Reverse Engineering central heating wireless thermostat - help needed! - Page 1
Forum section: electronics / projects

author: picitup
author_rank: Regular Contributor
timestamp: December 02, 2015, 10:19:44 am
content: Hi AllI'd like to control my central heating from the Internet. The current setup is a wireless stat in the hall and a wireless receiver in the airing cupboard, next to the boiler. I did consider removing the wireless receiver, and fitting a Photon board and controlling it that way, but I don't want to mod the system such that a new occupant can't use it if we sell the house.I did some searching and found this excellent page:http://www.stevenhale.co.uk/main/2013/08/home-automation-reverse-engineering-a-worcester-bosch-dt10rf-wireless-thermostat/This guy didn't own a storage scope, but managed to work out the protocol using a sound card and Audacity (sound recorder) to display the waveform.In his example, the protocol is very simple; it sends a series of 1s and 0s as a training sequence then a couple of bits at the end signify boiler on or off. His system used a 433mHZ transmitter/receiver and compatible hardware is available from eBay for less than £2.00.Flush with the promise of a simple and cheap solution, I bought a transmitter and receiver. Then I checked my stat and it's quite different to his.Mine works at 868.3 MHz and has a couple of chips in it:The Atmel XMEGA128B1 which is the microcontroller and is here:http://www.atmel.com/images/atmel-8330-8-and-16-bit-avr-microcontroller-xmega-b-atxmega64b1-atxmega128b1_datasheet.pdfThe second chip is an ATRF212 which is the wireless chip. It's essentially an SPI-to-wireless transceiver chip and is here:http://www.atmel.com/images/doc8168.pdfNow for the bit where I'm stuck. I don't have much radio experience and want to buy a suitable receiver for it, then I can decode the transmission and work out the on and off codes. However, the ATRF212 supports a range of transmission standards and I have no idea which one it uses. I have a scope, but that's only 100MHz and a frequency counter that goes up to 1.3GHz but I don't think either are much help in this situation.Interestingly, the ATRF212 is around £2.00, the XMEGA128B1 is around £3.70 and the stat costs £109.99. I think the manufacturer us making a killing with these...You may think I've bitten off more than I can chew, and you may be right, but I was wondering if anyone could point me in the right direction?I've attached some piccies of the stat for reference.Thanks for reading.....Steve

author: rickey1990
author_rank: Regular Contributor
timestamp: December 02, 2015, 03:04:31 pm
content: Reverse engineeringmy favourite topic - Well iv seen people turning on and off a LED from a webpage,http://www.instructables.com/id/ESP8266-Web-Server-Without-Arduino/&. It uses a ESP8266, its a wifi module with a build in microcontroller, The ones shown in the links previous can be picked up from aliexpress for about £1.50. but id recommend sepending a extra pound and getting the "NodeMcu Lua" from aliexpress as it has header pins.Then all you have to do is buy a cheap radio transmitter module and try to get it to communicate wirelesly with the reciever in the thermasat.Well thats my idea, hope it helps,Kind regards,Rickey

author: LaserSteve
author_rank: Super Contributor
timestamp: December 02, 2015, 03:24:26 pm
content: Post canceled, its O_QPSK modulationm, my diode detector idea would not work, never mind..OP needs to sniff the SPI bus. I dont suggest hacking furnace controllers, its a safety of life issue if something goes wrong. As each TX chip has a MAC addess the thermostat probably is probably a matched pair, anyways...Steve

author: picitup
author_rank: Regular Contributor
timestamp: December 02, 2015, 04:03:37 pm
content: @rickey1990 Thanks for your reply. The ESP8266 looks really cool - a tiny web server for almost nothingI didn't explain my own setup fully, I have a Photon (previously Spark Core) which you can communicate with over the Internet via their cloud which I guess is quite similar to the NodeMCU you suggested.I could fit this in a box and get it to power a relay to offer the volt-free contacts in a proper central heating receiver, but I don't want to modify the existing system as I'll have to put it all back together if we sell house.@LaserSteve how do you know it's O_QPSK? I'm interested to find out. I think you're right about the MAC address, but the user guide shows you how to pair the transmitter/receiver if, for example you have to replace one of them, so hopefully it's still possible in theory.ThanksSteve

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 04:14:55 pm
content: The problem with reverse engineering this thing is that you will need equipment and software that will total much more than the price of 10 units.You can do it on the cheap, of course, but then you will be paying with your time.There is no point in looking at transmissions over the air with the scope, that's a complete waste of time and you won't see anything because of complex modulations.You will need to get any ZigBee sniffer hardware/software that is capable of working in a sub-GHz bands. The cheap option is Atmel Wireshark interface and ZigBit-based USB stick (~$50). Expensive options start at ~$2500, so I guess they are out of the question.Another thing you can do is sniff SPI bus and record significant amounts of traffic, so you will need some equipment for that as well.

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 04:18:22 pm
content: Also, when replacing things that interact with the real world, think about the consequences. Thermostats control heaters, improper control may result in very serious consequences starting from damaging your heating equipment and ending up with a fire. Do you really want to risk it?

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 04:19:35 pm
content: Also, they may be using some secret encryption keys, and then you out of luck at all.

author: senso
author_rank: Frequent Contributor
timestamp: December 02, 2015, 04:21:38 pm
content: Those radios support encryption in hardware, in the software side is as simple as a define in the sample code from Atmel..

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 04:32:14 pm
content: Quote from: senso on December 02, 2015, 04:21:38 pm1. What makes you think they use code from Atmel?2. Encryption in hardware is typically used for session keys, but master keys are typically kept internal, since it is super easy to sniff the bus and bet the keys. That is if security is done right.

author: senso
author_rank: Frequent Contributor
timestamp: December 02, 2015, 04:57:42 pm
content: Was just implying that using the encryption is dead easy, so would doubt they are no using it.

author: picitup
author_rank: Regular Contributor
timestamp: December 02, 2015, 05:28:03 pm
content: Hi againThanks for your replies. It sounds like I've bitten off more than I can chew. It would probably be less work to fit a photon in a box with a relay.I'm not worried about controlling the heating myself as I worked as a BMS engineer for a few years. The control of the boiler on my system is done through a timer in series with the wireless receiver, which is a box external to the boiler so any volt free contact would work in the same way. So in practice, the wireless stat/receiver is no different to an old mechanical stat with a microswitch.I appreciate it would need a 'dead zone' so the boiler, for example, turns off at setpoint +1 degree and on at setpoint -1 degree to stop any rapid cycling of the boiler.Also the Photon would work locally without any need for an Internet connection, just the ability to change the setpoint over the net. So hopefully then we won't get cold if the Internet goes down!I'd still like to get this going, tell me I'm bonkers if you like and you may well be right.Thanks for reading...Steve

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 05:42:13 pm
content: Quote from: picitup on December 02, 2015, 05:28:03 pmWell, you can certainly do that, but it will take more effort to reverse engineer this stuff that to recreate the software from scratch. Just erase the Xmega and write your own software. You will have to do it on both sides, of course.Trying to reverse engineer the protocols will require a lot of time, luck and equipment.

author: picitup
author_rank: Regular Contributor
timestamp: December 02, 2015, 05:45:11 pm
content: Well I appreciate your feedback, thanks.I'll continue to wrangle with this until I come up with a solution or slip into a sulkIf I come up with anything, I'll post it up.CheersSteve

author: philpem
author_rank: Frequent Contributor
timestamp: December 02, 2015, 06:52:55 pm
content: Quote from: ataradov on December 02, 2015, 05:42:13 pmNot really. A Saleae Logic (or anything supported by Sigrok really) sat on the SPI lines of the RF chip and an hour with the Atmel datasheet should do it.Make the thermostat turn the boiler on. See what it sends to the RF chip. Repeat for boiler off.This is literally what I did for the Worcester-Bosch MT10RF, but I did it with an Agilent mixed-signal scope, a Python script, and a couple of wires and a broken Worcester-Bosch MT10RF I found on Ebay. Then I found a TI USB FET (MSP430 Flash programmer) and hooked it up to the JTAG pins on the main micro... which helpfully wasn't JTAG-locked!Ten minutes later, I had a complete flash ROM dump, and about an hour after that, I'd single-stepped their code and knew what the I/O pins did, why the temperature sensing was so shockingly bad (they're using a digital pin to sense a thermistor using an R/C, and the capacitor drifts like a mother with both time and temperature...) and what the RF protocol was "as they envisioned it". Curiously it can signal low-battery status back to the boiler, but the boiler doesn't have any way of saying "uh, the battery's low, fix pls?" -- nor does the thermostat. First you find out about that is when your heating doesn't come on...So it's not impossible. In fact, on an SPI chip it's probably easier than the WoBo -- I was dealing with TX_EN and FSK_DATA on some Infineon chip. SPI should be easier because once you know what the registers are (should be in the datasheet), you can figure out what it's actually doing. I'd be legitimately stunned if this thing uses encryption, and if it does, the keys probably go over the SPI bus in the clear. This is only meant to protect against passive eavesdropping and noise, really, most manufacturers consider "a guy with a Saleae Logic" to be a "well-funded attacker"...Cheers,Phil.

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 06:58:06 pm
content: Quote from: philpem on December 02, 2015, 06:52:55 pmProperly designed protocols will use sequence numbers for duplicate detection and replay attacks (which is what you are trying to do here).I work at Atmel and support those chips. I know what I'm talking about. The only way reverse-engineering will be simple if you are in luck and the protocol used is some custom simple protocol. Even if they went with basic IEEE 802.15.4 MAC, then sniffing the SPI and replaying the results will achieve absolutely nothing.Quote from: philpem on December 02, 2015, 06:52:55 pmAgain, you need a lot of luck for this to happen.

author: mark03
author_rank: Frequent Contributor
timestamp: December 02, 2015, 07:10:17 pm
content: You could reverse-engineer the air interface on the cheap using an RTL-SDR type of dongle and  GNU Radio software. But it may not be worth the investment of time.

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 07:12:37 pm
content: Quote from: mark03 on December 02, 2015, 07:10:17 pmWhy would you want to do that? The radio is a standard IEEE 802.15.4 transceiver, there are proper sniffers for this already in existence. But if OTA communication is properly encrypted, sniffing it makes no difference.

author: philpem
author_rank: Frequent Contributor
timestamp: December 02, 2015, 07:19:11 pm
content: Quote from: ataradov on December 02, 2015, 06:58:06 pmI think you're overestimating the average consumer electronics company manager. Quoting one of these beasts from some time ago..."Who's going to hack a <x>? It's not like it's a military radio or... or a Patriot missile or... something like that! Stop wasting time on that, just make it work, as quickly as possible! We need to get a product out the door faster than <competitor>!"I would be legitimately stunned if that thermostat -- almost an entry-level wireless 'stat -- is running a full Zigbee stack. They want a short development cycle and a cheap product. This is hardly a Nest. At best they'll have grabbed some Atmel sample code and used that.The most they'll want is "on" and "off", anti-collision (CSMA-CA or CSMA-CD) and an ID/pairing to make sure multiple nearby transmitters can't be misidentified.But really, all the OP wants to do is get the key and MAC for his thermostat and the packet format.Looking at the AT86RF212 datasheet, the key is set with an SRAM write. So that's volatile -- the MCU will have to write it on every power-up. Same goes for the transmit buffer.Transmit frequency, modulation settings, keys, MAC address, etc. can all be determined from SPI writes.As for sequence IDs -- look at a dozen or so packets. I think the MT10RF has a mod-3 counter or something like that. Sequence IDs usually follow a fairly obvious sequence. Humans (like engineers, no matter how much we deny it!) like obvious sequences, they're easy to remember and easy to test.Cheers,Phil.

author: mark03
author_rank: Frequent Contributor
timestamp: December 02, 2015, 08:14:30 pm
content: Quote from: ataradov on December 02, 2015, 07:12:37 pmI'm assuming a "proper sniffer" costs well over the $20 one those dongles will set you back.

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 08:45:44 pm
content: Quote from: mark03 on December 02, 2015, 08:14:30 pm$50 at least. Do you have a link to a $20 SDR receiver?

author: picitup
author_rank: Regular Contributor
timestamp: December 02, 2015, 09:19:28 pm
content: Well this has sparked some interesting debate! I'm learning loads!@philpem that's a very impressive piece of reverse engineering. Unfortunately I only have a budget scope and look at mixed signal scopes and drool. I don't have a Salea sniffer either, but it's nearly xmas....You can buy 833MHz receivers from fleabay for a couple of quid so I may well buy one and just see if it works.I'd still like to pursue this and the idea of reverse engineering it sounds like fun, I think I could learn a lot from that. Can I ask which Salea sniffer you have philpem?CheersSteve

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 09:26:25 pm
content: Quote from: picitup on December 02, 2015, 09:19:28 pmI can guarantee you, it won't.

author: senso
author_rank: Frequent Contributor
timestamp: December 02, 2015, 09:49:31 pm
content: You can also buy a cheap RTL-SDR, or even use an equal atmega128rfa/rfr and use Wireshark.

author: ataradov
author_rank: Super Contributor
timestamp: December 02, 2015, 10:00:31 pm
content: Quote from: senso on December 02, 2015, 09:49:31 pmWhich one and what is your definition of cheap?Quote from: senso on December 02, 2015, 09:49:31 pmNo, you can't. RF212 is a sub-GHz device. megaRF are only available in 2.4 GHz band.You can use this USB stickhttp://www.atmel.com/tools/atzb-x-rf212b-usb.aspxwith Wireshark. But it is $55 before taxes and shipping.

author: mark03
author_rank: Frequent Contributor
timestamp: December 03, 2015, 12:21:40 am
content: Quote from: ataradov on December 02, 2015, 08:45:44 pm$12.75 + shipping:http://www.amazon.com/RTL-SDR-DVB-T-Stick-RTL2832U-R820T/dp/B00C37AZXKThe RTL-SDR dongles (all based on the same digital TV tuner chip and its clones, I believe) are even cheaper now than I remember. I'm not saying this is necessarily the right tool. Because the radio is separate from the MCU it sounds as though sniffing the SPI bus would be just as useful, or just as useless (depending on encryption as you say). But these very simple tuners have allowed folks to do things like reverse-engineer the transmissions from the tire-pressure monitoring systems in their car, and other fun stuff.

author: LaserSteve
author_rank: Super Contributor
timestamp: December 03, 2015, 01:23:17 am
content: Why in the heck would you want to try to demod the RF when you have access to the SPI on BOTH ends?Unless a Demod tool is already coded, that is just asking for a huge development project. You could spend tens of minutes waiting for a single command burst.I'd vote for Sniffing the bus. Even my low end four channel scope has a sniff mode option for SPI.Dear OP, if you want to see the burst rate, I'll link what I was going to suggest if the transmitter was on/off keyed.One diode detector, one scope channel, and a 81 mm length of wire as a quarter wave antenna..http://www.techlib.com/electronics/detect.htmOn Chuck Wenzel's detector circuit, linked above, you may need to lower the value of the 0.1 uF cap or the 100K resisitor to see a full envelope.Steve

author: picitup
author_rank: Regular Contributor
timestamp: December 03, 2015, 08:28:54 am
content: HiI wanted to go the RF route for two reasons; firstly I wanted to know that I can acquire a transmitter (868.3MHz) that would work with the system otherwise it will never work and secondly, going the RF route, I can play until my heart's content rather than start hacking the transmitter around and killing it as the cold weather approaches then we have no heating. This may cause local tensionsAnother option is to buy another (cheap) wireless stat and receiver, fit that to the central heating then I'm free to hack this one around.Both reading the SPI bus and the RF side are interesting to me. I think there's plenty of scope for me to learn a lot.I've seen an RTL-SDR stick on eBay for £7.81 item number 161897487881. Is this the kind of stick I would need?Ps I don't mind spending the time if I'm learning something new.Thanks again all for your comments.CheersSteve

author: picitup
author_rank: Regular Contributor
timestamp: December 03, 2015, 10:35:23 am
content: OK I've done a bit of reading and youtubing and found these 2 videos, that you might find interesting if you're an RF noob like me. Both show using the RTL2832U stick on Androids using OTG.So I've put my hand in my pocket and bought a stick which is fleabay item 172017000295 for £7.58. Despite the main pic, it comes with an aerial and remote control. It's stocked in the UK supposedly so hopefully it won't take too long to come.I'll post up when it arrives.CheersSteve

author: picitup
author_rank: Regular Contributor
timestamp: December 05, 2015, 11:19:15 am
content: Yes when you start digging into devices, it's amazing how scabby the designs are. It gives me hope for the future!Well no SDR stick today, so hopefully Monday. I decided to buy the cheap transceiver from fleabay mentioned above. It's item 141804081741 and is £2.40 and is apparently a Silicon Labs SI4463 clone which is another SPI->Radio solution. I asked the seller for the data sheet and he sent me Silicon Labs AN632 EZRadioPro advice note:https://www.silabs.com/Support%20Documents/TechnicalDocs/AN632.pdfThe SI4463 datasheet is here:https://www.silabs.com/Support%20Documents/TechnicalDocs/Si4464-63-61-60.pdfand I'm pretty gobsmacked. It's a fully featured programmable spi->radio with I/O and configurable frequency and modulation etc. It has a config program which allows you to change many settings and I think you can code it in C too.I thought I was buying a simple on/off point-point device but it's the full works.I'm hoping I can learn how to use it in less than a year lol, but coupled with the SDR stick I think I'm in for some fun.CheersSteve

author: ataradov
author_rank: Super Contributor
timestamp: December 05, 2015, 06:43:37 pm
content: Well, actually Si446x is a subset of Atmel AT86RF215. IEEE 802.15.4g specifies a lot of modes, so it appears that things are infinitely configurable, but they are not.And Si446x does not support QPSK modes, so if your RF212-based device is using them, then it will be completely useless.

author: ataradov
author_rank: Super Contributor
timestamp: December 05, 2015, 06:45:22 pm
content: Or the goal of reverse engineering has changed to learning about modulations?

author: picitup
author_rank: Regular Contributor
timestamp: December 05, 2015, 09:27:05 pm
content: Hi you may well be right, but for the very low price I thought it was worth a try.No my main goal is the same, to be able to talk to the wireless receiver next to the boiler, but you're right I'm being seduced into learning some wider RF in the process.I'll post up when the SDR arrives and I'd had a play with it.CheersSteve

author: picitup
author_rank: Regular Contributor
timestamp: December 10, 2015, 10:32:13 am
content: Well, my RTL-SDR dongle hasn't arrived yet, but I've had a chance to do some reading and here's what I found:Dongles======I bought the cheapest one I could find (£7.58) and there are reports of drift at the higher end of the spectrum due to overheating. There's an improved version here:http://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/which is $24.95 and has an OXCO for 1ppm stability, is vented to keep it cooler and they say it has a more sensitive front end.The sdrPlay device covers from 100KHz to 2GHz and costs £118.80 and is here:http://www.sdrplay.com/However, don't expect to pick up much the low end with the piddly antenna supplied with the cheap dongle. I've read that you can buy a wide band antenna, something like the discone or eBay item 121508352707 if you're really serious.Software======There's a lot of free software out there and there's a list here:http://www.rtl-sdr.com/big-list-rtl-sdr-supported-software/I've chosen SDR# (sdrsharp) as it's free and seems to be widely used. It has a range of plugins (including an oscilloscope!!!) here:http://www.rtl-sdr.com/sdrsharp-plugins/Identifying Signals=============If you're a noob like me, you might like to look at the Signal Idenfication Wiki which has pictures of waterfalls, audio recordings and modulation types etc:http://www.sigidwiki.com/wiki/Signal_Identification_GuideWell that's all for now. I'm away all weekend so if the dongle doesn't arrive tomorrow then I'll post up again next week.CheersSteve

author: picitup
author_rank: Regular Contributor
timestamp: December 21, 2015, 04:26:13 pm
content: Hi AllAfter a short present wrapping break I found some time to look at this. The SDR dongle arrived and I installed sdr# to play with it. Just a couple of comments about the dongle; it's quite wide and fouls the USB port next to it, so I bought a 4 inch USB extension cable which seems to work fine. Secondly the supplied antenna had about 3 feet of cable which made it difficult to get by the window. The aerial socket on the dongle is mcx so I bought a 4 foot extension lead. The antenna screws onto the base with an m3 thread and I've got loads of m3 brass pillars so I may experiment with different antenna lengths in the future.To learn sdr# I just played around, tuning in local stations etc and then calibrated the dongle with a program called imaginatively, Kalibrate which scans for local GSM stations and then gives you a ppm offset you enter into sdr# by clicking on the cog icon.Onto the main business; I located my thermostat on the 868mHz band and proved it was the right one by removing the batteries. Unsurprisingly, it was the strongest signal at a distance of 1 foot from the antenna.I've posted up a picture of SDR (SDR-Raw)and the waterfall shows the transmission. The 2 wide signals are the thermostat and I'm not sure what the small signal is, but I think it's an outdoor temp sensor that connects to our wireless thermometer. The thermostats does a couple of bursts of information about every 40 seconds and you can see this in the audacity recording image Audacity-RepeatSignal.jpg. Audacity sampling rate was set to 384 KHz to get about 17 samples per cycle and get a reasonable representation.Audacity-FirstSignal.jpg and Audacity-FirstSignal-Zoom are zoomed in views of the first burst of data.Audacity-Single.wav is a recording of the dual spike signal and is amplified to make it more visible.Now I'm stuck. I don't have enough experience to find out the modulation type and protocol. Choosing RAW seems to have the best audio output as for example, WFM has a lot of background hiss. The zoomed in waveforms as show below don't seem to represent simple binary and have cycles that are well above and below the centre line and other cycles dancing around the centre line.If anyone has the patience for an RF noob then I'd be grateful for any help I can get.I did also take note of the helpful posts that suggested I sniff the SPI bus and as a backup plan I've ordered an OpenBench logic sniffer which is currently walking it's way from China. I figured, I could buy a transmitter only, experiment with it and if I didn't kill it, sell it again without too much loss.Thanks for reading....Steve

author: ataradov
author_rank: Super Contributor
timestamp: December 21, 2015, 05:16:12 pm
content: Sure. First of all, you have a good start knowing what radio it is and what standard it follows. So it will be very helpful to read IEEE 802.15.4-2006 standard to understand what is going on.The radio is quite flexible, but assuming they went with frequency/modulation from the standard, here are a few quotes from it:QuoteQuoteThe raw data is passed to a spectrum spreader, which maps each bit (symbol) to 15-bit long M-sequence, distinct for 1 and 0.Then the resulting stream is passed on to the BPSK modulator.Here is what we know about that modulator:QuoteWith chip rate of 300 kchip/s you need to digitize your signal with sampling frequency of at least 600 ksps, but for first experiments, it is better to go as fast as hardware will allow.Right now your signal looks way undersampled, it is not recoverable.

author: ataradov
author_rank: Super Contributor
timestamp: December 21, 2015, 05:18:23 pm
content: After you sample the signal at a right frequency, you should see a level signal with distinct states for 0 and 1. It may be multiplied by a relatively slow sine wave, which can be removed either by more accurate frequency tuning, or later in signal recovery.

author: Harvey17
author_rank: Contributor
timestamp: November 13, 2018, 09:22:58 pm
content: Quote from: philpem on December 02, 2015, 06:52:55 pmNecro-posting here, but wondering if you still have any info on the RF protocol these MT10RF's use? I can see [in the one I have] it uses a TDA 5100 as the ASK/FSK Transmitter, and a MSP430F2121 processor, so I'm hoping its not going to be too hard to work out what's going on. I'd like to make a "better" thermostat as these MT10RF's are just damn annoying in so many ways.

author: Harvey17
author_rank: Contributor
timestamp: November 21, 2018, 01:13:19 am
content: So I managed to tap into the transmitters FSK drive test point, found out my scope's storage space isn't quite big enough to capture an entire packet () so resorted to using the sound card capture and have managed to get a few examples captured. I've got a feeling this thermostat is more than just a basic ON/OFF signal as we have a modulating combi boiler and its noticeable that the boiler reduces its output as the temperature of the room gets close to the set temperature, so ideally I'd like to work out some sort of decoding of the transmitted data so as to figure out if this is the case.I first thought the data stream was Manchester coded, but it doesn't seem to follow the rules for Manchester, so would anyone like to guess the transmission protocol used in the attached capture? (The selected part is the preamble. and this is just the start of the data stream)

author: ataradov
author_rank: Super Contributor
timestamp: November 21, 2018, 02:47:21 am
content: The frequency in the preamble is two times the frequency of the bits. So the preamble is used to lock the bit clock. Just decode it as individual bits. At least count how many bots there. Hoe do they change from transmission to transmission? Any parts are static?To tell for sure you will have to do many more captures. And you can probably take Arduino or similar board and write a simple decoder that will synchronize the same way as a real receiver. This will make it easier to dump the data continuously.

author: philpem
author_rank: Frequent Contributor
timestamp: June 03, 2020, 02:43:53 pm
content: Quote from: Harvey17 on November 21, 2018, 01:13:19 amI've actually been reverse engineering the MT10RF protocol myself!As it happens, the MSP430 in the transmitter isn't code protected and can be read out or debugged with a GoodFET or MSP430 debug probe. The PIC16F628 in the receiver has its code space protected but not its data EEPROM. (the data EEPROM contains the three-byte ID of the transmitter it was paired with)Line protocolIt's 868MHz FSK (specifically 868.29MHz), 4kHz deviation. With that said, the receiver module's IF filter is considerably wider. A '1' sent to the modulator makes it transmit on the lower frequency (868.29MHz minus 2kHz). The transmitter chip is a TDA5100.Encoding is Manchester biphase, 800us per bit. "01" is a zero, "10" is a one.There's a 40-cycle preamble (400ns period, 50% duty) followed by a 1.6ms gap, then the Manchester coded data.Every byte is packed into a 12-bit block: Start - 8 bits - Parity - Stop - StopStart bit is a '0', then 8 data bits (sent LSB to MSB), odd parity, then two '1's for stop bits.Packet protocol4byte Preamble (68 07 07 68 hex) -- ID0,ID1,ID2 -- Pa,Pb,Pc,Pd -- checksum -- terminator.ID0,1,2: transmitter ID -- unless this is a pairing block, when the ID is set to zero.Pa: 0x80 for a pairing block, otherwise 0x01 for normal operation or 0x02 for low battery indication.Pb: ID0 in a pairing block, otherwise 0x00 for no heating demand of 0xFF for heating demand.Pc: ID1 in a pairing block, otherwise a sequence number: 0x0A, 0x14, 0x28, 0x32 (then wraps round to 0x0A)Pd: ID2 in a pairing block, otherwise 0x14Checksum: The additive checksum of ID0 through Pd inclusiveTerminator: 16 hex in a pairing block, otherwise 68 hexWhen the thermostat is first powered up, it sends Pairing packets every five seconds for a couple of minutes. (IIRC the actual pattern is slightly more complex, but the exact timing isn't in my notes)After the pairing sequence finishes, it waits 180 seconds, then transmits a Status packet every 180 seconds if the heating demand state hasn't changed.When heating demand changes (off->on or on->off), it sends three Status packets at 5-second intervals, then reverts to sending them every 180 seconds.I don't think there's any modulation capability, because the receiver module's output is a switch driver. Possibly the boiler is modulating because the TRVs are starting to switch off or the thermostat is oscillating around the setpoint.

author: QuitButton
author_rank: Contributor
timestamp: July 14, 2020, 09:09:51 pm
content: I've been pointed to the pose by philpem as I was helping a friend a while back to get some of the MT10RF protocol worked out - we didn't get too far and then unfortunately life got in the way...However, I've just spent a few hours over the last couple of days coming up with a bit of rough STM32 arduino code that creates a bitstream array that matches the protocol you've posted and it matches a few sample captures I've compared it against. I'll tidy it up a bit and post it somewhere as it could be useful for someone.The plan was to use a RFM22B to transmit the code (I can't see as it can be transmitted using the RFM22b's internal packet handler, so I coded it to use a timer)...but I'll admit I'm totally baffled by the RFM22B's datasheet and so far I've have little luck making head nor tail of any example code to get something as simple as the right frequency and offset.Does anyone know of a simple to use Arduino friendly TX module for 868MHz?

author: QuitButton
author_rank: Contributor
timestamp: July 31, 2020, 11:26:20 am
content: Quote from: philpem on June 03, 2020, 02:43:53 pmI'm seeing something more than just a basic sequence number. The one I'm playing with now for an "on" command sends 3 x "on" with 0x28, a pause, one "on" with 0x32, then back to 0x28 while heating needs to be on. For the off sequence it sends 3 x "off" with 0x14, a pause, "off" with "0x0A", then "off" with 0x14 etc.Quote from: philpem on June 03, 2020, 02:43:53 pmI don't know much about RF but looking at the signal using SDRsharp and a RTLSDR I'm seeing near 100k between upper and lower peaks. Surely that can't be right can it?