Carrier Infinity
- Thread starter nov0798
- Start date
-
- Tags
- carrier hvac thermostats
Thanks. Any chance I could see the text on the oscillator?
Looks like the chip is possibly a custom version of an MCW1001A? I ordered a sample of the stock chip, lets see if that helps.
Also put a logic analyzer on the debug_rx/tx pads with no luck. Has anyone been able to get a console or something similar?
Looks like the chip is possibly a custom version of an MCW1001A? I ordered a sample of the stock chip, lets see if that helps.
Also put a logic analyzer on the debug_rx/tx pads with no luck. Has anyone been able to get a console or something similar?
gfb said:
I'll see if I can get a better pic of the oscillator over lunch today. Wrt the debug tx/rx, I put a 3.3v serial to usb adapter to it with no results and thought to myself, "self, this will probably take a logic analyzer." It's quite likely nothing at all is done /w the serial port anyway. Since this is a SuperH chip running Adobe Air/SWF, it could even be WindowsCE.
I didn't have a handy ttl converter so i started with the logic analyzer. Unfortunately nothing there, both pads simply went high when I powered up the unit and stayed there. I really had my fingers crossed that I would see a console on those debug pads 
It's a fairly underpowered SHA2A chip, not sure it can handle WinCE... though I'm surprised it can handle AdobeAir, so who knows.
It's a fairly underpowered SHA2A chip, not sure it can handle WinCE... though I'm surprised it can handle AdobeAir, so who knows.
edit: I see you already mentioned this above. Well, still. Have a datasheet, Internet. Hooray.
This is the closest part # I could find for U17. Seems to fit as it's a controller for the MRF24WB0MA. I'm assuming the can is just an 8Mhz crystal.
http://datasheet.octopart.com/MCW1001A-I/SS-Microchip-datasheet-11045500.pdf
This is the closest part # I could find for U17. Seems to fit as it's a controller for the MRF24WB0MA. I'm assuming the can is just an 8Mhz crystal.
http://datasheet.octopart.com/MCW1001A-I/SS-Microchip-datasheet-11045500.pdf
So i soldered on the missing components and no luck. I suspect there is a flag in the EEPROM that I need to flip for it to see the wifi parts... or maybe it activates based on serial number. Either way, I need to start spending some time investigating the firmware side of this.
Anyone here good with SHA2 firmware hacking?
Anyone here good with SHA2 firmware hacking?
Yes, I know one can get a USB version for 1/3 the price, but since several people are using Raspberry Pis to communicate with their hvac, I wonder if anyone has tried, or would be interested in this:
[url=http://www.amazon.com/RS485-GPIO-Shield-Raspberry-Pi/dp/B00HGJEU6S/ref=sr_1_4?ie=UTF8&qid=1398458248&tag=sbhq-20&sr=8-4&keywords=linksprite+rs485[/URL]]Raspberry Pi RS485 shield
[url=http://www.amazon.com/RS485-GPIO-Shield-Raspberry-Pi/dp/B00HGJEU6S/ref=sr_1_4?ie=UTF8&qid=1398458248&tag=sbhq-20&sr=8-4&keywords=linksprite+rs485[/URL]]Raspberry Pi RS485 shield
A pi shield looks interesting for my purposes. I'm less interested in actual control of my greenspeed and more into the possibilty of data logging. The abiliity to log runtimes at capacity along with all the other metrics you can display in the service mode like blower RPMS, CFM, coil temp and the like would be neat. Has the carrier protocol been decoded to the point where that's possible? How could I help if it hasn't?
It's quiet in here..
I have been using the scripts 3tones put together to figure out some things. So far I have found damper positions, outdoor temp and coil temp, and a few others. But I have hit a problem - the table 2001 - 3B that others have referred to always return zeros for everything. Is table 3B in the stat only populated if it thinks a SAM is present? Or maybe they disabled this in the latest firmware? I'm guessing those of you that are getting valid data from table 3B either have the older non-touchscreen stat or an older firmware?
I have infinity touch wifi stat, firmware is latest (11) and hardware is latest revisions, just installed a month ago. I have not been able to find any useful info from reading any tables from the stat, not even setpoint or current temperature.
Partial output from the scanalltables.py script,
2001 3001 03 0B 003B02 CC1D
3001 2001 20 06 003B020000000000000000000000000000000000000000000000000000000000 09F6
2001 3001 03 0B 003B03 0DDD
3001 2001 99 06 003B03000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 E7CF
2001 3001 03 0B 003B04 4C1F
3001 2001 0E 06 003B040000000000000000000000 D700
2001 3001 03 0B 003B05 8DDF
3001 2001 0E 06 003B050000000000000000000000 2AC3
2001 3001 03 0B 003B06 CDDE
3001 2001 37 06 003B0600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 655E
Does anyone have a startup log from a system that has a SAM? That would be very useful.
stat: SYSTXCCITC01-A device 2001
furnace: 58CVX device 4001
a/c: 24ANB7 device 5001
damper control device 6001
smart sensor device 2201
I have been using the scripts 3tones put together to figure out some things. So far I have found damper positions, outdoor temp and coil temp, and a few others. But I have hit a problem - the table 2001 - 3B that others have referred to always return zeros for everything. Is table 3B in the stat only populated if it thinks a SAM is present? Or maybe they disabled this in the latest firmware? I'm guessing those of you that are getting valid data from table 3B either have the older non-touchscreen stat or an older firmware?
I have infinity touch wifi stat, firmware is latest (11) and hardware is latest revisions, just installed a month ago. I have not been able to find any useful info from reading any tables from the stat, not even setpoint or current temperature.
Partial output from the scanalltables.py script,
2001 3001 03 0B 003B02 CC1D
3001 2001 20 06 003B020000000000000000000000000000000000000000000000000000000000 09F6
2001 3001 03 0B 003B03 0DDD
3001 2001 99 06 003B03000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 E7CF
2001 3001 03 0B 003B04 4C1F
3001 2001 0E 06 003B040000000000000000000000 D700
2001 3001 03 0B 003B05 8DDF
3001 2001 0E 06 003B050000000000000000000000 2AC3
2001 3001 03 0B 003B06 CDDE
3001 2001 37 06 003B0600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 655E
Does anyone have a startup log from a system that has a SAM? That would be very useful.
stat: SYSTXCCITC01-A device 2001
furnace: 58CVX device 4001
a/c: 24ANB7 device 5001
damper control device 6001
smart sensor device 2201
jt099, unfortunately table 3B for the touchscreen devices is different than that of the other models.
See http://https://github.com/nebulous/infinitude/wiki/Infinity---interpreting-data for details of what we know of tables, and by all means, add what you've discovered!
I have a SYSTXCCITW01, and for me, table 3B is labeled NVMINIT rather than AI PARMS, which I expect is true for you as well. The good news is, almost all of your data can probably be dumped in json format if you use Infinitude.
See http://https://github.com/nebulous/infinitude/wiki/Infinity---interpreting-data for details of what we know of tables, and by all means, add what you've discovered!
I have a SYSTXCCITW01, and for me, table 3B is labeled NVMINIT rather than AI PARMS, which I expect is true for you as well. The good news is, almost all of your data can probably be dumped in json format if you use Infinitude.
Gah! Of course, you're right az1324. I keep forgetting that not all touch stats have network access. gfb's efforts looked promising, but the controller for the MRF chip seemed to be a one-off. If I had infinite free time I suppose I could log the data in and out of said controller with the buspirate to figure out what's needed there.
