{"id":534,"date":"2015-07-05T15:36:15","date_gmt":"2015-07-05T14:36:15","guid":{"rendered":"http:\/\/www.sevenwatt.com\/main\/?p=534"},"modified":"2016-01-10T14:07:04","modified_gmt":"2016-01-10T13:07:04","slug":"rfm69-energy-count-3000-elv-cost-control","status":"publish","type":"post","link":"https:\/\/www.sevenwatt.com\/main\/rfm69-energy-count-3000-elv-cost-control\/","title":{"rendered":"RFM69 – Energy Count 3000 \/ ELV Cost Control"},"content":{"rendered":"

Conrad Energy Count 3000 and ELV Cost Control are wireles 230V electricity consumption measuring plugs Thomas Schulz has cracked the RF protocol of these device back in 2011 on the JeeLabs forum<\/a>. The signals are FSK encoded and use the 868Mhz band. Thomas was able to receive them with a RFM12B module. Together with a JeeLink V3, it has found popular use with the German home automation software FEHM<\/a>.<\/p>\n

In this post I describe how the RFM69 can take over a task that earlier had to be performed in software.<\/p>\n

One of the complications of the protocol is that the preamble of a series of 0x55 is scramble (whitened), and therefore more difficult to recognize. However, after scrambling it is still identical for all packets.<\/p>\n

raw data 25 8A F9 59 DA 02 7E 15 ED 67 13 F1 85 D3 AC D2   [payload]   13 E6 84 A8 3B \r\ndescramb 48 BB 55 55 55 55 55 55 55 55 55 55 55 55 55 7E   [payload]   7E 55 55 55 55 \r\n               -------------------------------------- --   ---------   -- -----------\r\n                             preamble                 HDLC  payload  HDLC  postamble\r\n<\/pre>\n
The original Jeelib-based RFM12B programs detection of valid packets was clumsy.<\/p>\n
It started matching the last 4 bytes of the preamble with the received signals
\n13 F1 85 D3 AC<\/code>
\nThe problem was that it is undetermined which is the first bit received from the preamble, as the receiver first has to detect a signal and then tune its gain and frequency. Some bits are lost. So Thomas Schulz had to not only check for the given series of bytes, but also for all 7 bit shifted variants. The code checks on:
\n13 F1 85 D3 | F8 C2 E9 D6 | FC 61 74 EB | 7E 30 BA 75 | 3F 18 5D 3A | 9F 8C 2E 9D | 4F C6 17 4E | 27 E3 0B A7
\n<\/code>
\nAfter detecting one of these pattern, the complete receive buffer gets bit-shifted the proper amount so that the buffer shows the last 5 preamble bytes as 13 F1 85 D3 AC<\/code><\/p>\n
Sync words<\/h3>\n
Here comes the RFM69 to the rescue. Where the RFM12B can only program one user defined syncword-byte, the RFM69 can have 8. When programming those last five preamble bytes as sync-words, the task of detecting a proper packet and bit-aligning it is fully left to the RFM69.
\nThe received signal now no longer contains the preamble, but starts at the HDLC control word 0x7E.<\/p>\n
raw data    D2   [payload]   13 E6 84 A8 3B \r\ndescrambled 7E   [payload]   7E 55 55 55 55 \r\n            --   ---------   -- -----------\r\n            HDLC  payload  HDLC  postamble\r\n<\/pre>\n
Effortless!
\n <\/p>\n
Descrambling<\/h3>\n
But before this will start working one has to realize that the preamble bits are also scrambled. In other words, the descrambler needs to be primed if one wants to start descrambling at the payload.
\nThe actual AX5051 \/ AX5042 scrambling is this polynomial: 1+X12<\/sup>+X17<\/sup><\/em>.
\n\"AX5051-descrambler\"<\/a>
\nPriming needs to be done for 17 bits at most, So the last three bytes of the preamble could be send through the descrambling algorithm and discarded before descrambling HDLC+payload. As the preamble is always constant, the priming value can also be determine one time, which I did.
\nThe magic number is scramshift = 0xF185D3AC;<\/code><\/p>\n
\r\nstatic void descramb(uint8_t* buff, uint16_t len) {\r\n\tuint8_t ibit, obit;\r\n\tuint8_t bit;\r\n\tuint8_t inpbyte, outbyte;\r\n\tuint32_t scramshift;\r\n\r\n\t\/\/scramshift = 0xFFFFFFFF;\r\n\tscramshift = 0xF185D3AC; \/\/descrambler primed at end of preanble\r\n\twhile (len--) {\r\n\t\tinpbyte = *buff;\r\n\t\tfor (bit = 0; bit < 8; ++bit) {\r\n\t\t\t\/\/ RFM69 receives MSBit first into bytes:\r\n\t\t\tibit = (inpbyte & 0x80) >> 7;\r\n\t\t\tobit = ibit ^ (count1bits(scramshift & SCRAMPOLY) & 0x01);\r\n\t\t\tscramshift = scramshift << 1 | ibit;\r\n\t\t\tinpbyte <<= 1;\r\n\t\t\toutbyte = outbyte << 1 | obit;\r\n\t\t}\r\n\t\t*buff++ = outbyte ^ 0xFF;\r\n\t}\r\n}\r\n<\/pre>\n
Code<\/h3>\n
The software is developed on a LPC824. It can be used on the complete LPC8xx family as it fits the tiny LPC810. Hardware that can be used is for example a Jeelabs Tinker Pico LPC824 board<\/a>.
\nThe software can be found in my github embapps<\/a> repository<\/p>\n","protected":false},"excerpt":{"rendered":"
Conrad Energy Count 3000 and ELV Cost Control are wireles 230V electricity consumption measuring plugs Thomas Schulz has cracked the RF protocol of these device back in 2011 on the JeeLabs forum. The signals are FSK encoded and use the 868Mhz band. Thomas was able to receive them with a RFM12B module. Together with a […]<\/p>\n","protected":false},"author":1,"featured_media":535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[12,27,15],"tags":[6,53,55,54,8,49],"class_list":["post-534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-jeenode","category-picos-arm","category-rfm69","tag-868mhz","tag-ec3k","tag-elv-cost-control","tag-energy-count-3000","tag-fsk","tag-rfm69"],"_links":{"self":[{"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/posts\/534","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/comments?post=534"}],"version-history":[{"count":19,"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/posts\/534\/revisions"}],"predecessor-version":[{"id":577,"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/posts\/534\/revisions\/577"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/media\/535"}],"wp:attachment":[{"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/media?parent=534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/categories?post=534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sevenwatt.com\/main\/wp-json\/wp\/v2\/tags?post=534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}