Replicating behaviour of a device with CC1100 transmitter (868MHz)

Using Arduino Project Guidance
#1

I have a wireless thermostat for my central heating system that I’d like to replace with an arduino+tranceiver.

The manual for the existing device says it uses 868MHz for data transmission: http://www.honeywelluk.com/products/Systems/Wireless-Enabled/Sundial-RF2-Pack-2/

I opened up the device and was pleased to see at Atmega329V and quickly identified the other chip - a Texus Instruments C1100 tranceiver. (see attached image)

It looks like the C1100 has been superseded by the C1101, but from what I’ve read they seem to be compatible.

My question is: how do I go about capturing the transmissions (for later analysis/replay)? Presumably this is simplified by having the same hardware, rather than some completely unknown protocol on the same freqency. I’ve used the NRF24L01 modules before and know they have different channels / addresses / packet size and structure - how do I approach this task?

2048×1152 648 KB

IMG_20170107_191042.jpg
IMG_20170107_191042.jpg2048×1152 648 KB

#2

and quickly identified the other chip - a Texus Instruments

Probably a fake.

#3

AWOL:
Probably a fake.

What makes you think that?

#4

NRF24L01+ works at 2.4GHz, which is totally incompatible with 868 MHz.
I think you’ll have to come up with your own protocol, or make friends with a HAM radio operator who might have tools to capture data at 868 MHz, or analyze the existing circuit, see which pins are the digital output from the TI chip to the Atmel chip, and use a logic analyzer or perhaps a protocol analyzer to see what’s being sent back & forth.

Will be a lot easier to make up your own protocol.

#5

I doubt Honeywell would be caught using fake chips.

#6

CrossRoads:
Will be a lot easier to make up your own protocol.

The hope was that I'd be able to use the existing protocol, so that I wouldn't have to replace the heating controller also.

#7

The CC1100 is actually a bi directional radio transceiver, and they usually work in pairs,ie
you can use one to receive the transmissions of another.
The radio has an spi interface so can easily be interfaced to an Arduino.
Unfortunately, the radios have a lot of configurable options such as modulation schemes which have to be matched at both ends for a transmission to be received.
Still a lot of work, and you would have to assume that the CC1101 was compatible with the
CC1100.

#8

Figuring out how the radio chip is interfaced to the rest of the thermostat and is configured by the on board microprocessor would be a moderately challenging task, even for someone who knows exactly what they are doing. And then what?

On the other hand, heating systems are very simple to control. I know which route I would take!

#9

Sounds like this is going to be too difficult for me. :frowning:

I'm aware that controlling the heating system directly would be easier - I just don't trust myself working with 240V AC.

#10

I just don't trust myself working with 240V AC.

Heating and cooling systems are (at least in the U.S. and Canada) controlled by transformer isolated, low current 24V AC circuits, and are quite safe for hobbyists to interface. Reed relays make this easy with Arduino.

See for example HVAC control circuits & troubleshooting. | Experts Exchange

#11

snorfalorpagus:
What makes you think that?

I believe that TI would spell “Texas” correctly.

#12

jremington:
Heating and cooling systems are (at least in the U.S. and Canada) controlled by transformer isolated, low current 24V AC circuits, and are quite safe for hobbyists to interface. Reed relays make this easy with Arduino.

See for example HVAC control circuits & troubleshooting. | Experts Exchange

In the UK it's not uncommon for the control system to run at 240V. I know mine does. I did manage to get something working with a relay, but didn't trust it enough not to burn my house down if it failed.

#13

Hmm... please show us a photo of the other side of that thermostat circuit board.

The board does not look like it has a section that could safely deal with 240 VAC switching (such sections are required in most countries to be well isolated from the low voltage circuitry, and clearly marked as HV).

If the thermostat board connects to another board or module that does the 240VAC switching, then you could interface to that component.

#14

jremington:
Hmm... please show us a photo of the other side of that thermostat circuit board.

The board does not look like it has a section that could safely deal with 240 VAC switching (such sections are required in most countries to be well isolated from the low voltage circuitry, and clearly marked as HV).

If the thermostat board connects to another board or module that does the 240VAC switching, then you could interface to that component.

The board in the photo is a wireless tempearture sensor / interface only. It connects to the actual controller wirelessly. The controller uses a couple of relays to switch 240V (one for central heating, one for hot water).

#15

Well, the actual controller is what you should be looking at.

It will almost certainly have low voltage circuitry (3.3 or 5V) that controls whatever switches the 240VAC, which would be solid state or electromechanical relays.

#16