Carrier Infinity

Interesting.  Good progress.
 
Aww come on you're telling me you won't write to a setpoint register after you've confirmed that manually changing it affects the register? 
 
Running without a thermostat would probably not be a great idea for warranty purposes, but I doubt you could override any safety mechanisms.
 
Some error code data:
 
Fan Coil
Code 37 -- Heater output sensed On when not energized
Code 41 -- Blower Motor Fault (ventilator, humidifier, dehumidifier, outdoor unit will be turned off)
Code 44 -- Motor Communication Fault (ventilator, humidifier, dehumidifier, outdoor unit will be turned off)
Code 45 -- Control failure
 
Furnace
Code 12 -- Blower On After Power Up
Code 13 -- Limit Circuit Lockout
Code 14 -- Ignition Lockout
Code 15 -- Blower Motor Lockout (ventilator, humidifier, dehumidifier, outdoor unit will be turned off)
Code 21 -- Gas Heating Lockout
Code 22 -- Abnormal Flame Proving Signal
Code 23 -- Pressure Switch Did Not Open
Code 24 -- Secondary Voltage Fuse Open
Code 25 -- Invalid Model
Code 33 -- Limit Circuit Fault AND high heat only is active
Code 34 -- Ignition Fault
Code 41 -- Blower Motor Fault (cooling mode only) (ventilator, humidifier, dehumidifier, outdoor unit will be turned off)
Code 45 -- Control Circuitry Lockout
 
Outdoor Unit
Code 25 -- Invalid model plug
Code 32 -- Low Pressure Switch Open
Code 45 -- Control Failure
Code 47 -- No 230V at unit
Code 48 -- Loss of inverter communications
Code 53 -- Outdoor Air Temp Sensor Fault
Code 56 -- Temp sensor out of range
Code 69 -- Inverter internal fault
Code 73 -- Contactor shorted
Code 74 -- No high voltage at compressor
Code 76 -- Low stage didn’t start three times
Code 78 -- High stage didn’t start three times
Code 81 -- Thermal lockout in low stage -- 4 hrs.
Code 82 -- Thermal lockout in high stage -- 4 hrs.
Code 83 -- Low Pressure Lockout -- 4 hrs.
Code 84 -- High Pressure Lockout -- 4 hrs.
Code 85 -- Low contactor open
Code 86 -- Low contactor shorted
Code 87 -- High contactor open
Code 88 -- Inverter Temp Lockout or High Contactor Shorted
Code 96 -- VDC under voltage lockout
Code 97-- VDC over voltage lockout
Code 99 -- High torque lockout

User Interface
S Temp sensor failed, loss of communication with smart sensor, smart sensor fault. “NO SENSOR DATA” shown
S Indoor unit communication fault
S Outdoor unit communication fault
S Packaged product communication fault
S NIM communication fault
S SAM communication fault
S Possible Frozen Coil
S High Room Temp Alert, when 100_F exists for at least 10 minutes, and removed when less than or equal to 98_F exists
S Low Room Temp Alert, when 38_F exists for at least 10 minutes, and removed when greater than or equal to 40_F exists
S High Humidity Alert, when 80% Rh exists for 30 minutes, and removed when less than or equal to 78% Rh exists
 
Not sure if anyone else is running their dumper on embedded hardware, but I hacked together a frame dumper in C that works equally well with glibc or uClibc. Handles setting tty speed and disables line discipline, so stty isn't required. It's been a long while since I've done anything useful in C and ymmv, but it cross compiled and ran on my router using only a few k of mem and less than 0.01% cpu so maybe others will find it useful.
 
https://github.com/nebulous/infinitude/tree/master/sniff/cardump
 
Anyone can post a dump of changing various settings via SAM/web interface as well as documenting what settings were changed?
 
Nice work.  Next step is to cache replies and only post changes, loop, and be restricted to a particular device and/or register (could be done by modifying the output of scanalltables).  Then you should be ready to start mapping memory to values by, for example, looping reads on the thermostat and then walking over and changing the setpoint.

The output should be something like:
 
From: 4201
To: 2001
Command: ACK
Address: 000405
DATA: 00-00-07-01-68-01-D5-0B-14
ASCII: h
DATA CHANGED
Data Byte 5: 02 -> 01
Data Byte 6: 7E -> D5
Data Byte 8: 18 -> 14
 
I had that in my old code, but have not implemented it in the new code.  I needed to get the scanning functions working, since many of the parameters will not show up on the bus - the temp setpoint, for example, never shows up on the bus because no one besides the stat "needs to know".  Now that the scanning is working, you can put that in the loop to request it and see what changes.  The issue is a full scan on all devices takes a long time.  You'd need to narrow it down to a device or table for the scanning to be fast enough to be useful.  However, that shouldn't be difficult as the tables have names that help with that.  I haven't posted my logs yet, I want to do a full ASCII conversion of all tables and look for private data (installer info, serial no, etc) and provide a mechanism to anonymize it.
 
I believe serial # is in 0104 (description, s/w version, model name, model code, serial#) and installer data is in the eeconfig somewhere.  The thermostat may store copies of the other equipment serials in the eeprom as well.
 
nebulous said:
Not sure if anyone else is running their dumper on embedded hardware, but I hacked together a frame dumper in C that works equally well with glibc or uClibc. Handles setting tty speed and disables line discipline, so stty isn't required. It's been a long while since I've done anything useful in C and ymmv, but it cross compiled and ran on my router using only a few k of mem and less than 0.01% cpu so maybe others will find it useful.
 
https://github.com/nebulous/infinitude/tree/master/sniff/cardump
Click to expand...
 
can you post a shorter capture when you are actively using the web interface?  assuming it is 1F01 then it was never active during the full day capture you posted, only in the startup.
 
Gotta keep you guys on track after 4 years...
 
Thermostats (and maybe smart sensors) use a Sensiron SHT10 temperature/humidity sensor.
 
Thermostat Data to Identify:
  • Indoor Temps (per zone)
  • Indoor Humidity (not sure if this is only at the main thermostat or an average)
  • Outdoor Temp (comes from OAS/ODU?)
  • Mode (heat,cool,off)
  • AC Status
  • Fan Status
  • Heat Status
  • Accessory Status
  • Fan Setting
  • Setpoints (heat/cool) per zone per period (wake,day,evening,sleep)
  • Period Times (wake,day,evening,sleep) per day,weekdays,weekends,alldays
  • Humidity Settings (heat,cool)
  • Fresh Air Settings (heat,cool)
  • Vacation Status/Settings
  • Unoccupied Status/Settings
  • Hold Status
  • Zone Names
  • Reminder Status/Settings (filter,humidifier,uv,ventilator)
  • Auto Changeover Settings (enable,time,deadband)
  • Sensor Offsets
  • Program Settings (enable,periods,fan,smart recovery)
  • Location Settings (temp units,elevation)
  • Equipment Settings (IDU,ODU,accessory,zone)
IDU Data to Identify:
  • Mode/Stage
  • Airflow
  • RPM (blower,inducer)
  • Static Pressure
  • Lockout Timer
  • Errors
ODU Data to Identify:
  • Mode/Stage
  • Airflow
  • Coil Temp
  • Defrost
  • RPM
  • Static Pressure
  • Outdoor Temperature?
  • Line Voltage
  • Errors
Damper Control Data to Identify:
  • Damper Positions
  • Temperatures (room sensor, leaving air, heat pump)
NIM Data to Identify:
  • Legacy Outputs Status
  • Ventilator Status
 
can you post a shorter capture when you are actively using the web interface?  assuming it is 1F01 then it was never active during the full day capture you posted, only in the startup.
Click to expand...
 
I'll need to update a few things in the webservice before I can actively check that, but I'm skeptical due to the way it works. A log from lleo above with the older ethernet SAM would probably be most helpful there. The Infinity Touch thermostat polls a webservice to get any changes from the network, then issues them on the serial bus. So I fully expect (though I've yet to verify) that any remote changes won't be any different than just making changes on the thermostat itself. 
 
Where there is useful info however is in the comparison of the two networks' data. Since the stat sends its configuration to the webservice, we have access to known-values that can then plausibly be found on the bus. I haven't had as much time as I'd like to work on this over the last few weeks, but I thought I should be able to find outdoor temperature values coming from 50->20 over the course of the day.
 
Ah I see well I guess if the WiFi module is integrated into the thermostat instead of just physically co-located then they wouldn't talk to each other over the bus.  Doesn't really explain the 1F duplicate commands on startup. 
 
For the ODU there is 000304 which has a single byte vary from 20 to AF.  Then the first two bytes of 003E01 vary from 031F to 04B0 which is equivalent to 799 to 1200 aka 79.9 to 120.0 coil temperature perhaps.  The next two bytes also vary in that range and are usually close in value.  Perhaps some other temperature sensor in another part of the unit.
 
I ordered the usb-rs485 dongle and is on its way. I am also out of town until end of this week, but will start to make some logs shortly.
 
Update: Got home but the RS485 adapter hasn't arrived yet. Snailmail from China takes time it seems...
 
You must log in or register to reply here.

Similar threads

StarTrekDoors
PC Access 3.17.0.843 Update Release Notes
Replies
0
Views
4K
StarTrekDoors
StarTrekDoors
pete_c
Food, Feet and Farts
Replies
7
Views
677
wkearney99
wkearney99
pete_c
Who / What done it? Why?
2
Replies
26
Views
14K
pete_c
pete_c
pete_c
What if the Internet stopped working for a day?
Replies
2
Views
1K
pete_c
pete_c
C
HAI Omnipro2 and Somfy RS485 Transmitter -Solved
Replies
1
Views
2K
BirdingPix
BirdingPix
Back
Top