Individual Room Control ELV the MAX!

[jrkalf]

Zwave somehow will never get my full attention, perhaps it's the price, perhaps it's the range of it's products.

Nice to see that the MAX! is doing a nice job.
The max is now already fully implemented in your system, or are you using in to experiment with, without putting the actuators on the radiators

How does the MAX! system connect to your central heating system? Does it control it in any form, or doesn't it control it at all?

[Digit]

@blb
I had some spare time for doing something that wouldn't take too long
You know what, this:

Code: Select all

7QC7+gACAf9JRVEwMTEyMDE1AAsABEAAAAAAAAAAAP///////////////////////////wsABEAAAAAAAAAAQf///////////////////////////2h0dHA6Ly93d3cubWF4LXBvcnRhbC5lbHYuZGU6ODAvY3ViZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAENFVAAACgADAAAOEENFU1QAAwACAAAcIA==

....is Base64 encoded stuff. I've seen enough of that to recognize it right away.

Decode it and you'll find a url inside: http://www.max-portal.elv.de:80/cube

Another thing, the first byte in the decoded stuff seems to be the packet length byte. Maybe a bit premature to conclude already, otoh...

Well, maybe you knew this already but if not this may help you.

[Digit]

Regarding setting the temperature, the example of setting temperature to 5 degrees:

Code: Select all

AARAAAAAADoXAUo=

decodes to hex:

Code: Select all

00 04 40 00 00 00 00 3A 17 01 4A

Looking at the other examples you gave, the last byte seems to contain the temperature of which the last 4 bits are the number of 0.5 degree steps from 0.
So, the last byte value=4A, take the last 4 bits (nibble) = 0A which equals 10 decimal -> 10*0.5 = 5... bingo? I think so
I'm beginning to like this

[Bwired]

Haha, Digit and I ordered a set too

[blb]

Hi Digit,

That looks promising! I haven't looked with this knowledge to the results from my last tests yesterday, see attached file. I have now 2 thermostats active. In the Java application you can select to send a command to all or a selection of the thermostats. It's clear the application sends commands to each thermostat individually.

I have tried to send a couple of these command via telnet port 80 and I do get the same response from the Max! Gateway and, after closing down the telnet session and opening Java application interface (via browser), I see the command is executed. The Max! Gateway only accepts 1 connection. The good thing is the Java application closes the session to the MAX! Gateway when you close the browser, you can setup the telnet session direct afterwards.

My use case would be:
initial setup thermostats via JAVA application
setup standard week schedule via JAVA application (for each thermostat individual)
manual setting of each thermostat to - eco, comfort and fixed temperature via Homeseer, if possible with time limit (after which the thermostat returns to the default week program).

[Digit]

Hi lbl,

Thanks for the additional info, I'm sure it will be useful when my own set of MAX! hardware has arrived and the dissecting of the protocol can start.
I'll share my findings here.

[Bwired]

these are the command send to the valvues, but I think the valvues are sending stuff back like temperature etc.
Can you see those in your app too?

[blb]

Yes, the Thermostats are giving status info back (on request after command l:\r\n)

the response (in my case) is, after setting both Thermostats manual to 5 degrees:
CwA6FwASGQAKAAAACwA13QASGAAiAAAA

this can be decoded (base64) to:0B003A17001219000A0000000B0035DD0012180022000000

this can be split in 2 for the 2 Thermostats, my current understanding:

trailer address ?? temp and?? endtime
1: 0B00 3A17 00 1219000A 000000
2: 0B00 35DD 00 12180022 000000

[Digit]

Yes, the 3A17 and 35DD are probably the addresses, cause I saw something yesterday I haven't posted about yet, I will do that later this evening. The rest is a matter of logging a lot of frames and start comparing them all to find 'the logic' in it all. BTW are you sure both were set to 5 degrees? And do the thermostats also send status updates when not asked for? (which can take a while, minutes or even more).

[Digit]

This was the last thing I did yesterday:

Code: Select all

VgIBAQhCYWRrYW1lcgA6FwEBADoXSUVRMDEwOTYxOAhSYWRpYXRvcgEB

decodes to

Code: Select all

00000000h: 56 02 01 01 08 42 61 64 6B 61 6D 65 72 00 3A 17 ; V....Badkamer.:.
00000010h: 01 01 00 3A 17 49 45 51 30 31 30 39 36 31 38 08 ; ...:.IEQ0109618.
00000020h: 52 61 64 69 61 74 6F 72 01 01                   ; Radiator..

Here I think we see a location (Badkamer) and a description (Radiator) that belong to the thermostat I guess; and the bytes 3A 17 are mentioned twice also; these 2 bytes are also seen in other communication so these are a good candidate for the address.

[Digit]

Hi blb,

Could you please check if the 'max trials2.txt' is correct? Some of the longer lines are missing the \r\n at the end. I saw that when I got the feeling I was missing some parts...
For example, the line starting with A C:00bbfa,7QC7 seems to be truncated?

[blb]

Hi Digit,

I guess it was indeed truncated. I did copy it from wireshark which is not that easy with long messages. I have now copied the output after I initiate the telnet session:

Code: Select all

01 H:IEQ0112015,00bbfa,0102,00000000,45f5c6f1,25,32
02 M:00,01,VgICAQhCYWRrYW1lcgA6FwIPWm9sZGVyIG92ZXJsb29wADXdAgEAOhdJRVEwMTA5NjE4CEJhZGthbWVyAQEANd1JRVEwMTA4ODM2D1pvbGRlciBvdmVybG9vcAIB
03 C:00bbfa,7QC7+gACAf9JRVEwMTEyMDE1AAsABEAAAAAAAAAAAP///////////////////////////wsABEAAAAAAAAAAQf///////////////////////////2h0dHA6Ly93d3cubWF4LXBvcnRhbC5lbHYuZGU6ODAvY3ViZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAENFVAAACgADAAAOEENFU1QAAwACAAAcIA==
04 C:003a17,0gA6FwEBFP9JRVEwMTA5NjE4Kh49CQcYAzAD/wBAVFSRSORU/kEgQSBBIEUgRSBFIEUgRSBFIEBUVJFI5FT+QSBBIEEgRSBFIEUgRSBFIEUgQEhWbETkVRRBIEEgQSBFIEUgRSBFIEUgRSBASFRsRORVFEEgQSBBIEUgRSBFIEUgRSBFIEBIVGxE5FUUQSBBIEEgRSBFIEUgRSBFIEUgQEhUbETkVRRBIEEgQSBFIEUgRSBFIEUgRSBASFRsRORVFEEgQSBBIEUgRSBFIEUgRSBFIA==
05 C:0035dd,0gA13QECFP9JRVEwMTA4ODM2Kh49CQcYAzAM/wBESEUIRSBFIEUgRSBFIEUgRSBFIEUgRSBFIERIRQhFIEUgRSBFIEUgRSBFIEUgRSBFIEUgREhFCEUgRSBFIEUgRSBFIEUgRSBFIEUgRSBESEUIRSBFIEUgRSBFIEUgRSBFIEUgRSBFIERIRQhFIEUgRSBFIEUgRSBFIEUgRSBFIEUgREhFCEUgRSBFIEUgRSBFIEUgRSBFIEUgRSBESEUIRSBFIEUgRSBFIEUgRSBFIEUgRSBFIA==
06 L:CwA6FwASGgAKgYsACwA13QASGgAKgYsA



02 HEX 56020201084261646B616D6572003A17020F5A6F6C646572206F7665726C6F6F700035DD0201003A1749455130313039363138084261646B616D657201010035DD494551303130383833360F5A6F6C646572206F7665726C6F6F700201
02 ASC V[2][2][1][8]Badkamer[0]:[23][2][15]Zolder overloop[0]5[221][2][1][0]:[23]IEQ0109618[8]Badkamer[1][1][0]5[221]IEQ0108836[15]Zolder overloop[2][1]
03 HEX ED00BBFA000201FF49455130313132303135000B0004400000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0B0004400000000000000041FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF687474703A2F2F7777772E6D61782D706F7274616C2E656C762E64653A38302F6375626500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043455400000A000300000E10434553540003000200001C20
03 ASC [237][0][187][250][0][2][1][255]IEQ0112015[0][11][0][4]@[0][0][0][0][0][0][0][0][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][11][0][4]@[0][0][0][0][0][0][0]A[255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255][255]http://www.max-portal.elv.de:80/cube[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]CET[0][0][10][0][3][0][0][14][16]CEST[0][3][0][2][0][0][28] 
04 HEX D2003A17010114FF494551303130393631382A1E3D090718033003FF004054549148E454FE4120412041204520452045204520452045204054549148E454FE4120412041204520452045204520452045204048566C44E455144120412041204520452045204520452045204048546C44E455144120412041204520452045204520452045204048546C44E455144120412041204520452045204520452045204048546C44E455144120412041204520452045204520452045204048546C44E45514412041204120452045204520452045204520
04 ASC [210][0]:[23][1][1][20][255]IEQ0109618*[30]=[9][7][24][3]0[3][255][0]@TT[145]H[228]T[254]A A A E E E E E E @TT[145]H[228]T[254]A A A E E E E E E @HVlD[228]U[20]A A A E E E E E E @HTlD[228]U[20]A A A E E E E E E @HTlD[228]U[20]A A A E E E E E E @HTlD[228]U[20]A A A E E E E E E @HTlD[228]U[20]A A A E E E E E E 
05 HEX D20035DD010214FF494551303130383833362A1E3D09071803300CFF004448450845204520452045204520452045204520452045204520444845084520452045204520452045204520452045204520452044484508452045204520452045204520452045204520452045204448450845204520452045204520452045204520452045204520444845084520452045204520452045204520452045204520452044484508452045204520452045204520452045204520452045204448450845204520452045204520452045204520452045204520

I added line numbers in front and a hex and ascii conversion from it as well.

about addresses: on line 3, 4 and 5 the output starts with something which I believe is the address of the equipment. I think the 1st one (line 3) is the address of the Max gateway or a general system address, the other 2 (line 4 and 5) are the addresses of the 2 thermostats.

I have again done some investigation with wireshark (and a base64->Hex converter ) this evening (see attached file)

as already mentioned by you, the temperature is in steps of 0,5 degrees C.
I have trouble decoding the date when a particular end date (and time) for a command is set (after which the standard programs takes over again. I'm pretty confident I found the coding for the time and also for the temperature setting.

Temperature settings are always done with the temperature itself, not with "Comfort" or "Eco" I have "Comfort" set to 21 degrees; the command to the Max Gateway is exactly the same for : set to "Comfort" and set to 21 degrees.
the temperatures Eco and Comfort, but also other settings like boost setting and most important the week schedule can be programmed. I guess these setting are on one way or the other in the output after initiation of the session with the Max Gateway.

max trials3.zip

file with some decoding results (e.g. address, temperature, time)

(1009 Bytes) Downloaded 863 times

[Digit]

Thanks blb,

Making progress, great! Now with higher temperatures you see extra bits being used.
I think in total 6 bits are used, since 30 degrees = 60 steps -> 6 bits needed to store the value 60.
Yesterday I tried to find the dates and times but didn't have enough samples to see what was happening, now I see you've already found the hours.

I got a shipping notification this morning, so it shouldn't take too long (I hope) before I have my own hardware

[blb]

Digit,

About the temperature: you are right, the temp is in the last 6 bits. the first 2 are used to define with or without end time.
01: without end time (continue temp setting)
10: with end time (after which the default week program takes over again)

[Phaeton]

Do you guys use this with central heating? I dont have enough knowledge to find out if this is suitable for central heating.