[How-To] Hack A Palm Pad Remote


How To Hack A PalmPad Remote
To Send An X-10 Code On A Specific Trigger
By BraveSirRobbin

This How-To will describe how to hack into a standerd X-10 palm pad remote so you can send an X-10 house/unit code based upon a specific external trigger (contact closure). Applications that this could be used for include a mail box sensor that will send an X-10 command whenever the mail box is opened.

To open the palm pad remote remove the four screws located in the bottom four corners of the unit as shown below.

(Click on Picture for Full Sized Image)

Carefully remove the PC board from the case. Leave the circular house code selector wheel in place. I removed the unit code selector switch because I only needed unit codes above eight and didn't have a lot of luck getting this switch to work again after removing the board (the board will default to unit codes 9-16 with this switch removed).

Note that those four AAA batteries were installed in a series fashion so that means they supplied 4 * 1.5 Volts for a total of 6 Volts. Well, if it can handle six volts it surely can handle nine right? Besides a nine volt battery clipped to a 9-volt header with leads (purchased from Radio Shack) will be a lot easier to attach to those power leads coming out of the PC board.

Clip the red and black power leads from the battery terminals as shown below:

(Click on Picture for Full Sized Image)

Also, remove the metal "battery clips" from the bottom case section.

Attach the red to red and black to black wire from a Nine Volt Battery Clip, then attach a nine volt battery to this clip.

Position the board component side up, with the silk screened letters oriented properly so you can read them. Notice on the "component" side of the PC board that there are a series of eight jumpers running along the top side of the components themselves.

Also notice on the left side of the board that there are a series of five diodes (red cylinder components with a black stripe on their right side). The top diode is labeled "D12" and the one directly underneath it is labeled "D10".

For the purposes of this [How-To] we will label the jumpers and the "correct" diodes that we will use as shown below.

(Click on Picture for Full Sized Image)

Notice that we will NOT use the small jumper below the "D10" diode nor the very bottom diode.

Move this PC board to your computer and pull up your Homeseer log or some other program that monitors X-10 commands received (from your RF receiver such as an MR26A). Clear the log.

Using a jumper as shown below, clip one lead to the "A" jumper. Touch the other jumper lead to the left (non-stripe) side of diode "1". You should see the red light on the PC board turn on and the X-10 command pair of "M15 OFF" as being received in your log.

(Click on Picture for Full Sized Image)

Touch the jumper to the diode "2" (left side) and you should see the X-10 command pair of "M12 OFF" as being received in your log.

Skip the plain jumper and touch the diode "3" and you should see "M11 ON".

Touch diode "4" and you should see "M9 OFF".

Do not touch the last bottom diode.

The reason the "M" house code showed is because the "House Code Selection Wafer Dial" that selects the various X-10 house codes was removed and the "M" house code is the default output when no "Wafer Pads" are shorted with that dial. Also, the jumper slide selector switch (selects unit codes 1-8 or 9-16) was also removed; therefore the PC board will default to 9-16 unit codes.

The jumper itself was simulating specific keypad presses. Other combinations that can easily (i.e. easy to solder an exterior wire to) be obtained are explained below.

Remove the clip from jumper "A" and clip it to jumper "B". You will now get the following if the diodes are touched with the other end of the jumper as above:

Diode 1: M16 OFF, Diode 2: M13 OFF, Diode 3: M11 OFF, Diode 4: M10 OFF

Note that the PC board jumpers "C" and "H" will yield the same results as jumper "A"; and PC board jumpers "D", "F", and "G" will yield the same results as jumper "B".

Remove the jumper lead from the PC board’s jumper "B" and place it on jumper "E". You will now get the following combination outputs:

Diode 1: M15 ON, Diode 2: M12 ON, Diode 3: M10 ON, Diode 4: M9 ON

The table below summarizes are results:


A, C, & H..............M15 Off...........M12 Off...........M11 On...........M9 Off

B, D, F, & G..........M16 Off...........M13 Off...........M11 Off...........M10 Off

E..........................M15 On...........M12 On...........M10 On............M9 On

Well, we easily obtained at least 12 different X-10 command pair combinations.

Also notice that if you leave the jumper shorting a particular pc board jumper/diode combination, that particular signal will continue to broadcast until it is disconnected.

For my purposes I soldered (green colored) wires to specific jumpers and diodes as shown in the palm pad pic above. Be careful not to leave the soldering iron on the components to long or else you could "remove" them from their original solder pads on the other side of the board. Also make sure the board is supported on the corners so you don't "press down" on the lead ends below (this may also force the components to go "through" the board when heat is applied from the solder iron).

After you solder the wires to your selected components (and label the ends), place the board back into the case being careful to route the wires through the hole near the battery cover as shown below:

(Click on Picture for Full Sized Image)

Now you can select a different house code other than "M" by dialing the desired on with the selector wheel. One important note is that you will not obtain the same results when testing the above jumper combinations as you did with the M house code. To do a list of all the different scenarios would be beyond the scope of this How-to. Rather just test the various house codes you may want to use with the jumper wire as described above. You will eventually find a house and unit code combination for your use.

Now you are ready to use this palm pad to monitor anything that will yield a contact closure such as a mail box or door (when used with a normally open type of contact sensor).

This palm pad hack will be used for a car monitor circuit which will be described in a separate How-to very soon.

Please leave questions, comments, or suggestions below.