X2D decoding attempt

[SixK]

@marcelr,
Thank's, This Retargetable Decompiler is really great.

API_XXD.c probably handle X2D packets, but actually I can't make it match with data I receive.
To have a better understanding of the file, decompile it once again on https://retdec.com to have a look at generated callgraph. (note, you can also decompile it to python source code)

Actually I can't make match any part of this code to data I get. I don't know if this code will help.
Interresting variable is v4 that can take a value from 1 to 30 and seem's to impact several other variables.

I'm actually try to add 2 other functionnalities :
Vacancy mode, that put Heaters to "Frost Protected" mode (HG - Hors Gel)
Heater Off mode, that turn off heaters.

SixK

[marcelr]

To have a better understanding of the file, decompile it once again on https://retdec.com to have a look at generated callgraph. (note, you can also decompile it to python source code)

I know, I have all those, but I just uploaded the C-code. Like I said, I don't have any X2D stuff, so can't test. As for the python, I'm fluent in C, not so much python ...
The code that's generated is basically assembler, translated to a higher level source code. I find the extraction of data structures the most interesting part of retdec.

grtz,

marcelr

[SixK]

OK, found something interesting,

Deltia 1.03 device use 2nd message sent by Deltia8.33 to Turn Off/On Heaters and for HG mode.

So :
- 1rst message is for ECO/Comfort mode and Heater Association
- 2nd message for On/Off and HG mode

When sending ECO/COMFORT message, 2nd message is "On/OFF" State (In this state it's always On)

When sending On/Off message, 1rst message is probably currrent COMFORT/ECO state seen by Deltia 8.33 emitter device.

Github source code updated with Power On/Off and HG modes :
https://github.com/SixK/CC1101-X2D-Heaters

SixK

[SixK]

If some of you have a DVB Tuner TV (RTL_SDR compatible) stick and a Deltia emitter,
could you please catch your messages with rtl_433 and share your results ?
This should help to validate some assumptions and learn a bit more on X2D protocol.

I need messages for Area1, 2 3 (if your deltia device handle 3 zones) with Sun, Moon, Power Off, Power On and HG functionnalities to compare with mines.

If some of you have a RFBee or a similar device, you can associate your heaters with my values.
It should work as is without changing a single line in my source code.
I know that Deltia receivers can be associated with at least 2 areas, but I don't know if it can be associated with 2 areas from 2 differents houses (Deltia emitter house Id).

SixK

[ervplecter]

will try asap. I don't have a DBV key but I have the USB receiver so I can probably read plain jane X2D and log it
will report

[SixK]

@ervplecter,

Data you already shared were usefull, but I need the same without values replacement by its ascii letters, in hexa (preferably, I can do conversions and I'll convert in binary anyway to be able to compare) and in LSB instead of MSB (but I have a script to convert values if necessary).
It will be necessary to clearly mark all datas with Area, action and 1rst/2nd message.

Here is my latest excel working file :

analyse_log2.zip

(135.89 KiB) Downloaded 133 times

SixK

[SixK]

Hi,

Updated my gitHub :
- Fixed wrong values for Area1 Sun and Moon commands
- Moved pyX2DCmd.py to pythonScripts directory
- Added pyDeltia.py (and HandlePlanning.py class) to Handle Heaters on a Week
- Added chauffage.ods (and chauffage.csv) to Plan Heaters on a Week


SixK

[jarek]

Hi all !

A very interesting thread indeed!

As I happen to have an Delta Dore Starbox F03 CPL (8 heating zones + water heater control + 'out of home for X days heater control' ) with their RF bridge Tydom 520 I would be interested in testing the solution you've found ...

Got some solid bases in Linux, but this area is a novelty for me

I looked at the GitHub page and while - some - requirements seem mostly clear to me (RFBee, UARTSbee) I'm little bit
puzzled by the DVB (SDR compatible) USB key:
- is that mandatory for reading initial sequence from Delta Dore system ? (I understand that RFBee alone can;t do that ? - needs to be reprogrammed first ?)
- can you recommend any of such DVB key model ?

Also my understanding is that "any" linux will do (giving above mentioned devices are supported of course ) and arduino itself as such is just an option to have a tiny hardware "package" connected to home automation ?

are my assumptions above correct ?

Thanks !

Jarek

[SixK]

Hi jarek,

Reading Delta dore documentation, TyDom 520 is an emitter, so you will not be able to command it using RFBee.
I suppose your heaters are managed by CPL (PLC in english) ?

You only can command Deltia 1.0x receivers (I dunno if Delta dore has produced any other X2D RF receivers for heaters).
If you have such receivers then it should work.

DVB Stick will let you catch RF messages from your TyDom520 and you will keep control on your Heaters with TyDom520 and your RFBee.
Without the stick, you will have to associates your heaters with my settings and your Tydom520 will not be able to control Heaters (unless Deltia receivers accept to be associated with 2 "houses"), until they are associated to Tydom520 again.

RFBee should be able to catch messages, but I didn't managed to make it works in receiving mode to get valid data,
but as I can send messages, I should try again to catch messages with RFBee.

For DVB stick, if you are located in france, you can buy the following one (quite low price and said to be RTL-SDR compatible) :
https://www.passion-radio.com/fr/recept ... t-249.html

RFbee with my source code can be used with Linux, Windows and probably MacOs X.
Python Script I done to manage heaters on a Week will probably work on Windows (not tested, you will just have to add a scheduled task to start the script every 30 minutes or less)

SixK

[jarek]

Hi
Many thanks for the info, ordering necessary hardware , will try to test when it arrives in few weeks.

The TyDom 520 seems to be emitter/receiver (notice says bi-directional: http://www.deltadore.fr/data/product_fi ... -rev03.pdf, and starbox f03 cpl docs: http://www.deltadore.com/mediastore/23/ ... iginal.pdf , page 16-18 mention using it with add-on RF products and TyDom 200 remote)

Yes, heaters are CPL driven by starbox but it seems that starbox itself can be commanded by an RF remote.

Thanks !

Jarek

[SixK]

Well, I read again documentation about Tydom520 module, it may work with association functions I have coded.
But don't expect too much, it's not clear about what can be done. Maybe in this case, you need full message (74 bytes instead of 14 bytes ) ? Maybe messages are different ? And maybe it's not a use case covered by the module ?

You possibly have 2 ways to command Heaters with TyDom520 :
- Simulate a TyDom Remote (maybe my Association command will work ? You can catch messages and send them with RFbee if you have such a remote)
- Simulate a X2D Alaram device (but if you don't have such a device, it will be hard to get messages. Maybe Poloalexis could help in this case ?)


For others, my heaters are now driven since 2 days by my RFbee connected to Raspberry pi (My Deltia emmitter is turned off in manual mode)
Python Planning script is working fine. I'll have to see if there is an interest to program Heaters 15 minutes by 15 minutes (or less).

Next step, PHP script to drive heaters online...

SiXK

[jmbjmbjmb]

Hi,

Reading through the many messages in this topic, I believe that I just found what I have been looking for over 2 years.
I have a Deltia from Delta Dore that switches my boiler on and off, with the thermostat sending orders according to temperature.

Could you please confirm that you code allows for sending on and off signals to the switch (i.e., the wireless device that is on the boiler side) in place of the thermostat ?
My goal here being to replace the thermostat and have a raspberry decide when to switch the boiler on and off ?
From the documentation, I understand that there is also a hors-gel (non-freeze) signal. Is that so ? Because I thought the switch was a simple on/off device.

Finally, RFBees + the USB adapter are quite expensive. Is there anything cheaper that I could use with the raspberry to send the signal ?

Thanks

[SixK]

Hi jmbjmbjmb,

I have no idea if my code will work with your devices.
Only tested devices are Deltia 1.03 receivers driving Heaters with "copy/past" messsages from a Deltia 8.33 emitter.

Messages sent by my code are : Sun (comfort), Moon (Eco), HG (Non freeze), On (power On), Off (Power Off) and Associate.
Missing message is "Test".

I only use 14 first bytes from messages sent by Deltia 8.33 (full message is about 75 bytes), I actually have no idea what that extra 61 bytes are used for.

With a RTL_SDR DVB stick, you should be able to catch and add any missing messages. (and replace existing messages by thoses emitted by your own Deltia Emitter)

Do you have more informations about your devices (Full designation) ?

RFBee + UArtSbee is the easy way, it's quite expensive when bought in france (about 26Euro + 20Euro + shipping), but you can buy directly from china. (should cut the cost in half)
Any RF868 module with CC1101 chip can replace RFbee (you can find some for about 7 Euro from china), then you will have to see how to upload my firmware.
You probably also could buy an USB Stick with CC1101 chip but I don't know if you will have to modify sources or not.

In any case, if not using RFbee, be sure to buy a RF 868 Mhz version (not a 433 Mhz, even if such a version should also work, it will not be optimized for 868Mhz, so you may have problems...).

@others, I just seen that github didn't took my "chauffage.ods" file, but ".csv" is available. I'll have to see how to send ".ods" file on github.

SixK

[jmbjmbjmb]

Hi SixK,

Thanks for the very fast reply.
So it is a Deltia 8.03 (Ref: 6050417). Other indications shown directly on the board : 17420SD and on stickers: 4100544, 4090230, T018, S29. I've bought it in July 2013.

So, my understanding is that would be able to use your code to send the various signals but that would require first to find some uniq id that is sent by my device.
I do have a DVB-T usb stick for that purpose. To obtain "readable" values, did you have to go through the hassle of using GNU Radio or is there an easier way ?

To give you more information about the overall goal:
So, I have the thermostat device of course to "drive" the boiler. The only annoying thing is that this device must be located in the colder room to have the boiler on until the right temperature has been set. Of course, the colder room in my house is not always the same (our kitchen is pretty cold but not anymore when we start cooking). I do not want to move the thermostat/sensor around the house to find the colder room.
So, the idea was to put wireless temperature sensors in each room (e.g., either something I would build out of an arduino board (or even just an atmega chip) + DSB18B20 sensor and the communication would happen over 433 RF as these are pretty cheap). Or, I would simply buy a bunch of temperature sensors (that are to be used with weather stations) and have rtl_433 capture/decode using the DVB-T dongle on my raspberry pi. And then I would have the boiler on until all rooms have reached their set temperature (for short, something smarter than what the actual Deltia does).

Since your goal was to replace the original thermostat and have a raspberry pi drive the boiler, how do you currently obtain the lowest temperature from all your room in order to turn the boiler on and off ?

[jmbjmbjmb]

After re-reading your answer, I just figured that we are not on the same devices. Yours is for electric heaters. Then I understand why you had the various signals that correspond to a pilot wire signal (fil pilote). Though, I'm sure that the protocol must be pretty much the same in terms of RF. The one thing I noticed when I listened to the signal using my DVB-T dongle with SDR Sharp is that the signal would be sent 3 times by the thermostat. Did you observe the same ? (though I understand that it does not prove that the protocol will be very similar it could still give some indication).

[SixK]

OK, Deltia 8.03 doesn't have exactly the same functionnalities as Deltia 8.33, but message should not be really different.
Deltia 8.33 only send orders to heaters to go in Comfort mode or Eco mode (-2 or -4 degrees), then heaters decide to heat or not depending on its own integrated temperature sensor. Deltia 8.33 is not really a Thermostat, it doesn't react to temperature, but only send orders depending on Week day and Hour.

DVB-T stick will be used to catch messages that your Deltia 8.03 send to your receiver (Deltia 1.13 ?)
You may use my own message, but in this case you will have to associate your receiver with my values. In this case your Deltia 8.03 will not be able to take controle over your Boiler. And I have not idea if my messages can control your Boiler since messages may not be the same.

So best is to catch messages from Deltia 8.03 with RTL_433 tool and then replace my values by yours. (or create/add your own keywords/variables for boiler)
RTL_433 tool (https://github.com/merbanan/rtl_433 probably only works on Linux, you will probably have to compile it manually).
Once compiled, the following command line should work : rtl_433 -D -A -f 868340000

Be carefull with cheap 433Mhz modules, 1rst price modules may not be able to send data to more than 5/6 meters (distance depends partly from input Voltage from 3v to 12v for emitter and 3v to 5v for receiver). At least when receiving data from my cheap Commercial Weather Station modules powered by 2x1,5v battery, I don't catch anything after this distance. 433Mhz Modules with something like a CC1101 are probably better.
Wifi modules are also a good solution, you can find some for about 5 Euro in china and you will be able to plug an USB dongle directly on Raspberry Pi.

Before buying anything, I would suggest you to first catch messages from your Deltia device and post them here.
I Should be able to tell you if it's something near to what I have for my heaters or something totaly different.

For a good Temperature regulation you will probably have to use a PID library :
https://en.wikipedia.org/wiki/PID_controller
https://www.raspberrypi.org/forums/view ... 37&t=63714

SixK

[jmbjmbjmb]

Thanks

So, I am getting a lot of these:
bitbuffer:: Number of rows: 25
[00] {0} :
[01] {0} :
[02] {0} :
[03] {0} :
[04] {5} 80 : 10000
[05] {1} 80 : 1
[06] {7} fe : 1111111
[07] {5} f8 : 11111
[08] {0} :
[09] {0} :
[10] {1} 80 : 1
[11] {0} :
[12] {0} :
[13] {0} :
[14] {1} 80 : 1
[15] {1} 80 : 1
[16] {0} :
[17] {0} :
[18] {0} :
[19] {1} 80 : 1
[20] {2} c0 : 11
[21] {0} :
[22] {0} :
[23] {0} :
[24] {256} ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f3 ff ff ff ff ff ff ff ff


Though it might be coming from other 868MHz that I have at home.

Also, this:
bitbuffer:: Number of rows: 25
[00] {0} :
[01] {0} :
[02] {0} :
[03] {0} :
[04] {5} 08 : 00001
[05] {1} 80 : 1
[06] {7} fe : 1111111
[07] {5} f8 : 11111
[08] {0} :
[09] {0} :
[10] {1} 80 : 1
[11] {0} :
[12] {0} :
[13] {0} :
[14] {1} 80 : 1
[15] {1} 80 : 1
[16] {0} :
[17] {0} :
[18] {0} :
[19] {1} 80 : 1
[20] {1} 80 : 1
[21] {2} c0 : 11
[22] {0} :
[23] {0} :
[24] {249} ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 80
pulse_distance 189321

Also this:
bitbuffer:: Number of rows: 25
[00] {0} :
[01] {0} :
[02] {0} :
[03] {0} :
[04] {3} e0 : 111
[05] {1} 80 : 1
[06] {3} e0 : 111
[07] {4} f0 : 1111
[08] {0} :
[09] {0} :
[10] {1} 80 : 1
[11] {0} :
[12] {0} :
[13] {0} :
[14] {0} :
[15] {0} :
[16] {0} :
[17] {0} :
[18] {0} :
[19] {1} 80 : 1
[20] {0} :
[21] {0} :
[22] {0} :
[23] {0} :
[24] {148} ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f0
pulse_distance 3189466

or that:
bitbuffer:: Number of rows: 25
[00] {0} :
[01] {0} :
[02] {0} :
[03] {0} :
[04] {6} fc : 111111
[05] {0} :
[06] {3} e0 : 111
[07] {2} c0 : 11
[08] {0} :
[09] {0} :
[10] {1} 80 : 1
[11] {0} :
[12] {0} :
[13] {0} :
[14] {0} :
[15] {1} 80 : 1
[16] {0} :
[17] {0} :
[18] {0} :
[19] {1} 80 : 1
[20] {1} 80 : 1
[21] {1} 80 : 1
[22] {0} :
[23] {0} :
[24] {154} ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c0


and also a few others that are quite similar.

Does this look like yours ?

[SixK]

No, it's not what expected, you should have something like that : 0x55,0x7f,0x5d,0xa4,0xca,0x95,0x32,0xad,0x95,0x4a,0x81,0xc3,0x80,0x3f, .......
rtl_433 should say that data are Manchester encoded.

Note that encoding may be different between Deltia 8.03 and Deltia 8.33 (and for receiver 1.03 and 1.13) in this case, it will be more difficult to get messages.
For exemple, it's possible that for Alarms Delta dore use a Bi-Phase mark encoding and RTL_433 doesn"t have such encoding support ... ;(
In that case, you will have to decode manually instead of using internal CC1101 decoding function.

Note that when DVB Stick is cold, you may try higher frequency like : 868400000 instead of 868340000

Obviously, you must force your Deltia sending a message to the Receiver. If you don't want to play with On/Off mode, you can send a "Test" message or an associate message. (See Delta dore documentation for this)
For better result, you must put your Deltia Emitter near your DVB stick (less than 1 meter if you don't have any antena, maybe about 1 meter and more if you have an antena)

SixK

[jmbjmbjmb]

Right, setting it to: 868400000
I am now getting since when forcing the boiler to start (3 messages as I noticed when using the DVB-T stick).
Although they are not exactly the same
[00] {596} 55 7f 23 f3 ea 55 65 56 dd 54 9f 9c 40 1f c8 fc fa 95 59 55 b7 55 27 e7 10 07 f2 3f 3e a5 56 55 6d d5 49 f9 c4 01 fc 8f cf a9 55 95 5b 75 52 7e 71 00 7f 23 f3 ea 55 65 56 dd 54 9f 9c 40 1f c8 fc fa 95 59 55 b7 55 27 e7 10 00
[00] {596} 55 7f 23 f3 ea 55 65 56 ca 85 60 77 3f e0 37 03 05 6a a6 aa 4d 5e a7 e2 30 07 f2 3f 3e a5 56 55 6c a8 56 07 73 fe 03 70 30 56 aa 6a a4 d5 ea 7e 23 00 7f 23 f3 ea 55 65 56 ca 85 60 77 3f e0 37 03 05 6a a6 aa 4d 5e a7 e2 30 00
[00] {596} 55 7f 23 f3 ea 55 65 56 ea ba 9f 87 3f e0 37 03 05 6a a6 aa 45 51 58 1e 30 07 f2 3f 3e a5 56 55 6e ab a9 f8 73 fe 03 70 30 56 aa 6a a4 55 15 81 e3 00 7f 23 f3 ea 55 65 56 ea ba 9f 87 3f e0 37 03 05 6a a6 aa 45 51 58 1e 30 00

[jmbjmbjmb]

I have run again with 3 or 4 on/off.
Hereafter the captured frames sorted by number of occurences (number of occurence : frame)
17 : [00] {438} 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
8 : [00] {596} 55 7f 23 f3 ea 55 65 56 dd 54 9f 9c 40 1f c8 fc fa 95 59 55 b7 55 27 e7 10 07 f2 3f 3e a5 56 55 6d d5 49 f9 c4 01 fc 8f cf a9 55 95 5b 75 52 7e 71 00 7f 23 f3 ea 55 65 56 dd 54 9f 9c 40 1f c8 fc fa 95 59 55 b7 55 27 e7 10 00
8 : [00] {596} 55 7f 23 f3 ea 55 65 56 ca 85 60 77 3f e0 37 03 05 6a a6 aa 4d 5e a7 e2 30 07 f2 3f 3e a5 56 55 6c a8 56 07 73 fe 03 70 30 56 aa 6a a4 d5 ea 7e 23 00 7f 23 f3 ea 55 65 56 ca 85 60 77 3f e0 37 03 05 6a a6 aa 4d 5e a7 e2 30 00
8 : [00] {435} 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
5 : [00] {596} 55 7f 23 f3 ea 55 65 56 ea 8a 9f 9f 3f e0 37 03 05 6a a6 aa 45 5d 58 18 30 07 f2 3f 3e a5 56 55 6e a8 a9 f9 f3 fe 03 70 30 56 aa 6a a4 55 d5 81 83 00 7f 23 f3 ea 55 65 56 ea 8a 9f 9f 3f e0 37 03 05 6a a6 aa 45 5d 58 18 30 00
4 : [00] {596} 55 7f 23 f3 ea 55 65 56 ea ba 9f 87 3f e0 37 03 05 6a a6 aa 45 51 58 1e 30 07 f2 3f 3e a5 56 55 6e ab a9 f8 73 fe 03 70 30 56 aa 6a a4 55 15 81 e3 00 7f 23 f3 ea 55 65 56 ea ba 9f 87 3f e0 37 03 05 6a a6 aa 45 51 58 1e 30 00