We recently had a new boiler fitted with the Salus RT500RF controller. I’ve been playing around with a lot of home automation recently involving LightwaveRF, RFXCom unit and OpenHAB. Having temperature monitoring in my lounge and bedroom I really wanted the option to be able to control the boiler allowing the OpenHAB control system to decide when to enable the boiler based on factors such as room temperature, time of day and outside temperature.
Opening the RT500 RF transmitter is pretty easy (just a couple of screws inside) and I found a nicely labelled RFM02B module inside.
I then used a JeeLink USB stick and nRFmon to find out what frequency we were operating on. I was fortunate that the transmission was long enough to be picked up on the frequency scan. It seems that nRFMon is pretty slow over a wide band. I initially thought it looked like OOK. I had hoped that I would be able to use the RFM12B in the JeeLink for reverse engineering the protocol, but this isn’t straight forward. So I got out my Open Logic Bench and decided to attack from the other side and get the baseband signal going into the RFM02.
Using the RFM02 datasheet I probed the FSK pin and discovered it’s running at approximately 2.4kHz. Knowing this I could set the logic analyser to nice long capture window by dropping the sampling rate. Using a sample rate of 100kHz I got the following trace:
This then allowed me to enter the bit timings into a spreadsheet so I could compare different messages.
At this stage I still thought I has OOK on my hands and proceeded to start trying to send the boiler control messages using the OOK method from the Jeelink. This was far from successful.
I decided I needed a bit more information about the RF protocol and decided to invest in a USB SDR (software defined radio) for about £13 from eBay. This would allow me to see the RF signal properly, decode it and then compare to what I was outputting on the Jeelink so I could debug it.
This was much more successful as I was able to receive the signal and record the RF signals as an IQ wave file for post-processing using SDR#.
Using gnu-radio and the information from a blog post about using gnuradio to decode rfm12 signals I was able to create a decoder for the boiler transmitter. The baseband signal I received and decoded from the transmitter matched nicely with what I had probed from using my logic analyser.
I was also able to ascertain that the deviation from the carrier frequency was ~+130kHz and that the carrier frequency was ~868.2 Mhz.
Now I had the raw line coded message I was needed to work out the format. Reading the RFM module datasheet I eventually realised that the message was using a standard format of a pre-amble followed by the sync word, the data and then what appears to be a stop byte. With some more data points (recording the signal sent with different address jumper settings) it should become apparent what the format of the data bits is.
However, I put that to one side at this stage as I had what I needed to turn the boiler on and off – which is the primary aim!
I then created my own version of the jeelib library to allow the control of the salus RT500RF boiler controller via the Jeelink USB stick. The library and example code can be found on github as part of my JeelinkHa (Jeelink Home Automation) project.
The main modifications are the stripping out of the RX stuff and CRC so that I can send my own custom messages. I have also created a nice wrapper for the sending of boiler commands which makes the arduino sketch somewhat simpler.
The plan is to re-implement the RX side of things so that I can receive none RFM packets (such as from the eq-3 MAX! range of radiator valves) and to also extend it so I can transmit other 868Mhz messages (such as to the eq-3 MAX! radiator valves).
OpenHAB is brilliant – it’s amazingly flexible and very powerful for home automation! To integrate the JeelinkHA control into OpenHAB I created a custom binding based on the RFXCom binding that was already present. This JeelinkHA binding can be found on github.