1. Part 1: The physical layer - Reading the wireless signal and extracting the bytes
2. Part 2: Decoding the protocol
3. Part 3: Including the device in rtl_433 and potentially in RFLink or OpenHAB

Remember the results of our decoding project that we did in parts 1 and 2 of our little series:

The remote control sends only the following data to the boiler, all other smart logic resides in the wireless controll (i.e. smart control, dumb boiler):

• Heating On/Off (in analogue mode: heating water temperature)
• Warm water pre-heating On/Off
• Battery OK/LOW

The data is sent in frames of 16 bytes, where the actual data is contained in bytes 4-12, and bytes 13-14 are a 2-byte checksum.

All bytes are converted to a bit sequence with least-significant bit first.

For transmission over the 868,275MHz frequency, the data contents (bytes 4-14, but NOT bytes 3 and 15) are bit-stuffed (i.e. after five consecutive one bits, one extra zero bit is inserted). The resulting bit sequence is then encoded using differential Manchester encoding (1 is encoded as a transition, 0 as no transition) based on an underlying square wave of frequency 303Hz. Each bit period will be a half-wavelength, i.e. there will be 606 bit periods per second. After each bit period, a state transition is guaranteed and does not contain any information, and in the middle of each bit period there will be a state transition for a binary 1 and no transition or binary 0.

Each signal is first sent with byte 9 set to 0x00 and shortly afterwards repeated with byte 9 set to 0x01 (and the checksum updated correspondingly).

Adding support for the heating control in rtl_433 is actually quite easy, once you realize that OOK_PULSE_CLOCK_BITS is actually differential Manchester encoding. Unfortunately, bit-unstuffing and changing bytes from least-significant-bit first to last needs to be done manually.

All this can be seen in my Pull request for the rtl_433 github repo: https://github.com/merbanan/rtl_433/pull/532/

If you clone this PR (or use the latest rtl_433 once it is merged), one can tune rtl_433 to 868MHz and see the captured signals analyzed:

reinhold@laptop:~/Software/rtl_433$ ./src/rtl_433 -f 868275000 
[...]
Registering protocol [57] "Vaillant calorMatic 340f Central Heating Control"
[...]
Registered 59 out of 79 device decoding protocols
Found 1 device(s):
  0:  Realtek, RTL2838UHIDIR, SN: 00000001

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Exact sample rate is: 250000.000414 Hz
[R82XX] PLL not locked!
Sample rate set to 250000.
Bit detection level set to 0 (Auto).
Tuner gain set to Auto.
Reading samples in async mode...
Tuned to 868275000 Hz.
2017-05-11 19:19:52 :   Vaillant VRT340f Central Heating Thermostat
        Device ID:       0x6DF6
        Heating Mode:    ON (2-point)
        Heating Water Temp.:     52
        Pre-heated Water:        ON
        Battery:         Ok
2017-05-11 19:20:12 :   Vaillant VRT340f Central Heating Thermostat
        Device ID:       0x6DF6
        Heating Mode:    OFF
        Heating Water Temp.:     0
        Pre-heated Water:        ON
        Battery:         Ok

Yet to come (I don't have a 868MHz receiver for RFLink yet, and RFLink does not support both 433MHz and 868MHz receivers at the same time, so I'm waiting until they implement support for the CC1101).