Reverse engineering a Bluetooth roof ventilation

Hi, posting this in case anyone else has the same device and has attempted any reverse engineering.

I have a CSR AiroMatic roof ventilatior (sometimes also branded as Edmonds or Bradford, or SmartBox) - it sits in the roof and:

  • Has 3 fan speeds
  • Has temperature and humidity sensors
  • Operates either in manual mode, or an auto mode which chooses fan speed based on the onboard sensors.

Unfortunately, a few downsides:

  • In its higher speed settings, it’s loud - not great for sleeping nearby
  • The button to change mode is somewhat inconveniently located on the device - in the roof space.

Strangely, the fan shows up on Bluetooth scanners - that’s not advertised as a feature, there’s no info online, and no obvious way to control it. This means there’s no app I can control it with to sniff.

I’ve connected to it with nRF Connect, and can see the following info:

  • Device Name: Edmonds SmartBox
  • Model number: SmartBox
  • Firmware revision string: RF-03
  • PnP ID: Bluetooth SIG Company: Texas Instruments Inc. / Product version 72
  • Unknown services with names such as deadaa20-b00f-0000-c4d7-0000000023eb
  • Unknown service 0xFFE0
    • Includes 0x2091 Key Press State

I don’t know what I’m doing, and it may just be that this isn’t controllable without some significant work. But if someone out there has one of these and knows more than I do about this stuff, would be keen to hear about it.

Control board below for good measure