Decoding proprietary 485 comms

Question

I am trying to decode a reverse cycle split system air-conditioner comms signal so that I can control an outdoor a/c compressor unit without using the manufactures indoor unit. The unit is made by Midea and they seems reluctant to share their protocol details.

I used my oscilloscope to look at the data and used the default serial decoding settings to get some HEX data strings.

Data is sent (or received?) every 50ms. With 4.8kbaud, no parity,1 stop bit and LSB bit order. I get HEX data like this when there is no heating or cooling request from the indoor unit.

I took some more data when the indoor unit was requesting cooling but I don't know if my acquisition settings right. Here is some data recorded of packets taken every 40seconds or so before the indoor unit requests cooling, during cooling request and after.

I know that the indoor unit is receiving temperature measurements so that the system can decide at what speed to run the compressor. Not sure if it is temperature measurements that are communicated to the outdoor unit or if it is VSD speed commands. If it is temperature measurements then there should be data that is reducing during the cooling call data block.

I am looking for any advise as to how I should go about decoding this data. Should I buy a serial decoder instead of using my oscilloscope? I am probably out of my depth, but I love a challenge. Any advise greatly appreciated.

Answer 1

I would hardly call this an answer, but I can't comment yet..

You need additional data.

1. Have you tried opening the outdoor unit and examining the board that you're communicating with? you might find it has some debug interfaces (serial or something else). It might provide additional information - debug prints when a command is received for example.
2. Recording additional reference data - I would record every possible temperature setting. Then try identifying the constant values vs. the varying values. This might help with determining the command format.
3. As a continued effort from the second option - record every possible command and start diffing them. Try to find a pattern - message types, sub fields to the message.
4. Record your A/C remote (fairly simple - google it) and see if there is any correlation (this is a long shot, but worth a try)

As for the serial decoder - At the very least it will make sampling the signals simpler. The easier to sample the more you will probably sample.

Hope this helped :)

Answer 2

I managed to decode the protocol on XYE connection. My findings are here https://codeberg.org/xye/xye

The XYE connection is the bus between a central controller and the indoor units. The bus from the indoor units to the outdoor units is labeled PQE. My units don't have the connection for that, so I can't test it.

The data in the initial post look like you are missing bytes. I used a cheap RS-485 to USB converter to monitor the data. Worked great.

Answer 3

The comms on the PQ(E) bus are similar to the XY(E), just with only 10-byte messages. You can sniff the RS-485 traffic with an RS-485 - USB dongle and some serial monitor, connect the A-B lines of the dongle to the bus. A short example, captured with ioninja:

12:36:56 +01:04.353 > 00c8 aa 00 02 00 00 00 00 00 fe 55 .........U
12:36:56 +01:04.420 > 00d2 aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:36:58 +01:06.676 > 00dc aa 00 02 1f 00 00 01 00 de 55 .........U
12:36:58 +01:06.748 > 00e6 aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:37:01 +01:09.000 > 00f0 aa 00 02 1f 00 04 01 00 da 55 .........U
12:37:01 +01:09.068 > 00fa aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:37:03 +01:11.322 > 0104 aa 00 02 1f 00 04 01 00 da 55 .........U
12:37:03 +01:11.391 > 010e aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:37:05 +01:13.644 > 0118 aa 00 02 1f 00 04 01 00 da 55 .........U