Modbus communication between stove and wifi module

[elkarto]

I have been doing some research looking at the communication between the wifi module and the stove.

Mi stove is an Edilkamin Blade H and the wifi module is a Wifi H (Astrel / HottoH)

It is an RS232 bus, and the used communication protocol is MODBUS RTU.

Baudrate: 19200 Data bits: 8 Parity: Even Stop bits: 1

The slave address of the stove is 0x10.

There is still a lot of work to be done. I have only been able to do some quick tests. I have only been able to identify with confidence a few register addresses, which are the ones I am listing here. I have potential candidates for other addresses but I want to be sure about it.

Well, what matters:

When you change any setting in the application, the module writes that register on the fly. There is no write polling. The records it writes are as follows:

Regarding the reading, there is a polling of the information, rather fast.

The module cyclically reads all these registers in the same order:

I have doubts about other addresses marked with ?, but I think that some of them may also correspond to:

• Water pressure
• Chamber differential pressure
• Water input temperature
• Other temperature sensing inputs, like boiler, puffer, dhw, other rooms... (reads 65101 value in my stove)

I will try to continue testing to identify more addresses

I don't know if it can be so useful for this python library, but maybe someone can find it helpful.

What seems to be clear is that the wifi module reads more data than it afterwards exposes over the network.

[benlbrm]

Hello, Yes it's sur the wifi module gets more than it output to us on the app. I saw on my dns server logs than the wifi module is talking with hottoh's server in Italy. They should read working indicators like runtime, plug time, maintenance time and so on.

[elkarto]

Do you think so?

I thought it would simply act as a proxy to be able to access the stove remotely.

Have you checked if it is an encrypted communication? Maybe we can see which data it is sending.

[nomaro]

Hello, I am reviving the subject because I am trying with your information to communicate with my MCZ VIVO 90 pellet stove with Hottoh HB04V1 motherboard. I can communicate via Modbus on RS232 bus with the stove at address 16. I tried to retrieve the information with your tables but it doesn't seem to match. I'm moving forward, testing different addresses.

Here are my results:

Address 1 to 256: unknown information that I cannot recover.

Address 257 to 512: COILS length 8: increment from 00000000 to 11111111

Address 513 to 768: HOLDING REG length 1 increment from 0 to 65280 in steps of 256.

Address 769 to 1024: COILS length 24: increment from 00000000 to 11111111 on the first 8 characters then a fixed series identical each time 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0

Do you have an idea to guide me? :D

[FranzKillig]

Hello,

I would like to participate here because I would like to control my MCZ VIVO 90 with the Modebus adapter in the ioBroker. I currently control my oven with the Gateway RMS100 from EDNT. https://www.pobes.de/IM/HEATOMATIC/RMS100-HC-8-15-Endkunden_screen.pdf However, since the APP did not work properly and the company stopped further development, I made do with it I access the web interface of the RMS100 using a script from the ioBrocker and control the oven. Unfortunately, the bus communication between the RMS100 and the oven's motherboard is not 100% stable. So it happens every few weeks that the oven continues to heat instead of switching off.

That's why I would like to help you get direct communication between iobroker and the oven to work.

So the first question is, what hardware do you use to establish the connection between the motherboard and the computer interface (USB or TCP)?

greeting Franz

Excuse the bad Google English

[benlbrm]

Hello, I am reviving the subject because I am trying with your information to communicate with my MCZ VIVO 90 pellet stove with Hottoh HB04V1 motherboard. I can communicate via Modbus on RS232 bus with the stove at address 16. I tried to retrieve the information with your tables but it doesn't seem to match. I'm moving forward, testing different addresses.

Here are my results:

Address 1 to 256: unknown information that I cannot recover.

Address 257 to 512: COILS length 8: increment from 00000000 to 11111111

Address 513 to 768: HOLDING REG length 1 increment from 0 to 65280 in steps of 256.

Address 769 to 1024: COILS length 24: increment from 00000000 to 11111111 on the first 8 characters then a fixed series identical each time 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0

Do you have an idea to guide me? :D

I'm sorry but I can't help you, I've never tried the modbus connection on my side but maybe @elkarto can give help ?