Monday, April 15, 2013

Hacking the central heating

The central heating I have installed in my home (Integra Zero F29e) doesn't have any network functionality or possibility to interface with a computer. It's using a 2 wire thermostat as a control. The thermostat is powered from the 2 wires it uses to communicate with the central unit.


As I was interested in a computer interface, I set out to investigate what my options were. After some googling around, I got up to speed on the types of interfaces that exist for these kinds of devices. It seems there are 2 major interfaces. One is called Ebus and the other OpenTherm. Both of these have been dissected by hobbyists and therefor there are devices / schematics available to make an interface.

When I started this endevour, I only had a multimeter available. Measuring the 2 wires, it gave a voltage around 20-24v, which led me to believe it was an Ebus interface. So I put something together to convert the data on the bus to TTL levels, since Ebus is just 9600bps serial communication. However, it didn't quite work out.

While researching all this stuff, I figured an oscilloscope would come in handy and since these days you can pick up a digital oscilloscope pretty cheap, I went ahead and ordered a cheap Rigol DS1052e. Once I had the scope, it quickly became apparent that this system wasn't Ebus based.

As I was already on a shopping spree, I also got myself an Open Workbench Logic Sniffer and some arduino's.



I figured it would be simpler to bypass the bus driving circuit, so I had a look at the PCB of the central unit. The PCB was quite simple, it's nothing more than a couple of relays controlled by a microprocessor, in this case an ST62T25.

Here the scope came in handy to check the pins on the MCU, which helped me to figure out which pins were used for the transmission and reception of data. With this knowledge, I could hook up the logic sniffer on those pins and get a dump of the data transmission. Here's how it looked:



For anyone with the same device, the data of the MCU pins are available from the topside of the PCB at points J1 (green wire) and J10 (white wire), the black wire is just a ground point.



With the logic dump available, my next step was to try and decode it. Which I'll explain in another post.


5 comments:

Mirko Ugolini said...

Hi Karl,
Tell me that you decode the protocol!!!

I have the same Heather and I'm trino to interfacce it With Arduino and Android.

Let me know Please.

Mirko Ugolini

Karl Vogel said...

Yes, I'm able to read out the data and interpret it.

I posted some info on how to interpret the analog signal, here: http://poke152.blogspot.co.uk/2013/07/central-heating-decoding.html

I haven't continued on the project, but last status was that I hooked up the status readout with an arduino to my main linux machine running graphite / team dashboard to show graphs of the temperature etc.

I'll see if I find the time to dig it up again and write some info about it.

Mirko Ugolini said...

Hi Karl

could you kindly send to me the Arduino Sketch?

mirko.ugolini(AT)gmail.com

regards

Mirko

Karl Vogel said...

Sure, I'll dig up the sources.

Unknown said...

Hello, Karl!
Could you kindly send arduino sources to me if you have some yet? antonpakhomov(dogtail)gmail.com

regards
Anton