Ac infinity controller 67 Bluetooth temp, humidity, fan pwm

Just curious if anyone has tried or succeeded at controlling an ac infinity Bluetooth controller with home assistant. Any info or links would be greatly appreciated.

3 Likes

This I need this lol… I’ve seen my sensors in HA but not sure how they showed up… currently they are “down” not reading anything

2 Likes

so that is promising… You own this unit, and it has shown in HA?

1 Like

I too am looking for help with this.
I have gotten HA to “see” the bluetooth device(controller 67) by using the bluetooth tracker.
That is not much use to me but I needed a place to start.
So when I plug in the controller it is recognised as being “home” and when I unplug the controller it is reported by HA as “away”.

The hard part That I am very unfamiliar with is how to send commands to the controller from HA>
I was able to connect to the controller in Terminal and got this:

But I am not sure where to go from here. Any help would be appreciated.

1 Like

Did you get any further with this?

I managed to connect to it using nRF Connect android app - the output is mostly the same as you received from gattool. If I then fire up the AC Infinity app and bond it to the device, that 70d51002 characteristic gets a property of NOTIFY and the value starts updating every 1 second.

Also if I then tap into the graph tab of the ac infinity app, i get huge strings for the value here, updating very quickly - so I guess that is the historic information too.

I think a similar approach to this is needed here - ESPHome definition to pick up readings from the PH-260BD water PH/EC/TDS/Temp sensor - https://www.aliexpress.com/item/1005002707585119.html / https://www.aliexpress.com/item/4001143771176.html · GitHub

Maybe we can sniff the packets required to initiate this characteristic then get the sensor data broadcasting without the app also running. It does look like all the required pieces exist for this to happen, including writing data back for setting fan speeds.

I would be interested to hear from @itzyoungen about how your sensor data may have ended up in HA - guessing you had a bluetooth tracker of some sort running and opened the ac infinity app?

Not sure if any of this is useful, I’ll prod at it a little more tomorrow and attach a wireshark trace of what the app is up to.

1 Like

There are two ways that I am aware of for this – see if you can decompile the android apk app to control this device or if you actually have an Android, use the HCI dev logs and WireShark. Good video I came across recently on this: How To Reverse Engineer A Bluetooth Device - YouTube

Unfortunately I don’t have one of these fans to test it with (my fan has physical dial which I am hoping I can replace with an ESP doing PWM but haven’t looked into it yet)

Thanks @bjeanes that has helped.

I seem to be making some progress, a gatttool command like
gatttool -b C9:E4:CE:XX:XX:XX -t random --char-write-req --handle=0x0020 --value=0012 --listen

then

char-write-req 0x001d a5000008001327ca00120000000100000001ced0

seems to turn the fan off briefly ( on closer inspection it seems to be crashing it )

I also have a list of btatt.opcode.method values that my android app was sending that I’m trying to decipher

a50000 0200 0e2397 00 0120 308345

a50000 0300 01e548 00 01313233f0ea
a50000 0300 01e548 00 01313233f0ea
a50000 0300 05a5cc 00 01313233f0ea
a50000 0300 0b4402 00 01313233f0ea
a50000 0300 10e758 00 01313233f0ea
a50000 0300 087461 00 0111121354a8
a50000 0300 0d24c4 00 0111121354a8

a50000 0400 04307d 00 0110020320a0b7
a50000 0400 04307d 00 0110020320a0b7
a50000 0400 0cb175 00 0110020320a0b7

a50000 0800 07757f 00 01101112131415 1617713e

a50000 0800 0994b1 00 1200 0000 01 00 00 00 00 def1
a50000 0800 c3ecb7 00 1200 0000 01 00 00 00 00 def1
a50000 0800 0aa4d2 00 1200 0000 01 00 00 00 01 ced0
a50000 0800 c58c71 00 1200 0000 01 00 00 00 01 ced0

a50000 0900 0302cb 00 030107 16 05 11 03 01 07 1a b4 af


a50000 0e00 06d7fe 00 1116051016111f 00 00 27d3 0000 d208 72f6
a50000 0e00 0f46d7 00 1116051016111f 00 00 27d5 0000 d208 bf73```

Any idea how to get past the “Failed to pair” “AuthenticationFailed”?

With gatttool? Try using -t random when you connect
gatttool -I -t random -b C9:E4:CE:XX:XX:XX

I was trying to connect using bluetoothctl @jayrama

just managed to connect to the ACI-Controller and was able to list the attributes.
Hopefully this is helpful to someone more knowledgeable than myself:

[ACI-UniversalController]# list-attributes 
Primary Service (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000a
	00001801-0000-1000-8000-00805f9b34fb
	Generic Attribute Profile
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000a/char000b
	00002a05-0000-1000-8000-00805f9b34fb
	Service Changed
Descriptor (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000a/char000b/desc000d
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration
Primary Service (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e
	0000180a-0000-1000-8000-00805f9b34fb
	Device Information
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char000f
	00002a29-0000-1000-8000-00805f9b34fb
	Manufacturer Name String
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0011
	00002a24-0000-1000-8000-00805f9b34fb
	Model Number String
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0013
	00002a27-0000-1000-8000-00805f9b34fb
	Hardware Revision String
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0015
	00002a26-0000-1000-8000-00805f9b34fb
	Firmware Revision String
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0017
	00002a28-0000-1000-8000-00805f9b34fb
	Software Revision String
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service000e/char0019
	00002a23-0000-1000-8000-00805f9b34fb
	System ID
Primary Service (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
	70d51000-2c7f-4e75-ae8a-d758951ce4e0
	Vendor specific
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c
	70d51001-2c7f-4e75-ae8a-d758951ce4e0
	Vendor specific
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
	70d51002-2c7f-4e75-ae8a-d758951ce4e0
	Vendor specific
Descriptor (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration
Primary Service (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
	0000fe59-0000-1000-8000-00805f9b34fb
	Nordic Semiconductor ASA 
Characteristic (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
	8ec90003-f315-4f60-9fb8-838830daea50
	Vendor specific
Descriptor (Handle 0x0000)
	/org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024
	00002902-0000-1000-8000-00805f9b34fb
	Client Characteristic Configuration

Here are the Vendor specific attributes I was able to read using gatt in the submenu of bluetoothctl and using “attribute-info”

[ACI-UniversalController:/service0021/char0022]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
[ACI-UniversalController:/service001b]# read
Unable to read attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
[ACI-UniversalController:/service001b]# attribute-info 
Service - Vendor specific
	UUID: 70d51000-2c7f-4e75-ae8a-d758951ce4e0
	Primary: yes
[ACI-UniversalController:/service001b]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c
[ACI-UniversalController:/service001b/char001c]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001c Value:
  a5 00 00 04 02 1e e5 64 00 01 11 12 15 18 8b ee  .......d........
  a5 00 00 04 02 1e e5 64 00 01 11 12 15 18 8b ee  .......d........
[ACI-UniversalController:/service001b/char001c]# attribute-info 
Characteristic - Vendor specific
	UUID: 70d51001-2c7f-4e75-ae8a-d758951ce4e0
	Service: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
	Value:
  a5 00 00 04 02 1e e5 64 00 01 11 12 15 18 8b ee  .......d........
	Flags: write-without-response
	Flags: write
	MTU: 0x00f7
[ACI-UniversalController:/service001b/char001c]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
[ACI-UniversalController:/service001b/char001e]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e Value:
  a5 10 00 13 02 1e 27 cd 00 01 11 01 00 12 01 06  ......'.........
  15 04 00 00 07 08 18 05 01 00 1d 10 00 61 f9     .............a. 
  a5 10 00 13 02 1e 27 cd 00 01 11 01 00 12 01 06  ......'.........
  15 04 00 00 07 08 18 05 01 00 1d 10 00 61 f9     .............a. 
[ACI-UniversalController:/service001b/char001e]# attribute-info 
Characteristic - Vendor specific
	UUID: 70d51002-2c7f-4e75-ae8a-d758951ce4e0
	Service: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b
	Value:
  a5 10 00 13 02 1e 27 cd 00 01 11 01 00 12 01 06  ......'.........
  15 04 00 00 07 08 18 05 01 00 1d 10 00 61 f9     .............a. 
	Notifying: no
	Flags: notify
	MTU: 0x00f7
[ACI-UniversalController:/service001b/char001e]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020
[ACI-UniversalController:/service001b/char001e/desc0020]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e/desc0020 Value:
  00 00                                            ..              
  00 00                                            ..              
[ACI-UniversalController:/service001b/char001e/desc0020]# attribute-info 
Descriptor - Client Characteristic Configuration
	UUID: 00002902-0000-1000-8000-00805f9b34fb
	Characteristic: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service001b/char001e
	Value:
  00 00                                            ..              
[ACI-UniversalController:/service001b/char001e/desc0020]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
[ACI-UniversalController:/service0021]# read
Unable to read attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
[ACI-UniversalController:/service0021]# attribute-info 
Service - Nordic Semiconductor ASA 
	UUID: 0000fe59-0000-1000-8000-00805f9b34fb
	Primary: yes
[ACI-UniversalController:/service0021]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
[ACI-UniversalController:/service0021/char0022]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
[ACI-UniversalController:/service0021/char0022]# attribute-info 
Characteristic - Vendor specific
	UUID: 8ec90003-f315-4f60-9fb8-838830daea50
	Service: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021
	Notifying: no
	Flags: write
	Flags: indicate
	MTU: 0x00f7
[ACI-UniversalController:/service0021/char0022]# select-attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024
[ACI-UniversalController:/service0021/char0022/desc0024]# attribute-info 
Descriptor - Client Characteristic Configuration
	UUID: 00002902-0000-1000-8000-00805f9b34fb
	Characteristic: /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022
	Value:
  00 00                                            ..              
[ACI-UniversalController:/service0021/char0022/desc0024]# read
Attempting to read /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024
[CHG] Attribute /org/bluez/hci0/dev_F6_61_CF_9A_AB_6D/service0021/char0022/desc0024 Value:
  00 00                                            ..              
  00 00                                            ..              
[ACI-UniversalController:/service0021/char0022/desc0024]# 

I saw this fan online and wondered if it’s HA compatible…few seconds later found this thread. Have any of you figured out a way to control it through HA without the cloud?

1 Like

Is there a way of doing this with the cloud?

Just got a Controller 69 and am looking to try and wade into this. @hivemind do you have any details as to how you were able to discover and pair with this in gattool or bluetoothctl? [edit: turns out my bluetooth stack was blown up, sudo systemctl restart bluetooth.service got me back up and running]

I’ve gone and run the current Android APK through a couple of analysis/decompilation tools and have dropped the results here.

Great idea, the definitions there could be enough to get this working.

Did you manage to send any commands? I can still only make it crash.

Also got the 69 controller & bluetooth adapter. Following this thread!

Perhaps we should all push this as a feature request as a lot of other Bluetooth integrations being updated at the moment?

I think we could have some success there with reading sensor values, but if we want to also send payloads like new temp/hum set points then I’m guessing it will quickly become out of scope.

I believe there is enough info in this thread and the definitions that @luma has provided to get this working. The strings we are getting back from the vendor specific attributes address should be the sensor and variable values and writing to 0x001d seems to be triggering something on the controller side. At first glance it appears that perhaps entire config is sent as an array each time a change is made.

Is anyone aware of any BLE integration contributors or resources we could pull in for a quick review? Sorry to tag you again @bjeanes, in your opinion, has any of the additional info in this thread the past couple of months bought us any closer to a solution?

Happy to contribute funds to send a controller to someone who can help :slight_smile:

I’m sure there is gold in that APK, though it is definitely pretty thick. I’d try to find the code paths that set/read a value and follow it down to the actual BLE characteristics it is using. I can’t help more than that, sorry.

Would also happily contribute to send a controller to someone who can help