Somfy Smoove Origin RTS Protocol

This document describes the Somfy RTS protocol as used by the “Somfy Smoove Origin RTS”. Most information in this document is based on passive observation of the data send by the Smoove Origin RTS remote, and thus can be inaccurate or incorrect!

Changelog:

• 2014-06-25: Updated with information provided by Dirk Farin in the comments.
• 2014-09-24: Extended Control code list with info provided by Gerrit in comments. And incorporated Gerardwr’s comment about non constant key MSB.

Parameters

• Frequency: 433.42 Mhz
• Modulation: ASK/OOK
• Encoding: Manchester code, rising edge = 1, falling edge = 0
• Payload Data length: 56 bit
• Symbol Width: 1208 us

Frame description

Before the first frame of a button press there is some kind of wakeup pulse of 9415 us long followed by 89565 us of silence.

Frame structure:

                                              604 us
                                                /
| 2416us | 2416us | 2416us | 2416us | 4550 us |  | 67648 us |  30415 us  |

+--------+        +--------+        +---...---+
+        +--------+        +--------+         +--+XXXX...XXX+-----...-----

|              hw. sync.            |   soft.    |          | Inter-frame
|                                   |   sync.    |   data   |     gap

Where:

• Hardware sync.: Repeating sequence of 4 symbol width’s high(~2416 us) and 4 symbol width’s low(~2416 us). When a button is pressed the first frame has only 2 of these, repeating frames have 7
• Software sync.: 4550 us high, followed by 1/2 symbol width low(~604 us)
• Inter-frame gap: 30415 us of silence after last symbol. (Note: This means that if last bit = 0, then the line will be silent 1/2 symbol width longer)
• Data: Data is Manchester encoded, 1=rising edge, 0=falling edge. One bit is encoded per symbol(~1208 us)

Encoded data example:

|   1208 us   |
|604 us|

       +------+      +------+------+      +------+             +------+
+------+      +------+             +------+      +------+------+  

|      1      |      1      |      0      |      0      |      1      |

The whole timing isn’t very critical. It is not required to send the wake up pulse and it is enough to just send one frame. Dirk Farin reports in the comments below that there is about a 15-20 percent tolerated error margin.  Although what is accepted can probably depend on the receiver you are trying to talk to.

Payload Data

   byte
    0       1        2       3       4       5       6
|-------|--------|-------|-------|-------|-------|-------|
|  key  |ctrl|cks|  Rolling Code |   Address(A0|A1|A3)   |
|-------|--------|-------|-------|-------|-------|-------|

Where:

• Key: “Encryption Key”, Most significant 4-bit are always 0xA, Least Significant bits is a linear counter. In the Smoove Origin this counter is increased together with the rolling code. But leaving this on a constant value also works. Gerardwr notes that for some other types of remotes the MSB is not constant.
• Ctrl: 4-bit Control codes, this indicates the button that is pressed
• Cks: 4-bit Checksum.
• Rolling Code: 16-bit rolling code (big-endian) increased with every button press.
• Address: 24-bit identifier of sending device (little-endian)

The payload data is send starting with the MSB from byte 0.

Payload obfuscation

The payload data is obfuscated by doing an XOR between the byte to obfuscate and the previous obfuscated byte. In pseudo C the algorithm can be written as:

uint8_t frame[7];
for (i=1; i < 7; i++) {
	frame[i] = frame[i] ^ frame[i-1];
}

Checksum algorithm

The checksum is calculated by doing a XOR of all nibbles of the frame. To generate a checksum for a frame set the ‘cks’ field to 0 before calculating the checksum. To verify a frame check if the value returned by the checksum algorithm is equal to 0, if not the frame is corrupt.

In pseudo C the algorithm can be written as:

uint8_t frame[7];
for (i=0; i < 7; i++) {
 	cksum = cksum ^ frame[i] ^ (frame[i] >> 4);
}
cksum = cksum & 0xf;

Control codes

The Smoove Origin RTS uses the following control codes:

Value	Button(s)	Description
0x1	My	Stop or move to favourite position
0x2	Up	Move up
0x3	My + Up	Set upper motor limit in initial programming mode
0x4	Down	Move down
0x5	My + Down	Set lower motor limit in initial programming mode
0x6	Up + Down	Change motor limit and initial programming mode
0x8	Prog	Used for (de-)registering remotes, see below
0x9	Sun + Flag	Enable sun and wind detector (SUN and FLAG symbol on the Telis Soliris RC)
0xA	Flag	Disable sun detector (FLAG symbol on the Telis Soliris RC)

More info on the motor programming/limits see the Somfy Motors FAQ

Addressing

The address field of a frame contains the address of the source(eg. the remote control). The device to be controlled is programmed with the addresses of the remote controls it should listen to. Looking at the addresses of multiple remote controls from the same batch suggests that the addresses are little-endian and are sequentially assigned to the devices.

Rolling code

The Rolling code is increased every time a button is pressed. The receiver only accepts frames if the rolling code is above the last received code and is not to far ahead of the last received code. This window is in the order of a 100 big.

Frame repeat

When a button is hold pressed the sender will repeat the same code. The frames are separated by the Inter-frame gap. The second and following frames have a hardware sync that consists out of 7 high/low repetitions instead of 2. The repeating frames are identical to the original, the key and rolling code is not increased.

(De-)Registering remotes

The Somfy receivers allow new remotes to be registered and old remotes to be deregistered from a receiver. The exact procedure is described in the Somfy manuals.

In short the registration process goes like this:

• Long press the ‘Prog’ button on a remote that is already registered to the device, until the blinds move shortly up and down. (TODO: how many frames is a long press?)
• Press the ‘Prog’ button on the new remote that you want to register, until the blinds move shortly up and down again. Sending the same frame 4 times, like I do with a normal button press, worked for me.

The deregistration process should be similar although I haven’t tried that yet.

As Dirk note’s in the comments below, when registering a new remote its rolling code can start at an arbitrary value. But for deregistering the rolling code must be within the receivers expected range.