Except for the difference in carrier frequencies, the RF protocol that X-10 uses for standard (i.e. non-security) X-10 RF devices is identical to the original NEC IR protocol which is widely used for IR remote controls. The data envelope for a typical NEC code is pictured below.

Each code starts with a 9ms burst of carrier followed by a 4.5ms silence. This leader is necessary to set the ACG in the receivers which dynamically adapt to signal strength. After the leader, there are 32 bits with binary 1 represented by 2.25ms between rising edges and binary 0 represented by 1.125ms between rising edges. The rising edge of the 33rd and final pulse marks the end of the last bit and is followed by a silence of approximately 40ms. The RF timings are slightly different from the IR timings, with an initial 8.8ms burst followed by a 4.4ms silence, with 2.2ms for binary 1, and 1.1ms for binary 0. Most X-10 RF transmitters send a minimum of five copies of the code separated by 40ms silences although some can send singles.

Instead of address and data bytes, X-10 sends two bytes of data with each byte followed immediately by its bitwise complement for error checking. Within each byte, bit7 is received first and bit0 last. In the pictured code, in the order received, the first byte is 0011 0111, the second is 1100 1000, the third is 0001 1010, and the fourth is 1110 0101. After reversing the bit orders and testing for bitwise complementarity, the two data bytes are 1110 1100 and 0101 1000 or 0xEC and 0x58. Since the illustration was taken from an explanation of IR codes, these represent a device and button for an IR code. If these were X-10 RF codes the bytes would be two data bytes as detailed in the CM17A protocol.

The BasicX routine below is called after detecting a valid leader. It captures the pulses, decodes the bit values, and reverses the bit orders. When it returns, the 4 bytes received are in the global array RF().

Sub GetRF()

  Dim PulseTrain(1 To 64)  As Integer 
  Dim Duration             As Integer
  Dim i                    As Integer
  Dim bit                  As Byte
 
  Call InputCapture(PulseTrain, 64, 1)
  bit = 7
  i = 1
  Do
    Duration = PulseTrain(i) + PulseTrain(i + 1)
    If (Duration < 5794) Or (Duration > 23162) Then    
      Exit Sub
    End If
    If (Duration > 11581) Then
      Call PutBit(RF, bit, 1)        'RF is a global 4 byte array
    Else
      Call PutBit(RF, bit, 0)
    End If
    If i = 15 Then
      bit = 15
    ElseIf i = 31 Then
      bit = 23
    ElseIf i = 47 Then
      bit = 31
    Else
      bit = bit - 1
    End If
    i = i + 2
  Loop Until i > 63
  
End Sub

The overall time to send one code, including the approximate 40ms silence, is about 108ms. Timings will vary from one transmitter to another but are repeatable for a specific transmitter. I have seen a range from 95ms to 116ms for my various transmitters. Empirical tests using TM751 and RR501 transceivers indicate that standard X-10 transceivers tolerate timing variations of 30-35% from nominal.

X-10 security transmitters use a similar protocol but only one nybble of the first two bytes are bitwise complementary while the last two bytes follow the same pattern as standard X-10 RF codes. Some X-10 security devices append 9 bits to the initial 32 but these 9 bits do not appear to convey any significant information. HomeLink garage door sensors use the security protocol (32 bits only) and send eleven copies of the code with no silence between codes.

In the NEC code, the first byte is a device or ID number and the third byte is a button or function. The second and last bytes are used for error checking. Using AD DR to represent the nybbles of the first byte and DA TA to represent the nybbles of the third byte, the standard X-10 codes take the form:

          ____      ____
     ADDR ADDR DATA DATA 

with the second byte being the bitwise complement of the first and the last byte being the bitwise complement of the third.

In binary notation, this becomes:

     10101010 01010101 11110000 00001111

X-10 security devices and Stanley garage door sensor codes take the form:

            __      ____
     ADDR ADDR DATA DATA 
     10101010 10100101 11110000 00001111

with only the second nybble of the second byte complementing the second nybble of the first byte. The last byte is the complement of the third.

In North America, the X-10 RF carrier frequency is 310MHz. In the UK, they use 418MHz and 433.92MHz. In the rest of Europe it is 433.92MHz.

The following screenshots show the near constant noise on the DATA out line of a Ming RE-66 receiver with no X-10 signal followed by the same DATA output line with an X-10 signal. You can see how the leadin sets the AGC and allows the receiver to capture the signal. Screenshots using a TM751 RF daughterboard are almost identical.