Reverse UART communication protocol

Question

I'm objective is to build a custom wifi module to be used on a Samsung AC AR24HSFSAWKN. I have such an official module SWL-B70F for which I'm trying to reverse engineer the communication with the main AC board. It's just for the challenge and my first attempt on such hack.

From the AC manual I have identified the following pinout:

CN51 - WI-FI MODULE
#1 : WIFI UART SIGNAL1
#2 : WIFI UART SIGNAL2
#3 : WIFI RESET SIGNAL
#4 : GND
#5 : DC 12V
#6 : N.C

Once module was disassembled, I found inside an arm board and a second one which I identified to be a step-down regulator (12V -> 5V). On the regulator board, I've hooked some wires to the UART lines + GND to 2 ftdi cables on their RX pin, so I can dump the frames in both directions. I've booted the device several times with different tty baud rates. I think 9600 bauds is the right one as other did not gave nice patterns. Now I end with the exchanges bellow. I found some common patterns. I suppose frames start with d0 (or d0c002) and ends with e0. There seems to have a message counter, a fixed separator, a payload, and a checksum: <start> <????> <counter> <sep?> <payload> <CheckSum8 Xor> <end>. When a message is sent, a similar message is sent on the other line, probably a ack message.

I can send xml commands via the actual wifi module. As a test, I send a OFF command, wich resulted in the following exchanges:

OFF Command:

# try 1
-> d0c002 12 000000000038 fe 1204060201f074010f 5f e0
<- d0c002 12 000000000038 fe 1205060201f074010f 5e e0

# try 2
-> d0c002 12 000000000047 fe 1204060201f074010f 20 e0
<- d0c002 12 000000000047 fe 1205060201f074010f 21 e0

# try 3
-> d0c002 12 000000000058 fe 1204060201f074010f 3f e0
<- d0c002 12 000000000058 fe 1205060201f074010f 3e e0

Another possible command is to get DeviceState, which return the following XML (but did not triggered any exchange with main board, I suppose the values are stored in the wifi module upon initialization):

?xml version="1.0" encoding="utf-8" ?> 
<Response Type="DeviceState" Status="Okay"> 
  <DeviceState> 
    <Device DUID="F8042ED83EA0" GroupID="AC" ModelID="AC" > 
      <Attr ID="AC_FUN_ENABLE" Type="RW" Value="Enable"/> 
      <Attr ID="AC_FUN_POWER" Type="RW" Value="Off"/> 
      <Attr ID="AC_FUN_OPMODE" Type="RW" Value="Auto"/> 
      <Attr ID="AC_FUN_TEMPSET" Type="RW" Value="21"/> 
      <Attr ID="AC_FUN_COMODE" Type="RW" Value="Off"/> 
      <Attr ID="AC_FUN_ERROR" Type="RW" Value="NULL"/> 
      <Attr ID="AC_FUN_TEMPNOW" Type="R" Value="23"/> 
      <Attr ID="AC_FUN_SLEEP" Type="RW" Value="0"/> 
      <Attr ID="AC_FUN_WINDLEVEL" Type="RW" Value="Auto"/> 
      <Attr ID="AC_FUN_DIRECTION" Type="RW" Value="Fixed"/> 
      <Attr ID="AC_ADD_AUTOCLEAN" Type="RW" Value="Off"/> 
      <Attr ID="AC_ADD_SETKWH" Type="RW" Value="255"/> 
      <Attr ID="AC_ADD_CLEAR_FILTER_ALARM" Type="RW" Value="240"/> 
      <Attr ID="AC_ADD_APMODE_END" Type="W" Value="0"/> 
      <Attr ID="AC_ADD_STARTWPS" Type="RW" Value="Default"/> 
      <Attr ID="AC_ADD_SPI" Type="RW" Value="Off"/> 
      <Attr ID="AC_OUTDOOR_TEMP" Type="R" Value="71"/> 
      <Attr ID="AC_COOL_CAPABILITY" Type="R" Value="68"/> 
      <Attr ID="AC_WARM_CAPABILITY" Type="R" Value="80"/> 
      <Attr ID="AC_SG_WIFI" Type="W" Value="Connected"/> 
      <Attr ID="AC_SG_INTERNET" Type="W" Value="Disconnected"/> 
      <Attr ID="AC_ADD2_USEDWATT" Type="R" Value="65024"/> 
      <Attr ID="AC_ADD2_VERSION" Type="RW" Value="65024"/> 
      <Attr ID="AC_SG_MACHIGH" Type="W" Value="216"/> 
      <Attr ID="AC_SG_MACMID" Type="W" Value="62"/> 
      <Attr ID="AC_SG_MACLOW" Type="W" Value="160"/> 
      <Attr ID="AC_SG_VENDER01" Type="W" Value="248"/> 
      <Attr ID="AC_SG_VENDER02" Type="W" Value="4"/> 
      <Attr ID="AC_SG_VENDER03" Type="W" Value="46"/> 
      <Attr ID="AC_ADD2_PANEL_VERSION" Type="R" Value="150224"/> 
      <Attr ID="AC_ADD2_OUT_VERSION" Type="R" Value="1246985"/> 
      <Attr ID="AC_FUN_MODEL" Type="R" Value="5"/> 
      <Attr ID="AC_ADD2_OPTIONCODE" Type="R" Value="53432"/> 
      <Attr ID="AC_ADD2_USEDPOWER" Type="R" Value="58933"/> 
      <Attr ID="AC_ADD2_USEDTIME" Type="R" Value="265675"/> 
      <Attr ID="AC_ADD2_CLEAR_POWERTIME" Type="RW" Value="254"/> 
      <Attr ID="AC_ADD2_FILTERTIME" Type="RW" Value="500"/> 
      <Attr ID="AC_ADD2_FILTER_USE_TIME" Type="R" Value="10000"/> 
    </Device> 
  </DeviceState> 
</Response>

Some values are present in the boot log, such as AC_ADD2_USEDTIME, AC_ADD2_OPTIONCODE, AC_ADD2_USEDPOWER, AC_ADD2_FILTER_USE_TIME => d0c002 39 000000000009 fe 14032d3201fef601fef403150224f303130709f501053902 d0b8(AC_ADD2_OPTIONCODE) e0040000 e635 e404000 40dcb(AC_ADD2_USEDPOWER) e801fee90103e602 2710(AC_ADD2_FILTER_USE_TIME) 93 e0

The frame may be split as:

14032d3201fef601fef403150224f303130709f50105
3902 d0b8 
e004 0000e635 
e404 00040dcb
e801 fee90103
e602 2710

e004, e404, e602 could probably be some field header?

The checksum is CheckSum8 Xor of the first bytes: d0c00212000000000047fe1204060201f074010f -> 20

Also the first exchange (0000 / 00fc) never showed again, so it should be some sort of handshake.

Next I'll try to remove the wifi module, and replay the communication with it, simulating the AC.

Questions:

Are my methodology and assumptions valid?
What could be the second field in the frame (unique values seems to be 0f 12 18 1c 1e 22 30)?
Am I splitting the frames correctly?
Do you have some advises on how to decode the remaining messages and reverse the full protocol?
Does it looks like something known elsewhere?
Any other tip :)

Thanks a lot!

The full boot log:

#-> WIFI TO AC
#<- AC TO WIFI

-> 00fc
<- 0000
-> d0c002 12 000000000000 fe 12040601010f7401f0 64 e0
<- d0c002 12 000000000000 fe 12050601010f7401f0 65 e0
-> d0c002 18 000000000001 fe 14040c170115180105190127fd0102 37 e0
<- d0c002 18 000000000001 fe 14050c170115180105190127fd0102 36 e0
-> d0c002 1e 000000000002 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 6d e0
<- d0c002 1e 000000000002 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 6c e0
-> d0c002 18 000000000003 fe 14040c170115180105190127fd0102 35 e0
<- d0c002 18 000000000003 fe 14050c170115180105190127fd0102 34 e0
-> d0c002 1e 000000000004 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 6b e0
<- d0c002 1e 000000000004 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 6a e0
-> d0c002 18 000000000005 fe 14040c170115180105190127fd0102 33 e0
<- d0c002 18 000000000005 fe 14050c170115180105190127fd0102 32 e0
-> d0c002 1e 000000000006 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 69 e0
<- d0c002 1e 000000000006 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 68 e0
-> d0c002 30 000000000006 fe 1207240201f04101324301e24401126201006301c2ea01fe5a01155c0117730100f70400000000 ce e0
<- d0c002 30 000000000006 fe 1206240201f04101324301e24401126201006301c2ea01fe5a01155c0117730100f70400000000 cf e0
-> d0c002 1c 000000000008 fe 13021032004000440043007500760077007800 80 e0
<- d0c002 26 000000000008 fe 13031a3201234001ff4401f043010f7501f07601497702004478020050 3f e0
-> d0c002 22 000000000009 fe 1402163200f600f400f300f5003900 e000e400e800e900e600 2b e0
<- d0c002 39 000000000009 fe 14032d3201fef601fef403150224f303130709f501053902d0b8e0040000e635e40400040dcbe801fee90103e6022710 93 e0
-> d0c002 0f 00000000000a fe 14040337010f c3 e0
<- d0c002 0f 00000000000a fe 14050337010f c2 e0
-> d0c002 18 00000000000b fe 14040c170115180105190127fd0102 3d e0
<- d0c002 18 00000000000b fe 14050c170115180105190127fd0102 3c e0
-> d0c002 22 00000000000c fe 1402163200f600f400f300f5003900 e000e400e800e900e600 2e e0
<- d0c002 39 00000000000c fe 14032d3201fef601fef403150224f303130709f501053902d0b8e0040000e635e40400040dcbe801fee90103e6022710 96 e0
-> d0c002 1e 00000000000d fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 62 e0
<- d0c002 1e 00000000000d fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 63 e0
-> d0c002 0f 00000000000e fe 1404033801f0 37 e0
<- d0c002 0f 00000000000e fe 1405033801f0 36 e0
-> d0c002 0f 00000000000f fe 14040337010f c6 e0
<- d0c002 0f 00000000000f fe 14050337010f c7 e0
-> d0c002 0f 000000000010 fe 14040337010f d9 e0
<- d0c002 0f 000000000010 fe 14050337010f d8 e0
-> d0c002 18 000000000011 fe 14040c170115180105190127fd0102 27 e0
<- d0c002 18 000000000011 fe 14050c170115180105190127fd0102 26 e0
-> d0c002 1e 000000000012 fe 140412fa01f8fb0104fc012ef701d8f8013ef901a0 7d e0
<- d0c002 1e 000000000012 fe 140512fa01f8fb0104fc012ef701d8f8013ef901a0 7c e0
-> d0c002 0f 000000000013 fe 1404033801f0 2a e0
<- d0c002 0f 000000000013 fe 1405033801f0 2b e0
-> d0c002 0f 000000000014 fe 14040337010f dd e0
<- d0c002 0f 000000000014 fe 14050337010f dc e0
-> d0c002 0f 000000000015 fe 1404033801f0 2c e0
<- d0c002 0f 000000000015 fe 1405033801f0 2d e0
-> d0c002 0f 000000000016 fe 14040337010f df e0
<- d0c002 0f 000000000016 fe 14050337010f de e0
-> d0c002 0f 000000000017 fe 1404033801f0 2e e0
<- d0c002 0f 000000000017 fe 1405033801f0 2f e0
-> d0c002 0f 000000000018 fe 14040337010f d1 e0
<- d0c002 0f 000000000018 fe 14050337010f d0 e0
-> d0c002 0f 000000000019 fe 1404033801f0 20 e0
<- d0c002 0f 000000000019 fe 1405033801f0 21 e0
-> d0c002 0f 00000000001a fe 14040337010f d3 e0
<- d0c002 0f 00000000001a fe 14050337010f d2 e0

I want to do something similar, can you explain how you connected the board and with what device? My air conditioner with this module no longer connects to the samsung application despite connecting to wifi. — user43320, Commented Feb 28, 2023 at 8:29
@user43320 I created an arduino sketch to read UART in a loop and print on the console the received bytes. I've hooked that to the green board with some thin wires soldered here an there on some points I've identified by that time. I'm sorry I don't have the sketch neither the pictures anymore. Good luck! My started GitHub project (linked as comment to the bellow answer) is stalled, but feel free to contribute! — KumZ, Commented Mar 1, 2023 at 10:03

KumZ · Accepted Answer · 2020-09-02 10:00:11Z

From my question:

It seems to work :)
Is the message length
more or less ;)
See procedure bellow
Still wondering if it's a "common/standard protocol"?

Procedure

I have removed the module from the AC and build a simple fake AC server.

From what I see, once a message is sent, a response has to be returned. I've exchanged some messages with it using XML commands, looking at the messages sent back to the AC (my virtual AC server), and could decode most of the messages. Then I've sent back some messages directly to the module as if the AC sent them, and looked at the new values stored in the module.

I end up with the following protocol. There is still some points to be clarified, but most of the work is done.

Next step, I'll write a daemon capable of translating messages as human readable, and connect back the module to the AC, then sniffing while playing with the different function to find if there are some "new" messages.

Message format

Each message could be decomposed as follow:

╔═══════╦══════════╦════════╦══════════════╦═════╦════════════════════════════════╦══════════╦═════╗
║ start ║ version? ║ length ║   counter    ║ sep ║            payload             ║ checksum ║ end ║
╠═══════╬══════════╬════════╬══════════════╬═════╬════════════════════════════════╬══════════╬═════╣
║ d0c0  ║       02 ║     12 ║ 000000000000 ║ fe  ║ 12040601010f7401f0             ║       64 ║ e0  ║
║ d0c0  ║       02 ║     12 ║ 000000000000 ║ fe  ║ 12050601010f7401f0             ║       65 ║ e0  ║
║ d0c0  ║       02 ║     18 ║ 000000000001 ║ fe  ║ 14040c170115180105190127fd0102 ║       37 ║ e0  ║
║ d0c0  ║       02 ║     18 ║ 000000000001 ║ fe  ║ 14050c170115180105190127fd0102 ║       36 ║ e0  ║
║ …     ║          ║        ║              ║     ║                                ║          ║     ║
╚═══════╩══════════╩════════╩══════════════╩═════╩════════════════════════════════╩══════════╩═════╝

Fields start, end, sep, version? seems static
Counter is incrementing for each new message
when one of the two cards receives a message, it sends back the same message but increasing the ack value
checksum the CheckSum 8 Xor of the all columns before
length, count from here to end of message (including checksum and end)

Payload

Each payload may be decomposed in command, sub

╔══════╦═════════╦══════════╦════════════════════════════════════════════════════════════════════════════════════════╗
║ type ║ command ║ register ║                                        value(s)                                        ║
╠══════╬═════════╬══════════╬════════════════════════════════════════════════════════════════════════════════════════╣
║ 1204 ║ 06      ║ 0101     ║ 0f74010f                                                                               ║
║ 1205 ║ 06      ║ 0101     ║ f074010f                                                                               ║
║ 1204 ║ 09      ║ f704     ║ 5445535474010f                                                                         ║
║ 1403 ║ 2d      ║ 3201     ║ fef601fef403150224f303130709f501053902d0b8e0040000e635e40400040dcbe801fee90103e6022710 ║
╚══════╩═════════╩══════════╩════════════════════════════════════════════════════════════════════════════════════════╝

Types

1204: user commands
1205: ack - user commands
1206: values from AC
1207: ack - values from AC
1302: reset? registers
1303: values from AC (OutDoor?)
1304: Set
1305: ack - Set
1402: counters from unit
1403: ??? ack?
1404: wifi module status
1405: ??? ack?

`1204` Commands

06 Set Integer
09 Set String

AC_FUN_ENABLE

╔═════════╦═════════╦══════════╦════════╦═══════╦════════╗
║         ║ command ║ register ║ length ║ value ║  end   ║
╠═════════╬═════════╬══════════╬════════╬═══════╬════════╣
║ Enable  ║      06 ║       01 ║     01 ║ f0    ║ 74010f ║
║ Disable ║      06 ║       01 ║     01 ║ 0f    ║ 74010f ║
╚═════════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_POWER

╔═════╦═════════╦══════════╦════════╦═══════╦════════╗
║     ║ command ║ register ║ length ║ value ║  end   ║
╠═════╬═════════╬══════════╬════════╬═══════╬════════╣
║ Off ║      06 ║       02 ║     01 ║ f0    ║ 74010f ║
║ On  ║      06 ║       02 ║     01 ║ 0f    ║ 74010f ║
╚═════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_OPMODE

╔══════╦═════════╦══════════╦════════╦═══════╦════════╗
║      ║ command ║ register ║ length ║ value ║  end   ║
╠══════╬═════════╬══════════╬════════╬═══════╬════════╣
║ Cool ║      06 ║       43 ║     01 ║ 12    ║ 74010f ║
║ Dry  ║      06 ║       43 ║     01 ║ 22    ║ 74010f ║
║ Wind ║      06 ║       43 ║     01 ║ 32    ║ 74010f ║
║ Heat ║      06 ║       43 ║     01 ║ 42    ║ 74010f ║
║ Auto ║      06 ║       43 ║     01 ║ e2    ║ 74010f ║
╚══════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_COMODE

╔═══════════╦═════════╦══════════╦════════╦═══════╦════════╗
║           ║ command ║ register ║ length ║ value ║  end   ║
╠═══════════╬═════════╬══════════╬════════╬═══════╬════════╣
║ Off       ║      06 ║       44 ║     01 ║ 12    ║ 74010f ║
║ TurboMode ║      06 ║       44 ║     01 ║ 22    ║ 74010f ║
║ Smart     ║      06 ║       44 ║     01 ║ 32    ║ 74010f ║
║ Sleep     ║      06 ║       44 ║     01 ║ 42    ║ 74010f ║
║ Quiet     ║      06 ║       44 ║     01 ║ 52    ║ 74010f ║
║ SoftCool  ║      06 ║       44 ║     01 ║ 62    ║ 74010f ║
║ WindMode1 ║      06 ║       44 ║     01 ║ 82    ║ 74010f ║
║ WindMode2 ║      06 ║       44 ║     01 ║ 92    ║ 74010f ║
║ WindMode3 ║      06 ║       44 ║     01 ║ a2    ║ 74010f ║
╚═══════════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_TEMPSET (from 16°C to 28°C)

╔══════╦═════════╦══════════╦════════╦═══════╦════════╗
║      ║ command ║ register ║ length ║ value ║  end   ║
╠══════╬═════════╬══════════╬════════╬═══════╬════════╣
║ 16°C ║      06 ║ 5a       ║     01 ║ 10    ║ 74010f ║
║ 17°C ║      06 ║ 5a       ║     01 ║ 11    ║ 74010f ║
║ …    ║         ║          ║        ║       ║        ║
║ 28°C ║      06 ║ 5a       ║     01 ║ 1c    ║ 74010f ║
╚══════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_WINDLEVEL

╔═══════╦═════════╦══════════╦════════╦═══════╦════════╗
║       ║ command ║ register ║ length ║ value ║  end   ║
╠═══════╬═════════╬══════════╬════════╬═══════╬════════╣
║ Auto  ║      06 ║       62 ║     00 ║    00 ║ 74010f ║
║ Low   ║      06 ║       62 ║     01 ║    12 ║ 74010f ║
║ Mid   ║      06 ║       62 ║     01 ║    14 ║ 74010f ║
║ High  ║      06 ║       62 ║     01 ║    16 ║ 74010f ║
║ Turbo ║      06 ║       62 ║     01 ║    18 ║ 74010f ║
╚═══════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_DIRECTION

╔══════════╦═════════╦══════════╦════════╦═══════╦════════╗
║          ║ command ║ register ║ length ║ value ║  end   ║
╠══════════╬═════════╬══════════╬════════╬═══════╬════════╣
║ Off      ║      06 ║       63 ║     01 ║ 12    ║ 74010f ║
║ Indirect ║      06 ║       63 ║     01 ║ 21    ║ 74010f ║
║ Direct   ║      06 ║       63 ║     01 ║ 31    ║ 74010f ║
║ Center   ║      06 ║       63 ║     01 ║ 41    ║ 74010f ║
║ Wide     ║      06 ║       63 ║     01 ║ 51    ║ 74010f ║
║ Left     ║      06 ║       63 ║     01 ║ 61    ║ 74010f ║
║ Right    ║      06 ║       63 ║     01 ║ 71    ║ 74010f ║
║ Long     ║      06 ║       63 ║     01 ║ 81    ║ 74010f ║
║ SwingUD  ║      06 ║       63 ║     01 ║ 92    ║ 74010f ║
║ SwingLR  ║      06 ║       63 ║     01 ║ a2    ║ 74010f ║
║ Rotation ║      06 ║       63 ║     01 ║ b2    ║ 74010f ║
║ Fixed    ║      06 ║       63 ║     01 ║ c2    ║ 74010f ║
╚══════════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_SLEEP

TODO: To validate

╔═════╦═════════╦══════════╦════════╦═══════╦════════╗
║     ║ command ║ register ║ length ║ value ║  end   ║
╠═════╬═════════╬══════════╬════════╬═══════╬════════╣
║   0 ║      06 ║       73 ║     01 ║ 00    ║ 74010f ║
║ 255 ║      06 ║       73 ║     01 ║ ff    ║ 74010f ║
╚═════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_FUN_ERROR

╔════════════════════════════════════════════════════════════════════════╦════════════╦══════════╦════════╦══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╦════════╗
║                                                                        ║ command??? ║ register ║ length ║                                                                    value                                                                     ║  end   ║
╠════════════════════════════════════════════════════════════════════════╬════════════╬══════════╬════════╬══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╬════════╣
║ NULL                                                                   ║ 09         ║ f7       ║     04 ║ 4e554c4c                                                                                                                                     ║ 74010f ║
║ TEST                                                                   ║ 09         ║ f7       ║     04 ║ 54455354                                                                                                                                     ║ 74010f ║
║ MY_ERROR_MESSAGE                                                       ║ 15         ║ f7       ║     10 ║ 4d59204552524f52204d455353414745                                                                                                             ║ 74010f ║
║ 0123456789012345678901234567890123456789012345678901234567890123456789 ║ 4b         ║ f7       ║     46 ║ 30313233343536373839303132333435363738393031323334353637383930313233343536373839303132333435363738393031323334353637383930313233343536373839 ║ 74010f ║
╚════════════════════════════════════════════════════════════════════════╩════════════╩══════════╩════════╩══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╩════════╝

`1206` Commands

╔══════════════════╦═════════╦══════════╦════════╦══════════╗
║                  ║ command ║ register ║ length ║  value   ║
╠══════════════════╬═════════╬══════════╬════════╬══════════╣
║ Multi_valued     ║      24 ║          ║        ║          ║
║ AC_FUN_POWER     ║         ║ 02       ║     01 ║ f0       ║
║ ?                ║         ║ 41       ║     01 ║ 32       ║
║ AC_FUN_OPMODE    ║         ║ 43       ║     01 ║ e2       ║
║ AC_FUN_COMODE    ║         ║ 44       ║     01 ║ 12       ║
║ AC_FUN_WINDLEVEL ║         ║ 62       ║     01 ║ 00       ║
║ AC_FUN_DIRECTION ║         ║ 63       ║     01 ║ c2       ║
║ ?                ║         ║ ea       ║     01 ║ fe       ║
║ AC_FUN_TEMPSET   ║         ║ 5a       ║     01 ║ 15       ║
║ AC_FUN_TEMPNOW   ║         ║ 5c       ║     01 ║ 17       ║
║ AC_FUN_SLEEP     ║         ║ 73       ║     01 ║ 00       ║
║ AC_FUN_ERROR     ║         ║ f7       ║     04 ║ 00000000 ║
╚══════════════════╩═════════╩══════════╩════════╩══════════╝

`1302` Commands

Reset?

╔═══════════════════════════╦═════════╦══════════╦════════╦═══════╗
║                           ║ command ║ register ║ length ║ value ║
╠═══════════════════════════╬═════════╬══════════╬════════╬═══════╣
║ Multi_valued              ║      10 ║          ║        ║       ║
║ AC_ADD_AUTOCLEAN          ║         ║       32 ║     00 ║       ║
║ AC_ADD_SETKWH             ║         ║       40 ║     00 ║       ║
║ AC_ADD_CLEAR_FILTER_ALARM ║         ║       44 ║     00 ║       ║
║ AC_ADD_STARTWPS           ║         ║       43 ║     00 ║       ║
║ AC_ADD_SPI                ║         ║       75 ║     00 ║       ║
║ AC_OUTDOOR_TEMP           ║         ║       76 ║     00 ║       ║
║ AC_COOL_CAPABILITY        ║         ║       77 ║     00 ║       ║
║ AC_WARM_CAPABILITY        ║         ║       78 ║     00 ║       ║
╚═══════════════════════════╩═════════╩══════════╩════════╩═══════╝

`1303` Commands

╔═══════════════════════════╦═════════╦══════════╦════════╦═══════╗
║                           ║ command ║ register ║ length ║ value ║
╠═══════════════════════════╬═════════╬══════════╬════════╬═══════╣
║ Multi_valued              ║ 1a      ║          ║        ║       ║
║ AC_ADD_AUTOCLEAN          ║         ║       32 ║     01 ║ 23    ║
║ AC_ADD_SETKWH             ║         ║       40 ║     01 ║ ff    ║
║ AC_ADD_CLEAR_FILTER_ALARM ║         ║       44 ║     01 ║ f0    ║
║ AC_ADD_STARTWPS           ║         ║       43 ║     01 ║ 0f    ║
║ AC_ADD_SPI                ║         ║       75 ║     01 ║ f0    ║
║ AC_OUTDOOR_TEMP           ║         ║       76 ║     01 ║ fe    ║
║ AC_COOL_CAPABILITY        ║         ║       77 ║     02 ║ 0044  ║
║ AC_WARM_CAPABILITY        ║         ║       78 ║     02 ║ 0050  ║
╚═══════════════════════════╩═════════╩══════════╩════════╩═══════╝

`1304` Commands

06 Set Integer

AC_ADD_AUTOCLEAN

╔═════╦═════════╦══════════╦════════╦═══════╦════════╗
║     ║ command ║ register ║ length ║ value ║  end   ║
╠═════╬═════════╬══════════╬════════╬═══════╬════════╣
║ On  ║      06 ║       32 ║     01 ║    22 ║ 74010f ║
║ Off ║      06 ║       32 ║     01 ║    23 ║ 74010f ║
╚═════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_ADD_SETKWH

╔═════╦═════════╦══════════╦════════╦═══════╦════════╗
║     ║ command ║ register ║ length ║ value ║  end   ║
╠═════╬═════════╬══════════╬════════╬═══════╬════════╣
║ 0   ║      06 ║       40 ║     01 ║ 00    ║ 74010f ║
║ …   ║         ║          ║        ║       ║        ║
║ 255 ║      06 ║       40 ║     01 ║ ff    ║ 74010f ║
╚═════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_ADD_CLEAR_FILTER_ALARM

╔═════╦═════════╦══════════╦════════╦═══════╦════════╗
║     ║ command ║ register ║ length ║ value ║  end   ║
╠═════╬═════════╬══════════╬════════╬═══════╬════════╣
║ 0   ║      06 ║       44 ║     01 ║ 00    ║ 74010f ║
║ …   ║         ║          ║        ║       ║        ║
║ 255 ║      06 ║       44 ║     01 ║ ff    ║ 74010f ║
╚═════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_ADD_SPI

╔═════╦═════════╦══════════╦════════╦═══════╦════════╗
║     ║ command ║ register ║ length ║ value ║  end   ║
╠═════╬═════════╬══════════╬════════╬═══════╬════════╣
║ On  ║      06 ║       75 ║     01 ║ 0f    ║ 74010f ║
║ …   ║         ║          ║        ║       ║        ║
║ Off ║      06 ║       75 ║     01 ║ f0    ║ 74010f ║
╚═════╩═════════╩══════════╩════════╩═══════╩════════╝

AC_ADD_APMODE_END

╔═══╦═════════╦══════════╦════════╦═══════╦═════╗
║   ║ command ║ register ║ length ║ value ║ end ║
╠═══╬═════════╬══════════╬════════╬═══════╬═════╣
║ … ║         ║          ║        ║       ║     ║
╚═══╩═════════╩══════════╩════════╩═══════╩═════╝

AC_ADD_STARTWPS

╔════════╦═════════╦══════════╦════════╦═══════╦═════╗
║        ║ command ║ register ║ length ║ value ║ end ║
╠════════╬═════════╬══════════╬════════╬═══════╬═════╣
║ Direct ║ …       ║          ║        ║       ║     ║
║ …      ║         ║          ║        ║       ║     ║
╚════════╩═════════╩══════════╩════════╩═══════╩═════╝

AC_OUTDOOR_TEMP

╔═══╦═════════╦══════════╦════════╦═══════╦═════╗
║   ║ command ║ register ║ length ║ value ║ end ║
╠═══╬═════════╬══════════╬════════╬═══════╬═════╣
║ … ║         ║          ║        ║       ║     ║
╚═══╩═════════╩══════════╩════════╩═══════╩═════╝

AC_COOL_CAPABILITY

╔═══╦═════════╦══════════╦════════╦═══════╦═════╗
║   ║ command ║ register ║ length ║ value ║ end ║
╠═══╬═════════╬══════════╬════════╬═══════╬═════╣
║ … ║         ║          ║        ║       ║     ║
╚═══╩═════════╩══════════╩════════╩═══════╩═════╝

AC_WARM_CAPABILITY

╔═══╦═════════╦══════════╦════════╦═══════╦═════╗
║   ║ command ║ register ║ length ║ value ║ end ║
╠═══╬═════════╬══════════╬════════╬═══════╬═════╣
║ … ║         ║          ║        ║       ║     ║
╚═══╩═════════╩══════════╩════════╩═══════╩═════╝

AC_ADD2_USEDWATT

╔═══╦═════════╦══════════╦════════╦═══════╦═════╗
║   ║ command ║ register ║ length ║ value ║ end ║
╠═══╬═════════╬══════════╬════════╬═══════╬═════╣
║ … ║         ║          ║        ║       ║     ║
╚═══╩═════════╩══════════╩════════╩═══════╩═════╝

AC_ADD2_VERSION

╔═══╦═════════╦══════════╦════════╦═══════╦═════╗
║   ║ command ║ register ║ length ║ value ║ end ║
╠═══╬═════════╬══════════╬════════╬═══════╬═════╣
║ … ║         ║          ║        ║       ║     ║
╚═══╩═════════╩══════════╩════════╩═══════╩═════╝

`1402` Commands

When message received, Wifi module also respond:

-> 1404 0c1701 15180105190127fd0102 -> 1404 12fa01 f8fb0104fc012ef701d8f8013ef901a0

╔═════════════════════════╦═════════╦══════════╦════════╦═══════════╗
║                         ║ command ║ register ║ length ║  comment  ║
╠═════════════════════════╬═════════╬══════════╬════════╬═══════════╣
║ Multi_valued            ║      16 ║          ║        ║           ║
║ AC_ADD2_USEDWATT        ║         ║ 32       ║     00 ║ ?         ║
║ AC_ADD2_VERSION         ║         ║ f6       ║     00 ║ Confirmed ║
║ AC_ADD2_PANEL_VERSION   ║         ║ f4       ║     00 ║ ?         ║
║ AC_ADD2_OUT_VERSION     ║         ║ f3       ║     00 ║ ?         ║
║ AC_FUN_MODEL            ║         ║ f5       ║     00 ║ ?         ║
║ AC_ADD2_OPTIONCODE      ║         ║ 39       ║     00 ║ ?         ║
║ AC_ADD2_USEDPOWER       ║         ║ e0       ║     00 ║ ?         ║
║ AC_ADD2_USEDTIME        ║         ║ e4       ║     00 ║ ?         ║
║ AC_ADD2_CLEAR_POWERTIME ║         ║ e8       ║     00 ║ ?         ║
║ AC_ADD2_FILTERTIME      ║         ║ e9       ║     00 ║ ?         ║
║ AC_ADD2_FILTER_USE_TIME ║         ║ e6       ║     00 ║ ?         ║
╚═════════════════════════╩═════════╩══════════╩════════╩═══════════╝

`1403` Commands

From AC to Wifi. When message received, Wifi module also respond:

-> 1404 0c 170115180105190127fd0102 (Not decoded yet)

-> 1404 12 fa01f8fb0104fc012ef701d8f8013ef901a0

╔═════════════════════════╦═════════╦══════════╦════════╦══════════╦═════════════════════════════════════╗
║                         ║ command ║ register ║ length ║  value   ║               comment               ║
╠═════════════════════════╬═════════╬══════════╬════════╬══════════╬═════════════════════════════════════╣
║ Multi_valued            ║ 2d      ║          ║        ║          ║                                     ║
║ AC_ADD2_USEDWATT        ║         ║ 32       ║     01 ║ fe       ║                                     ║
║ AC_ADD2_VERSION         ║         ║ f6       ║     01 ║ fe       ║                                     ║
║ AC_ADD2_PANEL_VERSION   ║         ║ f4       ║     03 ║ 150224   ║ (Raw value in XML)                  ║
║ AC_ADD2_OUT_VERSION     ║         ║ f3       ║     03 ║ 130709   ║ (Raw value in XML)                  ║
║ AC_FUN_MODEL            ║         ║ f5       ║     01 ║ 05       ║                                     ║
║ AC_ADD2_OPTIONCODE      ║         ║ 39       ║     02 ║ d0b8     ║                                     ║
║ AC_ADD2_USEDPOWER       ║         ║ e0       ║     04 ║ 0000e635 ║                                     ║
║ AC_ADD2_USEDTIME        ║         ║ e4       ║     04 ║ 00040dcb ║                                     ║
║ AC_ADD2_CLEAR_POWERTIME ║         ║ e8       ║     01 ║ fe       ║                                     ║
║ AC_ADD2_FILTERTIME      ║         ║ e9       ║     01 ║ 03       ║ (00:00 01:180 02:300 03:500 04:700) ║
║ AC_ADD2_FILTER_USE_TIME ║         ║ e6       ║     02 ║ 2710     ║                                     ║
╚═════════════════════════╩═════════╩══════════╩════════╩══════════╩═════════════════════════════════════╝

`1404` Commands

03 Notify
06 Set Integer
0c Set Multi values
12 Set Multi values

AC_SG_WIFI

╔═════╦═════════╦══════════╦════════╦═══════╦═════╗
║     ║ command ║ register ║ length ║ value ║ end ║
╠═════╬═════════╬══════════╬════════╬═══════╬═════╣
║ On  ║      03 ║       37 ║     01 ║ 0f    ║     ║
║ Off ║      03 ║       37 ║     01 ║ f0    ║     ║
╚═════╩═════════╩══════════╩════════╩═══════╩═════╝

AC_SG_INTERNET

╔═════╦═════════╦══════════╦════════╦═══════╦═════╗
║     ║ command ║ register ║ length ║ value ║ end ║
╠═════╬═════════╬══════════╬════════╬═══════╬═════╣
║ On  ║      03 ║       38 ║     01 ║ 0f    ║     ║
║ Off ║      03 ║       38 ║     01 ║ f0    ║     ║
╚═════╩═════════╩══════════╩════════╩═══════╩═════╝

AC_ADD2_FILTERTIME

╔═════╦═════════╦══════════╦════════╦═══════╦════════╗
║     ║ command ║ register ║ length ║ value ║  end   ║
╠═════╬═════════╬══════════╬════════╬═══════╬════════╣
║   0 ║      06 ║ e9       ║     01 ║    00 ║ 74010f ║
║ 180 ║      06 ║ e9       ║     01 ║    01 ║ 74010f ║
║ 300 ║      06 ║ e9       ║     01 ║    02 ║ 74010f ║
║ 500 ║      06 ║ e9       ║     01 ║    03 ║ 74010f ║
║ 700 ║      06 ║ e9       ║     01 ║    04 ║ 74010f ║
╚═════╩═════════╩══════════╩════════╩═══════╩════════╝

0c

╔══════════════╦═════════╦══════════╦════════╦═══════╗
║              ║ command ║ register ║ length ║ value ║
╠══════════════╬═════════╬══════════╬════════╬═══════╣
║ Multi_valued ║ 0c      ║          ║        ║       ║
║ ?            ║         ║ 17       ║     01 ║    15 ║
║ ?            ║         ║ 18       ║     01 ║    05 ║
║ ?            ║         ║ 19       ║     01 ║    27 ║
║ ?            ║         ║ fd       ║     01 ║    02 ║
╚══════════════╩═════════╩══════════╩════════╩═══════╝

12

╔════════════════╦═════════╦══════════╦════════╦═══════╗
║                ║ command ║ register ║ length ║ value ║
╠════════════════╬═════════╬══════════╬════════╬═══════╣
║ Multi_valued   ║      12 ║          ║        ║       ║
║ AC_SG_VENDER01 ║         ║ fa       ║     01 ║ f8    ║
║ AC_SG_VENDER02 ║         ║ fb       ║     01 ║ 04    ║
║ AC_SG_VENDER03 ║         ║ fc       ║     01 ║ 2e    ║
║ AC_SG_MACHIGH  ║         ║ f7       ║     01 ║ d8    ║
║ AC_SG_MACMID   ║         ║ f8       ║     01 ║ 3e    ║
║ AC_SG_MACLOW   ║         ║ f9       ║     01 ║ a0    ║
╚════════════════╩═════════╩══════════╩════════╩═══════╝

See most recent protocol version at github.com/kumy/samsung-ac-wifi-module/blob/master/protocol/… — KumZ, Commented Sep 4, 2020 at 16:46

Stack Exchange Network

Reverse UART communication protocol

1 Answer 1

From my question:

Procedure

Message format

Payload

Types

`1204` Commands

`1206` Commands

`1302` Commands

`1303` Commands

`1304` Commands

`1402` Commands

`1403` Commands

`1404` Commands

Not the answer you're looking for? Browse other questions tagged
hardware
serial-communication
protocol
packet
or ask your own question.

Hot Network Questions

Reverse UART communication protocol

1 Answer 1

From my question:

Procedure

Message format

Payload

Types

1204 Commands

1206 Commands

1302 Commands

1303 Commands

1304 Commands

1402 Commands

1403 Commands

1404 Commands

Not the answer you're looking for? Browse other questions tagged hardwareserial-communicationprotocolpacket or ask your own question.

Related

Hot Network Questions

`1204` Commands

`1206` Commands

`1302` Commands

`1303` Commands

`1304` Commands

`1402` Commands

`1403` Commands

`1404` Commands

Not the answer you're looking for? Browse other questions tagged
hardware
serial-communication
protocol
packet
or ask your own question.