Page 1 of 18

Evohome / Evotouch Wireless protocol?

PostPosted: Thu Dec 23, 2010 12:07 pm
by Beat
As I have finished installing, configuring and fine-tuning my central heating system using an Honeywell Evo Touch controller and several associated devices (HR80, BDR91, R8810A1018, MT8-230LC-NC, HC60NG), the next step would be further automation / monitoring / remote control. Any ideas on how to proceed? I was wondering:

* If the Evo Home system uses a standardized communications protocol such as Zigbee or Z-Wave? Would a Zigbee/Z-Wave PC transceiver help intercepting the messages / remote controlling the controller / devices? Any recommendations for a Zigbee/Z-Wave PC tranceiver hardware/software manufacturer/model?
* If anyone is aware of PC programming or controlling software for the Evo Touch controller? It DOES have a USB connection but is not recognized as a known plug-and-play device by Windows. Are there drivers / PC control/monitoring software available?
* If there are firmware upgrades or alternative firmware images for the Evo Touch controller? Does anybody know what OS the device runs on / what language / tools the original software is developed in? Any source code / firmware flashing instructions?
* If anybody knows the hardware specs / CPU / Chipset and interface port IDs of the Evo Touch? Are there devices by other manufacturers that have similar or identical hardware specs? I have found some specs elsewhere on this forum, but they seem far from complete.

Any information would be great.

Regards, Beat Nideröst

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Thu Dec 23, 2010 3:28 pm
by Bwired
I think that will be hard, Honeywell is not opening up the protocol.
For year we want the protocol for the HR80 etc. and trying to integrate this in our own Home automation system.
Until now no luck, lets hope honeywell wil see the light in 2011 and open up!

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Thu Dec 23, 2010 5:17 pm
by Beat
Update on some info I found:

I opened the EvoTouch controller and made some really high-res scans of the PCB's. All the device numbers are readable. The photo's are too large to post here (3 .bmp images (to make sure I don't loose any detail), over 70 MB each), but I'm willing to share if somebody is interested. It's clear the central CPU is an Atmel AT91SAM9261 (as r_255 already found out, see his post "Re: Honeywell EvoHome"), and it uses an Atmel 45DB161D DataFlash storage device. Some info about the processor can be found here:

http://www.atmel.com/dyn/products/produ ... rt_id=3638

And there seems to be many programming tools available for this device:

http://www.atmel.com/dyn/products/tools ... ily_id=605

Does anybody have experience with these tools? Assuming that the USB interface is quite standard, maybe these tools could work to dump the firmware onto a PC and run in the PC emulator?

Below is a list with several markings I found on the PCB and chips in the device. Some markings I was able to identify. Does anybody find a marking that could indicate the radio chip in the device? I would be very interested in finding it's specs. I suspect the C(M)OOP because of its form factor. Does this code sound familiar to somebody? It's actually a C with an M inside it directly followed by the letters OOP. See the attached image for details. What is the SEC-8010675 device?

Regards, Beat Nideröst

PCB Markings
PCB 50033019-001 REV_C
CC ASSY.50033020
LR (backwards) CP8B 94V-0 / 1016
LR (backwards) CP5 94V-0 / 1016
5640FGPWTWC-01 2210-6. T RoHS A 5
V0056270 Rev A

Chips
ATMEL AT91SAM9261 - ARM CPU
ATMEL 45DB161D - DataFlash memory device
AD7877 / ACPZ - Touch screen controller
SEC 8010675 / K4H64163PK / Z1K167WD
C(M)OOP
160 AGOG
BRR / 02W / Z73H
312T
CC1101 / 05MOR3G / 1019 (X-tal clock controller? X-tal SJK 26.000)
1080L / 950A1
KRBC / SZ74 / FB
32C030
PS79533 / 03ZJD4H

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Fri Dec 24, 2010 3:26 pm
by r_255
Hey Beat,

I think on the wireless side it is going to be hard, due to copyright restrictions.

But on the atmel side it should be possible.... i am more than willing to invest time or money on this one to open up the system, but my knowledgement doesnt reach far enough to reverse engineer the stuff that is running on the microcontroller now.
I dont think we have to set our hope on honeywell as i tried to ask for a new rom image so i can update my evotouch with my local language.
Only authorised people are allowed to flash the device was the official statement a year ago.
What we need is some one thats familiar on the atmel platform can tap into the atmel at91sam to fake the controls it takes from the touchscreen
and sends back the values it writes on the evo screen.

If honeywell doesnt open up the system soon ill be stepping over to the new danfoss z-wave theromostats.

So far my expierence

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Fri Dec 24, 2010 3:58 pm
by Bwired
Agree, Honeywell will lose the battle.
I also contacted Honeywell, but even with inside contacts it did not work out.
For a moment I thought it would start up, they where willing, but then no response anymore.
Marcel from waakzaamwonen.nl was also busy with this and made some progress too, but also stranded afterwards :(
Companies like Honeywell and Nefit should wake up!

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Fri Dec 24, 2010 8:50 pm
by r_255
Oh and Beat,

Dont get me wrong, i hate to give up..
We could try to explain and ask for some pointers on this forum

http://www.at91.com/forum.html

A good start would be opening up the device thru usb and grab a image from the device its flash memory.
Or recieve one from a supportive installer that understands our problem. Yeah, i love to dream .... ;o)

But like bwired mentions we dont have to expect any official support from honeywell.

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Fri Dec 24, 2010 11:34 pm
by Bwired
Some reverse enginering would be nice, but mostly you can't reverse all you need.
I don't use the evohome products, just know that the HR80 is a nice device which i would like to have in my house.
but only if I have full control and use my own drivers. For all the devices I use right now I can do that.
Lets see what happens :)

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Mon Dec 27, 2010 10:11 am
by Beat
Another update: I just found out that the CC1101 chip is actually the transceiver chip.

http://focus.ti.com/docs/prod/folders/print/cc1101.html

It seems to me that using for example the CC1101 Evaluation Module 868-915 MHz:

http://focus.ti.com/docs/toolsw/folders ... 8-915.html

and/or the CC1101 Development Kit 868-915MHz:

http://focus.ti.com/docs/toolsw/folders ... 8-915.html

It should be possible to turn the radio signal into a bitstream that we then could use for further analysis. And, even if we don't understand the stream, we probably could at least replay the stream and control the modules (e.g. the HR80) that way simply by recording the message that the EvoTouch sends out when we touch in the command we look for and replay that message the moment we need to send that command.

Does this sound like a way to go?

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Mon Dec 27, 2010 12:45 pm
by r_255
Well i dont think it is as easy as sniffing packages.... But we always can try.
But that raises some questions here, like how could we analyse the 2 way data stream that flies true the air.

I am familiar with decoding from wired devices, but if you can find out how to sniff the packages from air we could try to reconstruct or even unrafle the protocol.


We might even ask JC for his opinion...
http://talk.jeelabs.net/topic/385

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Mon Dec 27, 2010 7:39 pm
by Henk
The potential business of RF radiator valves by domotica end users is very small so no interest. Also it may risk the controller business - may be third parties will start developing controllers as soon as the protocol are open, so no way those protocols will be ever public. You may bet on Danfoss with Zwave but they have the same interest to protect their business.

Henk

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Wed Dec 29, 2010 10:51 am
by crazydiamond
Hi Beat,

Please make the pictures you made available to me.
I was spending the last day to reverse the protocol, and it does not seem to be so hard.
(I have 15+ years of practice in paging and television embedded systems, but lack of time :( ; if anyone would like to help I would appricate ).

As my house is full of HR80s and HCW82s, as soon as I have time I will try to build a "special edition".
I like the honeywell, but there are lack of features and bugs I need to implement and fix. If you are interested and/or have ideas, please let me know.
As a first step, it might be a PC interfaced transciever, later a custom evotouch controller firmware.

Best regards,
cd

P.S:
PIOA 09 -> Peri A, PIOA 10 -> Peri A, PIOA 11 <->, PIOA15 ->, PIOA17 ->, PIOA28 <-, PIOA31 -> Power (LCD related), PIOC 03 <-,PIOC 06 ->,PIOC 14 ->,PIOC 15 <-,PIOC 16 <-,

Code: Select all
RAM:2000BAE4 ; =============== S U B R O U T I N E =======================================
RAM:2000BAE4 Set_Contrast                            ; CODE XREF: sub_2000CCC0+8p
RAM:2000BAE4                                         ; sub_2000CD64+18p ...
RAM:2000BAE4                 MOV     R1, 0xFFFFFF3C
RAM:2000BAE8                 BIC     R1, R1, #0x700  ; PIO Controller Pin Data Status Register
RAM:2000BAE8                                         ; Name: PIO_PDSR
RAM:2000BAE8                                         ; Addresses: 0xFFFFF83C (PIOC)
RAM:2000BAEC                 LDR     R1, [R1]
...
RAM:2000BB10 loc_2000BB10                            ; CODE XREF: Set_Contrast+10j
RAM:2000BB10                                         ; Set_Contrast+18j
RAM:2000BB10                 LDR     R1, =0x600844   ; Contrast Value Register
RAM:2000BB10                                         ; Name: CONTRAST_VAL
RAM:2000BB10                                         ; Address:0x00600844
RAM:2000BB14                 ANDS    R2, R0, #0xFF
RAM:2000BB18                 STR     R2, [R1]
RAM:2000BB1C                 BX      LR
RAM:2000BB1C
RAM:2000BB1C ; End of function Set_Contrast
RAM:2000BB1C ; ---------------------------------------------------------------------------


Re: Evohome / Evotouch Wireless protocol?

PostPosted: Wed Dec 29, 2010 8:34 pm
by Bwired
Great,
As I told before im very interested in the HR80 if we can control it.
i will follow this topic for sure
Good luck....

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Wed Dec 29, 2010 10:09 pm
by Rene
I am very interested too and would like to help although I do not know how. I do not own any Honeywell stuff yet.

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Wed Dec 29, 2010 11:51 pm
by r_255
@ crazydiamond

Thats great News, would like to help out if you can tell on witch point you would like to see some help.
I do own a evotouch and some hr80 + relay.

I am interested just for controlling reasons, so modified rom or transciever would do.

Robin

http://talk.jeelabs.net/topic/328

Re: Evohome / Evotouch Wireless protocol?

PostPosted: Sun Jan 02, 2011 1:53 pm
by Digit
I've been searching for good remote controllable radiator valves, but nothing seems to fit my needs :(
I'd be very interested in the HR80 and would like to help if possible; however, I don't have any hardware yet either...