Evohome / Evotouch Wireless protocol?

[automatikas]

Gear job lads!

We were using Evohome and Tridium driver for gathering data form evohome, but after i've found this thred desided to read the maseges with HGS80 antena conected to PC directly. As Tridium controller and driver is not cost efective solution.

here is some log from RS port:

Code: Select all

045  I --- 04:122496 --:------ 04:122496 30C9 003 0007C1
....................046  I --- 01:011910 --:------ 01:011910 1F09 003 FF0901
.045  I --- 01:011910 --:------ 01:011910 2309 015 00086601085F020834030834040834
045  I --- 01:011910 --:------ 01:011910 30C9 015 00079B0107E4027FFF037FFF0407C1
.................................................045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
........................................................................................................................045  I --- 04:122496 --:------ 01:011910 3150 002 0400
..................045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
...045  I --- 04:122496 --:------ 01:011910 2309 003 0401F4
..............................045  I --- 01:011910 --:------ 01:011910 0008 002 04A2
...........045  I --- 01:011910 --:------ 01:011910 1F09 003 FF0901
.045  I --- 01:011910 --:------ 01:011910 2309 015 00086601085F020834030834040834
045  I --- 01:011910 --:------ 01:011910 30C9 015 00079D0107E4027FFF037FFF0407C1
..................................................................045  I --- 04:122496 --:------ 04:122496 30C9 003 0007BB
........................................................................................................045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
.045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
...045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
................045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
..........................................045  I --- 01:011910 --:------ 01:011910 1F09 003 FF0901
045  I --- 01:011910 --:------ 01:011910 2309 015 00086601085F020834030834040834
045  I --- 01:011910 --:------ 01:011910 30C9 015 0007980107E4027FFF037FFF0407BB
045  I --- 01:011910 --:------ 01:011910 0008 002 04A6
............................045  I --- 01:011910 --:------ 01:011910 3B00 002 FCC8
........045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
...045  I --- 04:122496 --:------ 01:011910 3150 002 0400
............................045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
........045  I --- 04:122496 --:------ 01:011910 2309 003 0401F4
.....................................045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
...........045  I --- 04:122496 --:------ 04:122496 30C9 003 0007A7
..................................................045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01
045  I --- 04:122496 --:------ 04:122496 1060 003 00FF01
...................045  I --- 04:122496 --:------ 01:011910 3150 002 0400
..................045  I --- 04:122496 --:------ 01:011910 3150 002 0400
.....................045  I --- 01:011910 --:------ 01:011910 1F09 003 FF0901
045  I --- 01:011910 --:------ 01:011910 2309 015 00086601085F020834030834040834
045  I --- 01:011910 --:------ 01:011910 30C9 015 00079D0107E4027FFF037FFF0407A7
.........055  I --- 01:011910 --:------ 01:011910 0008 002 04B8
.........045  I --- 04:122496 --:------ 01:011910 1060 003 04FF01

been playing with this for an hour so no decode sucsess yet...

Any ideas about decoding?

after decode, i'll make a code for Arduino as internet gateway or web server with the rest of nice data representation.

best regards
AJ

[Giuseppe]

The messages are ascii decoded and reformatted to fix size. All messages are described in Crazydiamond and JRosser PDF document.
Every message start with 045 or 046. First message, 122496 is HR80 deviceid, 30C9 is command code, 003 is length bin data, 0007C1 hex presentation of bin data. And so on

[kimstone]

@Giuseppe

Do you know where the 045 & 046 comes from? Can't find it in the protocol PDF's

[Giuseppe]

@automatikas
I do not know what it means, at the end there is a 055. You recognise and understand the other data?
Where is the log data from? I see CR LF (0d 0a) in it, what I did not expect.

[Giuseppe]

Honeymon log items from Evotouch version 23

Code: Select all

2013.05.05 15:26:57 0002  18 1c 11 9d 1c 11 9d 00 02 08 00 00 75 02 02 07 e4 01 e5
Device is HB85 (outside temperature), command code = X0002, temperature = X07E4/100 = 20,2°C

2013.05.05 15:27:27 1060  18 12 bb 92 04 3f ca 10 60 03 01 ff 00 09
Device is HR80, command code = X1060 , XFF00 = FAULT BATT LOW indicator

This is a new command code X0418 appears with version 23, telling about the BATT LOW indicator (device ID 12BB92) 
2013.05.05 15:27:27 0418  18 04 3f ca 04 3f ca 04 18 16 00 00 00 b0 04 01 04 00 00 00 52 8d 7b 67 ff ff ff 70 00 12 bb 92 56

Device is HR80, command code = X1060, XFF01 = RESTORE BATT LOW indicator when battery replaced.
2013.05.05 15:53:52 1060  18 12 bb 92 04 3f ca 10 60 03 01 ff 01 08

[mouse256]

For the ones interested: I've made an android monitoring app that allows you to monitor your evotouch remotely. It uses a small daemon tot uses a CUL to fetch the data. It's read-only, I hope I will once be able to add control support, but that will not be for anytime soon...

Android app: https://play.google.com/store/apps/deta ... hol.evomon
Daemon: https://github.com/mouse256/evomon

[hydrogenetic]

I took a chance and ordered an HGI80 to work on integration with Domoticz. I've been able to read all the basics from evohome without any problems but no luck sending anything back. I'm assuming there must be some vital steps missing e.g. the data must be formatted differently than it is read in, there are escape codes required, there are some initialisation steps like binding required for it to work or some combination of all those. If anyone has access to a somfy tahoma or tridium and an HGS80/HGI80 etc. then it would be fantastic to see a grab of the comms to help understand how to send data including any setup or initialisation that may be required. If I can get this thing sending I'll publish a revised version of the evohome patch for domoticz with support for the HGI80/HGS80. I would expect this to cover the controller mode reading / setting as well as reading / setting all individual zones/dhw including permanent or temporary overrides but no plans for scheduling atm.

[bitmanrc]

hi, I try lcd screen as photos. the device wirelles for parts to control temperature evohome / honeywell. if someone has to spare please contact andrea@ilsentierone.it Oggeto email put in touch evohome

behind the photo exists lcd

thank you very

[mouse256]

I took a chance and ordered an HGI80 to work on integration with Domoticz. I've been able to read all the basics from evohome without any problems but no luck sending anything back. I'm assuming there must be some vital steps missing e.g. the data must be formatted differently than it is read in, there are escape codes required, there are some initialisation steps like binding required for it to work or some combination of all those. If anyone has access to a somfy tahoma or tridium and an HGS80/HGI80 etc. then it would be fantastic to see a grab of the comms to help understand how to send data including any setup or initialisation that may be required. If I can get this thing sending I'll publish a revised version of the evohome patch for domoticz with support for the HGI80/HGS80. I would expect this to cover the controller mode reading / setting as well as reading / setting all individual zones/dhw including permanent or temporary overrides but no plans for scheduling atm.

Nice.
How exacly can you read out the HGI80? I assumed it's connected over USB to a PC? Do you need any special drivers? Or is it serial over USB?

[hydrogenetic]

Nice.
How exacly can you read out the HGI80? I assumed it's connected over USB to a PC? Do you need any special drivers? Or is it serial over USB?

Thanks that's the USB version currently running under linux, some minor messing to get the usb driver working

Code: Select all

Bus 002 Device 002: ID 10ac:0102 Honeywell, Inc. 

something like this works under ubuntu 12.04...

Code: Select all

modprobe ti_usb_3410_5052  
echo 10ac 0102 > /sys/bus/usb-serial/drivers/ti_usb_3410_5052_1/new_id

kernel output...

Code: Select all

usbcore: registered new interface driver ti_usb_3410_5052
usbserial: USB Serial support registered for TI USB 3410 1 port adapter
usbserial: USB Serial support registered for TI USB 5052 2 port adapter
ti_usb_3410_5052 2-1:1.0: TI USB 3410 1 port adapter converter detected
ti_usb_3410_5052: probe of 2-1:1.0 failed with error -5
ti_usb_3410_5052 2-1:2.0: TI USB 3410 1 port adapter converter detected
usb 2-1: TI USB 3410 1 port adapter converter now attached to ttyUSB0

the magic for sending data on HGI80 is similar to the following (read format is also very similar but the important part for sending is 18:730)....

Code: Select all

<W|I|RQ|RP> <TS> 18:730 <id2class>:<id2addr> <id3class>:<id3addr> <cmd> <len> <payload>

e.g.

Code: Select all

W - 18:730 -:- 13:012345 3EF0 003 00C8FF

Intergration with Domoticz mostly complete now by updating my previous code to work with the HGI80. The HGI80 appears to be limited to sending as a fixed address so maybe can't do everything you can with the CUL/RFBee. Probably need to implement a retry for sending data and also need to poll setpoints as they will only update if you change them manually on the controller atm (or set them in Domoticz).

You can see images from the mod here and I'll publish the changes (eventually) to the same git repo...

https://github.com/fullTalgoRythm/Domoticz-evohome/wiki

Btw I based my implementation on your code so thankyou for your efforts and the work on this thread as would of been hard to do this otherwise.

One final thing I tried to send the outside temp (as available from the internet) to the controller but it didn't work my guess is that as mentioned I can not change the built in address class to the correct one. There is a possibility though that there are just some missing messages or my binding procedure is not correct. If anyone can capture the packets for binding so I can see if there are any extra messages etc, that would be great.

[mouse256]

@hydrogenetic: As far as a understood from investigating the HGI80 (I don't have one though), the way it controls your system is a bit different. You need a recent firmware on your evotouch (V22 or V23 I believe), and then you're able to actually control your evotouch from the HGI80 instead of sending raw commands directly. (At least that's what I would think is the most logic how it would work. I can be wrong...) But for figuring out those commands you probably need a working somfy box setup...

[hydrogenetic]

@mouse256: sorry just to clarify the HGI80 still uses raw commands, whatever the firmware does is fairly minimal. I'm already using it to control my evohome controller successfully. I was also able to control a BDR91 relay although you may need to keep sending some sort of heartbeat to these after binding with them to prevent the red error light flashing up (comms failure). The main difference that I can see between this and being able to send raw data (and possible limiting factor) is the packet header which the HGI80 will handle for you by inserting its own ID when using the special 18:730 ID to send (appears to be the only supported ID for sending data). The payload and command are still as specified and exactly as per previously identified specification. I did identify a few new commands for the evotouch/evohome protocol, those will be available when I publish the code.

The reason a new evotouch firmware may be required and that there is also no way to predict whether or not you will be able to control any other devices is because the device class/type of the HGI (and probably HGS) is 18 (this is the 6 most significant bits of the ID). The problem here is that other devices may respond differently (or not at all) depending on the device class. My guess would be that the key thing with later evotouch firmware is that it is pre-enabled for device class 18 as I did not need to bind with the device in order to control it. You do need the device id of the controller to address your commands properly but you can obtain that by listening to some traffic or there is some procedure on the evohome to do it as well.

There is a chance you could bind to an older evohome or other device as the remote gateway or a controller device, the issue here is even if you do the binding correctly it may not work for device class 18 and that appears to be fixed in the firmware of the HGI80. For example I tried to bind to my evohome as the outside temperature sensor and although it does accept the binding signal it did not appear to accept the actual packets containing temperature data. That was the reason I wanted to see the binding and other messages for the outside controller to try and work out if it was due to the device class being wrong or something else. If anyone does have a capture of the packets for that I'd be interested in having a look.

[r_255]

@ mouse256, Nice you got it to work and shame i have no android running here to give it a test try.

@ Hydrogenetic, so in the end you can controll your system direct ;O) sweet !!!

[hydrogenetic]

@r_255: thanks I have to admit I was pretty happy with the result and you can also see a few interesting things going on like the relays firing although I haven't brought that data into the system yet. I'll send what I have to Domticz and see if it gets merged.

[r_255]

At one point i was considering to ask Rudolf Koenig, the one that made the orignal maker of the culfw firmware, the one that Crazy Diamond modified to recieve and send the data. But as no one has a clue how to send and there is no source file from the firmware so that will be hard. Never had the guts to ask Rudolf himself. I might find some in the future ;O)

So many people have tried, and except for crazy diamond no one sucseeded, so you got all the right to be pretty happy.....!
At least all the hard work and efforts of people here on the forum and decoding the protocol wasn't for nothing.

Thats something that makes me smile !
Cheers and thanks for sharing so far.

Robin