hardware:vaillantvrt340f_protocol
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
Beide Seiten der vorigen RevisionVorhergehende ÜberarbeitungNächste Überarbeitung | Vorhergehende Überarbeitung | ||
hardware:vaillantvrt340f_protocol [2017/05/05 11:36] – reinhold | hardware:vaillantvrt340f_protocol [2017/05/11 19:28] (aktuell) – reinhold | ||
---|---|---|---|
Zeile 2: | Zeile 2: | ||
- [[hardware: | - [[hardware: | ||
- [[hardware: | - [[hardware: | ||
- | - **[[hardware: | + | - //[[hardware: |
After we investigated the wireless signal that was sent by the Vaillant CalorMatic 340f over the 868MHz frequency and extracted the binary contents [[hardware: | After we investigated the wireless signal that was sent by the Vaillant CalorMatic 340f over the 868MHz frequency and extracted the binary contents [[hardware: | ||
Zeile 84: | Zeile 84: | ||
Why least significant bit first? That took me a while, too, and it stems from the way the checksum is calculated. | Why least significant bit first? That took me a while, too, and it stems from the way the checksum is calculated. | ||
- | Our sixteen base signals from above now become: | + | Our sixteen base signals from above now become |
^Heat.^Wat.^Rep.^Bat.| '' | ^Heat.^Wat.^Rep.^Bat.| '' | ||
Zeile 150: | Zeile 150: | ||
==== UPDATE: Making sense of the 0xFD byte 13 ==== | ==== UPDATE: Making sense of the 0xFD byte 13 ==== | ||
- | The byte 13 with unknown constant value 0xFD kept bothering me, and a few days after I understood the checksum byte I figured out its meaning too: As I mentioned, bytes 4-12 together with the checksum byte 14 summed up always yielded 0x0300. It seemed strange to me that the 0x03 byte of the sum was somehow ignored, until I realized that 0xFD is actually the binary complement of 0x03, i.e. the checksum is actually just byte 14, but the two-byte value of bytes 13 and 14. So, our assumption that bytes 13 with a value of 0xFD is some kind of End-Of-Data or separator byte was simply wrong, and it being constant is just a coincidence. | + | The byte 13 with unknown constant value 0xFD kept bothering me, and a few days after I understood the checksum byte I figured out its meaning too: As I mentioned, bytes 4-12 together with the checksum byte 14 summed up always yielded 0x0300. It seemed strange to me that the 0x03 byte of the sum was somehow ignored, until I realized that 0xFD is actually the binary complement of 0x03, i.e. the checksum is actually |
- | In short, bytes 13 and 14 are simply | + | In short, bytes 13 and 14 are the binary negative of the sum of bytes 4-12, with most significant byte first, i.e. bytes 13+14 interpreted as a signed integer is -sum(byte 4-12). As we are summing up only 9 bytes, there will be no overflow, either (which was what was bothering me with the 0x03 when one uses only byte 14 as checksum). |
Zeile 190: | Zeile 190: | ||
What we also observe is that the heating will still be turned on for target temperatures up to 1°C below the current room temperatur (i.e. no need to heat up the room, because it's already warm enough!), but with a low value of the heating byte. And for target temperatures above current temperature + 1°C, the heating byte will not change any more (0x5A = 90 decimal), indicating that the maximum heating intensity is already reached for target temperature of room temperature plus 1°C. | What we also observe is that the heating will still be turned on for target temperatures up to 1°C below the current room temperatur (i.e. no need to heat up the room, because it's already warm enough!), but with a low value of the heating byte. And for target temperatures above current temperature + 1°C, the heating byte will not change any more (0x5A = 90 decimal), indicating that the maximum heating intensity is already reached for target temperature of room temperature plus 1°C. | ||
- | The final indication that we need can be found in the diagnosis mode of the control: The manual states that when diagnosis mode is initiated, the boiler will be instructed to heat the water for the heating to exactly 50° C. When enabling diagnosis mode (pressing the " | + | Let's print all observed values of the heating byte in correlation with the difference between target and current room temperature: |
+ | |||
+ | The values of this chart were observed for room temperatures of 22, 22.5, 23, 23.5 and 24°C, but the current room temperature has no influence on the heating byte, only the difference to the target temperature. As observed above, the same temperature difference can lead to different heating bytes, but apparently, the possible intervals for each temperature difference are not overlapping. This is an indication that the wireless control displays the temperature only in 0.5°C steps, but measures the current room temperature (and thus the difference to the target) in higher accuracy. | ||
+ | |||
+ | The possible (decimal) values of the byte range from 0 (for OFF) to 90 (for fully ON). So, are these percentage values (i.e. 0% heating to 90%) of the capacity of the boiler? | ||
+ | |||
+ | |||
+ | The final indication that we need to fully understand the byte can be found in the diagnosis mode of the control: The manual states that when diagnosis mode is initiated, the boiler will be instructed to heat the water for the heating to exactly 50° C. When enabling diagnosis mode (pressing the " | ||
'' | '' | ||
Zeile 198: | Zeile 205: | ||
This can't be a coincidence! The heating byte must be the target temperature of the heating water. | This can't be a coincidence! The heating byte must be the target temperature of the heating water. | ||
- | This makes perfect sense: The values observed (for " | + | This makes perfect sense: The values observed (for " |
If 2-point mode is enabled, bit 8 is set and bits 1-7 carry a value of 52°C, in analogue mode bit 8 is never set and bits 1-7 carry the target heating water temperature. | If 2-point mode is enabled, bit 8 is set and bits 1-7 carry a value of 52°C, in analogue mode bit 8 is never set and bits 1-7 carry the target heating water temperature. | ||
Zeile 224: | Zeile 231: | ||
^15 || 0xFF | End of Signal indicator | | ^15 || 0xFF | End of Signal indicator | | ||
^16 || 0x00 | Epilogue (no data any more) | | ^16 || 0x00 | Epilogue (no data any more) | | ||
+ | {{: | ||
All bytes are converted to a bit sequence with least-significant bit first. | All bytes are converted to a bit sequence with least-significant bit first. | ||
+ | |||
For transmission over the 868,275MHz frequency, the data contents (bytes 4-14, but NOT bytes 3 and 15) are bit-stuffed (i.e. after five consecutive one bits, one extra zero bit is inserted). The resulting bit sequence is then encoded using differential Manchester encoding (1 is encoded as a transition, 0 as no transition) based on an underlying square wave of frequency 303Hz. Each bit period will be a half-wavelength, | For transmission over the 868,275MHz frequency, the data contents (bytes 4-14, but NOT bytes 3 and 15) are bit-stuffed (i.e. after five consecutive one bits, one extra zero bit is inserted). The resulting bit sequence is then encoded using differential Manchester encoding (1 is encoded as a transition, 0 as no transition) based on an underlying square wave of frequency 303Hz. Each bit period will be a half-wavelength, | ||
Each signal is first sent with byte 9 set to 0x00 and shortly afterwards repeated with byte 9 set to 0x01 (and the checksum updated correspondingly). | Each signal is first sent with byte 9 set to 0x00 and shortly afterwards repeated with byte 9 set to 0x01 (and the checksum updated correspondingly). | ||
+ | |||
+ | ==== Setup Mode: RF detection ==== | ||
+ | Playing around with the operator and installation modes of the Vaillant VRT340f, all signals I found fit perfectly well into the protocol described in the last section, except for one signal: RF detection: | ||
+ | |||
+ | '' | ||
+ | 0x00 00 7E FF FF 00 FF 00 F1 FF FF 6D F6 20 00 02 00 F8 8F FF 00'' | ||
+ | |||
+ | As one can see, the signal is longer, but it still follows the same pattern of the begin and end of frame bytes. Also, bit-stuffing is still used, and the checksum is calculated just like in all other packets. However, there are some differences: | ||
+ | |||
+ | ^Byte ^^ Value ^Description ^ | ||
+ | ^1-2 || 0x00 00 | Preamble (square wave to synchronize clocks with the receiver) | | ||
+ | ^3 || 0x7E | Begin of frame/data (Constant) | | ||
+ | ^ 4-19 || Data content of the frame with 2-byte checksum attached || | ||
+ | | ^4-5 | 0xFF FF | Indicates broadcast | | ||
+ | |::: ^6-8 | 0x00 FF 00 | Unknown (constant) | | ||
+ | |::: ^9 | 0xF0/F1 | Repeat: 0xF0 for original signal, 0xF1 for repeat signal (bit 1, bits 5-8 always set) | | ||
+ | |::: ^10-11 | ||
+ | |::: ^12-13 | ||
+ | |::: ^14-17 | ||
+ | |::: ^18-19 | 0xF8 .. | 2-byte Checksum (signed integer): negative of the sum of bytes 4-17 | | ||
+ | ^20 || 0xFF | End of Signal indicator | | ||
+ | ^21 || 0x00 | Epilogue (no data any more) | | ||
+ | |||
+ | |||
====== Implementing support for the device in rtl_433, rflink and/or OpenHAB ====== | ====== Implementing support for the device in rtl_433, rflink and/or OpenHAB ====== | ||
Now that we understand both the physical layer of the signal, as well as the structure of the protocol, we can go on to [[hardware: | Now that we understand both the physical layer of the signal, as well as the structure of the protocol, we can go on to [[hardware: |
hardware/vaillantvrt340f_protocol.1493984219.txt.gz · Zuletzt geändert: 2017/05/05 11:36 von reinhold