My ventilation system needs an upgrade. The old one is noisy and it is 40 years old. Some research lead me to the Itho CVE ECO RFT SP. This has a DC driven motor which should consume a lot less power as well. The new unit has a remote receiver and you can buy a remote control. The RF communication works on the 868 MHz band.
Now I spent some time to reverse-engineer the schematic. All pin 1 pads are coulored blue.
ANT: PCB Antenna
BAT: Battery holder CR2032 3V Lithium
C7: 600pF ?
K1: Programming connector
Q1: FDPUC (did not find it yet, probably a transistor)
Q2: SRARBF (also did not find this part yet, probably a voltage regulator)
Q3: AT MEGA169PV
As you see they use a standard ATMega controller and an RF chip (TI 1150) for sending information to the other unit. On the print I also noticed a lot of TestPoints. It turns out that every netlist has been exposed by a TestPoint (except for the oscilator, antenna and bias pins). From the contoller the power of the RF chip is enabled by Q1. This is done to save power when there is no transmission needed.
Next steps is to look at the SPI signals. For that I need to connect to the following TestPoints:
TP2 or TP26: NET_GND
TP11: NET_1150_SCLK (Clock input)
TP12: NET_1150_SI (Data input)
TP23: NET_1150_CSn (Chip select)
TP24: NET_1150_SO (Data output)
On the receiver side we have the following:
In the beginning I found it strange that there is a transciever on the fan unit because the remote control I have does not have the possibility to send info back. Later I received information that the new remote control units are able to send as well. That way the new generation remote controls are able to implement a stronger security regime ;-(
I already have a set of nrf905 modules from dx.com. With these I will try to decode the RF traffic generated by the remote control. I can also a sniffer to dissect the I2C protocol.
The transmitter has an Atmel mega controller and a TI CC1150. Maybe the NRF905 module isn’t the best one to start with, but I will give it a try.