this is formatted like shit, i'm just logging all the shit i've done and i'll make it pretty later
when i was a teenager, i did a bunch of manual labor for an residential gate company that a family friend ran so that I could afford going to scout camp. he had this cool little puck installed to his truck that could open every residential gate, which is supposed to be installed on every firetruck.
i always wondered how it actually worked, so I can reverse engineer it and make my own. luckily for me, my neighborhood's gate was being worked on and i was able to convice the technician to show me what it was and how to use it.
as far as i know, this system is installed on every gate in clark county nevada, and potentially in other regions as well. it's required by fire code!
interestingly, the las vegas fire code does not specifically name that this device must be used, but vaguely states it must have a device "approved by the fire code official"
but the clark county fire code does specifically mention the avi transmitter!
so what actually is this thing? how can we reverse it?
there are 2 manufacturers of basically the same thing: reno a&e / diablo controls
from what i can tell, they are both subsidiaries of eberle design inc, a company that makes traffic controls
anyways, it's their avi (automated vehicle identification) system.
basically the puck transmits a signal with a passkey that is detected by a wire loop that is installed into the ground. interestingly these loops are almost identical to the ones used to detect whether a vehicle is present, just different hardware on the end.
by going through some documentation, i found the following important tidbits
https://diablocontrols.com/store/avi-auto-vehicle-identification/avi-x-1/
https://www.controlledproducts.com/ASSETS/DOCUMENTS/ITEMS/EN/AVIB1911_Literature.pdf
Frequency: 375 kHz and complies with FCC part 15 for unlicensed operation.
Codes: Any two codes between 1 and 19,683 using the standard Motorola trinary format.
Transmission Speed: Code is transmitted once every 15 ms.
what the fuck is the motorola trinary format? 19,683 is a weird maximum number
god damn model train nerds, it's a fucking train communication format.
tbh the overlap between traffic control engineers and model train enthusiasts makes a lot of sense, it's basically the same shit on a different scale
anyway here's 2 links that were instrumental for my understanding:
THE MANUAL OF THE NEW MÄRKLIN-MOTOROLA FORMAT by Andrea Scorzoni, 1995-1998
Intro to Märklin-Motorola by StephanStrassleRojas on Hackaday.io
19,683 is 222222222 in base 3 (trinary)
can we get our hands on one of these so we can test it?
there's 2 models of the avi-x
a big one, that is completely potted in epoxy. i got this one first and didn't realize i couldn't take it apart when i ordered it.
and a smaller one, which is able to be disassembled. this would be better for easier reverse engineering.
note: thank you ebay for selling me the one with the proper code to open every gate. hilarious pickup, but i don't just want one, i want to make as many as i feel like making.
i was able to put the puck right up to my hackrf's antenna, and with a very weak signal, i was able to confirm that the motorola marklin format is what we were looking for, and what the format of the code is supposed to be. this is below what the hackrf's stated range is, but it worked good enough! (it'd probably be better if i made a proper receiving loop...)
but wait, 375khz? if this is radio, we'd need a ridiculously sized antenna, or we'd need to bitbang it out which would be a menace to the airwaves. these things are fcc approved, so they must be doing something different...
aaaand it's fucking nfc, but big. the puck is a near field transmitter, and the receiving antenna is a 12 foot perimeter with 5 turns (or bigger with less turns, it's in the docs)
so we know what it is and how it works, but how do we actually test our implementation without walking to the gate and potentially arousing suspicion?
once again, ebay to the rescue!
i was able to get both a transmitter and a receiver for the 739 code for pretty cheap. this is great because i can use these to test my own transmission solution without having to walk to the gate and test it (or answer any questions about what i'm doing)
we can use the doc above from controlledproducts for installation instructions.
so that leads us to the current status of this project in 2/2026:
- i gotta build our testing platform using the tx/rx i ordered.
- i gotta figure out how to build a near field transmitter.
i don't want to spend $100 on the wiring harness for the avi-b receiver, but i might do it anyway. or i might 3d print an adapter, we'll see.
i could buy it here:
https://gateopenersafety.com/store/reno-a-e-lmh8r-10-pin-harness.html
but there's docs for how it's supposed to be wired here:
https://www.editraffic.com/wp-content/uploads/2020/11/LMH-8_Catalog_Sheet-1.pdf
ordering the plug is $30 minimum, so it'll probably just be easier to order one i guess.
i can take apart the avi-xs-739 that i bought, but that's less fun.
i'll update this page as i keep building more