I opened up the device and was pleased to see at Atmega329V and quickly identified the other chip - a Texus Instruments C1100 tranceiver. (see attached image)
It looks like the C1100 has been superseded by the C1101, but from what I've read they seem to be compatible.
My question is: how do I go about capturing the transmissions (for later analysis/replay)? Presumably this is simplified by having the same hardware, rather than some completely unknown protocol on the same freqency. I've used the NRF24L01 modules before and know they have different channels / addresses / packet size and structure - how do I approach this task?
NRF24L01+ works at 2.4GHz, which is totally incompatible with 868 MHz.
I think you'll have to come up with your own protocol, or make friends with a HAM radio operator who might have tools to capture data at 868 MHz, or analyze the existing circuit, see which pins are the digital output from the TI chip to the Atmel chip, and use a logic analyzer or perhaps a protocol analyzer to see what's being sent back & forth.
Will be a lot easier to make up your own protocol.
The CC1100 is actually a bi directional radio transceiver, and they usually work in pairs,ie
you can use one to receive the transmissions of another.
The radio has an spi interface so can easily be interfaced to an Arduino.
Unfortunately, the radios have a lot of configurable options such as modulation schemes which have to be matched at both ends for a transmission to be received.
Still a lot of work, and you would have to assume that the CC1101 was compatible with the
CC1100.
Figuring out how the radio chip is interfaced to the rest of the thermostat and is configured by the on board microprocessor would be a moderately challenging task, even for someone who knows exactly what they are doing. And then what?
On the other hand, heating systems are very simple to control. I know which route I would take!
Heating and cooling systems are (at least in the U.S. and Canada) controlled by transformer isolated, low current 24V AC circuits, and are quite safe for hobbyists to interface. Reed relays make this easy with Arduino.
jremington:
Heating and cooling systems are (at least in the U.S. and Canada) controlled by transformer isolated, low current 24V AC circuits, and are quite safe for hobbyists to interface. Reed relays make this easy with Arduino.
In the UK it's not uncommon for the control system to run at 240V. I know mine does. I did manage to get something working with a relay, but didn't trust it enough not to burn my house down if it failed.
Hmm... please show us a photo of the other side of that thermostat circuit board.
The board does not look like it has a section that could safely deal with 240 VAC switching (such sections are required in most countries to be well isolated from the low voltage circuitry, and clearly marked as HV).
If the thermostat board connects to another board or module that does the 240VAC switching, then you could interface to that component.
jremington:
Hmm... please show us a photo of the other side of that thermostat circuit board.
The board does not look like it has a section that could safely deal with 240 VAC switching (such sections are required in most countries to be well isolated from the low voltage circuitry, and clearly marked as HV).
If the thermostat board connects to another board or module that does the 240VAC switching, then you could interface to that component.
The board in the photo is a wireless tempearture sensor / interface only. It connects to the actual controller wirelessly. The controller uses a couple of relays to switch 240V (one for central heating, one for hot water).
Well, the actual controller is what you should be looking at.
It will almost certainly have low voltage circuitry (3.3 or 5V) that controls whatever switches the 240VAC, which would be solid state or electromechanical relays.
