Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- hardware:vaillantvrt340f [2017/04/23 23:16] – [section 9] reinhold
+++ hardware:vaillantvrt340f [2017/05/11 19:46] (aktuell) – reinhold
@@ Zeile 1: / Zeile 1: @@
 ====== Decoding the wireless heating control Vaillant CalorMatic 340f (868MHz) ======
+  - [[hardware:vaillantvrt340f|Part 1: The physical layer - Reading the wireless signal and extracting the bytes]]
+  - [[hardware:vaillantvrt340f_protocol|Part 2: Decoding the protocol]]
+  - //[[hardware:vaillantvrt340f_implementing|Part 3: Including the device in rtl_433 and potentially in RFLink or OpenHAB]]//
-In our appartment, we have a wireless heating control system made by Vaillant (probably 8-10 years old). Since I recently started into Smart Home and Home Automation (well, so far, i have mainly set up a huge net of all different kinds of sensors and some light bulbs, as I have hardly anything that could be controlled wirelessly), of course I wanted to figure out how the wireless device works and in particular whether I could include it into my OpenHAB-based home network of things...
+{{:hardware:vaillant_calormatic340f:vaillant-thermostat-calormatic-340f-front.jpg?direct&400|}}
-To detect and analyze the wireless signals, I'm using an RTL282x-based DVB-T dongle together with the RTL-SDR software.
+In our apartment, we have a wireless heating control system made by Vaillant (probably 8-10 years old). Since I recently started into Smart Home and Home Automation (well, so far, i have mainly set up a huge net of all different kinds of sensors and some light bulbs, as I have hardly anything that could be controlled wirelessly), of course I wanted to figure out how the wireless device works and in particular whether I could include it into my [[http://www.openhab.org|OpenHAB]]-based home network of things...
+To detect and analyze the wireless signals, I'm using an RTL282x-based DVB-T dongle together with the [[http://www.rtl-sdr.com/|RTL-SDR]] software.
 ===== Figuring out the Frequency =====
@@ Zeile 185: / Zeile 190: @@
 It looks like we have extracted the actual binary information from the 868MHz signal.
+UPDATE: After some more reading, it seems that this type of encoding is also known as [[https://en.wikipedia.org/wiki/Differential_Manchester_encoding|Differential Manchester encoding]] or Bi-Phase Mark Code.
 ===== Decoding the Messages =====
-Yet to come...
+Now that we know the binary contents of the messages sent by the thermostat to the boiler, the next step is to understand what these messages actually mean. [[hardware:vaillantvrt340f_protocol|I'll describe this decoding in a separate post.]]
+===== UPDATE: Bit stuffing -- but WHY? =====
+During my tests of the wireless control, I collected various different signals. Trying to group them into octets for bytes, I ended up with a dilemma: I realized that the second-to-last byte should be 0xFF and the one before was probably some kid of checksum. That left me with 9 bits before that checksum byte:
+<html>
+<pre>00000000 00000000 01111110 10110110 01101111 00000000 00000100 00000000 00000000 00010001 00101101 00000000 <span style="color: red; font-weight: bold">101111101</span> 10000010 11111111 000000000
+00000000 00000000 01111110 10110110 01101111 00000000 00000100 00000000 10000000 00010001 00101101 00000000 <span style="color: red; font-weight: bold">101111101</span> 00000010 11111111 000000000
+00000000 00000000 01111110 10110110 01101111 00000000 00000100 00000000 00000000 00010001 00000000 00000000 <span style="color: red; font-weight: bold">101111101</span> 10101111 11111111 000000000
+00000000 00000000 01111110 10110110 01101111 00000000 00000100 00000000 10000000 00010001 00000000 00000000 <span style="color: red; font-weight: bold">101111101</span> 00101111 11111111 000000000
+00000000 00000000 01111110 10110110 01101111 00000000 00000100 00000000 00000000 00000001 00000000 00000000 <span style="color: red; font-weight: bold">101111101</span> 10111110 11111111 <span style="color: red; font-weight: bold">1</span>000000000
+00000000 00000000 01111110 10110110 01101111 00000000 00000100 00000000 00000000 00000001 01111100 00000000 <span style="color: red; font-weight: bold">010111110</span> 11111011 01111111 <span style="color: red; font-weight: bold">11</span>0000000 00
+00000000 00000000 01111110 10110110 01101111 00000000 00000100 00000000 10000000 00000001 01111100 00000000 <span style="color: red; font-weight: bold">010111110</span> 10111110 01111111 <span style="color: red; font-weight: bold">11</span>0000000 00
+</pre></html>
+The first four observations were among the most frequent signals.
+In this table, I already split the binary signal into octets, i.e. bytes. Since the full signal has 129-131 bits, some extra bits need to be included to form 9-bit parts somewhere.
+As my reasoning in part 2 shows, that extra byte must be before the final three bytes, but after the fifth-to-last one. So we have the 9-bit sequence 101111101 that we must make sense of. Even worse, the last two observations appear to be shifted by one additional bit after a bit sequence of 01111100.
+After some googling, I stumbled upon the [[https://en.wikipedia.org/wiki/High-Level_Data_Link_Control#Framing|framing approach in the High-Level Data Link Control]], where the frames start with 0x7e=01111110 and the bit stuffing in the data part means that after five consecutive 1 bits, an extra 0 bit is included, which must be removed at the receiving end. Indeed, the 101111101 bit sequence is the only appearance of five consecutive 1 bits in the first few examples. Some other signals also contained sequences of 5 (but not more) consecutive 1 bits, followed by a seemingly spurious zero... Bit stuffing would explain this spurious 0 bit and even demand to remove it before interpreting the signal. If we do bit unstuffing on our signals (again, using a little helper utility [[https://github.com/kainhofer/vaillant-calormatic340f/blob/master/Vaillant_decode_bitstuff.c|Vaillant_decode_bitstuff.c]]), suddenly the signal aligns perfectly into octets to form bytes:
+| ''00000000\ 00000000\ 01111110\ 10110110\ 01101111\ 00000000\ 00000100\ 00000000\ 00000000\ 00010001\ 00101101\ 00000000\ 10111111\ 10000010\ 11111111\ 00000000'' |
+| ''00000000\ 00000000\ 01111110\ 10110110\ 01101111\ 00000000\ 00000100\ 00000000\ 10000000\ 00010001\ 00101101\ 00000000\ 10111111\ 00000010\ 11111111\ 00000000'' |
+| ''00000000\ 00000000\ 01111110\ 10110110\ 01101111\ 00000000\ 00000100\ 00000000\ 00000000\ 00010001\ 00000000\ 00000000\ 10111111\ 10101111\ 11111111\ 00000000'' |
+| ''00000000\ 00000000\ 01111110\ 10110110\ 01101111\ 00000000\ 00000100\ 00000000\ 10000000\ 00010001\ 00000000\ 00000000\ 10111111\ 00101111\ 11111111\ 00000000'' |
+| ''00000000\ 00000000\ 01111110\ 10110110\ 01101111\ 00000000\ 00000100\ 00000000\ 00000000\ 00000001\ 00000000\ 00000000\ 10111111\ 10111111\ 11111111\ 00000000'' |
+| ''00000000\ 00000000\ 01111110\ 10110110\ 01101111\ 00000000\ 00000100\ 00000000\ 00000000\ 00000001\ 01111100\ 00000000\ 10111111\ 11111101\ 11111111\ 0000000'' |
+| ''00000000\ 00000000\ 01111110\ 10110110\ 01101111\ 00000000\ 00000100\ 00000000\ 10000000\ 00000001\ 01111100\ 00000000\ 10111111\ 01111101\ 11111111\ 0000000'' |
+So, the pysical layer appears to be encoded using differential Manchester coding, after bit-stuffing. Somehow to me this does not make too much sense, as bit-stuffing  is used mainly to cause state transitions at last every five bits to allow the receiver to synchronize its clock. However, the underlying differential Manchester coding of our signal already ensures a transition after every bit, so there is no need in my eyes for additional bit-stuffing.
+But as the evidence is so overwhelmingly in favor of bit-stuffing, let's accept that the signal is bit-stuffed (except for the two final 0xFF 00 bytes) and then transmitted using differential Manchester coding.
+===== Finally: Decoding the Messages =====
+Now that we finally know the binary contents of the messages sent by the thermostat to the boiler, the next step is to understand what these messages actually mean. [[hardware:vaillantvrt340f_protocol|I'll describe this decoding in a separate post.]]