help reverse engineering greenhouse controller com ports

I am working on an arduino project that will interface with an iPonic 624 greenhouse controller. This controller does things like turn on humidifier, open vents, etc, based on outside temp/humidity.

There are two outside temp/humidity sensors: Here is a picture of one. You will notice the four wires Red, Black, Green, White.

|375x500

From looking at the controller main board, the temp/humidity sensors wire into terminal blocks like this:

Both black leads > shared GND Both red leads > shared + Both white leads > shared CLK Room 1 green lead > DAT1 Room 2 green lead > DAT2

Here is picture of the Iponic greenhouse controller main board:

|500x277

I have researched different methods to snoop the communication going over these pins, such as turning on the device and looking for voltage on bootup. Or using a proper logic analyzer, or maybe using a USB to UART analyzer. I could toy with unplugging the sensors easily and replug them in to see if they re-establish communication.

I have used TCPDUMP to analyze lots of TCP/IP network traffic, but never anything like this :)

Can anybody give some tips on where to start?

Is it easy for any of you to see by looking at the images if you suspect it is UART or SPI?

Any tips are greatly appreciated!

Thanks

I guess I don't understand your posting. you ask about communications, and then show pictures and discuss the temperature and humidity sensors. Both temp and humidity sensors are basically resistors that vary in value based on their temperature or humidity.

How do you even know the device is trying to communicate with anything?

Paul

Paul_KD7HB: I guess I don't understand your posting. you ask about communications, and then show pictures and discuss the temperature and humidity sensors. Both temp and humidity sensors are basically resistors that vary in value based on their temperature or humidity.

How do you even know the device is trying to communicate with anything?

Paul

The iponic controller has some shortcomings. It does not have a sensor for "rainfall". If there is rainfall then I need to close all the vents in the greenhouse, adjust the humidifier, adjust co2, etc. Because of the lack of the rainfall sensor I want to emulate sending a signal of "101% humidity" to the main controller by using the arduino to inject the signal into the main controller. By having the ability to inject the fake "101%" humidity signal (using arduino) then the controller can do all the needed steps (close greenhouse vents, adjust humidifier, adjust co2). Hope that makes sense?

Paul_KD7HB: I guess I don't understand your posting. you ask about communications, and then show pictures and discuss the temperature and humidity sensors. Both temp and humidity sensors are basically resistors that vary in value based on their temperature or humidity.

How do you even know the device is trying to communicate with anything?

Paul

The assumption of a Communications Protocol is from the photo. Look at the Terminal Strip: "Clock" + "Data 1" + "Data 2" That does not appear be "basically resistors". That appears to be a Digital Synchronous Communication Protocol.

Cobbler: I am working on an arduino project that will interface with an iPonic 624 greenhouse controller. This controller does things like turn on humidifier, open vents, etc, based on outside temp/humidity.

There are two outside temp/humidity sensors: Here is a picture of one. You will notice the four wires Red, Black, Green, White.

|375x500

From looking at the controller main board, the temp/humidity sensors wire into terminal blocks like this:

Both black leads > shared GND Both red leads > shared + Both white leads > shared CLK Room 1 green lead > DAT1 Room 2 green lead > DAT2

Here is picture of the Iponic greenhouse controller main board:

|500x277

I have researched different methods to snoop the communication going over these pins, such as turning on the device and looking for voltage on bootup. Or using a proper logic analyzer, or maybe using a USB to UART analyzer. I could toy with unplugging the sensors easily and replug them in to see if they re-establish communication.

I have used TCPDUMP to analyze lots of TCP/IP network traffic, but never anything like this :)

Can anybody give some tips on where to start?

Is it easy for any of you to see by looking at the images if you suspect it is UART or SPI?

Any tips are greatly appreciated!

Thanks

Something like a 2-Wire Sensirion SHT15 Synchronous Protocol ? ( NOT an I2C device ) SENSIRION or similar device with Power + Shared Clock + Individual Data + Gnd

The CLOCK pin is shared, so ... Each device sends its respective data via Data 1 or via Data 2

Could your devices be individually addressable or do both devices always reply to a measurement request from master?

Probably not I2C Protocol, since I2C could share both Clock and Data lines.

You asked, if protocol could be UART or SPI ? I doubt: UART or SPI.

An oscilloscope will tell you the voltage levels, baud rate and give you an idea whether it is packet based or not.

Why not just cover the humidity sensor with a cloth that absorbs rain water. The humidity reported by the sensor should be close to 100%.

If I understand correctly, what you want to do is replace the Iponic communication controller with an Ardino and allow it to monitor the controller and send commands to the Iponic controller. I think this will certainly be an fine additional capability.

I doubt you will ever be able to discover the communications protocol without the Iponic communications controller in place. Then, beginning with an oscilloscope, you may be able to figure it out.

Once you know the voltage levels being used, you may be able to replace the Iponic communication controller with an Arduino and begin to duplicate the messaging you have seen.

Paul

Cobbler:
I am working on an arduino project that will interface with an iPonic 624 greenhouse controller. This controller does things like turn on humidifier, open vents, etc, based on outside temp/humidity.

There are two outside temp/humidity sensors: Here is a picture of one. You will notice the four wires Red, Black, Green, White.

From looking at the controller main board, the temp/humidity sensors wire into terminal blocks like this:

Both black leads > shared GND
Both red leads > shared +
Both white leads > shared CLK
Room 1 green lead > DAT1
Room 2 green lead > DAT2

Here is picture of the Iponic greenhouse controller main board:

I have researched different methods to snoop the communication going over these pins, such as turning on the device and looking for voltage on bootup. Or using a proper logic analyzer, or maybe using a USB to UART analyzer. I could toy with unplugging the sensors easily and replug them in to see if they re-establish communication.

I have used TCPDUMP to analyze lots of TCP/IP network traffic, but never anything like this :slight_smile:

Can anybody give some tips on where to start?

Is it easy for any of you to see by looking at the images if you suspect it is UART or SPI?

Any tips are greatly appreciated!

Thanks

You state, “Temp / Humidity Sensor”
But the DISM (Digital Integrated Sensor Module) monitors…

  1. Temperature
  2. Humidity
  3. CO2
  4. Light

Do have any idea if …
a) your sensors provide all four (4) data points with one request from the controller ?
b) or is each data point requested individually?

Knowing this would make decoding the protocol much less difficult.

Maybe the Bus Pirate is an interresting tool to analyze and play with your unknown bus.

|500x195

http://dangerousprototypes.com/docs/Features_overview

http://dangerousprototypes.com/docs/Bus_Pirate

$27.15 http://www.seeedstudio.com/depot/bus-pirate-v3-assembled-p-609.html?cPath=61_68

https://www.sparkfun.com/products/9544

Cobbler: The iponic controller has some shortcomings. It does not have a sensor for "rainfall". If there is rainfall then I need to close all the vents in the greenhouse, adjust the humidifier, adjust co2, etc. Because of the lack of the rainfall sensor I want to emulate sending a signal of "101% humidity" to the main controller by using the arduino to inject the signal into the main controller. By having the ability to inject the fake "101%" humidity signal (using arduino) then the controller can do all the needed steps (close greenhouse vents, adjust humidifier, adjust co2). Hope that makes sense?

If after hours, days, weeks of trying to "crack the protocol" It might be easier to:

a) When raining then ... have the Arduino over-ride the Iponic Window Relay and automatically close the windows

b) When dry then ... allow the Iponc to re-control / open the windows

I am not sure if the Iponic would get confused or not when the Arduino keeps the windows closed but the Iponic assumes the windows are still open?

Will the Iponic turn on the vent fan, as needed, to compensate for the windows being closed?

Paul_KD7HB:
If I understand correctly, what you want to do is replace the Iponic communication controller with an Ardino and allow it to monitor the controller and send commands to the Iponic controller. I think this will certainly be an fine additional capability.

I doubt you will ever be able to discover the communications protocol without the Iponic communications controller in place. Then, beginning with an oscilloscope, you may be able to figure it out.

Once you know the voltage levels being used, you may be able to replace the Iponic communication controller with an Arduino and begin to duplicate the messaging you have seen.

Paul

The way I interpret this thread is …
Th OP does not want to replace the Iponic controller.
But instead, have the Arduino send the Iponic controller a Humidity VALUE of 101% when raining.
This will make the Iponic Controller close the windows.

The Arduino would be wired between the Iponic Controller and the Humidity Sensor(s).

I suggested …
Until such time that the protocol can be hacked,
it is much easier to just have the Arduino over-ride the Iponic controller ouput relay
and allow the Arduino to hold the windows closed while raining.

Cobbler: The iponic controller has some shortcomings. It does not have a sensor for "rainfall". If there is rainfall then I need to close all the vents in the greenhouse, adjust the humidifier, adjust co2, etc. Because of the lack of the rainfall sensor I want to emulate sending a signal of "101% humidity" to the main controller by using the arduino to inject the signal into the main controller. By having the ability to inject the fake "101%" humidity signal (using arduino) then the controller can do all the needed steps (close greenhouse vents, adjust humidifier, adjust co2). Hope that makes sense?

If you do not know the communication protocol then how did you learn that sending an RH value of 101% will close the windows?

An RH value of 101% is typically not a valid RH value.

mrsummitville: If you do not know the communication protocol then how did you learn that sending an RH value of 101% will close the windows?

An RH value of 101% is typically not a valid RH value.

The iponic controller has a GUI where the user can set all kinds of actions to take based on co2, temp, humidity inputs.... that is how I know it has the capability. It does not have sensors for things like rainfall, latches, or any kind of custom input. I have since learned that the external sensor is based on the ATmega16A AVR! http://www.atmel.com/images/atmel-8154-8-bit-avr-atmega16a_datasheet.pdf

JTAG (IEEE std. 1149.1 Compliant) Interface ̶ Boundary-scan Capabilities According to the JTAG Standard

Byte-oriented Two-wire Serial Interface ̶ Programmable

Serial USART ̶ Master/Slave SPI Serial Interface ̶ Programmable Watchdog Timer with Separate On-chip Oscillator

Cobbler: The iponic controller has a GUI where the user can set all kinds of actions to take based on co2, temp, humidity inputs.... that is how I know it has the capability. It does not have sensors for things like rainfall, latches, or any kind of custom input. I have since learned that the external sensor is based on the ATmega16A AVR! http://www.atmel.com/images/atmel-8154-8-bit-avr-atmega16a_datasheet.pdf

JTAG (IEEE std. 1149.1 Compliant) Interface ̶ Boundary-scan Capabilities According to the JTAG Standard

Byte-oriented Two-wire Serial Interface ̶ Programmable

Serial USART ̶ Master/Slave SPI Serial Interface ̶ Programmable Watchdog Timer with Separate On-chip Oscillator

Yes, as I had stated way back in Message #3 and Message #4 of this thread, this is 2-Wire Digital Synchronous Communications.

Now, it is your job to decide: a) Control the Window opening & closing relay directly with the Arduino Digital Output OR b) Decipher the data packets yourself with the tools others have recommended OR c) request, and possibly receive, the Synchronous Comm Protocol details from iPonic

Thank you very much @mrSummitville I really appreciate your input and breaking it down like that. I've learned a lot already from your comments.

I tried to get the political information from them but I could not. I've ordered a bus pirate to play around with that.

Thx again all!

you may find that trying to hack someone else's program and decipher what they did is a lot of work. once you have cracked it, then you will need to write your own code to either (A) be compatible (B) fake our (C) over ride their stuff.

if you look at the programming you will have to do to interface with their stuff, you might find that it is less effort to start with a clean sheet, put in your own sensors and control the devices with your own program.

another note is that your fake sensor input will not act like a real sensor and it will cause any PID control to fail. part of PID, maybe the most important part, is the input signal. the controller responds to that much like you do on a curvy mountain road, in the dark, in the rain..... it anticipates what to do next by what results happened. your input will jump around.

you could create your interface and either let your control activate the thing, or you could allow the iPonic to control. a simple repeater circuit.

There are a lot of Arduino based greenhouse and gardening sites and offerings. making your own, 'work alike' to replace the iPonic

I offer that you read about Volkswagon and how they faked out the 'system' by having multiple overlaid programs that would do different things based on sensor inputs and value ranges.

read about the... I think it was AUDI, some many years ago in which the 'stomp the pedal by wire' control loop would mash the gas pedal man more than one car wound in the swimming pool after crashing though the garage door and then the rear garage wall. THAT affected all vehicles and today, you have to have the brake pedal depressed in order to engage the transmission. not sure, but I always that that is was a 'reset windup' and they lacked an anti-reset windup loop in their PID.

look at a car environmental control. you set 70°F and the control uses the fan speed to maintain temperature. you sett the fan speed to a fixed speed and it then uses a water control valve to regulate temperature by altering available heat.

what I am getting at, is that if you fake out one part, the system may compensate by doing something else.