188,1420,448,308,388,312,384,664,440,316,384,664,440,312,392,312,388,308,396,660,440,660,440,312,388,312,388,316,388,312,388,664,436,664,440,664,440,308,392,660,444,308,388,668,436,664,440,312,392,308,388,664,448,652,444,660,440,308,392,312,388,312,388,668,440,660,444,656,440,664,436,312,388,312,388,316,392,660,440,664,444,304,388,312,388,668,436,660,444,308,388,316,388,664,440,312,1184,1424,448,304,388,312,388,664,440,312,384,668,440,312,388,312,392,308,392,660,436,668,440,312,384,316,388,316,388,312,392,660,436,664,444,660,440,308,392,660,444,308,388,668,436,664,436,316,388,312,388,664,444,656,444,660,440,312,388,312,388,312,388,668,444,656,444,656,440,664,440,308,388,316,388,312,392,660,440,664,444,304,392,312,388,664,440,660

The numbers are in pairs, each pair representing the length (in microseconds) of the high and then the low part of the signal for each step in the waveform. You can see that (apart from the very first and last pairs) they fall into one of two groups; either a number around 310 followed by something around 390 (representing a zero) OR a number around 660 followed by something around 440 (representing a 1).

It's also worth noting that the 32 numbers after the first pair (ie No.s 3-34) are the unique key for the transmitter, so this tool can be used to decode the unique key for any transmitter.

Now the laborious part. I recorded a whole load of transmissions with many different settings, changing just one setting at a time and saved each one as a separate .csv with a note of the settings for that sequence. I was thinking that if I couldn't decode the signal, at least I would have a decent selection of combinations that I could choose from and transmit as required.

After collecting and trimming all the .csv files (about 40 of them), I was able to paste each as a separate row into a single excel chart. I could see that each pair fell into 1 of 2 ranges, (representing 1s and 0s) so using excel to automatically colour the cells with the long pairs black and the short ones white, I ended up with a chart that looked like this:

From this data, it's quite clear that the structure of the sequence is as follows:

Long pulse to denote the start of the sequence, transmitter ID (16 bits), collar ID (2 bits), zap level (7 bit binary), vibe level (7 bit binary), beep level (7 bit binary), a check-sum (7 bit) and then a zero.

After a bit of head scratching, I worked out that the check sum is the product of doing an XOR operation on each of the three 7-bit binaries in turn and I had it.

All that remained was to write some code to test it and then try it out.

Here is the code I wrote:

Code: Select all

// This code is designed to operate Petrainer 900B model collars.
// This collar is able to beep, zap and vibe all at the same time
// Use the code to drive the data pin on a 433mhz 3 pin transmitter module
// Some of these modules work better than others - the least fancy ones seem to work best
//
// Written by IcarusBurned 2020 - Use it at your own risk!!

// Variables which you can change during the loop
int ZapPower = 05;       // Strength of the zap (0-99)
int VibePower = 50;      // Strength of vibrate (0-99)
int BeepPower = 50;      // Strength of the beep (0-99)
int TxDuration = 250;    // Pulse duration in milliseconds
int CollarID = 1;        // Collar ID Can be 1, 2 or 3

// You can change these (but not during the loop)
const String TxID = "0010101011000011"; // ID of the transmitter
const int LEDpin = 2;                   // Pin for indication LED (pin 2 is the onboard LED on Node ESP32 Dev board)
const int TxPin = 19;                   // GPIO Pin connected to transmitter
const int StayAwakeInt = 30000;         // Length of inactivity before a signal is sent (milliSeconds) 

// You shouldn't need to change these values 
const int IntervalLow = 720;      // Pause between sequences (Microseconds)
const int StartHigh = 1400;       // Initial high pulse (Microseconds)
const int StartLow = 440;         // Initial low pulse (Microseconds)
const int OneHigh = 662;          // Length of "1" high pulse (Microseconds)
const int OneLow = 440;           // Length of "1" low pulse (Microseconds)
const int ZeroHigh = 316;         // Length of "0" high pulse (Microseconds)
const int ZeroLow = 380;          // Length of "0" low pulse (Microseconds)
unsigned long LastActive = 0;     // Timestamp of last activation time (for StayAwake function)

// Here is the main function that builds the code and then transmits it

void TxCmdSequence(int Chan, int Zpwr, int Vpwr, int Bpwr, int TxLength)

// Syntax is: 
//
// TxCmdSequence( ChannelID, Zap_strength, Vibe_strength, Beep_Strength, Length_of_transmission );
//
// Channel can be 1, 2 or 3
// Zap, Vibe and Beep strength all need to be values between 0-99
// Length of transmission is in milliseconds and should be above 100mS
// All the values are set when you call the function from the loop
//
// You shouldn't need to change any of the code in this function

{
  String collarNo = "00";           // Declare the string values
  String CheckSum = "0000000"; 
  String TxSequence;                // Holds the full TX sequence 
  
  digitalWrite(LEDpin, HIGH);       // Switch on the TX Indicator LED
  switch (Chan)                     // Check the channel
    {
    case 1:                         // For channel 1
      collarNo = "10";              // Set the string value for the Tx code
      CheckSum = "1000000";         // And the 7 bit checksum value
      break;
    case 2:                         // Same if it's channel 2
      collarNo = "11";
      CheckSum = "1100000";
      break;
    case 3:                         // Etc.
      collarNo = "01";
      CheckSum = "0100000";
      break;
    }
                                    // Now generate the binary strings for each variable
  String ZpwrBin = "0000000";       // Each string must contain exactly 7 characters
  for (int i = 0; i <= 6; i++)      // Loop to read the binary value bit by bit
    {
    ZpwrBin[i] = bitRead(Zpwr, i) + 48;             // Write the binary to the "ZpwrBin" string
    CheckSum[i] = (CheckSum[i] ^ ZpwrBin[i]) + 48;  // Use XOR to compare bits and update the checksum
    }
  String VpwrBin = "0000000";        // Same process for Vibe
  for (int i = 0; i <= 6; i++)
    {
    VpwrBin[i] = bitRead(Vpwr, i) + 48;
    CheckSum[i] = (CheckSum[i] ^ VpwrBin[i]) + 48;
    }
  String BpwrBin = "0000000";        // And same again for Beep
  for (int i = 0; i <= 6; i++)
    {
    BpwrBin[i] = bitRead(Bpwr, i) + 48;
    CheckSum[i] = (CheckSum[i] ^ BpwrBin[i]) + 48;
    }
    
  // Build the transmit sequence with the values and add a zero at the end
  
  TxSequence = ( TxID + collarNo + ZpwrBin + VpwrBin + BpwrBin + CheckSum + "0");
  
  // And send a debugging message
  Serial.println("New pulse settings:");
  Serial.print("C:");
  Serial.print(Chan);
  Serial.print(" Z:");
  Serial.print(Zpwr);
  Serial.print(" V:");
  Serial.print(Vpwr);
  Serial.print(" B:");
  Serial.print(Bpwr);
  Serial.print("  ");
  Serial.print(collarNo);
  Serial.print("-");
  Serial.print(ZpwrBin);
  Serial.print("-");
  Serial.print(VpwrBin);
  Serial.print("-");
  Serial.print(BpwrBin);
  Serial.print("-");
  Serial.print(CheckSum);
  Serial.println("-0");

  // Now transmit the code
  
  unsigned long TxStartTime = millis();       // Timestamp the start of the transmision
  LastActive = millis();                      // Reset stay awake counter
  while (millis() - TxStartTime < TxLength)   // Transmit until the duration is reached
    {
    // Transmit preamble bits
    Serial.print("TX: ");
    Serial.println(TxSequence);
    digitalWrite(TxPin, LOW);
    delayMicroseconds(IntervalLow);
    digitalWrite(TxPin, HIGH);
    delayMicroseconds(StartHigh);
    digitalWrite(TxPin, LOW);
    delayMicroseconds(StartLow);
    // Then transmit the rest of the sequence
    for (int n = 0; n < 47 ; n++)       // read the 48 bit sequence one character at a time
    {
      if (TxSequence.charAt(n) == '1')  // If it's a "1"
        {
        digitalWrite(TxPin, HIGH);      // Transmit a one
        delayMicroseconds(OneHigh);
        digitalWrite(TxPin, LOW);
        delayMicroseconds(OneLow);
        //Serial.print("1");
        }
      else                              // Otherwise transmit a zero
        {
        digitalWrite(TxPin, HIGH);
        delayMicroseconds(ZeroHigh);
        digitalWrite(TxPin, LOW);
        delayMicroseconds(ZeroLow);
        //Serial.print("0");
      }
    }
  }
  digitalWrite(LEDpin, LOW);            // Switch off the TX Indicator LED
}

void setup()
  {  
  pinMode (LEDpin, OUTPUT);     // Set the pin modes for the outputs
  pinMode (TxPin, OUTPUT);
  Serial.begin(115200);         // Start the serial
  delay (250);                  // Send debug message
  Serial.println("Starting levels are:");
  Serial.print("Zap: ");
  Serial.print(ZapPower);
  Serial.print("% Vibe: ");
  Serial.print(VibePower);
  Serial.print("% Beep: ");
  Serial.print(BeepPower);
  Serial.print("% Pulse Duration: ");
  Serial.print(TxDuration);
  Serial.println("mS");
}

void loop()
  {
  if (millis() - LastActive >= StayAwakeInt)     // Put whatever trigger code you want here
     {
     TxCmdSequence(CollarID, ZapPower, VibePower, BeepPower, TxDuration);  // Send the command to the collar
     }    
}

The loop in the code just sends a zap every 30 seconds, but I'm sure you might find other things to do with it. The main function generates the sequence and transmits the code, so all you need to do is call TxCmdSequence(CollarID, ZapPower, VibePower, BeepPower, TxDuration); from the loop and insert the variables you require.

To use it, you just need to connect a 433mhx Tx module to an Arduino and upload the sketch, it looks like this:

One last thing, if you order the e-collars, you will need to make sure that you pair them with the Arduino and not with the transmitter they come with as the codes will be different. To do this you just turn them on, put them in pairing mode and send the code with the Arduino/433mhz Tx module setup and everything should work.

One last note regarding the Petrainer 900B collar that this code operates, because of the way the e-collar adjusts it's power output - even the very low levels feel pretty strong. This is one problem with these cheap collars, they don't have the smooth power graduation of the more advanced units.

I hope this is of use, I have put the code out for anyone to use or modify as they see fit. Anything you do using it is entirely at your own risk!

[Kinbaku]

A real detective work.

[BoundInKasugai]

Many thanks for sharing and the very extensive writeup! That is going to be helpful to many!