Central Heating - Decoding

After staring some time at the logic capture of my central heating, I was able to decode the way data is encoded by the unit.

The smallest unit in the capture is 6.80ms. It takes 4 units to make up 1 bit/symbol, not exactly a high speed bus. There are 3 different patterns that show up in the cap:

 MARK MARK  SPACE SPACE
 MARK SPACE SPACE SPACE
 MARK SPACE MARK  SPACE

The transmission has 56 of these patterns, followed by a silence period. This means that each transmission totals 7 bytes. I used the arduino to decode this sequence and output the result on the serial. The MARK SPACE MARK SPACE pattern is decoded as a set bit, while the other 2 decode to a 0 bit. I have no clue as to why there's 2 patterns to indicated a zero, ie. MARK MARK SPACE SPACE and a MARK SPACE SPACE SPACE, maybe it has something to do with providing the remote unit enough power to load up it's internal capacitor, since that unit is completely powered from the 2 wire bus.

I found that to debug the timing of the code, it's quite useful to use an extra IO pin on the arduino, hooked up the the 2nd channel of the oscilloscope and then toggling the line when something goes wrong. By displaying both the CV signal and the debug channel signal on the scope, it was quite easy to see where the code lost track of the signal.

After some fiddling, this is what I got out of the signal: 

26 66 74 24 02 7B 0A    0010_0110 0110_0110 0111_0100 0010_0100 0000_0010 0111_1011 0000_1010  
60 66 75 FF FF 00 20    0110_0000 0110_0110 0111_0101 1111_1111 1111_1111 0000_0000 0010_0000  
26 06 77 FF FF 00 20    0010_0110 0000_0110 0111_0111 1111_1111 1111_1111 0000_0000 0010_0000  
60 FF 76 25 02 78 0A    0110_0000 1111_1111 0111_0110 0010_0101 0000_0010 0111_1000 0000_1010  

The communication gives 4 sets of 7 bytes, then repeats. Now it was time to play with the heating and see which values changed...

Hacking the central heating

The central heating I have installed in my home (Integra Zero F29e) doesn't have any network functionality or possibility to interface with a computer. It's using a 2 wire thermostat as a control. The thermostat is powered from the 2 wires it uses to communicate with the central unit.


As I was interested in a computer interface, I set out to investigate what my options were. After some googling around, I got up to speed on the types of interfaces that exist for these kinds of devices. It seems there are 2 major interfaces. One is called Ebus and the other OpenTherm. Both of these have been dissected by hobbyists and therefor there are devices / schematics available to make an interface.

When I started this endevour, I only had a multimeter available. Measuring the 2 wires, it gave a voltage around 20-24v, which led me to believe it was an Ebus interface. So I put something together to convert the data on the bus to TTL levels, since Ebus is just 9600bps serial communication. However, it didn't quite work out.

While researching all this stuff, I figured an oscilloscope would come in handy and since these days you can pick up a digital oscilloscope pretty cheap, I went ahead and ordered a cheap Rigol DS1052e. Once I had the scope, it quickly became apparent that this system wasn't Ebus based.

As I was already on a shopping spree, I also got myself an Open Workbench Logic Sniffer and some arduino's.

I figured it would be simpler to bypass the bus driving circuit, so I had a look at the PCB of the central unit. The PCB was quite simple, it's nothing more than a couple of relays controlled by a microprocessor, in this case an ST62T25.

Here the scope came in handy to check the pins on the MCU, which helped me to figure out which pins were used for the transmission and reception of data. With this knowledge, I could hook up the logic sniffer on those pins and get a dump of the data transmission. Here's how it looked:

For anyone with the same device, the data of the MCU pins are available from the topside of the PCB at points J1 (green wire) and J10 (white wire), the black wire is just a ground point.

With the logic dump available, my next step was to try and decode it. Which I'll explain in another post.

Laptop repair

With the repair done on my motherboard, I figured I'd take a look at an old laptop I still had laying around. It's an old Acer Aspire 1510 which has an nvidia graphics chip. The problem with it, was that the display output was all garbled. It was possible to boot it, but when it went into graphics mode, it would usually lock up pretty fast.
This is something that happens to many laptops with nvidia chips. The issue, from what I understand, is that due to the way the chipset heats up, the forces on it cause the solder joints to fracture.
These are BGA (Ball Grid Array) chips, reworking those needs specialized equipment although you can find BGA rework equipment pretty cheap on sites like aliexpress. However for a one off on an old laptop, it would still be too much and I doubt it will be easy the first time you try to reball a BGA.

Luckily, there's a cheaper and much easier way!

Basically what you can do is remove the PCB with the GFX chip and just put it in a normal oven at 200 degrees Celcius for 10 minutes. This will cause the solder joints to reflow and fix the fractures. There's plenty of youtube videos demostrating the effect. So I figured I'd give it a shot... 10 minutes later my freshly baked laptop was resurrected!

Upgrade from hell

About two weeks ago, I decided to finally take the time to upgrade an old Ubuntu 10.04 on a home server. This ofcourse involves a couple of upgrades, since that release is too old to bump to the latest and greatest.
The first upgrade step went rather uneventful, albeit slow. However, my weekend plans were quickly interrupted when after booting the new release, the machine decided to insta power off after 2 minutes. *sigh*

Mind you, this machine did give the occasional warning about temperature issues before the upgrade, so my first reaction was to think too much dust had collected on the CPU cooler. I opened the machine and tried to clear the dirt that had settled between the cooler and the CPU heat sink.. however while doing that, I accidentally broke one of the fan supports.. doh!

This was starting to get annoying. Good thing I had some super glue lying around. Couple of minutes later, the support was firmly reattached and I could continue (though the fan wasn't 100% aligned, causing it to scratch the sides a bit, making a wonderful whining noise)

After this operation, I could boot the board again and it seemed to stay up. Just to be safe, I kept it running overnight before continuing my upgrade fiasco.

The next day, still no reboot issues. So I prepared to do the remaining upgrades. It didn't take long for new issues to pop up. One or two minutes after starting the update manager, the machine again went completely dead. However this time, I couldn't power on the machine anymore. The hardware had completely failed this time. Just my luck again...

Now it just so happens that I recently picked up my interest in electronics again. Therefor instead of throwing out the board, I had a look at what I could do or find about what was wrong.

First investigation showed that I could power it on if only the 20 pin ATX connector was attached, but when the 4 pin ATX connector was also connected, it refused to work for more than 1-2 seconds.

That 4-pin ATX connection supplies 12V to the VRM section of the motherboard. When looking closer, I noticed 2 capacitors which were bulging, which is usually a dead giveaway that they are damaged.

This looked promising...

I had some old CD and DVD audio player I wasn't using anymore, so used those to find some spare parts. Desoldered a couple of capacitors from them and put them in the motherboard. However, while turning the motherboard around a couple of times to see what I was doing, I accidentally also turned one of the caps around. Needless to say the repair didn't work. To add insult to injury, I also took the wrong cap for 1 of the replacements, picking a 6.3V in a place that had a 16V cap.

Some swearing ensued...

When I corrected the error, the board still didn't work (maybe it would have, if I didn't screw up the first fix).

Since working without a schematic is fairly hard, especially for a novice in electronics. I decided to just check on google if there was any info to be found for this motherboard (MSI 6728). To my surprise the service manual with a full schematic turned up. Nice!

Anyway in order to pinpoint the issue, I hooked up my lab power supply and put some juice on the 12V circuit. This immediately showed that there was a short circuit on that rail. When I turned up the amps, one of the MOSFETs quickly heated up, while the neighbouring ones which were for the other phases didn't. So I decided to desolder that MOSFET and check again.

With that one removed, the short on the rail was gone and the lab supply showed a steady 12V. To double check, I reconnected the original PSU, but nothing happened. It seemed the PSU had died due to the short, good thing I still had another PSU around and decided to try that one. This time the board booted again!

Next problem was actually finding a replacement part. I could only find the old part on mouser, but it was EOL and out of stock, but they did have a similar part (I made sure the rise and fall times were the same or better, since I figured that was important.. for details, google for multiphase buck converter). The part was only 60 euro cent, but of course shipping was a biatch, but I offset that by ordering some more goodies :-)

Few days later, the order arrived and a couple of minutes later, I was enjoying the fruits of my labor... my board was booting again! Victory!