Toon as a domotica controller?

[marcelr]

If I understand correctly the only way to get access for now is with jtag. But if a cfw with telnet enabled could be installed then more people will be able to start working on the platform.

Yes, you will have to physically open toon to get in. There's no other way (at least not one that we know of). Quby did a good job at securing the machine from intrusion through software. Prodrive shouldn't have soldered a serial port and JTAG interface to the pcb, though . Once you're in, it's straightforward to install dropbear, and to start talking with the machine, through ssh. Telnet is a bit old school.

P.S does a moderator has to re-look every post? this really disturbs communication.

Once your post counter hits 10, IIRC, you're no longer pre-moderated, and discussion can speed up, so, keep talking .

The hard-coded part is not a real issue. We can edit them out with a elf editor.

Not everybody's equally nimble with a hex editor (or a JTAG interface for that matter). But then again, if you can master one, you're probably not afraid to try the other ..

grtz,

marcelr

[al_n]

He Marcel,

nice find! Would you PM me with a emailadres I can reach you. I cannot send any messages.
Root access is a breezz (even without JTAG)

How did you get root access without jtag?

[al_n]

Since I don't have a jtag I was looking for a pre-cooked firmware with ssh that could be installed. But if I understand correctly nobody managed to install a new firmware yet.

As I'm not an eneco client I'm afraid to even bring toon online. As I said I've got it from a friend, I installed it at home and reset it to defaults.
At the setup process it says that this toon is activated. but will it stay that way? I don't know. So I just blocked it on my router.

I think I'll try to snif its network activity to see if I can safely bring it online. What I'm afraid of is it will be remotely disabled by eneco and will become useless as it isn't on any client account anymore.

[marcelr]

Since I don't have a jtag I was looking for a pre-cooked firmware with ssh that could be installed. But if I understand correctly nobody managed to install a new firmware yet.

There is no alternative firmware available (yet). Even if it were, you still have to get in through the hardware, there's no software-only access.

As I'm not an eneco client I'm afraid to even bring toon online. As I said I've got it from a friend, I installed it at home and reset it to defaults.
At the setup process it says that this toon is activated. but will it stay that way? I don't know. So I just blocked it on my router.

You can safely switch on toon. It's only useful as a thermostat and el.power/gas usage display if you don't have an eneco account. I don't have one either.

I think I'll try to snif its network activity to see if I can safely bring it online. What I'm afraid of is it will be remotely disabled by eneco and will become useless as it isn't on any client account anymore.

If you just make it accessible inside your own network, and do not allow it to communicate outside your own network, you should be good. Just don't reset to factory defaults.

grtz,

marcelr

[marcelr]

Next step (quite large in my view) taken:
boiler interface command is now ready for further development. As I posted in the OTGW thread, it's now possible to operate the boiler connected to toon without Eneco's (or quby's) software. The big issue now is to develop a boiler control algorithm. Will not go into that here, I think that subject better fits the OTGW thread.

question: has anyone else tried to access toon? If not, I may as well stop posting here ...

grtz,

marcelr

[hvxl]

I don't have a Toon (yet) myself, but I'm following your explorations with great interest. Once it's clear that you can run your own programs on it (and how), I will very likely try to obtain one. Unfortunately I don't have time at the moment to spend much effort on helping to figure out these things. But please continue to report on your progress.

[marcelr]

I don't have a Toon (yet) myself, but I'm following your explorations with great interest. Once it's clear that you can run your own programs on it (and how), I will very likely try to obtain one.

Getting in is the hard bit, by physically opening the case. If you know the JTAG tools I described, and have an idea about the inner workings of boot loaders, it's fairly straightforward. If not, chances are that you end up with a well-designed paperweight. That's one reason that I don't give too many details on this. You really have to know what you are doing, not just follow a recipe (probably with mistakes inside) found on the internet. The matter is fairly complex (many steps, not hard to do, but really a lot), and one typo in the right spot can kill the machine.

Using the opensource openembedded tree for toon, you can compile and link your own programs. By building this tree, you will get a host of programs not installed on toon by default, but very useful for all kinds of things (an ssh client/server, for starters). The openembedded tree among others builds the opkg package manager, and this one is installed on toon. Eneco cannot do any updates without it. It's the pkg manager of OpenWRT, can be used in a shell as well.

Once inside, you need to get rid of most of Eneco's software, then build your own code, install it, and run it. That's what I do, at least.

BTW obtaining one: check out MP regularly, saw one the other day for EUR 25.--.

Unfortunately I don't have time at the moment to spend much effort on helping to figure out these things. But please continue to report on your progress.

Fair enough, but you are an expert on OT. Maybe you can give me some advice on the inner workings of the OT protocol, and how thermostats use it to control a boiler. The control algorithm and learning stage for average heat loss properties of a building are not that hard to implement (a bunch of ODE''s with a parameter estimator, basically).

grtz,

marcelr

[hvxl]

I have no experience with JTAG, but feel confident that I can figure that out. I understand you used some special JTAG interface, but it seems it should also be possible to do it with a Raspberry Pi.

Due to my tinkerings with the OTGW I did indeed learn quite a bit about the OT protocol. So if you have any questions about that, feel free to contact me via PM. I'm not very good with control theory, and I have always been under the impression that it is hard to come up with a good thermostat control algorithm. That's one of the reasons I'm not doing any of that in the OTGW. I continue to use the existing thermostat to control the heating curve.

I'm not even sure I will use the thermostat part of the Toon. I have been looking for a way to get a wall-mounted control panel for my domotica. One possibility would be to somehow bolt an android tablet to the wall. But they are not designed for that purpose, so it's not straightforward how to do that nicely, without ugly clamps or a power cable sticking out on one side. The Toon was made to be mounted on the wall, has a touch screen, wifi, and Z-wave. So it seems ideal for that purpose.

[marcelr]

I understand you used some special JTAG interface, but it seems it should also be possible to do it with a Raspberry Pi.

Should indeed be possible, haven't tried it. Apparently there's an openocd config script for the raspi. Not sure if it supports the full JTAG interface (including the reset lines).

The Toon was made to be mounted on the wall, has a touch screen, wifi, and Z-wave. So it seems ideal for that purpose.

See my first post

grtz,

marcelr

[R0cc0]

I'm very interested in this subject, especially the possibility of reading Opentherm status from Toon.
Is there an 'easy' way to do this?
I know there is some risk involved in doing this, and I don't expect foolproof directions.
Just a bit more info... what are the options, what do I need to get started.

[marcelr]

I'm very interested in this subject, especially the possibility of reading Opentherm status from Toon.
Is there an 'easy' way to do this?

I'm not sure what you mean with 'easy'. Reading OT status is fairly straightforward once you have root access. If you want real time info, that will be tricky, communication between the boiler module and the boiler, and between boiler module and toon are not synchronous.

I know there is some risk involved in doing this, and I don't expect foolproof directions.
Just a bit more info... what are the options, what do I need to get started.

You will need:

hardware:

A JTAG debugging interface,
a bunch of wires with single contact male/female (YMMV) header connectors on both ends, (at least 10 of them),
a 3.3v signal level serial connector (typically usb-to-rs232).
Optional: a 10-channel 1k resistor bridge just to be on the safe side with the JTAG interface.

software:

Openocd or similar to operate the JTAG interface,
A terminal program to operate the serial connection,
A hex-editor,
A sound level of knowledge and experience in using these tools.
A sound level of understanding of the inner workings of a boot loader (u-boot in this case).
A sound level of knowledge on the boot sequence of a SysV linux machine.

Then: start reading this thread completely, and follow the steps as you go. If you have all the hard- and software available, you should know what to do.
I screwed up my toon's bootstrap a few times before I finally got it to work, chances are that you will experience the same. That's the reason you do not get a full description, before you know it, ierlandfan and I can set up a full-fledged help desk for people bricking their toon, and neither of us has the intention to do that any time soon.

And once again: this is a method which is at the level "works for me". It's not a well-tested production-level method.

grtz,

marcelr

[marcelr]

Just checked out the quby website once more, they have now also published the source code for the boot loader, as used in toon. Should give some more insights in the boot loader configuration.

http://quby.com/static/openembedded-qb2-toon-uboot.tgz

grtz,

marcelr

[R0cc0]

I'm not sure what you mean with 'easy'. Reading OT status is fairly straightforward once you have root access. If you want real time info, that will be tricky, communication between the boiler module and the boiler, and between boiler module and toon are not synchronous.

Thanks for your reply;
Basically all I want is to use Domoticz to read some parameters from my boiler, like waterpressure. That's it.
It doesn't have to be real-time.
I was hoping there would be an easier way to do this.

I know that there are Opentherm interfaces on the market that offer that functionality, but I don't like to buy yet another device.

[Boraxx]

If I understand correctly the only way to get access for now is with jtag. But if a cfw with telnet enabled could be installed then more people will be able to start working on the platform.

Yes, you will have to physically open toon to get in. There's no other way (at least not one that we know of). Quby did a good job at securing the machine from intrusion through software. Prodrive shouldn't have soldered a serial port and JTAG interface to the pcb, though . Once you're in, it's straightforward to install dropbear, and to start talking with the machine, through ssh. Telnet is a bit old school.

P.S does a moderator has to re-look every post? this really disturbs communication.

Once your post counter hits 10, IIRC, you're no longer pre-moderated, and discussion can speed up, so, keep talking .

The hard-coded part is not a real issue. We can edit them out with a elf editor.

Not everybody's equally nimble with a hex editor (or a JTAG interface for that matter). But then again, if you can master one, you're probably not afraid to try the other ..

grtz,

marcelr

@marcelr, this was most useful thanks a lot!
Was wondering how to access the Toon already since I want to add additional software to it, allowing for secure Internet of Things communication within my house and beyond.

[marcelr]

this was most useful thanks a lot!

You're welcome.
And welcome to the club as well
What kind of software are you planning to install?

grtz,

marcelr