Reverse engineering remote Itho CVE ECO RFT - Part 1

I have recently installed a new centrale-ventilation-box in my home, an Itho CVE ECO RFT. This ventilation box uses a lot less power (<2 watts at low speed) and most importantly makes a lot less noice.

In my first post on this blog Home Automation getting started I said that controlling the ventilation-box from my home-automation system was one of my wishes, so lets get started!

The ventilation-box can be controlled using a RF remote controle with 4 buttons. Creating a custom controller that sents the same signals would be the perfect solution. First I googled around looking for other people that might have created this controller (or parts of it) already. I found a few blogpost, but none have a solution that fits my requirement (controllable from my own home-automation software). A colleague of mine came closest to what I want, too bad his solution only works with the older Itho RF remote controller: Decoding Itho RF protocol.

Opening up my new controller I discovered that it uses a standard Atmel MEGA 169PV microcontroller and a standard Texas Instruments CC1150 chip for RF. Since these are standard components I should be able to create my own Arduino-based controller that sends the same signals to the ventilation-box. But where do I start? My colleague started with a Software Defined Radio (SDR) dongle to listen to the communication between the remote control and the ventilation-box. The problem with this approach is that you need to know the exact protocol/encoding that the RFT remote controller uses, else all you see is a stream of bits. Since he already tried this approach (and sadly failed for the RFT) I searched for another approach. I came across a blogpost-serie made by Andrew (@cybergibbons) about Reverse engineering a wireless burglar alarm which uses the same RF chip (CC1150) as my Itho remote. He used a Saleae Logic 8-channel logic analyser to log the communication between the Atmel MCU and the CC1150, and wrote Arduino code to transmit the same messages. I read all 8 parts of his blogpost-serie and got so excited that I went to eBay and ordered a logical analyzer, a set of probing clips, an Arduino Nano and a CC1101 tranceiver board. Now I only need to wait for my order to arrive.

**Other posts in this serie: **Part 2, Part 3, Part 4, Part 5, Part 6