Go Down

Topic: Decrypting the Vado Identity wired shower controller (Read 4152 times) previous topic - next topic

Riva

Using the same code I get the attached.
That's strange, when TEST is low the MAX chip should be in receive mode and the pullup resistor should hold the A line high (on my image it is low but this is probably the logic probe pulling it down) and the pulldown holds the B line low. On your trace A is behaving as expected but B is remaining high.

I used a module that looks like yours but I don't have it with me to check the exact model and MAX chip used.
I'm at work and just happen to have a MAX485 chip (not module) to hand to connected it to using the same scheme and get the same results.

Maybe you should try another MAX485 module/chip.
Don't PM me for help as I will ignore it.

Monkey3

I've tried a second and third module and it's exactly the same (see attached) - although all the modules came in the same pack so that may be saying too much.

The chip is  MAX485 ESA +18DN if that makes any difference.

When I look at your image versus mine, they look exactly the same but the mirror image.
With the exception that the test channel is not the mirror image.

I really don't know what that means.


I'm looking to see if there's another, different module I can get quickly and cheaply for comparison...

Riva

AFAIK the 3 characters after MAX485 denote the package type. ESA is 8 pin SO package.
When your testing you only have them connected to the logic analyser?
The Amazon link you posted has a schematic image so maybe check module matches schematic with a continuity meter
Maybe the whole packet of MAX485 modules are faulty or poorly designed/built or it could just be your logic device pulls the lines high when they are floating and mine pulls them low.
Don't PM me for help as I will ignore it.

Monkey3

AFAIK the 3 characters after MAX485 denote the package type. ESA is 8 pin SO package.
When your testing you only have them connected to the logic analyser?
The Amazon link you posted has a schematic image so maybe check module matches schematic with a continuity meter
Maybe the whole packet of MAX485 modules are faulty or poorly designed/built or it could just be your logic device pulls the lines high when they are floating and mine pulls them low.

When testing, I've tried a couple of different combinations and they all give the same result.

CHANNELCONNECTEDSIGNAL AT IDLE
Aarduino and logic analyserhigh
Aarduino, controller and logic analyserhigh
Amixer and logic analyserlow
Amixer, controller and logic analyserlow


So I've ordered another, very different rs485 (https://www.amazon.co.uk/gp/product/B07B667STP) which should be turning up tomorrow so, with any luck, this will resolve the issue.

Monkey3

OK, I think this is good news.


The new module doesn't have DE / RE pins, rather it relies on the TX to tell it when to switch to send / receive mode.

It does seem to properly switch back to idle though. :D

ALSO...
After some head bashing / panicking it would appear that actually the controller is working at 9600 baud with an ODD parity bit and I'm now able to immediately add a UART decoder with no frame errors!!!

It does mean that I now need to go back and re-analyse the mixer / controller traffic but that should be fairly easy.

Watch this space...

Riva

Glad you have one problem sorted and found the next hurdle to jump.
Just to put the old RS485 modules problem to bed how was you connecting them up?
 
Don't PM me for help as I will ignore it.

Monkey3

Glad you have one problem sorted and found the next hurdle to jump.
Just to put the old RS485 modules problem to bed how was you connecting them up?
 
For the old modules I connected them the same way described here.

Essentially:

ArduinoRS 485
TXDI
RXRO
3 (Direction Control)DE / RE
GNDGND
5VVCC


I don't know whether I got a bad batch or what but I must've re-wired the circuit about 50 times to make sure it was together correctly.
So gawd knows.

Monkey3

Ok, so with the new RS 485 module, I'm wired back in to try to work out the sequences again and here goes...

Any lines followed by "x n" means that the lines above (until the previos blank line) are repeated n times
"x ..." means the lines are repeated an unknown number of times or indefinitely

Just the mixer connected
Code: [Select]

00 00 00 00 00 00 00
x ...


Connect the controller
This just shows the handshake and then the mixer's start up sequence
Code: [Select]

00 00 00 00 00 00 00  00 00 00 00 00 02 00

00 00 00 00 00 00 41  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00
00 00 00 00 00 00 41  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00
00 00 00 00 00 00 41  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00

00 00 00 00 00 00 1D  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00
x 55

00 00 00 00 00 00 1D  33 F2 02 36 07 02 00
00 00 00 00 00 00 B1  33 F2 02 36 07 02 00
x ...


Turn shower on
Code: [Select]

00 00 00 00 00 00 B1
00 00 00 00 00 00 B1
00 00 00 00 00 00 B1
//MESS
00 00 00 00 00 00 B1  32 F2 01 36 07 02 00
00 00 00 00 00 00 1D  32 F2 01 36 07 02 00

00 00 00 00 00 00 1D  32 F2 01 36 07 02 00
x ...


Turn shower off
Code: [Select]

00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
//MESS
00 00 00 00 00 00 1D  33 F2 02 36 07 02 00

00 00 00 00 00 00 1D  33 F2 02 36 07 02 00
00 00 00 00 00 00 B1  33 F2 02 36 07 02 00
x ...


Turn shower on then
Change to outlet 2

Code: [Select]

00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
MESS
00 00 00 00 00 00 1D  31 F2 01 36 07 01 00
x ...


Turn shower off
Code: [Select]

00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
MESS
00 00 00 00 00 00 1D  32 F2 02 36 07 01 00

00 00 00 00 00 00 1D  32 F2 02 36 07 01 00
00 00 00 00 00 00 B3  32 F2 02 36 07 01 00
x...

00 00 00 00 00 00 1D  32 F2 02 36 07 01 00
00 00 00 00 00 00 B1  32 F2 02 36 07 01 00
x...


Turn shower on then
Increase flow

Code: [Select]

//Min flow
00 00 00 00 00 00 1D  32 F2 01 36 05 02 00

//Low flow
00 00 00 00 00 00 1D  32 F2 01 36 06 02 00

//Med flow
00 00 00 00 00 00 1D  32 F2 01 36 07 02 00

//High flow
00 00 00 00 00 00 1D  32 F2 01 36 08 02 00

//Max flow
00 00 00 00 00 00 1D  32 F2 01 36 09 02 00

Monkey3

There was some unexpected behaviour from the mixer while all that testing was going on.
At some point I noticed that the last bit from the mixer started to rise.
I assume that this indicates the temperature that the water flowing through the mixer has reached but even after I turned the mixer off it continued to rise for a bit, possibly down to heat soak.

Mixer behaviour
Code: [Select]

...
00 00 00 00 00 00 23

00 00 00 00 00 00 24
x 5

00 00 00 00 00 00 25
x 7

00 00 00 00 00 00 26
x 17

00 00 00 00 00 00 27
x 11

00 00 00 00 00 00 28
x 18

00 00 00 00 00 00 29
x 6

00 00 00 00 00 00 2A
x 5

00 00 00 00 00 00 2B
x 6

00 00 00 00 00 00 2C
x 24

00 00 00 00 00 00 2D
x 11

00 00 00 00 00 00 2E
x 6

//turn off

00 00 00 00 00 00 B3
00 00 00 00 00 00 2E
x 3
00 00 00 00 00 00 B3
00 00 00 00 00 00 2F
x 4
00 00 00 00 00 00 B3
00 00 00 00 00 00 30


I'm going to test a bit further to see if the mixer's temp matches up to the temp from the controller...


Then, bizarrely, the controller's first bit changed as well. I'm yet to work out what the controller's first bit is for...

Controller strangeness
Code: [Select]

35 F2 02 36 09 02 00

Monkey3

ARRRRRGGGGGHHHHHH!!!!!!!
 >:(  >:(  >:(

It seems the new rs485 doesn't want to read all of the data.

the following code:

Code: [Select]
//Transmission config
long baudRate = 9600;
byte serialConfig = SERIAL_8O1;
//Transmission Details
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Timing
long unsigned lastCom = 0;
long unsigned curMicros = 0;
const unsigned long comPeriod = 55240; //should 55240 - 55280 - Arduino is not perfect at timing so 55240 seems to equate to roughly 55260
//Timing
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Message Length
const int MSG_LEN = 7;
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Outgoing message details
//Outgoing messages
const byte MSG_INTRO[MSG_LEN] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
//Outgoing register
byte message[MSG_LEN];
//Outgoing message details
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Controller message details
//Incoming register
byte receivedData[MSG_LEN];
int nCurByte = 0;
//Controller message details
/////////////////////////////////////////////////////////////////

void setup() {
  Serial.begin(baudRate, serialConfig);
  Serial1.begin(baudRate, serialConfig);

  memcpy(message, MSG_INTRO, MSG_LEN);
}

void loop()
{
  SendData(message);

  if (ReadData()) {
    PrintData();
  }
}

void PrintData() {
  for(int i = 0; i < MSG_LEN; i++)
  {
    Serial.print(receivedData[i], HEX);
    Serial.print(" ");
  }
  Serial.println("");
}

void SendData(byte sendMsg[]) {
  curMicros = micros();
  if ((curMicros > (lastCom + comPeriod)) || (curMicros < lastCom)) {
    lastCom = curMicros;
    Serial1.write(sendMsg, MSG_LEN);
  }
}

bool ReadData() {
  while (Serial1.available() > 0) {
    receivedData[nCurByte++] = Serial1.read();

    if (nCurByte >= MSG_LEN) {
      nCurByte = 0;
      return true;
    }
  }
  return false;
}


Prints:

Code: [Select]

...
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
7 2 F2 2 7 2 F2
2 7 2 F2 2 7 2
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
7 2 F2 2 7 2 F2
2 7 2 F2 2 7 2
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
7 2 F2 2 7 2 F2
...


It's definitely reading the incoming data as I'm expecting:
33 F2 02 36 07 02 00

And the logic analyser is picking up all the data.
It's looking like I'm going to need to use the old module to read the incoming data and the new module to write the data.
I've tried using ReadBytes but that just times out after about a second or something (whatever the default is).

I'm at a loss...

Monkey3

#40
Dec 07, 2018, 10:51 pm Last Edit: Dec 07, 2018, 10:58 pm by Monkey3
Minutes later, I'm no longer at a loss...

AND WE'RE OFF!!!!!!!!
 :D  :D  :D

It looks like it's using SERIAL_8N2.
Certainly, if I set the arduino to use that config then I can read all the data.
sigrok seems to think that the controller is using a zero parity type but we don't have that option in arduino. So at 8N2 sigrok shows loads of parity errors from the arduino but it works dagnabbit!

On starting up the arduino with my new code using SERIAL_8N2 the screen is no longer flickering and goes into standby mode.

And I'm now able to properly communicate!!!!

It's been a long time coming and we're not there yet but this is a massive step forward and for the first time I can talk back to the blasted controller. Now I just have to add in the logic but that's the easy bit.

Massive thanks to Riva for keeping me going.  ;)
^^^ Starting to sound like an awards ceremony :D

Here is the info I have managed to gather about what the controller is sending:

3rd byte - Power

Power3rd byte
ON01
OFF02
PAUSED03

4th byte - Requested Temperature

Temp (deg C)4th byte
2529
262A
272B
282C
292D
302E
312F
3230
3331
3432
3533
3634
3735
3836
3937
4038
4139
423A
433B
443C
453D
463E


5th byte - Flow Rate

Flow5th byte
MIN05
LOW06
MED07
HIGH08
MAX09

6th byte - Outlet

Outlet6th byte
Default02
Alternate01

Riva

I should have jumped forward to your last message first instead of working my way through them one at a time and then going of reading about the connection example of the RS485 modules and then trying to decode the protocol only to find you have already done it. LOL

Glad your getting consistent and predictable results now and look forward to you posting the project is finished and working as expected. Also glad to help though I don't feel I helped much apart from showing someone was listening.
I would like to investigate the old MAX485 modules in more detail as I feel the boards you bought are probably just the same as the rest of them that look the same (like mine) but maybe they have faulty MAX485 chips or some other issue.
Don't PM me for help as I will ignore it.

Monkey3

#42
Dec 08, 2018, 05:59 pm Last Edit: Dec 08, 2018, 06:00 pm by Monkey3
I should have jumped forward to your last message first instead of working my way through them one at a time and then going of reading about the connection example of the RS485 modules and then trying to decode the protocol only to find you have already done it. LOL

Glad your getting consistent and predictable results now and look forward to you posting the project is finished and working as expected. Also glad to help though I don't feel I helped much apart from showing someone was listening.
I would like to investigate the old MAX485 modules in more detail as I feel the boards you bought are probably just the same as the rest of them that look the same (like mine) but maybe they have faulty MAX485 chips or some other issue.

:D

Not going for the smoke blowing but even a little bit of assistance around where to look or advice about getting a logic analyser just meant that I moved that much faster. It probably stopped me from giving up altogether quite honestly.

I've been putting my code on github here: https://github.com/RucialK/vado-identity-shower-interface
It's not perfect but I'm definitely getting there. Needs a lot more refactoring and tidying up but I want to get it working with all the safety features and so on so and then refactor once it's working.

If you want to PM me your address I'll send you one of the rs 485 modules if you want to have a look. No pressure but definitely the least I can do. And I very much doubt I'll be using them. ;)

Riva

If you want to PM me your address I'll send you one of the rs 485 modules if you want to have a look. No pressure but definitely the least I can do. And I very much doubt I'll be using them. ;)
Thanks for the offer, I'm also in the UK and the cost of shipping will be way more than the item is worth.

A quick look at your github write-up and depending on what else your going to hang of the Mega I/O pins you might be okay with a Pro Micro. It is a lot smaller than the Mega and has native USB built in for serial debugging so the hardware UART could be used for the RS485. I use them for various DMX projects as like your project I needed Serial to the PC and hardware serial for RS485 (DMX is 250000 baud)
Don't PM me for help as I will ignore it.

Go Up