Figuring out an RS485 protocol? - Page 1
Forum section: electronics / projects

author: alanambrose
author_rank: Frequent Contributor
timestamp: October 29, 2018, 04:01:47 pm
content: Hi,I'm trying to figure out (i.e. reverse engineer) an RS485 protocol - and I wonder whether (a) someone recognises this, or (b) someone has some hints on how to go about decoding it.It's taken from chatter between a heating controller and a thermostat.Messages occur roughly once a second. There's a 2s sample below, apparently with two messages (each maybe a poll & response), taken with an RS485 sniffer at 9600 baud (I measured the waveform frequency at 10kHz with a scope). The listing is time in ms followed by bytes in hex, so the 1st part is just 2 bytes 0x95ee. My preliminary investigation suggests this isn't Modbus RTU as the 2nd byte in the message, which should be the function code, isn't between 0x01 and 0x10.(I'm looking at this re Modbus format:https://ipc2u.com/articles/knowledge-base/modbus-rtu-made-simple-with-detailed-descriptions-and-examples/)Any ideas?TIA, AlanCode:15:16:50.545 95ee15:16:50.551 bb15:16:50.556 952a15:16:50.561 f80b7809f515:16:50.778 95ee15:16:50.784 ce400979a442000b7c38f915:16:50.847 2a15:16:50.852 f3b815:16:51.573 95ea15:16:51.578 ce056ac80b7809ac15:16:51.759 95eace15:16:51.764 400979a44215:16:51.769 820b7b08e9

author: alanambrose
author_rank: Frequent Contributor
timestamp: October 29, 2018, 04:45:15 pm
content: ...and looking at the protocol as it runs, it looks like a request-response with a 10 or 11-byte request and a 13 or 16-byte response...e.g.Code:Delta T in msTimeHex# BytesPacket Bytes15:16:27.444951515:16:27.449f2fe22615:16:27.475951615:16:27.48172080b7829cc61018115:16:27.66295f22615:16:27.668ce400979a442820b7c08fd1113

author: ajb
author_rank: Super Contributor
timestamp: October 29, 2018, 04:47:49 pm
content: It's a little tough to tell where packets start and end from the capture, because the vagaries of the OS, drivers, and software will obscure the timing somewhat. This is where looking at it on a scope or a logic analyzer would be helpful so you can see the timing more clearly.If you break the capture up by time:Code:15:16:50.545 95ee15:16:50.551 bb15:16:50.556 952a15:16:50.561 f80b7809f515:16:50.778 95ee15:16:50.784 ce400979a442000b7c38f915:16:50.847 2a15:16:50.852 f3b815:16:51.573 95ea15:16:51.578 ce056ac80b7809ac15:16:51.759 95eace15:16:51.764 400979a44215:16:51.769 820b7b08e9A couple of repeated patterns jump out. You'd really want to capture a lot more traffic to start sussing things out. With such a small sample you can't really distinguish between patterns and coincidences. Then you'll want to start capturing traffic while something in the system is changing, to see if you can find any parts of the traffic that seem to track those changes. You could also try disconnecting the two devices, which should give you an idea of which device is sending which sorts of messages.

author: nali
author_rank: Frequent Contributor
timestamp: October 29, 2018, 05:42:02 pm
content: I would probably start by disconnecting the thermostat as you should then hopefully only see the poll message. That'd give you a reference point as to the start of the message exchange.BTW - Are you sure you've got your A/B lines correct? (don't assume the manufacturer's notation is correct!)

author: MiDi
author_rank: Frequent Contributor
timestamp: October 29, 2018, 08:07:15 pm
content: If you could tell the manufacturers of the components or the system this could perhaps give a hint what protocols it could be.What are the high and low voltages measured?

author: engineer_in_shorts
author_rank: Regular Contributor
timestamp: October 29, 2018, 10:42:49 pm
content: Once I saw an interesting you tube video of how someone reverse engineered a protocol.I think it was a WiFi sous vide.

author: engineer_in_shorts
author_rank: Regular Contributor
timestamp: October 29, 2018, 10:49:18 pm
content: Ignore all the Tcp/ip type stuff. At around 14minutes into the video there is a couple of ideas such as time correlation of the known temperature to the packet payload.

author: Fortran
author_rank: Regular Contributor
timestamp: October 30, 2018, 05:54:15 am
content: See if this helps.I've just made a python script that talks to these controllers.English manual starts on page 27. (see attached pdf)

author: alanambrose
author_rank: Frequent Contributor
timestamp: October 30, 2018, 06:30:26 pm
content: Hmm, thanks - all good suggestions.>> Are you sure you've got your A/B lines correct? (don't assume the manufacturer's notation is correct!)I think so, but you're right, it would be worth reversing them to see whether it makes more sense.>>> I would probably start by disconnecting the thermostat as you should then hopefully only see the poll message.Duh, I actually didn't think of that.>>>If you could tell the manufacturers of the components or the system this could perhaps give a hint what protocols it could be.What are the high and low voltages measured?<<<These are Uponor components - from the markings on the device (A, B, 5V and GND) and the scope trace (sorry I'm not at that location right now and didn't save a pic) compared with some RS485 examples I saw on the web, it definitely looks like RS485 polled once a second at 9600 baud. Of course, I can always be wrong.>>> a couple of ideas such as time correlation of the known temperature to the packet payload.Nice, I think I can see half-a-dozen or so message types, each starting with 0x95xx where xx might be some kind of function code. 0x95 might be the ID of this particular sensor. A nice idea would be run code to spot-the-difference between the last message of that type and the current one. From the thermostat's IU - it looks like there are 5 or 6 values (set temp, current temp etc etc) which might be read as RS485 'registers'. Then I can twiddle the values in the thermostat's UI and spot the changes in the messages.Will try some of these ideas and report back.Alan

author: alanambrose
author_rank: Frequent Contributor
timestamp: November 07, 2018, 06:26:58 pm
content: >>> I've just made a python script that talks to these controllers.Sorry Mr Fortan, I didn't quite process that, esp. since I didn't say which controller...and the protocol you describe doesn't look like the signals I'm getting.Which controllers were you referring to? I'm looking at the T-146 and the I-143 peripherals and the X-145 controller.Alan

author: Fortran
author_rank: Regular Contributor
timestamp: November 08, 2018, 06:32:38 am
content: I'm referring to Drews PID regulators.Not the same, but I figured there could be some similarities.

author: alanambrose
author_rank: Frequent Contributor
timestamp: November 08, 2018, 05:10:17 pm
content: >>>I'm referring to Drews PID regulators.Not the same, but I figured there could be some similarities.<<<Ah, I see.For anyone playing along at home, this is what I'm recording atm:http://anagram.net/nuts/RS485/Uponor%2003-Nov-18%2011-18%20-%20rh%20channel.csvThis has my guess at part of the format in the headings.I also found this doc:https://www.uponor.com/-/media/country-specific/uponor_com/download-centre/smatrix/smatrix-pro/uponor-product-info-smatrix-move-pro-modbus-rtu-en-1088472-12-2016.pdf- this describes the modbus interface on a related (but not the same) device. That is clearly different.Curiously, the data I'm recording seems to have too much variation in it. I assume that if the only data that is changing from the thermostats is the air temperature then it shouldn't change very frequently. I'm getting changes on mostly every poll from (what I think is) the same device.I'm going to put a logic analyser on it to ensure the data I'm recording in my code is really what's on the wire.Alan

author: nali
author_rank: Frequent Contributor
timestamp: November 08, 2018, 09:11:02 pm
content: Just a thought - I'm assuming you're sniffing using a baud rate of 9600 with no parity & 8 data bits. Have you tried using using parity and 7bit?We interface with a variety of equipment at work. Whereas 90% of devices use the ubiquitous 9600,N,8,1 we do sometimes see 7-bit interfaces, especially when using an ASCII-based protocol.

author: alanambrose
author_rank: Frequent Contributor
timestamp: November 22, 2018, 03:28:50 pm
content: >>> Just a thought - I'm assuming you're sniffing using a baud rate of 9600 with no parity & 8 data bits. Have you tried using using parity and 7bit?Ah good point.I'm a bit slow in keeping the thread updated but a fair amount of progress has been made and I'm now successfully faking up some sensor replies.When I started out, being impatient, I waved the scope at it for 5 secs and it seemed to show A & B the right way round at 10KHz frequency so I thought '9,600 baud, probably TRU, off we go....' and fired up some serial code and started logging.Well, while I could see some polls and responses at 1 sec intervals, the data that came back looked a bit rubbish. In particular it varied too much. Barring some wacky encryption scheme, I expected the sensors to send back mostly the same temperature data from second to second - which is, of course, what they do.OK so I fired up the scope for a more careful look around:So, there's the 1 sec poll and response I saw before (screen dump #1), then every 6 secs an extra little poll and response is done (screen dump #2). I disconnected all the sensors (as suggested) and saw only 7 byte polls - all are 7 bytes long and each starts with 0x1104 except for the extra little poll which starts with 0x1204 (screen dump #3). Also, by looking at enough packets I saw that they're probably 8 / N / 1, although nali's point is noted.I measured the frequency a bit more accurately and came up with (screen dump #2) ... 19,690 Hz. Actually, if I use 19,200 baud I get dodgy data and if I use 19,690 everything is good.The clincher came when I checked the last two bytes of each packet against a modbus CRC calc ... and good data...OK so that left me the slowish job of twiddling the options on the sensors, observing the packets and seeing where the data was. It's a mess, all sorts of stuff tucked away on odd byte and bit boundaries and with odd lengths. Definitely not RTU. But decoded nevertheless.Result.Thanks everyone for your useful comments and suggestions.Alan

author: alanambrose
author_rank: Frequent Contributor
timestamp: November 22, 2018, 03:35:11 pm
content: Ah one other funny thing. I was having trouble decoding the temperature data so I started plotting it in Excel. It didn't make much sense until...WTF - Fahrenheit! Last thing I expected - I'm in the UK and Uponor are Norweigan ffsA.

author: thobie
author_rank: Newbie
timestamp: November 24, 2018, 10:00:55 am
content: Quote from: alanambrose on November 22, 2018, 03:35:11 pmUponor is Finnish company. And Celsius is from Sweden so hell no, US to blame!Maybe they have bought some US company or the software development has done is states.

author: stratcat
author_rank: Newbie
timestamp: December 19, 2018, 04:21:19 am
content: This is somewhat like what Raritan (https://www.raritan.com/) uses in their "PX Intelligent Rack PDUs" (glorified power strips for server racks).I pulled one of those (PX-1000) out of a trash bin thinking it was just a big 20 outlet power strip.A few days later, I got around to checking it out. It powered up, no smoke, etc.Then I noticed the ethernet port. They are web-accessible! Each unit has a webserver (and more) that allows monitoring and control of each outlet, banks of outlets, temperature, current, voltage, etc. Internally, they use an RS485-ish protocol. Once I got the Baud rate figured out, I started monitoring the 485 bus. There is a LOT of traffic that appeared to be gibberish at first. Then, I started noticing patterns while monitoring the bus with PuTTY while sending commands via the web server. After a few days (I'm retired), I got it all figured out and started sending commands via RS485 WITH SUCCESS.Needless to say, when I went back to get more of these units, they were all gone.Anyway, I have built up a good bit of documentation if anyone needs such.Sorry to be so long-winded but figuring out odd things is me.Then, there is the Raritan "AUATC terminal converter".Code:The AUATC is designed to emulate an “ASCII terminal,” converting RS232 serial ASCII terminal data to PS/2 keyboard and VGA video or Sun keyboard and Sun video.Saw one on eBay long before the PX-1000 incident for $15.00 and thought I had to have it.A little box about 4" x 4" x 1". I use it often for troubleshooting Arduino projects and other RS-232 stuff.I've modified it for switchable RS-232 serial or TTL serial.It also has an RJ45 port that outputs video and RS485 for their KVM products.Sorry for hijacking your post.

author: jsouto
author_rank: Newbie
timestamp: September 18, 2019, 08:05:52 pm
content: Hi,Did you make some improvements? i trying to find out how the T-146 os Uponor works because I want to manage the thermostat throught Internet.Thanks

author: jsouto
author_rank: Newbie
timestamp: September 20, 2019, 10:11:39 am
content: Quote from: alanambrose on October 29, 2018, 04:01:47 pmI thinking in sniffing the data with a with and Arduino shield,https://www.dfrobot.com/product-1024.html.Is it possible ?Thanks.Sorry for my english

author: alanambrose
author_rank: Frequent Contributor
timestamp: September 20, 2019, 04:52:22 pm
content: >>>I thinking in sniffing the data with a with and Arduino shield,https://www.dfrobot.com/product-1024.html.Is it possible ?<<<Probably, but you might need to set the baud rate to an unusual number and it looks to me that the Arduino codebase that it only accept a few magic baud rates. Maybe someone else can chime in. I'm using C# and a rs485 dongle and setting the baud rate to 19,685. You might like to measure the actual baud rate with a scope if you have one. You could just try a serial app and a cheap rs485 dongle on a Mac/Windows/Linux machine to see if you can see the data OK that way. Try 19,685 and 19,200 baud and 8 / N / 1 and see if either of those work well. You will probably see data in either case, but one may look like sensible regular comms and the other slightly random nonsense.Alan

author: jsouto
author_rank: Newbie
timestamp: September 20, 2019, 10:25:55 pm
content: >>>I'm using C# and a rs485 dongle and setting the baud rate to 19,685.>>>>>>Which dongle are you using ? and did you make an on porpose application in C# to read the data in the dongle ?What you mean with 8 / N / 1 ?Thanks

author: jsouto
author_rank: Newbie
timestamp: November 12, 2019, 11:20:07 pm
content: Quote from: alanambrose on September 20, 2019, 04:52:22 pmHi,I made some progress. As you said, I put a rs485 dongle to sniff the traffic of the thermostat. I tried with 19685 baud, 8/N/1 and I get data but now the problem is figure out where the temperature is store. This is my pattern:10 05 54 f1 ff a1 0f10 05 54 f1 40 02 c6 3e 00 00 3f 0c 08 3b 01 9a 71 4610 05 54 f1 2d 7f ff 3d 00 00 0c 00 24 37 01 9a 38 03 b6 3b 01 9a 3c 00 48 35 80 00 ea a711 05 68 d8 ff 43 5311 05 68 d8 40 02 c9 3e 00 00 3f 0c 03 42 00 22 08 09 da 09 68 26 0a 00 2e 45 1c11 05 68 d8 2d 7f ff 3d 00 04 0c 00 24 37 01 9a 38 03 b6 3b 02 c4 3c10 05 54 ff ff a5 6f10 05 54 ff 40 02 c2 3e 80 00 3f 0c 08 3b 03 b4 af 0110 05 54 ff 2d 7f ff 3d 00 40 0c 00 24 37 01 9a 38 03 b6 3b 03 b4 3c 00 48 35 80 00 e4 6e10 05 54 31 ff f1 0f10 05 54 31 40 02 c1 3e 00 00 3f 0c 08 3b 01 9a c1 9d10 05 54 31 2d 7f ff 3d 00 00 0c 00 24 37 01 9a 38 03 b6 3b 01 9a 3c 00 48 35 80 00 13 9810 05 54 eb ff aa 6f10 05 54 eb 40 02 c3 3e 00 00 3f 0c 08 3b 02 ab 86 e810 05 54 eb 2d 7f ff 3d 00 00 0c 00 24 37 01 9a 38 03 b6 3b 02 ab 3c 00 48 35 80 00 df 1c10 05 54 36 ff f3 3f10 05 54 36 40 02 ca 3e 00 00 3f 0c 08 3b 02 a9 fb da10 05 54 36 2d 7f ff 3d 00 00 0c 00 24 37 01 9a 38 03 b6 3b 02 a9 3c 00 48 35 80 00 fa e010 05 54 f1 ff a1 0fI think the 10h is the id device and 05h the function which would be Write Single Coil. How did you do to find the temperature field ?ThanksJSouto

author: mitokondoria
author_rank: Newbie
timestamp: March 25, 2020, 10:52:53 pm
content: I'm on my own quest to fetch data from the same thermostat.I have been able to sniff with an Arduino + MAX485 board at 19200 baud. Still havent disconnected the thermostat, but my pattern is:Code:11 05 95 8B FF EE 5311 05 95 8B 40 02 D9 3E 00 00 3F 0C 02 E1 F111 05 95 8B 2D 7F FF 3D 00 00 0C 00 24 37 01 9A 38 03 B6 3B 02 C4 3C 00 48 35 80 00 B9 9811 05 95 72 FF AC 0311 05 95 72 40 02 D3 3E 00 00 3F 0C 02 9E 1D11 05 95 72 2D 7F FF 3D 00 00 0C 00 24 37 01 9A 38 03 B6 3B 02 C4 3C 00 48 35 80 00 41 EB11 05 95 26 FF 92 C311 05 95 26 40 02 D1 3E 00 00 3F 0C 02 FF 4911 05 95 26 2D 7F FF 3D 00 00 0C 00 24 37 01 9A 38 03 B6 3B 02 B2 3C 00 48 35 80 00 01 4911 05 95 CD FF DC 3311 05 95 CD 40 02 E8 3E 00 00 3F 0C 02 23 F911 05 95 CD 2D 7F FF 3D 00 00 0C 00 24 37 01 9A 38 03 B6 3B 02 C4 3C 00 48 35 80 00 11 DA11 05 95 9F FF E1 5311 05 95 9F 40 02 CD 3E 00 00 3F 0C 02 F5 B011 05 95 9F 2D 7F FF 3D 00 00 0C 00 24 37 01 9A 38 03 B6 3B 02 84 3C 00 48 35 80 00 F9 ECWhich would match with the 5 thermostats at my home

author: Doctorandus_P
author_rank: Super Contributor
timestamp: March 26, 2020, 01:59:11 am
content: I skimmed through this thread and I'm not even sure whether the data captured is actually correct. RS485 does not imply a uart compatible format. As long as you're not sure of that, any attempt of staring at hex values will be pointless.If you use Sigrok + Pulseview with one of the USD10 Logic Analyser boxes with a Cypress CY7C680somethingsomething you have a much better platform to capture your data. (Especially if you add a RS485 to TTL chip)These very affordable Logic Analysers are also wonderfull for debugging "arduino", or any other microcontroller projects that work with (low speed) serial data streams. SPI, I2S, Uart, Sigrok has more then 100 protocol decoders now.

author: mitokondoria
author_rank: Newbie
timestamp: March 27, 2020, 08:11:38 pm
content: I'm certainly staring at those values, but after disconnecting 4 in 5 thermostats, it seems clear that the master is polling the slaves (because they were previously registered)These messages, in my case, are following this pattern:Code:11 05 95 XX FF YY ZZWhen the thermostat is available, the rest of the conversation packets start with 11 05 95 XX, so it looks like XX is the id of each thermostat, while FF whould be the ping messageThe other conversation messages have XX with values 40 and 2D (in my understanding, they could map to a slave-pong&message / master ack-message messages)the pong also includes additional info once the setup temperature has been modifiedI have modified the configured the temperature and the bytes having the value on Fahrenheit for the ack are02 96Code:11 05 95 9F 2D 7F FF 3D 00 00 0C 00 24 37 01 9A 38 03 B6 3B 02 96 3C 00 48 35 80 00 CB EDwhile the slave pong&message includes the same02 96Code:11 05 95 9F 40 02 C7 3E 00 00 3F 0C 02 3C 00 48 3B 02 96 AF 2AWith this, I'm fairly confident on the correct captured data, even on a different rate. I still have to find where is the actual temperature being set and if part of the message includes a master-turn-on-the-heating value, tho.About the sigrok usage, I will go for it as seems the proper way to go, instead of finding on a text editorEdit: As perhttps://www.lammertbies.nl/comm/info/crc-calculation,the last two bytes match the modbus crc-16, so the dump is definetly correctEdit2: found an Uponor document describing each modbus frame formathttps://www.mikrocontroller.net/attachment/446274/Uponor_IM_Smatrix_Base_PRO_MODBUS-RTU_EN_1090255_032018.pdfand more important:* requests to switch modes, from eco to confort* requests to write the setpoint* request to read a sensor temp

author: jsouto
author_rank: Newbie
timestamp: July 20, 2020, 11:50:03 am
content: Hi,Here are my advance:110568d8ff4353110568d84002c23e00003f0c03420019080a0d0965de0a000ce983110568d82d7fff3d00040c002437019a3803b63b02ba3c0048358000bc19110568d8 – Living room thermostat40 – Id SetPoint temperature02c2 – Value2d7ff – Id real temperature02ba – ValueWhich model of thermostat do you have??

author: dimmu311
author_rank: Newbie
timestamp: November 15, 2020, 09:32:10 pm
content: Hi,i have also Uponor Device. I want to repace the original uponor room thermostat and use home automation system that has rs485 interface.With the Infos form here and with the log of one of my thermostat, i think i have some more idea of the protocol, but it is still something missing.i also have a set nearly looks like the other ones postet here.10 4 21 77 FF D3 4910 4 21 77 40 3 4 3E 0 0 3F 0C 8 3B 2 B3 53 D010 4 21 77 2D 7F FF 3D 0 0 0C 0 24 37 1 9A 38 3 B6 3B 2 B3 3C 0 48 35 80 0 4A 31see this set for example.i think the first byte is something like device type. i use t145, wich is more basic one then yours.i think uponor uses diffrent values for diffrent thermostat types.i also think that this is a poll message form the controller to get the the values from the connectet thermostats.10 4 21 77 FF D3 49in my case the termostat answers with this to packets.i think i have found something intressting.see this messages. i have removed the header at the beginning and the crc at the endI think the message follows a simple rule. 1 byte messege code, 2 bytes value.using this rules i think about that:40 3 4 3E 0 0 3F 0C 8 3B 2 B32D 7F FF 3D 0 0 0C 0 24 37 1 9A 38 3 B6 3B 2 B3 3C 0 48 35 80 040 = actual temp = x03x04 -> 772 -> (772-320)/18 = 25,1°C3E = ?3F = ?3B = set Point temp = x2x3B -> 571 -> (571-320)/18 = 20,6°and the second packet2D = ? not sure, maybe a value in twos complement. in KNX 7fff is reserved for not available value.3D = ?0c = humidity? -> sure about this. the value could be posible, but i dont know if this thermostat is able to messure humidity.37 = Min possible Set Point Temp (5°C)38 = Max possible Set Point Temp (35°C)3B = again the setpont temp3C = ?after i study the modbus document i think ther should be some values for:heating/cooling mode,day/night mode,diffrent setpoint temp in cooling modediffrent setpoint temp in night mode (maybe after the 2D) could be -2K or somethingactual humiditysetpoint humidity.so now the problem is: on my thermostat i can only change the setpoint temp. When i change the setpoint temp i can see diffrent value after 3B. When i use hairdryer i can see higher value after 40.could maybe one of you check if my theory could be bossible? Or mybe somone of you have thermostat wher you can see humidity, or something else to double check if i have found right messeg code.i have attached excel sheet. you can put your message there and it calculates the thinks i found out.Thank you

author: TBuyukkilic
author_rank: Newbie
timestamp: February 07, 2022, 09:42:12 pm
content: Hi guys,This topic really helped me out on my quest. I'm a bit stuck and I don't really know what to do, hopefully you can help out.So I have a Uponor Smatrix Base X-245 base station with the Uponor Smatrix Base T-146 Bus thermostats. I have 8 of them hooked up, and this is the output I can read using a Raspberry Pi 3B+ and a MAX485 device:Code:110c1bcaffbdb4110c1bca40027d3e00003f0c023c00483b026042b300c856110c1bca2d7fff3d00000c002437019a3803b63b02603c00483580002928110c28beff6abb110c28be4002753e00003f0c0242b3003f71110c28be2d7fff3d00000c002437019a3803b63b02073c004835800077e1110c0566ffa0b2110c05664002753e00003f0c0242b3003285110c05662d7fff3d00000c002437019a3803b63b02073c00483580008c01110c04c9ff8c82110c04c94002d23e00003f0c0242b30011b2110c04c92d7fff3d00000c002437019a3803b63b02c33c0048358000f596110c04eaff95b2110c04ea4002c13e00003f0c0242b3009a8b110c04ea2d7fff3d00400c002437019a3803b63b02c43c0048358000c2b8110c04c5ff8982110c04c54002a03e00003f0c0242b300a39f110c04c52d7fff3d00000c002437019a3803b63b027c3c00483580004432110c04dbff8022110c04db4002c43e00003f0c0242b300c9ea110c04db2d7fff3d00000c002437019a3803b63b02c33c00483580000ab1110c055dffb382110c055d4002873e00003f0c0242b300cdf7110c055d2d7fff3d00000c002437019a3803b63b027c3c00So I was really happen when I was able to read the actual and set temperature values from this response. Since the request/responses adhere to the CRC-16 (Modbus) check, I started an attempt to set the temperatures. So I've installed the Python package minimalmodbus and configured my instrument as follows:Code:import minimalmodbusfrom gpiozero import OutputDevicede = OutputDevice(23)re = OutputDevice(24)de.off()re.off()instrument = minimalmodbus.Instrument('/dev/serial0', 1, minimalmodbus.MODE_RTU)instrument.serial.timeout = Noneinstrument.debug = TrueBut whatever command I try to send, e.g. instrument.read_register(40006,0,3,True) to read the value set for channel 6, I keep getting the "11 0C" response, which indicates that it's an functioncode 12 "Get Comm Event Log" response.This is the error:Code:>>> instrument.read_register(40006,0,3,True)MinimalModbus debug mode. Will write to instrument (expecting 7 bytes back): 01 03 9C 46 00 01 4B 8F (8 bytes)MinimalModbus debug mode. Clearing serial buffers for port /dev/serial0MinimalModbus debug mode. No sleep required before write. Time since previous read: 2965.81 ms, minimum silent period: 2.01 ms.MinimalModbus debug mode. Response from instrument: 11 0C 1B CA FF BD B4 (7 bytes), roundtrip time: 7.0 ms. Timeout for reading: 0.0 ms.Traceback (most recent call last):File "<stdin>", line 1, in <module>File "/usr/local/lib/python3.7/dist-packages/minimalmodbus.py", line 486, in read_registerpayloadformat=_Payloadformat.REGISTER,File "/usr/local/lib/python3.7/dist-packages/minimalmodbus.py", line 1245, in _generic_commandpayload_from_slave = self._perform_command(functioncode, payload_to_slave)File "/usr/local/lib/python3.7/dist-packages/minimalmodbus.py", line 1330, in _perform_commandresponse, self.address, self.mode, functioncodeFile "/usr/local/lib/python3.7/dist-packages/minimalmodbus.py", line 1875, in _extract_payloadresponseaddress, slaveaddress, responseminimalmodbus.InvalidResponseError: Wrong return slave address: 17 instead of 1. The response is: '\x11\x0c\x1bÊÿ½´'Do you guys know what to do? Is it possible that the Uponor Smatrix Base X-245 only has a subset of the Modbus functions implemented? If so, what would my best shot be to write something back?I tried to capture a possible request to change the temperature, but all I can see is the log where I went from 21,5°C (707°K, \x02\xc4) to 25,0°C (770°K, \x03\x02)Code:110c04eaff95b2110c04ea4002c43e00003f0c02 42b3008a9b110c04ea2d7fff3d00000c002437019a3803b63b02c43c0048358000d777110c04eaff95b2110c04ea4002c43e00003f0c02 3c00483b030242b3004466110c04ea2d7fff3d00000c002437019a3803b63b03023c0048358000b0b7110c04eaff95b2110c04ea4002c43e00003f0c023c00483b030242b3004466110c04ea2d7fff3d00400c002437019a3803b63b03023c0048358000a578110c04eaff95b2110c04ea4002c43e00003f0c0242b3008a9b110c04ea2d7fff3d00400c002437019a3803b63b03023c0048358000a578

author: mitokondoria
author_rank: Newbie
timestamp: February 21, 2022, 09:20:33 am
content: Quote from: dimmu311 on November 15, 2020, 09:32:10 pmHi dimmu311,I own a SMatrix Wave with five T146 thermostats. Such thermostats doesn't have any humidity sensor, only a configurable remote temperature sensor.My only available settings on the unit is modifying the ECO temperature and defining this remote sensor.I'm working on completing a sketch for a Wemos D1 mini + MAX485 behaving as a sniffer and publishing to a MQTT topic (so homeassistant displays several climate entities). Will publish it as soon as it is "fine"Edit: I have uploaded thee sketch athttps://github.com/witokondoria/homeassistant_uponor

author: mitokondoria
author_rank: Newbie
timestamp: February 24, 2022, 11:54:47 am
content: I would think that uponor is not following the Modbus protocol partially on each different productMy Smatrix base only uses the function code 0x05 (write single coil) maybe because all of my units are T146. On programmable thermostats (T148), other function codes might be used

author: TBuyukkilic
author_rank: Newbie
timestamp: March 03, 2022, 03:50:48 pm
content: I made some progress, it's not an actual Modbus implementation, but they kind of did their own version.- I can query the status, using the FF function code- I can set the setpoint temperature by sending ID + SETTING + VALUE + CRC, however I need to send an empty or invalid value first e.g. 3B00003B0269- I can only access other settings in the thermostat after a reset, however after registration I can nog longer access some settings, because I think the capabilities are hardcoded in the base unitRequestCode:data: 110C1BCA FF BDB4ID: 110C1BCAFUNCTION: FF (get status?)CRC: BDB4ResponseCode:data: 110C1BCA 4002AB 3E0000 3F0C02 42B300 D8AAID: 110C1BCAALLOW_COOLING (3F: 0C02): TrueCURRENT_TEMPRATURE (40: 02AB): 20.17OPERATING_MODE (3E: 0000): Room TempratureUNKNOWN5 (42: B300): B300CRC: D8AAResponse 2, not sure what triggers thisCode:data: 110C1BCA 2D7FFF 3D0000 0C0024 37019A 3803B6 3B0269 3C0048 358000 3F0402 ACEAALLOW_COOLING (3F: 0402): TrueECO_SET_BACK (3C: 0048): 4.0HEATING (3D: 0000): FalseSETPOINT_TEMP (3B: 0269): 16.5SETPOINT_TEMP_MAX (38: 03B6): 35.0SETPOINT_TEMP_MIN (37: 019A): 5.0UNKNOWN1 (0C: 0024): 0024UNKNOWN2 (2D: 7FFF): 7FFFUNKNOWN4 (35: 8000): 8000CRC: ACEACode:3F: Allow cooling - Some fuzzy logic here, it looks like hex value -2 /1024 returns an int, 1 is true, 2 is false, and 3 seems to be true....40: Current temperature - degrees = int(str(value), 16); return ((degrees - 320) / 1.8) / 103E: Operating mode - "0000": "Room Temprature", "0001":"Internal with floor max/min","0002":"Remote Outdoor", "0003":"Remote Sensor"B30042: No idea, returns B300 at all themorstats3C: Eco setback, weird logic, degrees = int(str(value), 16); return degrees / 183D: Heating, "0000": False, "0040": True3B: Set temperature - degrees = int(str(value), 16); return ((degrees - 320) / 1.8) / 1037: Min temperature - degrees = int(str(value), 16); return ((degrees - 320) / 1.8) / 1038: Max temperature - degrees = int(str(value), 16); return ((degrees - 320) / 1.8) / 100C: No idea, returns 0024 at all themorstats2D: No idea, returns 7FFFF at all themorstats, but this should indicate that the data is not available, whatever 2D stands for35: No idea, returns 8000 at all themorstats

author: TBuyukkilic
author_rank: Newbie
timestamp: March 03, 2022, 04:01:16 pm
content: Quote from: mitokondoria on February 21, 2022, 09:20:33 amReally nice, I want to do something similar, but also allow writing. We're getting there

author: drdds
author_rank: Newbie
timestamp: May 11, 2022, 02:10:14 pm
content: Hi there!This is my first post. Despite I was registered time ago something happened with my previous account, that is no usable anymore.It has been a long time since I discovered this thread and started planning my hardware and software (almost two years). In 2019 I sent a message to Alan (who started this thread) and after that started to plan. All your posts have been quite helpful to elaborate my software but still have a lot of doubts. Let’s start:Hardware:I’m using a RS485 server (http://www.hi-flying.com/hf5122) to interface with the controller (that is a SMATRIX BASE) and control my thermostats (all of, up to 6, them are T-146).My settings are 19200 bps 8/1/N and I get consistent frames that are validated by means of the CRC (that matches the modbus one).I created a server at port 9999 that copies any frame on the bus to the socket and allows me to send whatever frame.Sofware:I decided time ago to develop a service (written in Java) that will be running in a small linux server that gets the values from the RS485 port through TCP and posts them to a MQTT broker once they are processed.Results so far… The server frame capture and processing part is almost ready (except for my doubts that are shared here) and the MQTT part is still pending (I hope not for a long time…)Frames:The usual frames I can capture from the system are:Code:<- 11049E8BFF9E6D11 04 | 9E 8B | FF | CRC 9E6D [ OK ]-> 11049E8B4003373E00003F1C02FB1411 04 | 9E 8B | Room Temp( 03:37 -> 82.3F/27.94C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC FB14 [ OK ]-> 11049E8B2D7FFF3D10400C002437019A3803B63B02CC3C0048358000D8B911 04 | 9E 8B | ID: 2D | Val 7FFF || Demand water( 10:40 -> YES  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CC -> 71.6F/22.0C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC D8B9 [ OK ]My analysis of the frames:really modbus?In principle observing the frame staring with "11 04" anyone may think it is modbus requesting registers (0x04) to station 17 (0x11), however, observing others’ posts (that were quite helpful) I discovered that changes with the system. For instance, dimmu311 reports frames staring with "10 4" that also fits into the hypothesis, but jsouto reports "10 05" that does not fit! also TBuyukkilic reports "11 0c" that also does not fit! So…. This is something proprietary.I assumed first two bytes as SYSTEM ID (11 04)I assumed third and fourth bytes as the STATION ID (thermostat, 9E 8B in the example).I agree that FF may be status request as mitokondoria suggests for requests (<-)The data in responses are sets of the sequence ID (1byte) Payload(2 byte).So it is not modbus despite frame CRC matches.What about the data?I strongly relied on what TBuyukkilic provided in a previous post. Let me show my conclusions on the values and my doubts:Code:-> 11049E8B4003373E00003F1C02FB1411 04 | 9E 8B | Room Temp( 03:37 -> 82.3F/27.94C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC FB14 [ OK ]* ID 0x40 (room temperature) 400337(03:37 -> 82.3F/27.94C)DOUBTS: No doubt at all! This is crystal clear! I have double checked it. In uponor documents they claim they convert it using (F-320)/18. I’m doing the traditional way and also matches.* ID 0x3E (operating mode) 3E0000Code:ROOM_TEMPERATURE(0x0000, "Room Temperature"), INTERNAL_FLOOR_SENSOR(0x0002, "Internal floor sensor"), REMOTE_OUTDOOR_SENSOR(0x0003, "Remote Outdoor sensor"), REMOTE_SENSOR(0xB300, "Remote sensor");DOUBTS: TBuyukkilic , where did you get that??!!! It is great and seems to match! Thanks a lot!* ID 0x3F (allow cooling??) 3F1C02I process it this way:Code:hot = ((currently&0xF000) == 0x0000) ? true : false;cold = ((currently&0xF000) == 0x1000) ? true : false;DOUBTS: TBuyukkilic calls it Allow Cooling, but I noticed that 0xF000&Value=0x0000 for heating (winter) and 0xF000&Value=0x1000 for cooling (summer)… but I can’t say anything else about the rest that would be C02 taking out the first 4 bits…Code:-> 11049E8B2D7FFF3D10400C002437019A3803B63B02CC3C0048358000D8B911 04 | 9E 8B | ID: 2D | Val 7FFF || Demand water( 10:40 -> YES  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CC -> 71.6F/22.0C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC D8B9 [ OK ]* ID 0x2D (no idea!) 2D7FFFDOUBTS: everyone get 7FFF but no idea!* ID 0x3D (I named it demand) 3D1040I processed this way:Code:demanding = ((currently&0x00FF) == 0x0040) ? true : false;hot = ((currently&0xFF00) == 0x0000) ? true : false;cold = ((currently&0xFF00) == 0x1000) ? true : false;DOUBTS: So 0x0000 means actuators for this thermostat are not demanding water during heating, 0x0040 demands water (heating), 0x1000 no demand (cooling), 0x1040 demands (cooling). Do you observe the same?* ID 0x0C (no idea) 0C0024Always the same value!DOUBTS: did you observed something different? Are you all using t-146 (may be the model). It may also has something to do with display configurations at thermostat?* ID 0x38 Setpoint MIN* ID 0x37 Setpoint MIN, as room temperature. Also documented by uponor that is maximum 35 and minimum 5. So, crystal clear!* ID 0x3B (setpoint) 3B02CCI process it as Room temperature but get always two degrees LESS that the actual setpoint (at least in cooling mode – need to check in heating mode..)DOUBTs: do you read the exact temperature? Or you need to increase it by 2 (in Celsius)??* ID 0x3C and ID 0x35, no idea at all.Thanks for your time and let’s see if you can bring any light to all this!I add some traffic for analysis:Code:Client... started-> 110470642D7FFF3D10000C002437019A3803B63B02CD3C004835800087C511 04 | 70 64 | ID: 2D | Val 7FFF || Demand water( 10:00 -> NO  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CD -> 71.7F/22.06C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC 87C5 [ OK ]<- 11047069FFB6F811 04 | 70 69 | FF | CRC B6F8 [ OK ]-> 110470694002EA3E00003F1C02F16211 04 | 70 69 | Room Temp( 02:EA -> 74.6F/23.67C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC F162 [ OK ]-> 110470692D7FFF3D10000C002437019A3803B63B02CD3C00483580002C5311 04 | 70 69 | ID: 2D | Val 7FFF || Demand water( 10:00 -> NO  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CD -> 71.7F/22.06C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC 2C53 [ OK ]<- 11047064FFB26811 04 | 70 64 | FF | CRC B268 [ OK ]-> 110470644002F13E00003F1C02CB9911 04 | 70 64 | Room Temp( 02:F1 -> 75.3F/24.06C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC CB99 [ OK ]-> 110470642D7FFF3D10000C002437019A3803B63B02CD3C004835800087C511 04 | 70 64 | ID: 2D | Val 7FFF || Demand water( 10:00 -> NO  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CD -> 71.7F/22.06C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC 87C5 [ OK ]<- 1104708CFFFC6811 04 | 70 8C | FF | CRC FC68 [ OK ]-> 1104708C4002EB3E00003F1C02F5E411 04 | 70 8C | Room Temp( 02:EB -> 74.7F/23.72C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC F5E4 [ OK ]-> 1104708C2D7FFF3D10000C002437019A3803B63B02CD3C00483580007FDA11 04 | 70 8C | ID: 2D | Val 7FFF || Demand water( 10:00 -> NO  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CD -> 71.7F/22.06C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC 7FDA [ OK ]<- 11047124FFD26811 04 | 71 24 | FF | CRC D268 [ OK ]-> 110471244002F73E00003F1C02ABB111 04 | 71 24 | Room Temp( 02:F7 -> 75.9F/24.39C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC ABB1 [ OK ]-> 110471242D7FFF3D10400C002437019A3803B63B02CD3C00483580003C2011 04 | 71 24 | ID: 2D | Val 7FFF || Demand water( 10:40 -> YES  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CD -> 71.7F/22.06C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC 3C20 [ OK ]<- 1104706DFFB43811 04 | 70 6D | FF | CRC B438 [ OK ]-> 1104706D4002EC3E00003F1C02D6B711 04 | 70 6D | Room Temp( 02:EC -> 74.8F/23.78C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC D6B7 [ OK ]-> 1104706D2D7FFF3D10000C002437019A3803B63B02CD3C0048358000797611 04 | 70 6D | ID: 2D | Val 7FFF || Demand water( 10:00 -> NO  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CD -> 71.7F/22.06C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC 7976 [ OK ]<- 11049E8BFF9E6D11 04 | 9E 8B | FF | CRC 9E6D [ OK ]-> 11049E8B40033A3E00003F1C0227D411 04 | 9E 8B | Room Temp( 03:3A -> 82.6F/28.11C ) || Operating mode  ( 00:00 -> ROOM_TEMPERATURE || Params1  ( 1C:02 ->  ) || CRC 27D4 [ OK ]-> 11049E8B2D7FFF3D10400C002437019A3803B63B02CC3C0048358000D8B911 04 | 9E 8B | ID: 2D | Val 7FFF || Demand water( 10:40 -> YES  ) || ID: 0C | Val 0024 || SetPoint Temp Min  ( 01:9A -> 41.0F/5.0C ) || SetPoint Temp Max ( 03:B6 -> 95.0F/35.0C ) || SetPoint Temp( 02:CC -> 71.6F/22.0C ) || ID: 3C | Val 0048 || ID: 35 | Val 8000 || CRC D8B9 [ OK ]

author: drdds
author_rank: Newbie
timestamp: May 16, 2022, 06:59:47 pm
content: Hi there,I have had very productive days in row and I have a prototype for this.All the details can be found athttps://github.com/ddsuc3m/uponor-floorheatingAlso I opened a discussion in OpenHabhttps://community.openhab.org/t/control-uponor-underfloor-heating-thermostats/135969Some things that were open:- Eco set back is exactly as you mentioned before, so it is updated in code- Do you have a timer (I-143) to monitor how the controller changes the thermostats?- Can you please post your controller and thermostats models together with some traffic (I think the first two bytes are the controller model - or related)?- Any of you has a thermostat provinding humidity? (so we can findout the humidity command that is maybe one of the unknown fields)Thanks!

author: drdds
author_rank: Newbie
timestamp: May 18, 2022, 09:30:42 am
content: There are new updates to the software since it crashed after few hours.Now seems to be stableRegards!

author: TBuyukkilic
author_rank: Newbie
timestamp: September 13, 2022, 03:57:34 am
content: Sorry for the late reply, but my base unit is a Uponor Smatrix Base Pulse X-245 BUS 6X, it would be nice to map these to values as well.Edit: btw I got the operating mode and such from the manuals. I see in this thermostat settings like units (F or C), light, auto on/off, these might be the values for the missing settings. Source:https://www.uponor.com/getmedia/4114b1ac-c794-40cb-ac08-0a192915a8fb/single%20stage%20setpoint%20controller%20with%20floor%20sensor%20user%20manual.pdf?sitename=Canada