A standalone EBUS interface and LAN-connected thermostat for Protherm, Vaillant (and other) heaters

Open hardware schematics, KiCad PCB design and Gerber files as well as GPL firmware source code provided

After an upgrade of the heating system in our house I decided that a more sophisticated control of the heating than an on/off thermostat would be a nice feature. The Czech Protherm company (member of Vaillant concern) supports EBUS in their recent products.

There are some schematics available on the net and a software ebusd which can be used, however, I decided to build my own device which would not require additional hardware like Raspberry PI to operate. The design requirements were:
(i) reliable EBUS read/write access, without a need to use a trimmer to set voltage levels,
(ii) 24V/20mA on/off control for backward compatibility,
(iii) USB virtual terminal interface for firmware debugging and access from a PC,
(iv) LAN (wired Ethernet) interface - UDP packet <--> EBUS, connection to my home automation server, no third party services, clouds, etc. for internet of things
(v) interface of a limited EBUS command subset to my 433MHz band wireless device network (in particular also to get the outer temperature from a meteostation),
(vi) optional display and rotational encoder to be used as a regular thermostat,
(vii) avoiding additional hardware running an operating system, keep it as simple as possible for high reliability.

Hardware design of the EBUS interface - KiCad schematics and PCB

I have decided to use the LPC1343 MCU, which supports USB and the ENC28J60 SPI/LAN interface module, which is at Aliexpress cheaper than buying individual components at small quantities. Notice that at least two versions of the ENC28J60 module are on the market, one needs 5V power, the other 3V3 power (and is not 5V tolerant). My design assumes the latter, which can be connected directly, the former needs a flexible cable and rearrangement of the order of the pins, but both versions work.
Basically I took my previous design with LPC1343 which had USB and LAN interfaces, added a 433MHz OOK communication module and an optoisolated EBUS interface based on an existing design. The schematics in PDF can be seen here and open hardware full design Kicad files are here.
Here is a photo of the built device

Notice that some parts are not included - I dropped the EEPROM, I2C-connected LCD display, and rotational encoder, as at the moment I did not plan to fully replace the existing thermostat, just to modulate the heater power by setting heating water temperature based on outside temperature transmitted from my homemade meteostation and possibly remotely control the heater.

I have later found that a commercial device for EBUS-LAN (wired Ethernet) interface exists, see here, but is pretty expensive, and my device offers more functionality (433MHz communication, possibility to conntect display and rotational encoder and make combined LAN interface with a selfcontained thermostat from it. There are also claims about a problematic functionality of the commercial EBUS-LAN adapter. In my opinion, (except when doing very standard things) it is always better to start the design yourself at the hardware level than to buy some proprietary black box and have then "mysterious" problems with its compatibility...

Update 2021: a respin of the board using RFM22 transceiver module

I have updated the design to employ the mode modern RFM22 transceiver module for the wireless communication. Schematics in PDF is here and open hardware full design Kicad files are here. Firmware will appear later, once I employ this new board.

Reverse engineering of the Protherm and Vaillant EBUS communication

A lot of work has already been done in this direction, which can be found on some german discussion forums (partly in german language, which I fortunately understand) and on EBUS Wiki , see also PDF from EBUS wiki. It turns out, that Vaillant does not use at all standard EBUS commands and implements its whole communication by the proprietary commands (0xB5). The Czech Protherm company has been acquired by Vaillant and obviously they stopped their own independent firmware development and adopted fully Vaillant's firmware and communication standards, at least in the product I purchased.

The aim of my reverse engineering was to verify whether Protherm is indeed 100% compatible with what was already known about Vaillant communication, and how to emulate the behavior of original Protherm's EBUS thermostat and control the heater, specifically set the temperature of tap water and heating water, modulate thus the power of the heater, switch the heater on/off, and change the operation mode (tap water, heater water, both, none).

I have purchased the simplest EBUS thermostat from Protherm and tried three approaches to the reverse engineering:
(i) Connect the thermostat to heater and eavesdrop their communication on the EBUS bus, particularly after adjusting the thermostat
(ii) Connect the thermostat only to my EBUS interface, power the EBUS from 22V/0.02A power supply through 220R resistor and emulate the communication of the heater by hand.
(iii) Finally, verify the correctness of the analysis by programming my EBUS interface to play the role of the thermostat and communicate with the heater


I have verified the compatibility of my Protherm Panther condens 25 KKO heater with the Vaillant commands as described in the PDF from EBUS wiki.

The capture of the thermostat-heater communication revealed that the heater sends frequently (several times a second) the SYN packets. The thermostat waits until it detects a SYN (0xAA) packet and then sends the command asking time. Since my heater has no DCF receiver, it returns FFs:
10 08 B5 04 01 00 3D 00 0A 00 FF FF FF FF FF FF FF 00 80 3B 00 AA
Next, the thermostat sends:
10 08 B5 13 02 05 08 C6 00 01 01 9A 00 AA
This command was not documented in the PDF from EBUS wiki and I did not find out its purpose either. It is actually not necessary at all to control the heater. Then the thermostat sends the command to set temperatures and heater on/off, see the PDF for meaning of individual bytes:
10 08 B5 10 09 00 00 1E 78 FF FF 01 FF 00 7A 00 01 01 9A 00 AA
Finally, it asks the heater temperatures using 0xB511, both blocks 1 and 2:
10 08 B5 11 01 01 89 00 09 37 37 00 80 FF FF 00 00 FF 40 00 AA
10 08 B5 11 01 02 8A 00 05 02 14 96 4C 78 53 00 AA
The B510 and B511 commands are then repeated indefinitely each few seconds, in alternate order. When user changes the temperature setting or the thermostat finds out it should switch heating on, the parameters of the B510 command change accordingly. The B504 and B513 commands are inserted into the command sequence time to time. I have found that once the EBUS thermostat is connected and sends its commands, the temperature setting buttons on the heater panel become inoperative, even if the EBUS thermostat is disconnected again. Only after a reset or power cycle one can set temperatures on the heater manually again.

In the thermostat-heater communication, thermostat behaves as EBUS master and heater as a slave. However, the heater time to time sends some unsolicited messages as master, for example
03 64 B5 12 02 02 FE 98 AA
which seem totally irrelevant, at least for the purpose of thermostating.

Finally, I did NOT find out whether/how one can change the mode on the heater via EBUS (there are 4 modes: off, tap water only, heating only, heating+tap water). The mode button remains active even when EBUS thermostat is connected.

I have found that the command 0xB510 is sufficient to control the heater. 0xB511 can optionally be used to read out temperatures. Moreover I have found the meaning of LSB of the byte M12 of the 0xB510 command: if 1, the heater switches off, if 0 it switches on/off depending whether there is a jumper on the on/off control clamps. When using an EBUS thermostat, there is a jumper (factory installed) and the thermostat uses this bit to switch the heater on/off and the M8 and M9 bytes of the 0xB510 command to set the water temperatures. I plan just to set the heating water temperature based on the outer temperature using this device, and use already existing thermostat to toggle the heater on/off - keeping thus this bit = 0.

Open source firmware for the EBUS interface to LAN and USB

As my device does not run an operating system, I could not use the ebusd program, but developed a simple firmware to interface EBUS control of the heater to other communication interfaces. It is specifically oriented towards Protherm heaters, which are compatible with Vaillant, but incompatible with other EBUS devices. The firmware will read/write any EBUS communication, but higher level functionality like setting water temperature is implemented only for the proprietary Vaillant commands, corresponding to the hardware I have at my home.

The firmware source code (GPLv3 licensed) is included in a package of all my developments for LPC microcontrollers, see the arm_lpc111x.tar.gz file. In particular, the core of this project is in ebusint.c and lib/ebus.c files.
By various #ifdefs you can select whether it will only listen on the bus, or whether it will set tap water and heating water temperatures. USB, LAN UDP and 433MHz communication is also optional.
Full thermostat functionality is presently not implemented, as I keep the previously developed thermostat in use, while the EBUS interface just listens temperature reports from a meteostation and sets the heating water temperature appropriately. However, coding the thermostat would require just reading rotational encoder and writing to LCD display, for both of which I have already library routines, so it would be very easy to do if needed.

UPDATE 2019:
I have added support for LCD and rotational coder, at the moment for setting the heat water temperature and tap water temperature manually.

My Electronics page


My hobby page


My main page with e-mail contact


TOP of my family pages