Trying to decode my ducted Daikin unit

[yiannosi]

Hi,

I have been collecting packets from my Daikin ducted AC unit and trying to decode them for a couple of months now.
Based on documentation provided here and else where I have managed to extract the current state of the unit from packets
0010 and 0011

00 00 11 00 00 00 00 00 12 E2 00 00 00 D8
40 00 11 00 00 00 00 00 12 B4 00 00 00 00 11 0C 97
00 00 10 00 61 01 17 00 11 00 02 00 00 00 00 00 80 40 00 00 00 00 00 87
40 00 10 00 00 61 01 17 00 11 00 3A 00 00 00 00 00 80 00 00 00 00 80 E1

For the above I have managed to get the Power State On/Off and Mode of operation and the set temperature.
My problem now is that I couldn't find a way to send commands to the unit.!

Below is the traffic when the power button is pressed and the unit is switched on
I have filtered out all 0010 and 0011 packets for clarity.

00 0A 20 04 C3
00 0B 20 04 92
00 0C 20 04 96
00 00 1F 31
40 00 1F 00 F2 0B D4 0C 0F FF 10 00 00 00 00 00 00 00 00 01 00 00 80 E3
80 00 18 01 00 00 00 00 00 00 4B
00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
00 0D 20 04 C7
00 0E 20 04 34
00 0F 20 04 65
00 00 1F 31
40 00 1F 00 F2 0B D4 0C 0F FF 10 00 00 00 00 00 00 00 00 01 00 00 80 E3
80 00 18 01 00 00 00 00 00 00 4B
00 10 20 04 86
80 80 00 12
00 00 20 04 3C
40 00 20 01 23 B0 00 20 10 20 10 24 01 21 40 2C C2 50 0D 80 14 06 50 5B
00 00 1F 31
40 00 1F 00 F2 0B D4 0C 0F FF 10 00 00 00 00 00 00 00 00 01 00 00 80 E3
80 00 18 01 00 00 00 00 00 00 4B
00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
00 01 20 04 6D
00 02 20 04 9E
00 03 20 04 CF
00 00 1F 31
40 00 1F 00 DC 0B C0 0C 0F FF 10 00 00 00 00 00 00 00 00 01 00 00 80 02
80 00 18 01 00 00 00 00 00 00 4B
00 04 20 04 CB
00 05 20 04 9A
00 06 20 04 69
00 00 1F 31
40 00 1F 00 DC 0B C0 0C 0F FF 10 00 00 00 00 00 00 00 00 01 00 00 80 02
80 00 18 01 00 00 00 00 00 00 4B
00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
00 07 20 04 38
00 08 20 04 61
00 09 20 04 30
00 00 1F 31
40 00 1F 00 DC 0B C0 0C 0F FF 10 00 00 00 00 00 00 00 00 01 00 00 80 02
80 00 18 01 00 00 00 00 00 00 4B
00 0A 20 04 C3

And here is the traffic when the unit is turned back to Off

80 00 18 01 00 00 00 00 00 00 4B
00 0A 20 04 C3
00 0B 20 04 92
00 0C 20 04 96
00 00 1F 31
40 00 1F 0C C8 0B 30 0C 10 FF 10 00 00 00 00 00 13 00 00 01 00 00 80 C2
80 00 18 00 00 00 00 00 00 00 8A
00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
00 0D 20 04 C7
00 0E 20 04 34
00 0F 20 04 65
00 00 1F 31
40 00 1F 0C C8 0B 30 0C 10 FF 10 00 00 00 00 00 13 00 00 01 00 00 80 C2
80 00 18 00 00 00 00 00 00 00 8A
00 10 20 04 86
80 80 00 12
00 00 20 04 3C
40 00 20 01 23 B0 00 20 10 20 10 24 01 21 40 2C C2 50 0D 80 14 06 50 5B
00 00 1F 31
40 00 1F 0C C8 0B 30 0C 10 FF 10 00 00 00 00 00 13 00 00 01 00 00 80 C2
80 00 18 00 00 00 00 00 00 00 8A
00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
00 01 20 04 6D
00 02 20 04 9E
00 03 20 04 CF
00 00 1F 31
40 00 1F 00 C8 0B B4 0B 11 FF 11 00 00 00 00 00 13 00 00 01 00 00 80 0A
80 00 18 00 00 00 00 00 00 00 8A
00 04 20 04 CB
00 05 20 04 9A
00 06 20 04 69
00 00 1F 31
40 00 1F 00 C8 0B B4 0B 11 FF 11 00 00 00 00 00 13 00 00 01 00 00 80 0A
80 00 18 00 00 00 00 00 00 00 8A
00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
00 07 20 04 38
00 08 20 04 61
00 09 20 04 30
00 00 1F 31
40 00 1F 00 C8 0B B4 0B 11 FF 11 00 00 00 00 00 13 00 00 01 00 00 80 0A
80 00 18 00 00 00 00 00 00 00 8A
00 0A 20 04 C3
00 0B 20 04 92
00 0C 20 04 96
00 00 1F 31
40 00 1F 00 DC 0B 24 0B 11 FF 11 00 00 00 00 00 00 00 00 01 00 00 80 C7
80 00 18 00 00 00 00 00 00 00 8A
00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
00 0D 20 04 C7
00 0E 20 04 34

I understand that the 00 F0 30 packets that are left unanswered are calls for an external controller.

Not sure what the 00 1F 31 and its reply is about.

Could you please have a look and see if you can guess where the power on/off command is?
Once this is spotted I might then be able to find the temperature and mode settings..

Thanks so much for you help!

[Arnold-n]

The main controller sends 00 00 10 AA BB CC DD EE ... packets, where AA=on/of, CC=target mode, DD=actual mode, EE=target temperature. It is not yet known what the contents of the 00 00 1F packets is.

[yiannosi]

Thanks for your speedy reply!
Do you mean that we already know what 00 00 1F does?
If yes, where is this info?

The main question is how do I turn the unit on/off !!
Do you mean that the unit can be turned On/OFF with the 00 00 10 packet? I thought that was just read only..

[Arnold-n]

No, sorry, we do not know what 00 00 1F does (typo now corrected).

To turn the unit on you need to have an auxiliary controller, that's what the role of the ATmega.

[yiannosi]

To turn the unit on you need to have an auxiliary controller, that's what the role of the ATmega.

Yes I understand that we need an auxiliary controller which talks to the main controller.
But how would an auxiliary controller turn the unit on? What packet should it send?
or you mean the aux controller could just send something like:

40 0F 10 AA BB CC DD EE ... packets, where AA=on/of, CC=target mode, DD=actual mode, etc ??

[Arnold-n]

It works differently, 40 00 10 is the reply from the indoor unit. The protocol is partly documented in doc/LogicalFormat (the 3X packets) and implemented in P1P2Monitor.

[yiannosi]

You mean like packets 00 00 30 and 00 00 38 as listed here ?

I haven't seen any if these packets in the traffic i recorded!
I suppose you just try sending and see if they work?

[Arnold-n]

Indeed, if you reply to 00 00 30 you'll later see 00 00 38 to which you can reply.

[yiannosi]

Indeed, if you reply to 00 00 30 you'll later see 00 00 38 to which you can reply.

Will give a try tomorrow. See if packet 38 works for my model too..

[yiannosi]

Good morning!

Firstly, I really hope you don't mind me asking all these questions :)

So, I did try the above as follows

Received: 00 F0 30 00 23 B0 00 20 10 20 10 01 21 00 2C C2 50 0D 00 14 06 50 02 8A
Sent    : 40 F0 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68

Then I also tried sending a reply with empty payload like this :
40 F0 30 6D

But in both cases however there was response with another 3x packet.

Am I doing anything wrong here?