Simple LIN bus record/replay
laserir opened this issue · comments
Hi there,
very advanced hard- and software indeed! Very impressed!
I have a Truma Contol 4 Heater and Truma A/C operating with the Truma iNet Box and intend to switch the iNet Box for a custom solution, but much more basic.
First question: Have you already successfully reverse engineered the LIN protocol messages for control the Truma heater/A/Cs?
Second question: Which possibilities do you see/suggest to do the a simple record/playback solution? (Record the message e.g. sent when Heater is set on to xx °C etc. and simply playback to achieve exactly this operation.) With this I could save some hardcoded messages/presets. Is there some kind of shield or module (perhaps a RS485 or CAN bus module?) I could use to sniff the LIN bus and replay on this? Is the iNet box a Master and does is supply the power to the bus?
Thanks a lot in advance!
We had some logging, manly are 5 Frames, and you have repeat them for kepp alaive.
CP Plus is LIN Master
https://docs.google.com/spreadsheets/d/16nw7vJGL2m406Nb3y3_9kxW-dGib02PLaZ2sJC5xSz4/edit?usp=sharing
A simple Saleae Logic Analyzer (Clone also do) will do the Job for logging
Thanks for the document! So I see the communication Heater<->Panel is on the bus. I was aiming for the iNet<->CPPlus connection. As I understand heater and a/c are connected to the CPPlus and there is a single connection to the iNet box, so I could feed commands into the system and keep the CPPlus panel. Any ideas?
EDIT: According to this (https://serviceblog.truma.com/de/2020/06/29/truma-inetbox-was-ihr-schon-immer-wissen-wolltet/#comment-107006) TIN1 is the bus where CPPlus is Master; devices on that bus (heater and A/C) will (and must) be found by the CPPlus to be usable in the app.
TIN2 is a bus only handled by the iNet-box (search devices via app, not CPPlus).
So my focus will be to be the client (which the iNet box probably is) in the TIN1 bus.
So... I got myself this —> https://www.microchip.com/developmenttools/ProductDetails/APGDT001
Do you know which line goes where on the TIN plug?
Vbat is from the 12V of the caravan I guess?
If any useful... attached the conversion of the room temperature sensor (PID 61).
https://docs.google.com/spreadsheets/d/1c9_FCGcBeeDjsJtaojFys3Nlx2V27TBXtvGYYBC2gCw/edit?usp=sharing
The analyzer just arrived, let's see where the journey takes us.
Also if useful... here some analyses with all devices connected (CPPlus + Heater + A/C + iNet Box) and without iNet Box, A/C respectively...
https://docs.google.com/document/d/1cXJOo0R7dj7mbHKq1hL0edU1fNbdmElGy7ql1EkBc-k/edit?usp=sharing
Seems as iNet Box does its magic with PID "D8" and A/C with PID "97".
"7D" fails if either device is disconnected.
Also I'm curious about the massive "3C" bursts (marked in blue). Maybe some auto-discover about the lost devices?
could you, for the record, tell how you connected everything? The 'Microchip LIN Serial Analyzer Development Kit' to the cpplus? which port? Tempted to do the same. I was first thinking to control over sms automated, but the lin protocol would be nicer indeed.
…
The CPPlus is the TIN1 bus Master, iNet Box (TIN1 Ports) and devices acting as slaves.
On the TIN2 port, a separate Bus, the inet Box is Master. You should focus on the TIN1, as TIN2 is only used for in-app control.
Do not connect the CPPlus to TIN2, that would be 2 masters!
As it is a bus system, it doesn’t matter where on the bus you connect. Meaning you could connect to the TIN1 ports on the CPPlus or iNet box or even use a coupler like this:
The connection is done via RJ12 cable:
1 -
2 -
3 LIN
4 -
5 GND
6 -
Last connection is VBatt, meaning the 12V+ of the car battery.
CPPlus or iNet box or even use a coupler like this:
The connection is done via RJ12 cable:
1 -
2 -
3 LIN
4 -
5 GND
6 -Last connection is VBatt, meaning the 12V+ of the car battery.
We have also a Telegram Group for Truma Revere Engineering, if interestet, give me a note on Telegram @RFguy2
Hello all,
I have been searching for a integration for Truma and home assistant ( open source home automation software)
Is this possible?
I'm do not code or a software engineer.
Looking for help, and willing to compensate
Thank you
John.
Hello all,
I have been searching for a integration for Truma and home assistant ( open source home automation software)
Is this possible?
I'm do not code or a software engineer.
Looking for help, and willing to compensate
Thank you
John.
Hi John, I realised it with Openhab 3. But I am sure that it will work also with Home Assistant which I use for reading my smart shunt. The only thing you need is a relay with a NO NC and a resistor with 10 kOhm. You just open one wire of your temperature measurement and now you can fake low temperature. So you can control your Truma heating via Home Assistant. To get an idea about this solution visit my blog under https://schleeh.de By the way I can not code either.
Yes, I am familiar with the thermostat hack.
I was hoping to get more ability like controlling the hot water , or the blower fan as well.
The only way I can think of is to read and write the hex code and talk to it Via the LIN can bus.
@morawekj I've update for the spreadsheet in "Frame Decoding 4.1". ID 22 D0 is the battery voltage in 1/10 Volt. Bit 0x20 of D1 is raised, when shore power is connected.
When sending data via id 7d (3d) to LIN master, the frames D6 and D7 seems to be a checksum in the data field. Have someone noticed this already?
Here are two switch off commands, which are almost the same. Only D6 and D7 of "03 22" is different, but the have both the same checksum FC again.
LIN READ 3C 3C 03 21 00 00 22 FF FF FF B9
LIN READ 7D 3D 03 10 29 FA 00 1F 00 1E 8B
LIN READ 7D 3D 03 21 00 00 22 FF FF FF B9
LIN READ 7D 3D 03 22 54 01 0C 32 0A 40 FC
LIN READ 7D 3D 03 23 00 00 00 00 08 07 CA
LIN READ 7D 3D 03 24 00 00 08 07 02 02 C5
LIN READ 7D 3D 03 25 00 00 00 00 00 00 D7
LIN READ 7D 3D 03 26 00 00 00 00 00 00 D6
LIN READ 20 20 AA AA AA 00 12 02 E0 0F DB
LIN READ 61 21 D6 9B BB 28 12 02 F0 0F 34
LIN READ 3C 3C 03 21 00 00 22 FF FF FF B9
LIN READ 7D 3D 03 10 29 FA 00 1F 00 1E 8B
LIN READ 7D 3D 03 21 00 00 22 FF FF FF B9
LIN READ 7D 3D 03 22 54 01 0C 32 0D 3D FC
LIN READ 7D 3D 03 23 00 00 00 00 08 07 CA
LIN READ 7D 3D 03 24 00 00 08 07 02 02 C5
LIN READ 7D 3D 03 25 00 00 00 00 00 00 D7
LIN READ 7D 3D 03 26 00 00 00 00 00 00 D6
LIN READ 20 20 AA AA AA 00 12 02 E0 0F DB
Changing D6 or/and D7 to something random and the CP Plus will ignore the command, even if the frame checksum is valid.
The second checksum is calculated just the same as the LIN bus checksum, but over all bytes in the LIN Transport Layer message (starting with 54 01). The checksum byte itself must be set to 00 or be ignored for the checksum calculation.
Edit: I have not yet figured out what the first byte is for, but given your examples it does not seem to be a checksum over the content.
The first checksum is a random number probably to identify the message. Each 0C 32 message will be confirmed by a 02 0D message later on repeating the same random number.
I had already found out about the checksum in D7. Controlling the heating via the lin bus now works very well. If you look at the logs in the folder trumalogs and pay attention to the timestamp, the byte D6 seems to be a counter that is incremented by one with each command. Thanks for the info with the "02 0D" command. I hadn't noticed the D6 byte there.
Thanks for the update, @schwinn!
I have published a working inetbox emulation here: https://github.com/danielfett/inetbox.py
I also concluded that D6 must be a counter and implemented it that way.
If you like, feel free to contribute!
Thanks for the link @danielfett
Your implementation looks awesome. I do the LIN communication with a teensy 3.2 microcontroller, which acts as a gateway to the NMEA2000 CAN bus and my 3C/3D transport protocol code is a way more basic.
Hi all,
I'm currently trying to figure out the right command set for a Dometic Freshwell 3000 unit.
I thought it would use the same subset of commands as the Dometic Freshjet series.
However, when I send a command with ID 17 using the APGDT001 tool, it seems that the packet gets corrupted during transfer.
Any other command does transmit fine over the bus. (confirmed with Saleae logic analyzer)
Does anyone have experience with communicating with a Freshwell 3000?
Thanks in advance!
Thierry
Thanks @laserir for your posts - give me hope in buying hw for doing something similar on Alde heating systems. Unfortunately in my case I cannot use the iNet box or emulation as my Alde won't support it. However it support an external panel communicating most probably over a LIN bus connection.
Based on your input I'll probably go ahead and purchase also the same analyser https://www.microchip.com/en-us/development-tool/APGDT001
Hi everyone,
I am looking for help to find an error (apparently in the communication between a camper unit and the CP Plus I-NET - Combi Control - TWIN PORT).
Problem: Many of these campervans have reported that when setting the e.g. temperature via the camper unit (which communicates through the secondary TIN connector) the Truma periodically, however, randomly shuts off. This is without giving an error code. The Truma lets itself restart as if nothing has happened. While this is a problem, when e.g. you rely on constant temperature/heating e.g. in winter, a workaround is to unplug the RJ connector to the Camper Unit and the Truma does run without problems.
Hence, the problem seems to be some sort of signal/output from the camperunit at any given point to the Truma.
I want to (kind of man-in-the-middle style) monitor all communication that is sent to the Truma from the CU.
Any chance you could guide me in the right direction? E.g. Lin Analyser?
Thanks and regards
Robin
We had some logging, manly are 5 Frames, and you have repeat them for kepp alaive.
CP Plus is LIN Master
https://docs.google.com/spreadsheets/d/16nw7vJGL2m406Nb3y3_9kxW-dGib02PLaZ2sJC5xSz4/edit?usp=sharing
Is this the latest version or is there some new data available somewhere else?
I don't have a CP-Plus and I'd like to implement something like
https://github.com/Harry-58/Truma_CP-_Simulator
(actually I already adapted it to an ESP32 I had lying around and I'm waiting for the lin to uart converter to arrive).
Hi guys, I have a problem - maybe you can help me to solve.
I left my caravan far away from me, and for some reason Truma application has reset and I can not establish GSM connection with iNet box without bluetooth connection. I can of course send messages from SMS dialog window. Problem is that I need to switch on heating to 5 degrees. In message history I only have message with 22.0 degrees. When I do "copy/paste" with changing 22.0 to 5.0 iNet responds with my original message (like forward). Does not change heating parameters. I think problem is with checksums or somewhere in HEX numbers I do not finally understand.
Message which works fine:
Dear iNet Box, switch on the Alde system, set temp. 22.0C, hot water OFF, ACC OFF with electr. 3kW and gas OFF. Thanks & Regards, XXX 0x3c9a092391
How to modify to 5.0C?
Thanks in advance ;)
Hi everyone,
I am looking for help to find an error (apparently in the communication between a camper unit and the CP Plus I-NET - Combi Control - TWIN PORT).
Problem: Many of these campervans have reported that when setting the e.g. temperature via the camper unit (which communicates through the secondary TIN connector) the Truma periodically, however, randomly shuts off. This is without giving an error code. The Truma lets itself restart as if nothing has happened. While this is a problem, when e.g. you rely on constant temperature/heating e.g. in winter, a workaround is to unplug the RJ connector to the Camper Unit and the Truma does run without problems.
Hence, the problem seems to be some sort of signal/output from the camperunit at any given point to the Truma. I want to (kind of man-in-the-middle style) monitor all communication that is sent to the Truma from the CU.
Any chance you could guide me in the right direction? E.g. Lin Analyser?
Thanks and regards Robin
Did you find a solution?