aelias-eu / vent-axia-remote

Vent-Axia wired remote protocol analysis & reverse engineering
MIT License
16 stars 2 forks source link

Connecting Ventaxia Kinetic to a PC #1

Open Leeev opened 1 year ago

Leeev commented 1 year ago

Hi, Excellent work on this project! I'm trying to connect to my Ventaxia Kinect from my PC. I've tried using a few USB to serial adaptors, but I'm not getting any data sent though and data I send is being ignored. Just wondering if you'd progressed with anything like the virtual keypad on a ESP32 with an interface to MQTT, to allow integration into Home Assistant? All the best, Lee

alextrical commented 7 months ago

I'm in the same situation. Using ESP-Link on a ESP8266 and a MAX3232 as the TTL to RS232 adapter. Also with the same goal to integrate into home assistant.

I would guess that the display sends some information to the main unit to announce its presence?

Edit: yep, it looks like this is the case after looking through the custom display FW there is a chance we can get something communicating ''' // Message sent to MVHR unit at start-up. unsigned char alive_str[] = {0x04, 0x06, 0xFF, 0xFF, 0xFF, 0x10, 0xFC, 0xE8, '\0'}; '''

Leeev commented 7 months ago

Ah, I ended up buying cheap signal analyser from eBay. There's no need for any initialisation, the Ventaxia just spews data out every 300ms or so, it's a firehose of data, just repeating over and over what's on the screen of the main unit. I haven't got as far as sending data to the unit to imitate local key presses on the main unit.

alextrical commented 7 months ago

Huh, I wonder what's up with my unit? I used a MAX3232 and ESP-Link and got nothing back over the serial link. I will get a logic analyser on the cable in a bit and see what's happening (probably an issue on the RJ11 cable I'm using then)

If all units work like yours does of streaming an exact copy of the main screen 24/7 that would be a great start. Would love to get control over summer bypass into home assistant, and if we are lucky get some feedback from the unit too ^_^

Part of me does wonder how involved it would be to create a replacement (open source) control panel and firmware, to allow Full control of unit over WiFi

Edit: Further investigation shows only 1 of the RS232 lines has continuity to the SP202ECT chip (the RJ11 I'm using all pins have continuity to the socket) , so woop, at least that explains why I don't see this stream of data others can access. That's a job for another evening. Probably going to solder a pin header to pins 13 and 14 for further testing.

Looking through the manual, it seems I'm using the wrong port. It looks like I should be using the BMS port, and setting BMS to off in the commissioning menu. Hopefully connecting RS232 to the rear port hasn't caused any damage.

alextrical commented 7 months ago

So, I've managed to get connected up to the right port this time, and seeing that comical spew of data it's sending. So far only using ESP-Link to see a remote terminal, but it's looking good so far.

I've started drafting up an Arduino uno sketch to replicate the functionality of the Remote Display, and buttons, once that's working I will start looking at how to get a web gui setup to simulate a 16x2 display

Leeev commented 7 months ago

Yes, I was thinking about an Arduino, but I've gradually been moving to Raspberry Pi Pico's lately, due to the Micro Python, and the built in Wifi. With the intention of connecting it to Home Assistant as the end goal. Are you basically trying to recreate the Ventaxia remote unit?

FatBeard commented 7 months ago

Would anyone have the wiring information (rj11 pins to v g rx tx). I don't have original cable. I'm just using an rj11 cable I created myself. I'm going to give this a try myself. Thanks.

alextrical commented 7 months ago

With the intention of connecting it to Home Assistant as the end goal. Are you basically trying to recreate the Ventaxia remote unit?

The end goal for me is home assistant too, thought as i don't have a remote unit, I'm working through creating a prototype unit, to test the intended functionality before going too deep into new functionality such as MQTT integrations (with spam reducing filtering of the display messages)

alextrical commented 7 months ago

Would anyone have the wiring information (rj11 pins to v g rx tx). I don't have original cable. I'm just using an rj11 cable I created myself. I'm going to give this a try myself. Thanks.

I know the central 2 pins are Rx and Tx from testing. The port you want to use is the one listed BMS and its a RJ9 (Don't use the RJ11 on the rear, I don't know what that is for, but its not RS232)

Oddly testing I couldn't use a multi meter to identify GND/VCC, it seemed to be a AC signal, but the MAX3232 chip was happy using either of the outer pins as GND :/

I believe the pin-out (I've just drafted up) is the following, but it may be mirrored. Either way while testing the MAX3232 was perfectly fine, while connecting GND, RX and TX (not using VCC) RJ9_Handset_diagram

alextrical commented 7 months ago

First draft of a display connected to the Vent Axia unit, decoding the a communication from the MVHR https://wokwi.com/projects/388200586434783233

Going to try and work on getting the buttons working next and hopefully test in the real world in a few days

FatBeard commented 7 months ago

Thank you. I'll give it a try and let you now

aelias-eu commented 6 months ago

Hi, sorry for being inactive - I have a lot of going on. I'm glad that someone is interested in this :) Just for quick info - my first draft looks like this: image The Rx/Tx pins might be incorrectly connected to inputs/outputs of the MAX3232 in the schematics, but this is only a draft. I will do a measurement and test-connection (PoC) before PCB the design.

I want to connect the ESP32 between the keyboard module and the MVHR unit. The ESP will by default act as a repeater - everything that MVHR sends will be sent to the keyboard unit (data to show on the LCD) and everything that the keyboard sends will be sent to the MVHR (key press).

The ESP will use 2 HW serials with custom PIN assignment. It should be quite fast for this task.

On top of that, i want to send changes via WiFi to the MQTT server and also process received commands from MQTT (simulate keypress)

This schematics will be updated as soon as I have something new.

alextrical commented 6 months ago

Looks good to me, I was going to question the need for the ESP to be in-between the Display and Main unit, as it should be possible to Sniff and Inject without severing the direct link, (it would allow the Remote to still work regardless of the ESP's state) but I can see the benefits of doing it the way you propose, it will allow hijacking of the screen for the possibly of additional functionality.

The ESP32 is likely overkill for such a task, an ESP8266 would have plenty of power to run 2 software serials at 9600.

For simulation of the software, have a look at Wokwi. I drafted up a simulation with an Arduino UNO and a custom chip pretending to be the MVHR serial out stream (nothing too fancy) https://wokwi.com/projects/388200586434783233 You can simulate the ESP32 with WiFi through that site too

aelias-eu commented 6 months ago

but I can see the benefits of doing it the way you propose, it will allow hijacking of the screen for the possibly of additional functionality.

Yes, that's exactly what I've had in mind - among others, I would like to show some temperatures from external sensors on the LCD. And also injecting to a working RS-232 line could lead to problems - > if KBD module sets the state to "0" (+3to15V) and you will try to inject the "1" (-3to-15V), it could mess something up. Maybe one of the nodes (or both) could end up with blown RS232 output.

Currently, in my HomeAssistant it looks like this: image

The ESP32 is likely overkill for such a task, an ESP8266 would have plenty of power to run 2 software serials at 9600.

yes, that's true, but the price difference is minimal and I like the 2 cores of ESP32 - one will handle the serial communication, the other will communicate with MQTT and probably provide the HTTP server.

I have not used the Wokwi, but it looks interesting. Will try. Thanks

alextrical commented 6 months ago

wow, nice work. I'm curious as to haw you are obtaining the temperature metrics, I didn't believe that the the MVHR exposed those values.

aelias-eu commented 6 months ago

Sorry, it's an external measurement - esp32 + couple of ds18s20 or ds18s20. But it will be moved to the ESP32 dedicated fór mvhr/keyboard

aelias-eu commented 6 months ago

FYI - I have created a new repo for the ESP part -> https://github.com/aelias-eu/vent-axia-esp32 I'm waiting for the MAX3232 to arrive. I have tested the software part by simulating the Keyboard and MVHR via two USB/TTY converters. This worked for me. I'm just curious about some protocol frames because Brian in his https://github.com/brianmarchant/vent-axia-remote-oled-pic has a bit different byte values ... On his KBD the keypress frame started with 0x04, 0x06, 0xFF, 0xFF, 0xFF, but my sniffed values were 0x04,0x05,0xAF,0xEF,0xFB,. So why the difference? What does the MVHR / Keyboard really expects? We will seee when the MAX3232 arrives and I will do a real MITM - or better ESP-In-the-middle situation.

Leeev commented 6 months ago

Oddly testing I couldn't use a multi meter to identify GND/VCC, it seemed to be a AC signal, but the MAX3232 chip was happy using either of the outer pins as GND :/

Really? I'm sure when I tested it there was a solid 5V there, as I was planning to use it to power the ESP/Pico I'm planning on connecting to the unit.

aelias-eu commented 6 months ago

It should be DC 5V between the Black and Yellow line. @alextrical didn't you measure the voltage between the red and black? Because measuring AC there would make sense (RS-232 line)

alextrical commented 6 months ago

I'm away from the unit until mid next week, but I now have a second unit that I can access to do bench testing with, rather than crawling around in the loft space.

I'm not sure exactly what I did at this point, all I know was some of the testing was (incorrectly done) on the 6 pin socket at the rear. I will test the BMS socket and the breakout cable again on the second unit and confirm the pinout. It would be great if the VCC line was able to provide enough power for an ESP32 or ESP8266 (which I assume it should be able to, given it is meant to drive and LCD)

cassman42 commented 4 months ago

Hi, I'm enjoying watching your progress on this as I want to do the same. There is an interesting set of pages if you hold down the UP arrow and the "BOOST" / fan button for about 5 secs. the screen 2 gives the inbound air temp, and 3 the return from the house. there are other pages which give the humidity and co2 levels (i think looking at the numbers)

alextrical commented 4 months ago

That would be amazing if that's the case, we should be able to automate that to grab the data for Home assistant. Unfortunately i'm still a few months away from having the free time to tinker with this system again, but by then i will have a second unit setup in a workshop to pay around with, without risking the main one in the house

cassman42 commented 4 months ago

If I had something to log the interaction, I'd send you the logs. One thing I saw was when it was on screen 2 or which ever, it would continue to send the diagnostic data so if its sending all the data behind the scenes or not I don't know. I think I need to get a raspberry pi and 2 rs232 devices. just to act as a pass through logger.

martinglass commented 1 month ago

Hi, I'm enjoying watching your progress on this as I want to do the same. There is an interesting set of pages if you hold down the UP arrow and the "BOOST" / fan button for about 5 secs. the screen 2 gives the inbound air temp, and 3 the return from the house. there are other pages which give the humidity and co2 levels (i think looking at the numbers)

Does anyone have a list of the meaning of the data on each diagnostic page, or can we compile one?

martinglass commented 1 month ago

Here's a list of the data on my Diagnostics Screen pages:

Page | Value 1 | Value 2 | Value 3 | Value 4 | Value 5 | Value 6 -- | -- | -- | -- | -- | -- | -- 0 | 020 | 031 | % | 0813 |   |   1 | 035 | 044 | % | 1136 |   |   2 | 21 | C | 00 |   |   |   3 | 22 | C | 00 |   |   |   4 | 72 | % | 20 | C | 72 | 003 5 | 0 | 00 | 00 | 0 | 00 | 000 6 | 0000 | 1 | 0 | 000 | 00 |   7 | 0000 | 1 | 0 | 000 | 00 |   8 | 0000 | 1 | 0 | 000 | 00 |   9 | 0000 | 0 | 14 | 00 |   |   10 | 0000 | 0 |   |   |   |   11 | 00 | 0 | 16 | 0000 | 0000 |   12 | 000 |   |   |   | 10 |   13 | 000 |   |   |   | 10 |   14 | 000 |   |   |   | 10 |   15 | 000 |   |   |   | 10 |   16 | 000 |   |   |   | 06 |   17 | 0000 | 0 | 000 |   |   |   18 | 0000 | 1 | 000 |   |   |   19 | 1 |   |   |   |   |   20 | 0001 | 1 |   |   |   |   21 | 0000 |   |   |   |   |   22 | 0000 |   |   |   |   |   23 | 04474 |   |   |   |   |   24 | 00 | 0 | 000 | 00000 |   |   25 | 0000000000000000 |   |   |   |   |   26 | V99/06 |   |   |   |   |   27 | SBP TEST |   |   |   |   |   28 | Reset |   |   |   |   |  

aelias-eu commented 1 month ago

@martinglass great! I will check mine & compare. Thank you.