A standalone EBUS interface and LAN-connected thermostat for Protherm, Vaillant (and other) heaters
Open hardware schematics, KiCad PCB design and Gerber files as well as GPL firmware source code provided
After an upgrade of the heating system in our house I decided that a more sophisticated control of the heating
than an on/off thermostat
would be a nice feature. The Czech
Protherm company (member of Vaillant concern) supports EBUS
in their recent products.
There are some schematics available on the net and a software ebusd which can be used, however, I decided to build my own device
which would not require additional hardware like Raspberry PI to operate. The design requirements were:
(i) reliable EBUS read/write access, without a need to use a trimmer to set voltage levels,
(ii) 24V/20mA on/off control for backward compatibility,
(iii) USB virtual terminal interface for firmware debugging and access from a PC,
(iv) LAN (wired Ethernet) interface - UDP packet <--> EBUS, connection to my home automation server, no third party services, clouds, etc. for internet of things
(v) interface of a limited EBUS command subset to my 433MHz band wireless device network (in particular also to get the outer temperature from a meteostation),
(vi) optional display and rotational encoder to be used as a regular thermostat,
(vii) avoiding additional hardware running an operating system, keep it as simple as possible for high reliability.
Hardware design of the EBUS interface - KiCad schematics and PCB
I have decided to use the LPC1343 MCU, which supports USB and the ENC28J60 SPI/LAN interface module, which is at Aliexpress cheaper than buying individual components at small quantities.
Notice that at least two versions of the ENC28J60 module are on the market, one needs 5V power, the other 3V3 power (and is not 5V tolerant). My design assumes the latter, which can
be connected directly, the former needs a flexible cable and rearrangement of the order of the pins, but both versions work.
Basically I took my previous design with LPC1343 which had USB and LAN interfaces, added a 433MHz OOK communication module and an optoisolated EBUS interface based
on an existing design
The schematics in PDF can be seen here
and open hardware full design Kicad files are here
Here is a photo of the built device
Notice that some parts are not included - I dropped the EEPROM, I2C-connected LCD display, and rotational encoder, as at the moment I did not plan to fully replace the existing
thermostat, just to modulate the heater power by setting heating water temperature based on outside temperature transmitted from my homemade meteostation
remotely control the heater.
I have later found that a commercial device for EBUS-LAN (wired Ethernet) interface exists, see here
is pretty expensive, and my device offers more functionality (433MHz communication, possibility to conntect display and rotational encoder and make combined LAN interface with a selfcontained thermostat from it.
There are also claims about a problematic functionality of the commercial EBUS-LAN adapter
In my opinion, (except when doing very standard things) it is always better to start the design yourself at the hardware level than to buy some proprietary black box and have then "mysterious" problems with its compatibility...
Reverse engineering of the Protherm and Vaillant EBUS communication
A lot of work has already been done in this direction, which can be found on some german discussion forums (partly in german language, which I fortunately understand)
and on EBUS Wiki
, see also PDF from EBUS wiki
It turns out, that Vaillant does not use at all standard EBUS commands and implements its whole communication by the proprietary commands (0xB5).
The Czech Protherm company has been acquired by Vaillant and obviously they stopped their own independent firmware development and adopted fully Vaillant's firmware and communication standards,
at least in the product I purchased.
The aim of my reverse engineering was to verify whether Protherm is indeed 100% compatible with what was already known about Vaillant communication,
and how to emulate the behavior of original Protherm's EBUS thermostat and control the heater, specifically set the temperature of tap water and heating water,
modulate thus the power of the heater, switch the heater on/off, and change the operation mode (tap water, heater water, both, none).
I have purchased the simplest EBUS thermostat from Protherm and tried
three approaches to the reverse engineering:
(i) Connect the thermostat to heater and eavesdrop their communication on the EBUS bus, particularly after adjusting the thermostat
(ii) Connect the thermostat only to my EBUS interface, power the EBUS from 22V/0.02A power supply through 220R resistor and emulate the communication of the heater by hand.
(iii) Finally, verify the correctness of the analysis by programming my EBUS interface to play the role of the thermostat and communicate with the heater
I have verified the compatibility of my Protherm Panther condens 25 KKO heater with the Vaillant commands as described in the PDF from EBUS wiki
The capture of the thermostat-heater communication revealed that the heater sends frequently (several times a second) the SYN packets.
The thermostat waits until it detects a SYN (0xAA) packet and then sends the command asking time.
Since my heater has no DCF receiver, it returns FFs:
10 08 B5 04 01 00 3D 00 0A 00 FF FF FF FF FF FF FF 00 80 3B 00 AA
Next, the thermostat sends:
10 08 B5 13 02 05 08 C6 00 01 01 9A 00 AA
This command was not documented in the PDF from EBUS wiki
and I did not find out its purpose either.
It is actually not necessary at all to control the heater.
Then the thermostat sends the command to set temperatures and heater on/off, see the PDF for meaning of individual bytes:
10 08 B5 10 09 00 00 1E 78 FF FF 01 FF 00 7A 00 01 01 9A 00 AA
Finally, it asks the heater temperatures using 0xB511, both blocks 1 and 2:
10 08 B5 11 01 01 89 00 09 37 37 00 80 FF FF 00 00 FF 40 00 AA
10 08 B5 11 01 02 8A 00 05 02 14 96 4C 78 53 00 AA
The B510 and B511 commands are then repeated indefinitely each few seconds, in alternate order. When user changes the temperature setting or the thermostat finds out it should switch heating on, the
parameters of the B510 command change accordingly.
The B504 and B513 commands are inserted into the command sequence time to time.
I have found that once the EBUS thermostat is connected and sends its commands, the temperature setting buttons on the heater panel become inoperative, even if the EBUS
thermostat is disconnected again. Only after a reset or power cycle one can set temperatures on the heater manually again.
In the thermostat-heater communication, thermostat behaves as EBUS master and heater as a slave.
However, the heater time to time sends some unsolicited messages as master, for example
03 64 B5 12 02 02 FE 98 AA
which seem totally irrelevant, at least for the purpose of thermostating.
Finally, I did NOT find out whether/how one can change the mode on the heater via EBUS (there are 4 modes: off, tap water only, heating only, heating+tap water).
The mode button remains active even when EBUS thermostat is connected.
I have found that the command 0xB510 is sufficient to control the heater. 0xB511 can optionally be used to read out temperatures.
Moreover I have found the meaning of LSB of the byte M12 of the 0xB510 command: if 1, the heater switches off, if 0 it switches on/off depending whether there is a jumper
on the on/off control clamps. When using an EBUS thermostat, there is a jumper (factory installed) and the thermostat uses this bit to switch the heater on/off and the M8 and M9
bytes of the 0xB510 command to set the water temperatures. I plan just to set the heating water temperature based on the outer temperature using this device, and use already existing thermostat
to toggle the heater on/off - keeping thus this bit = 0.
Open source firmware for the EBUS interface to LAN and USB
As my device does not run an operating system, I could not use the ebusd program, but developed a simple firmware to interface EBUS control of the
heater to other communication interfaces. It is specifically oriented towards Protherm heaters, which are compatible with Vaillant, but incompatible
with other EBUS devices. The firmware will read/write any EBUS communication, but higher level functionality like setting water temperature is implemented only
for the proprietary Vaillant commands, corresponding to the hardware I have at my home.
The firmware source code (GPLv3 licensed) is included in a package of all my developments for LPC microcontrollers, see
In particular, the core of this project is in ebusint.c and lib/ebus.c files.
By various #ifdefs you can select whether it will only listen on the bus,
or whether it will set tap water and heating water temperatures. USB, LAN UDP and 433MHz communication is also
Full thermostat functionality is presently not implemented, as I keep the previously developed
thermostat in use, while the EBUS interface just listens temperature reports from a meteostation and sets
the heating water temperature appropriately. However, coding the thermostat would require just reading
rotational encoder and writing to LCD display, for both of which I have already library routines,
so it would be very easy to do if needed.
My Electronics page
My hobby page
My main page with e-mail contact
TOP of my family pages