Arduino Forum

Topics => Device Hacking => Topic started by: Monkey3 on Aug 18, 2018, 02:03 am

Title: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Aug 18, 2018, 02:03 am
Hi

So, I'm attempting to use a waterproof shower controller to control something other than the mixer it was intended for. I was looking to use a wireless controller (see here (https://forum.arduino.cc/index.php?topic=563999.0)) but that may be a little beyond this first attempt.

Instead I'm attempting to use a wired version instead.

So the controller I want to hack is the Vado Identity IDE-147A-C/P or now called the Vado SENSORI
Identity IDE-147C-C/P (https://www.vado.com/sensori-identity-2-outlet-shower-control?vid=5356).
So far I've passed a multi meter across all of the pins of the mixer to see what it's outputting and the attached is what I found.

Basically the controller is 5v DC and the power is on pins 3 (-ve) and 2 (+ve). I've connected 5v to it and, sure enough, it lights up and shows the default screen. It then displays E1 which is to be expected I guess as it's not connected to the mixer.

I'm thinking that pins 1 and 4 are likely to be tx / rx but I'm not sure which is which or what the next step would be to work that out.

I've tried to read digital values on pins 1 and 4 from the controller and they set to 1 as soon as I add power and stay there.
I've also tried reading analog on pins 1 and 4 from the controller and not much happens there either other than they both go to a particular voltage and stay there.

So the next step is going to be reading the same from the mixer to see if it shows up anything.
Then I'll start looking into serial reads from the mixer and try replaying that to controller to see what happens.

So, assuming it is serial then I need to work out which baud rate to use but I think that rather than attempt to work it out it may be quicker / easier to just try the standard rates and see if I can read anything.

I only have an uno at moment with a mega coming tomorrow so I'll hopefully be able to read from serial1 and write to the serial monitor then.

Nothing much to ask right now other than any advice on where to go next and I'll continue to update this thread with my findings...

Cheers,

Russell.
Title: Re: "hacking" the Vado Identity wired shower controller
Post by: Monkey3 on Aug 22, 2018, 11:26 pm
So, it turns out that pin 1 is the tx pin so I assume pin 4 is the rx.

Using this code:
Code: [Select]
long baudRate = 9600;
byte serialConfig = SERIAL_8N1;

const long cycle = 1000;

void setup() {
  Serial.begin(9600);
  Serial1.begin(baudRate, serialConfig);
}

void loop() {
  int inByte; 
  while (Serial1.available()) {
    inByte = Serial1.read();
    Serial.print(inByte, DEC);
  }
  Serial.println();
}


This was the output:
Code: [Select]
025525525525525525500
025525525525525525525200
01280128024025500
0255255150000
025525525525525525500
025525525525525525525400
25401280192128255255000
255311280000
0255255255255255630
025525525525525525525400
01281280251255255000
255600000
025525525525525570
025525525525525525525400
012822425525525524800
1500128000
02552552552553100
025525525525525525525400
0128025525525525525400
6000000
0255255255127000
025525525525525525525400
019225525525525525525400
25200128128224000
2552552557000
025525525525525525500
025525525525525525525200
012800128224255000
255255311280000
255255255255255255000
255255255255255255254000001281282552550
00255255630000
25500
2552552552552552550002552552552552552552550
000012819225525500
0255150000
00
2552552552552551500
25525525525525525525400012801282552552552400
03100000
00
25525525525531000
2552552552552552552550001281922552552552552520
0700000
02550255255255255140
002552552552552552552540
001282552552552552552540
0254000012800
025525525571280
002552552552552552550
001922552552552552552520
0128128012819225500
0255255310000
025525525525525525502550
025525525525525525525200
000128224255255025500
25525570000
025525525525525525500
255025525525525525525525400
01281280192255255000255
25515000000
255255255255255310
0255255255255255255255002540
012825525525512800
25519212800000
2552552552552551400
2552552552552552552550001281282552552552552480
2550254700000
002552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
25525525525525525502552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
2552552552552552550
25525525525525525502552552552552552550
2552552552552552550
...


and the line "25525525525525525502552552552552552550" repeats every 37 lines.

It looks to me as though the baud might be too slow for starters.
Secondly, it looks as though "2552552552552552550" might be a heartbeat of sorts with 0 being the termination character.
I also wonder if the data or stop bits are the wrong length as there is a line in there ending in 5 (assuming the 0 is the termination character) although I guess that could also be because of incorrect framing.

Any ideas on how to tailor the config?

Also, any ideas on how to interpret the data?
Title: Re: "hacking" the Vado Identity wired shower controller
Post by: Paul_KD7HB on Aug 23, 2018, 08:01 pm
Interpreting would be much easier if you printed in HEX! Then 3 digit numbers and 1 digit numbers would not be jammed together. Leave at least a space between what you are printing.

The 255 is obviously a x'FF.

Pau;
Title: Re: "hacking" the Vado Identity wired shower controller
Post by: Monkey3 on Aug 23, 2018, 11:07 pm
Interpreting would be much easier if you printed in HEX! Then 3 digit numbers and 1 digit numbers would not be jammed together. Leave at least a space between what you are printing.

The 255 is obviously a x'FF.

Pau;
Yeah, I found that really awkward as well so I've been working with HEX since. Will post more shortly.

So, firstly, some more information. I've opened the mixer to have a look at the components.
In the attachment you'll see 4 of them highlighted:


The data sheet for item 2 states:
Part NumberDuplexData Rate (Mbps)Rise/Fall Time (ns)Tx/Rx Skew (ns)Bus ESD (kV)Pin Count
ISL3152EHalf0.115110012/4±168

So I guess that confirms the baud rate, 115200 it is. Unless that's the max rate.
The other thing is that it states half-duplex... Err, that adds some complexity, doesn't it? or does it? or???

Is there anything else that the components could tell me about how to interpret the signal?
Title: Re: "hacking" the Vado Identity wired shower controller
Post by: Monkey3 on Aug 25, 2018, 01:09 pm
So, here's what I'm doing:


And here's the code:
Code: [Select]
long baudRate = 115200;
byte serialConfig = SERIAL_8N1;

const int lineLength = 100;
int curLength = 0;

void setup() {
  Serial.begin(baudRate);
  Serial1.begin(baudRate, serialConfig);
}

void loop() {
  int inByte; 
  while (Serial1.available()) {
    inByte = Serial1.read();
    Serial.print(inByte, HEX);
    Serial.print(" ");
   
    if (curLength++ > lineLength) {
      curLength = 0;
      Serial.println();
    }
  }
}


The arduino is connected to a laptop which is not connected to a power supply so how am I receiving any signal without a ground connected? Am I therefore just receiving interference?
And when I do connect the ground between the mixer and the arduino I get no output at all.

Is this a step backwards? How can I shield from interference and be sure I'm only getting a signal from the mixer?
Any help appreciated...

The output looked like this anyway:

Arduino turned on
Code: [Select]
0 0 FC 0 0 0 0 0 0 0 0 FC 0 E0 0 1C 0 0 0 0 FC 0 0 0 0 E0 0 0 1C 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 E0 0 FC 0 0 0 0 0 FC 0 0 0 3 3 0 0 0 FC 0 0 0 0 0 FC 0 0 0 0 FC C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 0 0 E0 1C 0 0 0 0 0 0 0 0
0 0 0 3 0 0 0 0 0 0 FC 3 0 8 0 0 0 1C 0 0 0 0 0 0 0 0 E0 0 0 0 F0 0 FC 0 0 F0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 70 FC 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 0 0 0 0 0 1E 0 0 0 0 0 1C 0 0 0 0 0 0 FC
0 0 FC 0 0 0 FC 0 0 FF 0 0 2 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 1C 0 0 0 0 0 0 FC 0 0 0 0 0 0 FC FC 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 1C 0 0 0 0 0 0 0 0 FC 0 0 E0 0 1F 0 0 0 0 0 0 0 FC 1C 0 0 0 0 0 0 0 FC 1C 0 0
0 0 0 0 0 0 0 0 0 C 0 FE 0 0 0 4 0 0 0 0 0 1C 0 0 0 0 0 FC 0 0 1C 0 0 0 0 0 0 0 0 0 0 1C 0 C 0 0 0 0 1C 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FC
C 0 0 1C 0 0 0 0 0 0 0 0 0 FC 0 0 0 FC 0 0 0 0 0 0 0 0 0 FC 0 0 0 FC 0 0 0 FC 0 0 0 0 0 0 0 0 0 E0 0 0 0 0 0 FC 0 1C 0 0 0 0 0 1C 0 1C 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 0 E0 1C 0 0 0 0 0 0 3E 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

Mixer turned on
Code: [Select]
FC 0 0 0 E0 4 E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FF FF F0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FF FC 0 0 0 0 0 0 0 FE 0 0 3 0 0 0 0 0 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0
F8 0 0 0 0 0 0 0 0 FE E0 C 0 0 0 0 0 F8 0 0 0 0 0 0 0 0 0 0 0 F0 F8 0 0 0 0 0 0 0 0 0 F8 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 FC 0 0 FC 0 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 0 FF E0 0 0 0 0
0 0 0 0 0 0 0 0 C0 0 0 0 0 0 0 0 0 0 0 0 0 FF FF F0 0 0 0 0 0 0 FF FF 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 FC F8 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 FC C0 0 0 0 0 0 0 FF FC 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 FE 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 FC F0 0 0 0 0 0 0 0 FE FC 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 0 0 0 FC C0 0 0 0 0 0 0 0 0 FC E0 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0 F8 FE 0 0 0 0 0 0
0 0 FC 0 1C 0 0 FC 0 0 FC FF 0 0 0 0 0 0 0 0 0 0 0 F8 F0 0 0 0 0 0 0 0 0 0 FF F8 E4 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 F8 0 0 0 0 0 0 0 0 0 FC C0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FF 0 FF E0 0 0 0 0 0 0 0 0 0 0 FF FF F8 0 0 0 0 0
0 0 0 0 0 0 0 FE 0 0 0 7 0 0 0 0 0 0 0 0 0 F0 F8 C 0 0 0 0 0 FE FF 0 FC 0 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0 0 FF F0 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 F8 0 0 0 0 0 0
0 0 0 0 0 0 FE FC C0 38 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 FF E0 0 0 0 0 0 0 0 FF F8 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0 FC F8 0 0 0 0 0 0 0 0 FE FF F8 FC 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0 FC F8 0 0 0 0
0 0 0 0 FF FC 86 0 0 0 0 7 0 0 0 0 0 0 0 0 0 0 0 0 F0 FC 0 0 0 0 0 0 0 0 C0 0 0 0 0 0 0 0 0 0 0 0 0 0 FF 0 0 F0 E0 0 0 0 0 0 0 0 0 0 FC F8 C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 F0 0 0 0 0 0 0 0 0 0 0 FF FC F8 0 0 0 0 0 0 0 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 3 0 0 FC F8 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FC FE F8 0 0 0 0 0 0 FE 0 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0 0 F0 1C
0 0 0 0 0 0 FE FE 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FF E0 0 0 0 0 0 0 0 F8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 F8 FC 0 0 0 0 0 0 0 FF FE F8 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0 FE F0 0 0 0 0 0 0 0 0 FE FC F0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 FE FF 0 0 0 0 0 0 0 0 0 0 0 0 0 FE 0 0 0 0 0 0 0 0 0 0 0 C0 F 0 0 0 0 0 0 0 0 F0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 F8 0 0 E0 0 0 0 0 0 0 0 0 FF 0 E0 F8 0 0 0 0 0 0 FF 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 FF FC FC 0 0 0 0 0 FC 0 0 0 0 0 0 0 F0 0 0 E0 0 0 0 0 0 0 0 0 0 0 FE E0 0 0 0 0 FC 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FF 0 0 F8 0 0 0 0 0 0 FC E 0 0 0 0 0 0 0 0 0 0 FF E0 0 0 0 0 0 FF 0 F8 FF 0
0 0 0 0 0 F8 0 0 0 0 0 0 0 0 0 0 0 FF 0 F0 F0 1C 0 0 0 0 0 0 FF FC 0 0 FE 0 0 0 0 FF 0 FE 0 0 0 0 0 0 0 0 0 0 0 FE FC 0 0 0 0 0 0 0 FE 0 0 0 0 3 F8 0 0 FC 0 0 0 0 0 0 0 0 0 FC FC C0 FE 0 0 0 0 0 0 0 FC FF 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 FE E0 0 0 0 0 0 0 0 0 FC F0 E 0 0 0 0 0 0 FC FE 0 0 0 0 0 0 0 0 0 0 0 FE F0 0 0 0 0 0 0 FF 0 0 FC 0 0 0 F8 0 0 F8 0 0 0 0 0 0 0 0 0 0 0 F8 F0 0 0 0 0 0 0 0 0 0 F8 FE 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 FC 0 0 B8 0 0 0
0 0 0 0 7 0 FC FC 1C 0 0 0 0 F0 0 0 0 0 0 0 0 0 0 0 E0 0 0 0 0 0 0 0 0 0 0 FC FC 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 FE 0 0 0 0 0 0 0 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0 0 0 FF F0 0 0 0 0 0 0 0 FF 0 0
0 0 0 0 40 0 0 0 0 0 0 0 0 0 0 0 0 FF FC F8 0 0 0 0 0 0 FE F8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FE FE 3 38 0 0 0 0 0 0 FE 0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 7 0 0 0 FC 80 0 0 0 0 0 0 0 F0 0 0 0 0 0 FF 0 0 0 0 0 0 0 0 0 0
FC 0 F8 F0 0 0 0 0 0 0 0 0 FE F0 0 0 0 0 0 FE 0 0 1C E0 0 0 FC FC 0 F8 0 0 0 0 0 0 0 0 0 FC 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FE 0 0 E0 0 0 FC FF 1C 60 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

Mixer turned off
Code: [Select]
E0 0 FC 0 0 0 0 0 FC 0 0 0 0 FC E0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FC E0 0 0 0 0 0 0 0 FC 0 0 0 0 E0 E0 0 0 0 0 0 0 0 0 0 0 E0 0 0 0 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 1C 0 0 0 0 0 0 0 0 FC 0 0 0 0
0 0 0 0 0 0 0 0 E0 0 0 0 0 0 0 0 0 0 0 FC 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 E0 0 0 0 0 0 0 3 C 0 FC FC FC 0 0 0 0 0 0 0 0 0 0 1C 0 0 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 0 0 0 FC FC 0 0 FC 7C E0 0 0
0 0 0 0 0 0 FC FC 0 0 0 0 0 0 0 0 0 0 0 0 1C 0 0 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 1C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FC 3 F8 1C 0 0 0 0 0 0 0 0 0 7F 0 0 0 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 1C 0 0 0 0 FC 0 0 0 0 0 0 0

output slows
Code: [Select]
0 FC 0 1C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 E0 0 0 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 E0 0 0 0 0 1C 0 0 0 0 0 0 0 0 FC 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 1C 0 0 0 0 FE 0 0 0

arduino turned off
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Aug 25, 2018, 06:38 pm
Ok, another step forward...

I've now set the internal pullup on the mega's rx pin and worked out that the cable that connects the mixer to the controller "crosses over" such that the pins on the mixer's connector are the same as the pins on the controller. I'm now bypassing the cable the connects the 2 which was causing me an issue with the + / - round the wrong way.

When looking at the connector face on with the notch at the bottom working in a clockwise direction from the bottom left:
On the plugs, pin 2 is +ve, pin 3 is -ve
On the cable, pin 3 is +ve, pin 2 is -ve

Pin 1 on the mixer connected to Serial2 on the Mega, pin 4 connected to Serial1.

I now only get a signal when power is applied to the mixer and the ground pin is connected. Thumbs up.

So, I'm investigating the mixer and, with this code:

Code: [Select]

long baudRate = 38400;
byte serialConfig = SERIAL_6E2;

void setup() {
  Serial.begin(baudRate);
  Serial1.begin(baudRate, serialConfig);
  Serial2.begin(baudRate, serialConfig);
 
  pinMode(17, INPUT_PULLUP); //Serial2
  pinMode(19, INPUT_PULLUP); //Serial1
}

void loop() {
  int inByte;
  if (Serial1.available()) {
    Serial.print("S1 - ");
    while (Serial1.available()) {
      inByte = Serial1.read();
      Serial.print(inByte, HEX);
      Serial.print(" ");
    }
    Serial.println();
  }

  if (Serial2.available()) {
    Serial.print("S2 - ");
    while (Serial2.available()) {
      inByte = Serial2.read();
      Serial.print(inByte, HEX);
      Serial.print(" ");
    }
    Serial.println();
  }
}


My output is as follows:
Code: [Select]

S2 - 0
S1 - 38
S2 - 0
S1 - 38
S2 - 0
S1 - 38
S2 - 0
S1 - 38
S2 - 0
S1 - 38 38 0
S2 - 0 0
S2 - 0
S1 - 38
S2 - 0
S1 - 38
S2 - 0
S1 - 38
S2 - 0
S1 - 38
S2 - 0
S1 - 38 38 0
S2 - 0 0


This pattern then repeats.
I've changed the baud and config on the serials to 38400 / SERIAL_6E2 as 115200 / SERIAL_8N2 was only giving 0's.
So I'm still not convinced this is the correct baud and config but at least I'm getting consistent results now.
Next step is to try replaying the mixer's output to the controller and see what happens...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Aug 25, 2018, 11:53 pm
So, on to the controller...
If I send nothing to the controller then the screen displays E1 and there is no output to the rx pin on the mega.

HOWEVER...
I replayed "38" from the mega to the rx on the controller and it no longer goes into error. Rather it now displays "00" which is the normal "off" state. The backlight stays lit, however, which is not right but it's progress.

Also, it now starts singing like a bird.
So, with this code:

Code: [Select]
long baudRate = 38400;
byte serialConfig = SERIAL_6E2;

void setup() {
  Serial.begin(baudRate);
  Serial1.begin(baudRate, serialConfig);
 
  pinMode(18, INPUT_PULLUP); //Serial1 tx
  pinMode(19, INPUT_PULLUP); //Serial1 rx
}

void loop() {
  int inByte;
  bool addLine = false;
  if (Serial1.available()) {
    while (Serial1.available()) {
      inByte = Serial1.read();
      if (inByte != 0) {
        addLine = true;
        Serial.print(inByte, HEX);
        Serial.print(" ");
      }
    }
    if (addLine)
      Serial.println();
  }

  inByte = Serial1.write(38);
  inByte = Serial1.write(0);

  delay(100);
}


I get the following:

Code: [Select]
38 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
3C 38 38 38 38 38 38 38 38 38
1E 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38
F 38 38 38 38 38 38 38 38 38
38 38 38 38 38 38 38 38 38


And on it goes.
Next I need to work out what else I should or shouldn't be sending it...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Sep 26, 2018, 09:13 am
After putting this down for a little while, I did some further poking around with the controller and the transceiver chip uses RS-485 for its serial communications. So it's not quite as simple as a tx and an rx pin. This also necessitated the use of a couple of RS-485 modules for the arduino to convert the comms to something the arduino can use.

Furthermore, I'm still unsure of what the baud rate is as I seem to be able to retrieve apparently real data at a variety of bauds. I therefore thought it would be worth trying an oscilloscope to help detect the baud rate.

Using the instructions / code / app from here (https://www.instructables.com/id/Oscilloscope-Arduino-Processing/) I managed to set up an oscilloscope using the arduino. It's certainly not perfect but it definitely appears to give some useful information.

From here (https://www.kumari.net/index.php/random/37-determing-unknown-baud-rate) it suggests measuring the shortest pulse and using a formula you can work out the baud.

I measured the shortest pulse at about 400 µs and that makes it really close to 2400 baud (allowing for errors in display and measurement).

I'm yet to test with this baud but, again, another step forwards perhaps...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Sep 27, 2018, 10:00 am
Using the scope trace you should also be able to work out the number of data bits and stop bits used.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Oct 03, 2018, 10:17 pm
Using the scope trace you should also be able to work out the number of data bits and stop bits used.
So I've done some measurements using the arduino oscilloscope and I'm not entirely sure it has suitable resolution to be completely confident about the individual bits.

Anyway, I've attached a screenshot with what it outputs and it shows the following:

The red line measurement shows a "packet" is 8 ms long.
The 2 pink dots on the red line are 1.2 ms apart.
The green line measurement shows the gap between spikes is about 0.4 ms.
The 2 pink dots on the green line are 3.5 ms apart - probably not that useful.

I've tried listening on Serial1 (the mixer) on the Mega and replaying any input to Serial2 (the controller) and vice versa but it's not working.

I have a feeling that there might be timing issues in that you may need to wait between bytes or something...

Any thoughts?
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Oct 04, 2018, 09:59 am
As your measuring the differential signal you only need to measure either the A or B side (or the UART input to the chip) on a single channel and this should increase the scope resolution.
Failing that then maybe invest in a cheap logic analyser like this (https://www.ebay.co.uk/itm/24MHz-input-USB-Logic-Analyzer-8-Channel-5-5V-Logic-Analyzer-for-MCU-ARM-FPGA/192480274317?hash=item2cd0b7e78d:g:kyQAAOSwE1Bbmi9V) that will be ideal for a job like this.

It's difficult to tell but looking at your image it looks like you will have only 7 bits per frame and assuming it includes one start and one stop bit that means only 5 data bits.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Oct 05, 2018, 08:38 am
As your measuring the differential signal you only need to measure either the A or B side (or the UART input to the chip) on a single channel and this should increase the scope resolution.
Failing that then maybe invest in a cheap logic analyser like this (https://www.ebay.co.uk/itm/24MHz-input-USB-Logic-Analyzer-8-Channel-5-5V-Logic-Analyzer-for-MCU-ARM-FPGA/192480274317?hash=item2cd0b7e78d:g:kyQAAOSwE1Bbmi9V) that will be ideal for a job like this.

It's difficult to tell but looking at your image it looks like you will have only 7 bits per frame and assuming it includes one start and one stop bit that means only 5 data bits.
Tried only reading one channel but it didn't seem to make any difference.
Also tried increasing the baud on the Arduino and the oscilloscope program to 250000 but, again, no dice.


I've ordered a logic analyser and it should turn up today or tomorrow so I'll give that a go and see what happens...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Oct 06, 2018, 03:19 pm
OK, so, logic analyser here and this is what I've managed to find so far.

I'm using sigrok to interpret the data from the analyser.

The following is connecting the analyser solely to the mixer, i.e. without the controller in the picture...

The image attached (full data.png) is the full set of data captured from when I turned the mixer on to when I turned it off.

The gap between the final peak of one packet and the first peak of the next packet is 47.3 ms

All the "packets" shown are the same and a single packet can be seen in the attached image (single packet.png). Each packet is 7.9 ms long and consists of 7 peaks. Are there start and stop bits at either end that are not peaks?

The attached image (peak.png) shows that a peak is 1 ms long and a trough (trough.png) is 0.1 ms long.

Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Oct 06, 2018, 06:13 pm
Next installment...

Now I've connected the mixer and the controller to a breadboard and have the signal analyser effectively listening in to the conversation.

From the conversation, it appears that there's a lot more going on than the single "packet" from the previous post. Having seen the data in the conversation I've measured the smallest pulse and it's about 0.1 ms which (according to here (https://www.kumari.net/index.php/random/37-determing-unknown-baud-rate)) correlates with a baud of 9600.

So, with that in mind I added a UART protocol decoder (according to here (https://sigrok.org/wiki/Protocol_decoders), it's the only protocol decoder that mentions RS485) and set the settings in PulseView as shown in uart.png, started reading data and then turned on the mixer. After a period of time I turned off the mixer and stopped reading data.

The attached file (sample.png) shows the first 11 chunks of data.

A couple of things of note before getting to the data:


It looks like there are 7 bytes from the mixer (As there were 7 peaks in my last post) followed immediately by 7 bytes from the controller.
Only the final byte from the mixer ever appears to contain any data but then I haven't pressed any buttons on the controller yet.

The data is as follows:

Code: [Select]

00 00 00 00 00 00 00    00 00 00 00 00 02 00
00 00 00 00 00 00 41    33 F2 02 16 07 02 00
00 00 00 00 00 00 B3    33 F2 02 16 07 02 00
00 00 00 00 00 00 21    33 F2 02 36 07 02 00
00 00 00 00 00 00 B3    13 72 02 36 07 02 00
00 00 00 00 00 00 41    13 72 02 16 07 02 00
00 00 00 00 00 00 B3    33 F2 02 16 07 02 00
00 00 00 00 00 00 04    33 F2 02 16 07 02 00
00 00 00 00 00 00 53    33 F2 02 36 07 02 00
00 00 00 00 00 00 24    13 F2 02 36 07 02 00
00 00 00 00 00 00 B3    13 72 02 36 07 02 00


I can definitely see a pattern there but I'm unsure what it means just yet.

The next thing I'll be trying is to see if I can replicate the data sent by the mixer using an arduino or it'll all be for nothing...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Oct 06, 2018, 10:06 pm
UART decoder is probably the one to use.
RS485/RS422 describe the electrical differential signal to reduce/cancel noise induced in the cables so you can transmit signals further in electrically noisy environments.

Does the protocol decoder have an auto mode to determine the correct baud rate, start/stop bits, data bits and parity or did you select them manually.
Assuming it is Serial data then it looks like it could be configured as 9600,6N1 is this what you was using?
That's 1 start bit, 6 data bits and one stop bit. Other options could be 5N2, 5E1, 5O1

UART signals are normally high in an idle state so you might have the logic probe connected to the wrong leg of the RS485 A/B line as your captures show the signal as idle low. You might be able to invert the logic in the protocol decoder instead.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Oct 07, 2018, 05:41 pm
There's no auto mode that I can find so I had to select everything manually.

I've tried loads of different options and the closest I've come to a match is the one I've got to here which is 9600, 8N1.
I think it's more likely 8N2 as when I add a parity bit (of any type) and set 1 stop bit the length is perfect but the parity bit is often wrong but there's no option to add 2 stop bits in PulseView.

I'm actually monitoring both the A and B but was only showing 1 of them in the images to save space. Both signals are the same, as you'd expect, except being the opposite. The idle high signal shows exactly the same data.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Oct 08, 2018, 10:26 am
You will know if the data is correct if you never get UART framing errors.
I mentioned about the A/B high idle as adding a UART protocol decoder to the wrong one may cause wrong data values and framing errors to be returned in the decode data.

This is just the sort thing I like working on and even looks at the Vado unit for playing with but it would be too expensive for just the fun of it.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 10, 2018, 02:37 pm
You will know if the data is correct if you never get UART framing errors.
I mentioned about the A/B high idle as adding a UART protocol decoder to the wrong one may cause wrong data values and framing errors to be returned in the decode data.

This is just the sort thing I like working on and even looks at the Vado unit for playing with but it would be too expensive for just the fun of it.
Had to put this down for a bit again as I've been really struggling with it.

When I use the RS485 modules I can't seem to replicate the unit's initial pattern in a sensible way. I set the baud to 9600 but when I send a character it's so much shorter than the pattern from the unit.

The only way I've managed to get close is with the following but it's not using the RS485 module at all so I don't think it'll work with the unit:

Code: [Select]

long unsigned lastCom = 0;
long unsigned curMicros = 0;

const int digPinHigh = 30;
const int digPinLow = 31;
const int byteLen = 7;

bool valArray[] = {HIGH, HIGH, HIGH, HIGH, HIGH, HIGH, HIGH, HIGH, HIGH, HIGH};

const int bitLen = 104;
const unsigned long comPeriod = 55000;

void setup() {
  pinMode(digPinHigh, OUTPUT);
  pinMode(digPinLow, OUTPUT);
  digitalWrite(digPinHigh, LOW);
  digitalWrite(digPinLow, HIGH);
}

void loop()
{
  curMicros = micros();
  if ((curMicros > (lastCom + comPeriod)) || (curMicros < lastCom)) {
    lastCom = curMicros;

    for (int j = 0; j < byteLen; ++j) {
      for (int i = 0; i < sizeof(valArray); ++i) {
        digitalWrite(digPinHigh, valArray[i]);
        digitalWrite(digPinLow, valArray[i] == HIGH ? LOW : HIGH);
        delayMicroseconds(bitLen);
      }
      digitalWrite(digPinHigh, LOW);
      digitalWrite(digPinLow, HIGH);
      delayMicroseconds(bitLen);
    }
  }
}
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Nov 10, 2018, 02:53 pm
When I use the RS485 modules I can't seem to replicate the unit's initial pattern in a sensible way. I set the baud to 9600 but when I send a character it's so much shorter than the pattern from the unit.
What if you use a lower baud rate, 300, 1200, 2400 and 4800 are standard rates below 9600 but it could also be custom.
Does your logic analyser protocol decoder have an auto baud option where it will try to figure out the baud rate for its self?
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 10, 2018, 06:45 pm
What if you use a lower baud rate, 300, 1200, 2400 and 4800 are standard rates below 9600 but it could also be custom.
Does your logic analyser protocol decoder have an auto baud option where it will try to figure out the baud rate for its self?

Firstly, thank you Riva for your help on this. It's very much appreciated and is really keeping me invested.

ok, another step forwards perhaps...

I changed the arduino code that utlilises the rs485 module to the following:

Code: [Select]

long baudRate = 9600;
byte serialConfig = SERIAL_8N1;

#define TxControlMixer      3   //RS485 Direction control
#define RS485Transmit       HIGH
#define RS485Receive        LOW

long unsigned lastCom = 0;
long unsigned curMicros = 0;
const unsigned long comPeriod = 55000;
const int bitLen = 104;

byte message[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

void setup() {
  Serial1.begin(baudRate, serialConfig);

  // Init Transceiver
  pinMode(TxControlMixer, OUTPUT); 
  digitalWrite(TxControlMixer, RS485Receive);
}

void loop()
{
  curMicros = micros();
  if ((curMicros > (lastCom + comPeriod)) || (curMicros < lastCom)){
    lastCom = curMicros;
    digitalWrite(TxControlMixer, RS485Transmit);  // Enable RS485 Transmit
    for (int i = 0; i < sizeof(message); ++i) {
      Serial1.write(message[i]);
      delayMicroseconds(bitLen);
    }
  }
}


The main point being I've removed the line that sets the RS485 module to receive. This means that the arduino is constantly in transmit which could be a problem when I connect the controller up but I'll get to that later.

This gave the right sort of pattern, as shown on the top line in the attached image.

Once I got to there I then changed the baud to 8750 (with some trial and error) which gave me the middle line.

The bottom line is the mixer.

Note:


So the overall length of a packet looks right but the individual segments look a little too short.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 10, 2018, 07:04 pm
I ran the mixer again and read the data in sigrok and then added a UART decoder at a baud of 8750.

I now get some clean packets but also still some frame errors... (see attachments).

However, if I increase the sample rate in sigrok to 50kHz then the frame errors pretty much go away entirely... :D
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 10, 2018, 07:56 pm
ok, I've now sampled both the mixer and the controller together and am seeing zero frame errors.

Looks like it's a baud of 8752... :\

Strange, but ok.

And with that I get the following data:

I'm certain the left is the mixer and the right is the controller.

The mixer sends 7 00's until the controller is connected at which point the controller sends a single 02 in response.
Code: [Select]
00 00 00 00 00 00 00   00 00 00 00 00 02 00


The following 6 packets are then exchanged:
Code: [Select]
00 00 00 00 00 00 21   13 72 02 16 07 02 00
00 00 00 00 00 00 53   13 72 02 16 07 02 00
00 00 00 00 00 00 21   13 72 02 16 07 02 00
00 00 00 00 00 00 53   13 72 02 16 07 02 00
00 00 00 00 00 00 21   13 72 02 16 07 02 00
00 00 00 00 00 00 53   13 72 02 16 07 02 00


There are then a whole load of the following packet pairs are exchanged until the mixer has finished its start up (making whirring noises - to reset the proportioning valve I would guess):
Code: [Select]
00 00 00 00 00 00 16   13 72 02 16 07 02 00
00 00 00 00 00 00 53   13 72 02 16 07 02 00


After the mixer's start up completes, the following pairs are exchanged ad infinitum:
Code: [Select]
00 00 00 00 00 00 16   13 72 02 16 07 02 00
00 00 00 00 00 00 51   13 72 02 16 07 02 00


so now to try to replicate the mixer pattern with arduino...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 10, 2018, 08:45 pm
Bit more messing with the controller...

If I press the power button, there's a bit of mess where it looks like the controller stops talking for a few packets while the mixer sends the following:
Code: [Select]
00 00 00 00 00 00 16


The controller then talks over the mixer for a couple of packets until it settles into the following:
Code: [Select]
00 00 00 00 00 00 16   12 72 01 16 07 02 00


After that I pressed the button to switch to a different shower outlet at which point there was some mess again followed by:
Code: [Select]
00 00 00 00 00 00 16   12 72 01 16 07 01 00


They then settled into the following:
Code: [Select]
00 00 00 00 00 00 16   11 72 01 16 07 01 00


I then hit the pause button, there was mess, then:
Code: [Select]
00 00 00 00 00 00 16   12 7A 02 16 07 01 00
00 00 00 00 00 00 53   12 72 02 16 07 01 00

I think the first line above may be a read error and 7A should in fact be 72

Then they settle into the following:
Code: [Select]
00 00 00 00 00 00 16   12 72 02 16 07 01 00
00 00 00 00 00 00 53   12 72 02 16 07 01 00


At some point thereafter they settle into the following:
Code: [Select]
00 00 00 00 00 00 16   12 72 02 16 07 01 00
00 00 00 00 00 00 51   12 72 02 16 07 01 00
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 18, 2018, 06:50 pm
New update!

I'm sort of talking to the controller. Certainly it knows I'm talking and is responding.

I rewrote the code to replicate the 3 stage start up sequence (from post 21 (https://forum.arduino.cc/index.php?topic=564171.msg3940459#msg3940459)) and then connected the controller to the arduino and it seems to be responding.
As far as the data being received from the controller in response to the data I'm sending, it looks identical to what's received when it's connected to the arduino.

The only difference in the data, and the main issue I seem to be having, is that on one of the 2 rs485 data pins the idle is HIGH whereas on the mixer it's LOW (see attached).

I'd like to resolve the data issue in order to eliminate it from the investigation (plus I think the arduino's signal is wrong as per the rs485 spec / requirements / guidelines / whatever).

Aside from the data issue I've found that when I connect the controller to the arduino and power everything on, the screen stays on the "00", the backlight stays lit and the buttons are unresponsive.
However, if I start everything up and then move the controller connections to the mixer (which is powered on patiently waiting) the backlight then goes out which is the appropriate standby mode and the buttons are responsive.
Better yet, if I then move the connections back to the arduino, the buttons remain responsive. I can perform all of the usual actions on the buttons until I attempt to put it back into standby at which point the buttons then become unresponsive once more.

Clearly the unresponsive buttons is a blocker for real use but I may continue to work on the code that handles the state, temp, pressure, etc. until I have a breakthrough or somebody points out the glaringly obvious mistake to me...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Nov 19, 2018, 10:36 am
What RS485 module are you using and does it have the relevant/correct pullup/pulldown resistors on the A/B lines and maybe the 120 ohm terminator?

Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 20, 2018, 12:29 am
What RS485 module are you using and does it have the relevant/correct pullup/pulldown resistors on the A/B lines and maybe the 120 ohm terminator?

It's this one: https://www.amazon.co.uk/WINGONEER-MAX485-Module-RS-485-Development/dp/B06XHHWLMW

From the looks of the schematic it's got all the resistors and the board seems to match the schematic (in terms or the number of components).

My first thought was pull up / down resistors so I tried adding a couple of 220's in parallel (so 110 ohm) across the A / B and from each as pull up / down but all I managed to do was change the "incorrect" pin to the other one. So it feels like it's in the right region but I'm not really sure how to work out what's required.

The next thing I'm going to try is to measure the resistance across everything with the controller connected to the mixer and then again with the controller connected to the arduino, both with everything powered on and off.
At least that will tell me what the difference is between the 2 scenarios...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Nov 20, 2018, 01:23 pm
If you disconnect the mixer and just connect your logic analyser to A, B & Gnd of the MAX485 module while sending data, does it then show idle as low or still as high?
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 20, 2018, 06:43 pm
If you disconnect the mixer and just connect your logic analyser to A, B & Gnd of the MAX485 module while sending data, does it then show idle as low or still as high?

Exactly the same. Still HIGH.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Nov 21, 2018, 09:50 am
Exactly the same. Still HIGH.
Is the MAX485 module in RX or TX mode when you take the readings?

EDIT:
Using the simple test program below on a Mega
Code: [Select]
#define DE 2
#define RE 3
#define TEST 4
#define DELAY 100

void setup()
{
  Serial.begin(115200);
  Serial1.begin(9600);
  pinMode(DE, OUTPUT);
  pinMode(RE, OUTPUT);
  pinMode(TEST, OUTPUT);
  Serial.println("Setup End");
}

void loop()
{
  Serial.println("DE/RE High");
  digitalWrite(DE, HIGH);
  digitalWrite(RE, HIGH);
  digitalWrite(TEST, HIGH);
  delay(10);
  Serial1.print("Hello World");
  delay(DELAY);
  Serial.println("DE/RE Low");
  digitalWrite(DE, LOW);
  digitalWrite(RE, LOW);
  digitalWrite(TEST, LOW);
  delay(DELAY);
}

I get the below image on my LA. You need to put the MAX481 into receive mode to release the lines.

(http://forum.arduino.cc/index.php?action=dlattach;topic=564171.0;attach=282769)
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 23, 2018, 07:38 pm
Is the MAX485 module in RX or TX mode when you take the readings?

EDIT:
Using the simple test program below on a Mega
Code: [Select]
...
I get the below image on my LA. You need to put the MAX481 into receive mode to release the lines.

...

Using the same code I get the attached.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Nov 24, 2018, 10:28 am
Using the same code I get the attached.
That's strange, when TEST is low the MAX chip should be in receive mode and the pullup resistor should hold the A line high (on my image it is low but this is probably the logic probe pulling it down) and the pulldown holds the B line low. On your trace A is behaving as expected but B is remaining high.

I used a module that looks like yours but I don't have it with me to check the exact model and MAX chip used.
I'm at work and just happen to have a MAX485 chip (not module) to hand to connected it to using the same scheme and get the same results.
(http://forum.arduino.cc/index.php?action=dlattach;topic=564171.0;attach=283139)
Maybe you should try another MAX485 module/chip.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Nov 30, 2018, 07:01 pm
I've tried a second and third module and it's exactly the same (see attached) - although all the modules came in the same pack so that may be saying too much.

The chip is  MAX485 ESA +18DN if that makes any difference.

When I look at your image versus mine, they look exactly the same but the mirror image.
With the exception that the test channel is not the mirror image.

I really don't know what that means.


I'm looking to see if there's another, different module I can get quickly and cheaply for comparison...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Dec 01, 2018, 05:00 pm
AFAIK the 3 characters after MAX485 denote the package type. ESA is 8 pin SO package.
When your testing you only have them connected to the logic analyser?
The Amazon link you posted has a schematic image so maybe check module matches schematic with a continuity meter
Maybe the whole packet of MAX485 modules are faulty or poorly designed/built or it could just be your logic device pulls the lines high when they are floating and mine pulls them low.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 01, 2018, 06:09 pm
AFAIK the 3 characters after MAX485 denote the package type. ESA is 8 pin SO package.
When your testing you only have them connected to the logic analyser?
The Amazon link you posted has a schematic image so maybe check module matches schematic with a continuity meter
Maybe the whole packet of MAX485 modules are faulty or poorly designed/built or it could just be your logic device pulls the lines high when they are floating and mine pulls them low.

When testing, I've tried a couple of different combinations and they all give the same result.

CHANNELCONNECTEDSIGNAL AT IDLE
Aarduino and logic analyserhigh
Aarduino, controller and logic analyserhigh
Amixer and logic analyserlow
Amixer, controller and logic analyserlow


So I've ordered another, very different rs485 (https://www.amazon.co.uk/gp/product/B07B667STP) which should be turning up tomorrow so, with any luck, this will resolve the issue.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 04, 2018, 08:20 pm
OK, I think this is good news.


The new module doesn't have DE / RE pins, rather it relies on the TX to tell it when to switch to send / receive mode.

It does seem to properly switch back to idle though. :D

ALSO...
After some head bashing / panicking it would appear that actually the controller is working at 9600 baud with an ODD parity bit and I'm now able to immediately add a UART decoder with no frame errors!!!

It does mean that I now need to go back and re-analyse the mixer / controller traffic but that should be fairly easy.

Watch this space...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Dec 05, 2018, 04:17 pm
Glad you have one problem sorted and found the next hurdle to jump.
Just to put the old RS485 modules problem to bed how was you connecting them up?
 
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 07, 2018, 07:08 pm
Glad you have one problem sorted and found the next hurdle to jump.
Just to put the old RS485 modules problem to bed how was you connecting them up?
 
For the old modules I connected them the same way described here (https://www.instructables.com/id/RS485-Serial-Communication-Between-Arduino-Mega-an/).

Essentially:

ArduinoRS 485
TXDI
RXRO
3 (Direction Control)DE / RE
GNDGND
5VVCC


I don't know whether I got a bad batch or what but I must've re-wired the circuit about 50 times to make sure it was together correctly.
So gawd knows.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 07, 2018, 07:37 pm
Ok, so with the new RS 485 module, I'm wired back in to try to work out the sequences again and here goes...

Any lines followed by "x n" means that the lines above (until the previos blank line) are repeated n times
"x ..." means the lines are repeated an unknown number of times or indefinitely

Just the mixer connected
Code: [Select]

00 00 00 00 00 00 00
x ...


Connect the controller
This just shows the handshake and then the mixer's start up sequence
Code: [Select]

00 00 00 00 00 00 00  00 00 00 00 00 02 00

00 00 00 00 00 00 41  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00
00 00 00 00 00 00 41  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00
00 00 00 00 00 00 41  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00

00 00 00 00 00 00 1D  33 F2 02 36 07 02 00
00 00 00 00 00 00 B3  33 F2 02 36 07 02 00
x 55

00 00 00 00 00 00 1D  33 F2 02 36 07 02 00
00 00 00 00 00 00 B1  33 F2 02 36 07 02 00
x ...


Turn shower on
Code: [Select]

00 00 00 00 00 00 B1
00 00 00 00 00 00 B1
00 00 00 00 00 00 B1
//MESS
00 00 00 00 00 00 B1  32 F2 01 36 07 02 00
00 00 00 00 00 00 1D  32 F2 01 36 07 02 00

00 00 00 00 00 00 1D  32 F2 01 36 07 02 00
x ...


Turn shower off
Code: [Select]

00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
//MESS
00 00 00 00 00 00 1D  33 F2 02 36 07 02 00

00 00 00 00 00 00 1D  33 F2 02 36 07 02 00
00 00 00 00 00 00 B1  33 F2 02 36 07 02 00
x ...


Turn shower on then
Change to outlet 2

Code: [Select]

00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
MESS
00 00 00 00 00 00 1D  31 F2 01 36 07 01 00
x ...


Turn shower off
Code: [Select]

00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
00 00 00 00 00 00 1D
MESS
00 00 00 00 00 00 1D  32 F2 02 36 07 01 00

00 00 00 00 00 00 1D  32 F2 02 36 07 01 00
00 00 00 00 00 00 B3  32 F2 02 36 07 01 00
x...

00 00 00 00 00 00 1D  32 F2 02 36 07 01 00
00 00 00 00 00 00 B1  32 F2 02 36 07 01 00
x...


Turn shower on then
Increase flow

Code: [Select]

//Min flow
00 00 00 00 00 00 1D  32 F2 01 36 05 02 00

//Low flow
00 00 00 00 00 00 1D  32 F2 01 36 06 02 00

//Med flow
00 00 00 00 00 00 1D  32 F2 01 36 07 02 00

//High flow
00 00 00 00 00 00 1D  32 F2 01 36 08 02 00

//Max flow
00 00 00 00 00 00 1D  32 F2 01 36 09 02 00
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 07, 2018, 08:04 pm
There was some unexpected behaviour from the mixer while all that testing was going on.
At some point I noticed that the last bit from the mixer started to rise.
I assume that this indicates the temperature that the water flowing through the mixer has reached but even after I turned the mixer off it continued to rise for a bit, possibly down to heat soak.

Mixer behaviour
Code: [Select]

...
00 00 00 00 00 00 23

00 00 00 00 00 00 24
x 5

00 00 00 00 00 00 25
x 7

00 00 00 00 00 00 26
x 17

00 00 00 00 00 00 27
x 11

00 00 00 00 00 00 28
x 18

00 00 00 00 00 00 29
x 6

00 00 00 00 00 00 2A
x 5

00 00 00 00 00 00 2B
x 6

00 00 00 00 00 00 2C
x 24

00 00 00 00 00 00 2D
x 11

00 00 00 00 00 00 2E
x 6

//turn off

00 00 00 00 00 00 B3
00 00 00 00 00 00 2E
x 3
00 00 00 00 00 00 B3
00 00 00 00 00 00 2F
x 4
00 00 00 00 00 00 B3
00 00 00 00 00 00 30


I'm going to test a bit further to see if the mixer's temp matches up to the temp from the controller...


Then, bizarrely, the controller's first bit changed as well. I'm yet to work out what the controller's first bit is for...

Controller strangeness
Code: [Select]

35 F2 02 36 09 02 00
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 07, 2018, 10:40 pm
ARRRRRGGGGGHHHHHH!!!!!!!
 >:(  >:(  >:(

It seems the new rs485 doesn't want to read all of the data.

the following code:

Code: [Select]
//Transmission config
long baudRate = 9600;
byte serialConfig = SERIAL_8O1;
//Transmission Details
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Timing
long unsigned lastCom = 0;
long unsigned curMicros = 0;
const unsigned long comPeriod = 55240; //should 55240 - 55280 - Arduino is not perfect at timing so 55240 seems to equate to roughly 55260
//Timing
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Message Length
const int MSG_LEN = 7;
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Outgoing message details
//Outgoing messages
const byte MSG_INTRO[MSG_LEN] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
//Outgoing register
byte message[MSG_LEN];
//Outgoing message details
/////////////////////////////////////////////////////////////////


/////////////////////////////////////////////////////////////////
//Controller message details
//Incoming register
byte receivedData[MSG_LEN];
int nCurByte = 0;
//Controller message details
/////////////////////////////////////////////////////////////////

void setup() {
  Serial.begin(baudRate, serialConfig);
  Serial1.begin(baudRate, serialConfig);

  memcpy(message, MSG_INTRO, MSG_LEN);
}

void loop()
{
  SendData(message);

  if (ReadData()) {
    PrintData();
  }
}

void PrintData() {
  for(int i = 0; i < MSG_LEN; i++)
  {
    Serial.print(receivedData[i], HEX);
    Serial.print(" ");
  }
  Serial.println("");
}

void SendData(byte sendMsg[]) {
  curMicros = micros();
  if ((curMicros > (lastCom + comPeriod)) || (curMicros < lastCom)) {
    lastCom = curMicros;
    Serial1.write(sendMsg, MSG_LEN);
  }
}

bool ReadData() {
  while (Serial1.available() > 0) {
    receivedData[nCurByte++] = Serial1.read();

    if (nCurByte >= MSG_LEN) {
      nCurByte = 0;
      return true;
    }
  }
  return false;
}


Prints:

Code: [Select]

...
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
7 2 F2 2 7 2 F2
2 7 2 F2 2 7 2
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
7 2 F2 2 7 2 F2
2 7 2 F2 2 7 2
F2 2 7 2 F2 2 7
2 F2 2 7 2 F2 2
7 2 F2 2 7 2 F2
...


It's definitely reading the incoming data as I'm expecting:
33 F2 02 36 07 02 00

And the logic analyser is picking up all the data.
It's looking like I'm going to need to use the old module to read the incoming data and the new module to write the data.
I've tried using ReadBytes but that just times out after about a second or something (whatever the default is).

I'm at a loss...
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 07, 2018, 10:51 pm
Minutes later, I'm no longer at a loss...

AND WE'RE OFF!!!!!!!!
 :D  :D  :D

It looks like it's using SERIAL_8N2.
Certainly, if I set the arduino to use that config then I can read all the data.
sigrok seems to think that the controller is using a zero parity type but we don't have that option in arduino. So at 8N2 sigrok shows loads of parity errors from the arduino but it works dagnabbit!

On starting up the arduino with my new code using SERIAL_8N2 the screen is no longer flickering and goes into standby mode.

And I'm now able to properly communicate!!!!

It's been a long time coming and we're not there yet but this is a massive step forward and for the first time I can talk back to the blasted controller. Now I just have to add in the logic but that's the easy bit.

Massive thanks to Riva for keeping me going.  ;)
^^^ Starting to sound like an awards ceremony :D

Here is the info I have managed to gather about what the controller is sending:

3rd byte - Power

Power3rd byte
ON01
OFF02
PAUSED03

4th byte - Requested Temperature

Temp (deg C)4th byte
2529
262A
272B
282C
292D
302E
312F
3230
3331
3432
3533
3634
3735
3836
3937
4038
4139
423A
433B
443C
453D
463E


5th byte - Flow Rate

Flow5th byte
MIN05
LOW06
MED07
HIGH08
MAX09

6th byte - Outlet

Outlet6th byte
Default02
Alternate01
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Dec 08, 2018, 11:32 am
I should have jumped forward to your last message first instead of working my way through them one at a time and then going of reading about the connection example of the RS485 modules and then trying to decode the protocol only to find you have already done it. LOL

Glad your getting consistent and predictable results now and look forward to you posting the project is finished and working as expected. Also glad to help though I don't feel I helped much apart from showing someone was listening.
I would like to investigate the old MAX485 modules in more detail as I feel the boards you bought are probably just the same as the rest of them that look the same (like mine) but maybe they have faulty MAX485 chips or some other issue.
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Monkey3 on Dec 08, 2018, 05:59 pm
I should have jumped forward to your last message first instead of working my way through them one at a time and then going of reading about the connection example of the RS485 modules and then trying to decode the protocol only to find you have already done it. LOL

Glad your getting consistent and predictable results now and look forward to you posting the project is finished and working as expected. Also glad to help though I don't feel I helped much apart from showing someone was listening.
I would like to investigate the old MAX485 modules in more detail as I feel the boards you bought are probably just the same as the rest of them that look the same (like mine) but maybe they have faulty MAX485 chips or some other issue.

:D

Not going for the smoke blowing but even a little bit of assistance around where to look or advice about getting a logic analyser just meant that I moved that much faster. It probably stopped me from giving up altogether quite honestly.

I've been putting my code on github here: https://github.com/RucialK/vado-identity-shower-interface (https://github.com/RucialK/vado-identity-shower-interface)
It's not perfect but I'm definitely getting there. Needs a lot more refactoring and tidying up but I want to get it working with all the safety features and so on so and then refactor once it's working.

If you want to PM me your address I'll send you one of the rs 485 modules if you want to have a look. No pressure but definitely the least I can do. And I very much doubt I'll be using them. ;)
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: Riva on Dec 09, 2018, 10:29 am
If you want to PM me your address I'll send you one of the rs 485 modules if you want to have a look. No pressure but definitely the least I can do. And I very much doubt I'll be using them. ;)
Thanks for the offer, I'm also in the UK and the cost of shipping will be way more than the item is worth.

A quick look at your github write-up and depending on what else your going to hang of the Mega I/O pins you might be okay with a Pro Micro (https://www.amazon.co.uk/HiLetgo-Atmega32U4-Bootloadered-Development-Microcontroller/dp/B01MTU9GOB/ref=sr_1_3?ie=UTF8&qid=1544347290&sr=8-3&keywords=arduino+pro+micro). It is a lot smaller than the Mega and has native USB built in for serial debugging so the hardware UART could be used for the RS485. I use them for various DMX projects as like your project I needed Serial to the PC and hardware serial for RS485 (DMX is 250000 baud)
Title: Re: Decrypting the Vado Identity wired shower controller
Post by: hazymat on Sep 25, 2019, 01:00 am
Hi Monkey3 - a fellow shower automation investigator here :)

I've been looking into the Mira platinum as well as this Vado. Would be really interested in asking some questions of you:

- are you just using this controller in the shower? elsewhere I saw you post about wanting to use it to control something else. Would like to hear about your project

- Are you using the Vado with the controller (i.e. the mixer valve system)? Can you give me an idea about how much the whole kit cost?

I liked the idea of making my own shower mixer using calibrated "proportional solenoid valves" (i.e. valves that take e.g. 0-10v and adjust the flow of water accordingly). So at first I thought I would try to get a nice waterproof user interface for the shower. That seems like the hard bit. The rest seems like a simple combination of finding the valves and controlling them with an Arduino - easy stuff.

Check out this product (https://www.rjselectronics.com/products/slb/) from RJS Electronics. It's basically a rotary encoder with a display built in. I'm thinking of getting one to test it out, and write a little arduino sketch to power it.

Also there's another UK guy who appears to have made a really nice looking DIY Nest knockoff (http://www.albates.com/low-cost-diy-nest-style-iot-thermostat-project/), which would look nice in a shower. His post doesn't go into much detail about the housing (which to my mind is the most interesting bit) so I have emailed him tonight to ask for more info.

Anyway, can you let me know how much you paid for the Mira, and the Vado, and also whether you liked the look and feel of the interfaces? And also how are you getting on with the Vado? Do you have it working? What exactly drove you to wanting to communicate with the controller? Simply to control the shower from your own automation hub? (That's basically what I want to do. I use Node-RED by the way.)

Cheers, Mat