Mimicking RF boiler/heater control

Projects General Guidance
1

Hello everyone.

I'm looking into a fun but challenging personal project and would love some guidance from anyone who might have some to share!

In my house is a combi-boiler which comes with a wireless box in which we can set the temperature. It's as simple as a dial and an LCD display. When we move the dial, the set temperature goes up or down and is immediately transmitted to the boiler which adjusts itself to match that temperature. Not unique by any means and in theory a very simple design.

From my limited research and dangerous assumptions, I'm led to believe the data is transmitted over an RF signal, and as I do not recall ever having to 'pair' the two devices, I imagine there is primitive/no authentication.

I've worked with Bluetooth before (in fact I have a project on the go at the moment thanks to some great help from people on this forum) but never RF and know very little about how to reverse engineer the signals and their frequency.

So, I have three major questions currently:

  • How do I work out what frequency it transmits on?
  • How do I intercept the signal? (So I know what to send from the arduino)
  • What kind of parts (generically speaking) will I need?

The workflow I have in my head currently is:

  • Get frequency
  • Listen to signal and note down the protocol
  • Build Arduino based device that has bluetooth/wired connection to PC and an RF antenna of correct freq.
  • Build PC/Phone app to instruct arduino to transmit relevant signals and change heating setting
  • Enjoy being able to set the heating in my house from the comfort of the sofa (instead of wherever the hell we left the ugly wireless thermostat thing)

(I'm looking to integrate a few other household appliances into a centralized 'House Controller' app)

Here are some pictures of the wireless thermostat, and it's underlying circuit:

Device
Circuit front
Circuit back

Thanks for reading and I look forward to your thoughts :slight_smile:

2

For part #1 i would start with an SDR device. Might be also nice to analyze the protocol.
Works with DVB-T /DAB Sticks : http://www.rtl-sdr.com/tag/sdrsharp/

3

Thanks Greennose120, would something like this do the trick?

http://www.gearbest.com/tv-box-mini-pc/pp_188367.html?currency=GBP&gclid=CPn12Z2t-ssCFUQcGwodNGQBCw

4

There is a 13.56 MHz crystal on the rear of the PCB.

My guess is that the transmitter frequency is a multiple of that frequency.

And I don't think it is just a coincidence that 32 x 13.56 MHz = 433.92MHz, which is actually the center frequency of one of the industrial, scientific and medical (ISM) radio bands.

Transmitters and receivers working on this frequency are readily available.

If you were to buy a receiver for that frequency you could use an Arduino or Oscilloscope to analyse the data that is being transmitted by the device.

Once you have worked out how the data is sent you can then program an Arduino to send data from a suitable transmitter.

5

To confirm or deny what I surmised about the transmitter frequency, you could try consulting the datasheet of the 8 pin IC that I have circled in red on the photograph below.

I couldn't read the type number of this IC, it is obscured by the transparent plastic ring.

Could you tell us what it is please?

Also try measuring the length of the track that I have coloured yellow, which I believe is the antenna. I'm predicting it should be close to a quarter wavelength at the transmitter frequency, which is 300/(433.92 x 4) metres = 173mm.

2016-04-06 15.25.42 marked up reduced size.jpg
2016-04-06 15.25.42 marked up reduced size.jpg449×797 108 KB

6

John,

Thanks for what I can only describe as an impressive reply, your knowledge of RF has me very jealous indeed! :slight_smile:

Ok, so I took a photo of the chip and after shining a light on it was able to read the following:

T 574
508

The chip

Measuring was rather difficult, I used a piece of wire and got a rough estimated reading of 147mm, or 132mm from the large gold square about 1cm from the beginning of the track (first solder joint from the resistor)

7

I see that the large TQFP is a Atmel device. You may dump the code running on it. Please share it's number too.

8

I see 5 pads next to the atmel part(m169PA),MAY BE SPI interface ??,so you wont need a spoofer/scope to find the protocol.

9

Thanks for the response MalharD.

I see that the large TQFP is a Atmel device. You may dump the code running on it. Please share it's number too.

I see 5 pads next to the atmel part(m169PA),MAY BE SPI interface ??,so you wont need a spoofer/scope to find the protocol.

These both sound like really interesting things to do, please could you point me int the right direction/ roughly outline the steps I'd need to do? I'm a confident programmer but have never delved into pulling code off a chipset before! :slight_smile:

10

This is only possible if they have not put a lock on their flash,probably not,it is a simple controller. When I looked at the datasheet(>60MB) The SPI pins are NOT FREE. MISO is connected to a tact switch,MOSI is connected to something other. SCK is free. Reset is tied to some SOT23. I wonder how they programmed that thing. Do you have any experience with an "arduino as isp" or a "usbtiny" or similar ?
Even if you read the flash, you need to disassemble it. I think that they may have the instructions for setting the temp in the EEPROM
we may go like-

  • Read the flash and store it safely on the PC.
  • Reflash it with a code to read the EEPROM
  • Read the EEPROM
  • See if data in the EEPROM is useful or not
  • If yes,Use it for Arduino
  • If not,then disassemble the flash read and find their code

OR

Use a scope to find the packets sent and received,but I don't know how.

11

"I wonder how they programmed that thing. "
Might have been programmed in bulk before being assembled onto the board.

12

CrossRoads:
"I wonder how they programmed that thing. "
Might have been programmed in bulk before being assembled onto the board.

Can we disassemble the flash read ?