The iRT bus seems to be build for supporting multiple devices, but is very sensitive to, too much load on the bus. The boiler provides (without load) +/- 12 volt to the bus. When a thermostat is connected this drops to +/- 7 volts. A 'Nefit Moduline IV' draws around 15 mA. This seems to be the maximum the iRT bus can provide.

Effectively the bus can only be used for two devices; the boiler and thermostat.

Signaling

On top of the power provided by the boiler a RS232 serial signals is put. The mark state (1) is a low level and the space state (0) is a high level. The picture below shows a picture of the signaling. Signal A (bottom) show the signal after the DC component has been removed. Signal B (top) shows the signal after detection.

The signal is a 4800 baud, 8N1 (8 bytes, no parity, 1 stop bit) signal.

Bus polling

The boiler is master of the bus. The boilers sends a break (11 zero bits). This indicates the previous frame has ended and a new frame is starting. The boiler then sends a single byte, addressing a device (0x01 - 0x03). The thermostat is address 0x01.

If the thermostat wants to transmit anything. It replies the the boiler with its address (0x01). If the boiler accepts, it replies with the inverse address (0xFE). The start of a transmission looks like: BRK 0x01 0x01 0xFE (The above picture only shows BRK 0x01 0x01)

Error checking

Each byte the thermostat sends to the boiler is echoed by the boiler. If the boiler sends data, it sends it twice, the byte to send followed by the inverse of that byte. Each sub message also includes a checksum.

Example message

Below an example of a full frame of raw data:

01 01 FE 90 90 C3 C3 79 79 F2 F2 CF 30 73 73 52 52 25 25 43 43 78 78 01 01 FF FF AD AD 01 01 51 51 F6 F6 50 50

(01 01 FE) The first 0x01 is the bus master poll of the boiler. Followed by the 0x01 of the thermostat indicating it wants to transmit. The boiler then sends 0xFE accepting the transfer.

(90 90 C3 C3 79 79 F2 F2 CF 30) The first 8 bytes are the bytes the thermostat is sending and the boiler is echoing. The last two bytes are send by the boiler. It sends 0xCF and then the inverse of that 0x30.

(73 73 52 52 25 25 43 43) This is a 8 bytes message from the thermostat to the boiler without a reply. It is followed by two similar messages: (78 78 01 01 FF FF AD AD) (01 01 51 51 F6 F6 50 50).

Decoded telegrams

The first step is in the software is to check for errors. Each byte must have an echo or inverse value. The example message is decoded as 4 sub-messages:

90 C3 79 F2 CF
73 52 25 43
78 01 FF AD
01 51 F6 50

The first sub-message (0x90) requests a status from the boiler. The following three sub-messages only set values on the boiler. The first byte is command type byte. If the high bit (0x80) is high it is a get message if it is low it is a set message.

The second and the third byte are depend on the message the fourth byte is the checksum. In the case of a get message the fifth byte is the response of the boiler.

For details see iRT-Telegram-Types

Sub-message checksum

Each sub-message has an checksum. Each of the first three bytes are xor'ed. But the second byte is rotate shifted left 1 bit before xoring. The third byte is rotate shifted left 2 bits before xoring. Depending on the high bit of the second byte and the high two bits of the third byte the resulting checksum is xor'ed with a fixed value. See the source code (irt.cpp) for details.