I am trying to decode a reverse cycle split system air-conditioner comms signal so that I can control an outdoor a/c compressor unit without using the manufactures indoor unit. The unit is made by Midea and they seems reluctant to share their protocol details.

I used my oscilloscope to look at the data and used the default serial decoding settings to get some HEX data strings.

Data is sent (or received?) every 50ms. With 4.8kbaud, no parity,1 stop bit and LSB bit order. I get HEX data like this when there is no heating or cooling request from the indoor unit.No request from indoor unit

I took some more data when the indoor unit was requesting cooling but I don't know if my acquisition settings right. Here is some data recorded of packets taken every 40seconds or so before the indoor unit requests cooling, during cooling request and after.Some random packets taken before during and after a cooling request

I know that the indoor unit is receiving temperature measurements so that the system can decide at what speed to run the compressor. Not sure if it is temperature measurements that are communicated to the outdoor unit or if it is VSD speed commands. If it is temperature measurements then there should be data that is reducing during the cooling call data block.

I am looking for any advise as to how I should go about decoding this data. Should I buy a serial decoder instead of using my oscilloscope? I am probably out of my depth, but I love a challenge. Any advise greatly appreciated.

  • I too have a Midea unit. I'm assuming you are decoding the XYE terminal connections? Did you make any progress on this.
    – XtremeGod
    Commented Feb 24, 2017 at 5:33
  • is it possible to also get this PDF?
    – Hiren A
    Commented Dec 31, 2021 at 11:04

3 Answers 3


I would hardly call this an answer, but I can't comment yet..

You need additional data.

  1. Have you tried opening the outdoor unit and examining the board that you're communicating with? you might find it has some debug interfaces (serial or something else). It might provide additional information - debug prints when a command is received for example.
  2. Recording additional reference data - I would record every possible temperature setting. Then try identifying the constant values vs. the varying values. This might help with determining the command format.
  3. As a continued effort from the second option - record every possible command and start diffing them. Try to find a pattern - message types, sub fields to the message.
  4. Record your A/C remote (fairly simple - google it) and see if there is any correlation (this is a long shot, but worth a try)

As for the serial decoder - At the very least it will make sampling the signals simpler. The easier to sample the more you will probably sample.

Hope this helped :)

  • Thank you Eli, that is a help. You are correct, the outdoor unit has a check switch and display that gives a bunch of information. One of the things it shows is the indoor coil temperatures and therefore I know that it is the outdoor board that controls the VSD based on the indoor coil temps. I should be able to record what the outdoor unit sees as indoor temperatures and then see how that data is represented in the command format. I am thinking I will buy a Saleae Logic 4 to make data acquisition and analysis easier. Thanks again.
    – Kirkland
    Commented Aug 28, 2016 at 2:14

I managed to decode the protocol on XYE connection. My findings are here https://codeberg.org/xye/xye

The XYE connection is the bus between a central controller and the indoor units. The bus from the indoor units to the outdoor units is labeled PQE. My units don't have the connection for that, so I can't test it.

The data in the initial post look like you are missing bytes. I used a cheap RS-485 to USB converter to monitor the data. Worked great.

  • Incredible work. Thank you!
    – Kirkland
    Commented Sep 29, 2020 at 6:30
  • I think the packets you have labeled as "Payload" possibly contain the PQE packets that I decoded.
    – Kirkland
    Commented Oct 6, 2020 at 0:00

The comms on the PQ(E) bus are similar to the XY(E), just with only 10-byte messages. You can sniff the RS-485 traffic with an RS-485 - USB dongle and some serial monitor, connect the A-B lines of the dongle to the bus. A short example, captured with ioninja:

12:36:56 +01:04.353 > 00c8 aa 00 02 00 00 00 00 00 fe 55 .........U
12:36:56 +01:04.420 > 00d2 aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:36:58 +01:06.676 > 00dc aa 00 02 1f 00 00 01 00 de 55 .........U
12:36:58 +01:06.748 > 00e6 aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:37:01 +01:09.000 > 00f0 aa 00 02 1f 00 04 01 00 da 55 .........U
12:37:01 +01:09.068 > 00fa aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:37:03 +01:11.322 > 0104 aa 00 02 1f 00 04 01 00 da 55 .........U
12:37:03 +01:11.391 > 010e aa 01 02 50 1f 01 00 00 8d 55 ...P.....U
12:37:05 +01:13.644 > 0118 aa 00 02 1f 00 04 01 00 da 55 .........U

  • Btw: are you also transforming the outdoor to a heat-pump with a water heat exchanger in place of the indoor? ;)
    – sz22
    Commented Sep 30, 2020 at 7:36
  • @Kirkland if not lost in the past, can you share your results? I planned a Raspberry for the control, but maybe that's overdo, an ESP would be better. My system is only meant for floor heating, you are absolutely right about the risk of destroying the heat exchanger by freezing it. I've recently seen one...for cooling, you need at the very least, a flow and/or temp sensor that cuts the outdoor in emergency case.
    – sz22
    Commented Sep 30, 2020 at 7:42
  • I actually commercialised my product and want to avoid any IP conflicts my publishing publicly. Also don't want to get detained next time i'm in China(I'm only partially joking). Is there a way to private message on this forum? I would be happy to share with you for the purpose of your private project.
    – Kirkland
    Commented Oct 2, 2020 at 0:07
  • Apparently no way. There are chat rooms, but you need level 100 to create one. I can give you an upload-only link to my cloud server, or simply a one-time email address here, what I remove immediately once the job done.
    – sz22
    Commented Oct 3, 2020 at 6:03
  • Sure thing. I can upload a pdf with all the details.
    – Kirkland
    Commented Oct 4, 2020 at 10:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.