Chromagen Midea 170L Heat Pump Hot Water System - Modbus Integration Success

darkorb · August 25, 2025, 7:55am

I only have the three modes I’d expect, it seems to wander off into “mode 0” of it’s own accord when not running. If I set it to Eco, then turn it off it stays with mode set to Eco showing correctly for some amount of time before reverting back to “mode 0”.

With regards the other stuff here is a current read out

and the values I got from the HWC via it’s query menu are as follows;

T5U: 15°C T5L: 13°C T3: 8°C T4: 11°C TP: 10°C TH: 9°C

So they do indeed map correctly as expected to the readout (also yikes my water got cold ) - Edit: oh with the exception of T4. Which is interesting as I can actually confirm it is 8°C outside as reported via modbus, according to my weather station - so if anything the query menu is actually wrong… I’ll keep an eye on that and compare the two over the next day.

My model has a max temp. that can be set of 60C per the document I got so there is some difference there between models;

I can prod around tomorrow a bit more when it’s not pitch dark outside and once I’m sure my other half isn’t going to murder me for us having no hot water in the morning

doenau · August 25, 2025, 8:10am

I’ve just updated the modbus test script so you can try setting different modbus values on the register and see what happens.
See below example output.
modbus_test.py

python .\modbus_test.py 192.168.1.80 502 -t

Water Heat Pump Status - 192.168.1.80:502

Connected successfully

Register Name Raw Value Processed Value Description

0 Power State 0 (0x0000) OFF On/Off Status

1 Operating Mode 4 (0x0004) E-Heater Heat pump mode
2 Target Temperature 65 (0x0041) 65 °C Set point temperature
101 Tank Top Temperature (T5U) 80 (0x0050) 25.0 °C Top of tank temperature
102 Tank Bottom Temperature (T5L) 154 (0x009A) 62.0 °C Bottom of tank temperature
103 Condensor Temperature (T3) 77 (0x004D) 23.5 °C Condensor temperature
104 Outdoor Temperature (T4) 76 (0x004C) 23.0 °C Ambient outdoor temperature
105 Exhaust Gas Temperature (Tp) 28 (0x001C) 28 °C Compressor exhaust temperature
106 Suction Temperature (Th) 81 (0x0051) 25.5 °C Compressor suction temperature

Successfully read 9/9 registers

============================================================

OPERATING MODE TEST MODE

This will attempt to write values to the Operating Mode register (address 1)

to discover undocumented modes.
WARNING: Only use this on a test system - changes may affect operation!

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 0
Attempting to write 0 to Operating Mode register…
Write failed: ExceptionResponse(dev_id=1, function_code=134, exception_code=3)
Exception Code: 3 - Illegal Data Value

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 1
Attempting to write 1 to Operating Mode register…
Write successful!
Reading back to verify…
Verified: Mode is now 1

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 2
Attempting to write 2 to Operating Mode register…
Write successful!
Reading back to verify…
Verified: Mode is now 2

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 3
Attempting to write 3 to Operating Mode register…
Write failed: ExceptionResponse(dev_id=1, function_code=134, exception_code=3)
Exception Code: 3 - Illegal Data Value

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 4
Attempting to write 4 to Operating Mode register…
Write successful!
Reading back to verify…
Verified: Mode is now 4

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 5
Attempting to write 5 to Operating Mode register…
Write failed: ExceptionResponse(dev_id=1, function_code=134, exception_code=3)
Exception Code: 3 - Illegal Data Value

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 6
Attempting to write 6 to Operating Mode register…
Write failed: ExceptionResponse(dev_id=1, function_code=134, exception_code=3)
Exception Code: 3 - Illegal Data Value

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 7
Attempting to write 7 to Operating Mode register…
Write failed: ExceptionResponse(dev_id=1, function_code=134, exception_code=3)
Exception Code: 3 - Illegal Data Value

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 8
Attempting to write 8 to Operating Mode register…
Write failed: ExceptionResponse(dev_id=1, function_code=134, exception_code=3)
Exception Code: 3 - Illegal Data Value

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 9
Attempting to write 9 to Operating Mode register…
Write failed: ExceptionResponse(dev_id=1, function_code=134, exception_code=3)
Exception Code: 3 - Illegal Data Value

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): r
Current mode: 4 (E-Heater)

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): 1
Attempting to write 1 to Operating Mode register…
Write successful!
Reading back to verify…
Verified: Mode is now 1

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): r
Current mode: 1 (Eco)

Enter mode value to test (0-255, ‘q’ to quit, ‘r’ to read current): q

TEST SUMMARY (11 attempts)

Mode 0: Exception 3: Illegal Data Value
Mode 1: SUCCESS
Mode 2: SUCCESS
Mode 3: Exception 3: Illegal Data Value
Mode 4: SUCCESS
Mode 5: Exception 3: Illegal Data Value
Mode 6: Exception 3: Illegal Data Value
Mode 7: Exception 3: Illegal Data Value
Mode 8: Exception 3: Illegal Data Value
Mode 9: Exception 3: Illegal Data Value
Mode 1: SUCCESS

Successfully wrote modes: 1, 2, 4, 1
Please document what each mode does on your heat pump display!
Consider reporting findings at: GitHub · Where software is built

Failed attempts: 7
Exception 3: Illegal Data Value: 7 occurrence(s)

darkorb · August 25, 2025, 9:47am

Reads the same as yours on mine. I can’t set mode 0, it only sets that itself for some reason and always after going from running → off. Also noticed there is something in read 107. Reads 480 right now, dunno what it relates to.

doenau · August 26, 2025, 8:08am

ok another update to the python script.
use -m at the end, once polled, hit enter twice to scan all registers
i also get 480 returned for register 107

ill_hey · August 27, 2025, 2:39am

sorry nevermind, i found the instructions eventually! might be worth a mini description in the github readme?

got exactly the same results as you both above for values and modes. my port was set as 8899 fwiw.

doenau · August 27, 2025, 9:59am

For those interested, you can find the modbus test script (modbus_test.py) and it’s documentation (README_Modbus.md) at the following link: https://github.com/0xAHA/Midea-Heat-Pump-HA/tree/main/files

This may help check other units for additional operating modes (vacation mode, cleaning mode, etc).

Please use the github issues page at the repo to let me know if you find anything useful.

darkorb · August 28, 2025, 9:14pm

Sorry got busy with life, that register changes when I change the mode. Once I have some more time this weekend I’ll pop all the stuff from my model into Github issue for keeping.

nomis52 · September 13, 2025, 1:53am

I’ve got what seems to be a similar unit to @darkorb but still can’t get it to talk modbus. I’ve tried both wiring setups and with the EW11 (output below) and direct using a DSD TECH SH-U11 using mbpoll

(modbus-env) simon:~/homelab/chromagen $ ./modbus_test.py  chromagen.d.ne4.org 8899 
🌡️  Water Heat Pump Status - chromagen.d.ne4.org:8899
=====================================================================================
✅ Connected successfully

Register Name                                Raw Value    Processed Value    Description
-------------------------------------------------------------------------------------
No response received after 3 retries, continue with next request
0        Power State                         EXCEPTION    -                  On/Off Status
Repeating....
1        Operating Mode                      EXCEPTION    -                  Heat pump mode
No response received after 3 retries, continue with next request
2        Target Temperature                  EXCEPTION    -                  Set point temperature
No response received after 3 retries, continue with next request
101      Tank Top Temperature (T5U)          EXCEPTION    -                  Top of tank temperature
No response received after 3 retries, continue with next request
102      Tank Bottom Temperature (T5L)       EXCEPTION    -                  Bottom of tank temperature
No response received after 3 retries, continue with next request
103      Condensor Temperature (T3)          EXCEPTION    -                  Condensor temperature
No response received after 3 retries, continue with next request
104      Outdoor Temperature (T4)            EXCEPTION    -                  Ambient outdoor temperature
105      Exhaust Gas Temperature (Tp)        EXCEPTION    -                  Compressor exhaust temperature
106      Suction Temperature (Th)            EXCEPTION    -                  Compressor suction temperature
-------------------------------------------------------------------------------------
Successfully read 0/9 registers

Is there something you had to enable on the unit to activate modbus support?

doenau · September 13, 2025, 1:56am

Here’s my instructions for setting up the EW-11A.
EW-11A installation

Also not sure where you were getting the chromagen.d.ne4.org name from - try just using the LAN address that it gets by DHCP on your wifi network

nomis52 · September 13, 2025, 2:16am

Sorry chromagen.d.ne4.org is the hostname of the EW11 device that points to the static IP of the EW11. The web UI loads fine.

It’s frustrating because the port is even labeled modbus! Connectivity checking with a multimeter shows the wiring is connect.

Here are my settings, can you spot anything that I’ve missed?

doenau · September 13, 2025, 2:33am

The EW11 settings look ok.
For the modbus connection, make sure that the GND from the modbus connector on the water heater is also connected to the GND pin from your DC power supply.
If that’s OK, swap your RS485 A & B wires over - in case they are incorrect.

nomis52 · September 13, 2025, 2:35am

Yup, I’ve tried both of those as well. I have the EW11A0 which is a slightly different connector (it has the reset button) but I’ve tripled checked the wiring.

I’m considering contacting Chromagen support to have them come out and check the modbus port isn’t fried.

doenau · September 13, 2025, 3:07am

Coincidentally I also just installed one. The wiring is different, even though it is also a 4-pin connector.
From left to right, looking at the screws, it is:

Modbus A
VCC
GND
Modbus B

Are you getting anything back on the status page?

dannymanno · October 27, 2025, 12:28pm

Hey Team,
After a few goes of trying to make the RS485 to Wifi EW11 to work i decided i needed something more so i went out and bought a RS485 to USB, did a bunch of digging, and now i’m reporting back with my findings and reaching out to see if anyone else could help me build on what I’ve found.

So I have a different version of the 170L Chromagen Midea (that i know at least one other person has).
Instead of a wire poking out the side with Modbus, or even a header on the board with Modbus, I’ve discovered we instead get only “Wire Control CN30”, that still runs on RS485, but instead communicates at 600 baud, seems to run a custom protocol, and spits out 33 Bytes of data every 4 seconds.

After capturing a bunch of data I’ve worked out some of the protocol structure detailed in the excel document, screenshot below (Note: Decimal and hex)
Lastly, CRC seems to be calculated as: (168 - "Sum of bytes 1 to 31") MOD 256

Hex:

Any thoughts on a good next step other than capturing more data?
And any idea how I can use the EW11 to capture the data? It seems to be changing it when connecting using Telnet to port 23 and then viewing as hex (Worth calling out that even though it’s only 30 bytes now it seems to have all the key data (Missing bytes from the original frame 5,6 and 8, and checksum calc becomes (144 - "Sum of bytes 1 to 29") MOD 256 ):

doenau · October 27, 2025, 8:32pm

The model number on the sticker looks the same as mine so it seems odd you don’t have the same connector. It would be looked up on the outside (left as you face the pcb). Check out my photos here: Midea-Heat-Pump-HA/README_Hardware.md at 2c21b8ee4e8f2bb62d9621735fa88d0329789eed · 0xAHA/Midea-Heat-Pump-HA · GitHub

But to answer your question, download MoodbusPoll. You can set it to log data.
Alternatively, feed your info to Claude and ask it to write a python script using pymodbus to monitor/check/compare and suggest what to do

dannymanno · October 28, 2025, 10:30am

Yeah nothing on the left hand side nor nothing on the PCB.
Modbus Poll doesn’t work as it’s not modbus signaling in my case, unless I’m missing something?
Good idea, I’ll see what i can do with Claude.

LoneWombat47 · November 26, 2025, 3:46pm

Hi Guys,

So I’m from Belgium and I recently received my digital smart meter.
People that have solar panels and heat their house solely on electrical power will know what I mean when I say this is not great …

That being said I’m looking to integrate as much of my big electricity spenders in home assistant as possible.
One of those spenders is my Heat Pump Boiler.
After some internet searching I found that my Heat Pump Boiler is a Midea Clone (later also found the sticker on the inside of the circuit panel to confirm that).
The Brand / Type op the boiler is a Sanistage DSW300 (Sticker on the inside says Midea RSJ-20/300RDN3-F1-JT).
After opening up the unit and exposing the circuitbord I found that the display panel on the outside has 5 wires connected, split into 2 connectors on the board.
I think (and hope) that the white and red wire are the modbus wires, as these are labeled A and B.

I ordered the EW-11 module and will connect these 2 wires to it and hope it works.
Does anybody else have any experience with this type of unit?

Thanks in advance!

doenau · November 27, 2025, 8:30pm

Does your unit have a cable loom on the outside of the pcb enclosure like the one shown here?

github.com/0xAHA/Midea-Heat-Pump-HA

README_Hardware.md

720f7c761

# 🔥 Midea Heat Pump ↔️ Modbus Hardware Integration

*Transform your Chromagen Midea 170L heat pump into a smart, Home Assistant-controlled water heater entity!*

---

## 🎯 What You'll Achieve

This readme is the associated documentation for the Modbus <-> WiFi hardware required to make your HWS reachable in Home Assistant.

## 🛠️ Hardware Requirements

| Item                               | Description                                 | Link                                                        |
| ---------------------------------- | ------------------------------------------- | ----------------------------------------------------------- |
| **EW-11A RS485 to WiFi**     | The magic bridge (EW11A-0 + 4pin connector) | [AliExpress](https://www.aliexpress.com/item/32916128353.html) |
| **240VAC to DC PSU**         | 12V recommended (5-18V supported)           | *Your local electronics supplier*                         |
| **Jumper wires & terminals** | For neat connections                        | *Hardware store*                                          |

---

This file has been truncated. show original

I’ve never tested it but I’d always thought the PQE connection might be modbus.
I’d suggest monitoring register 0 (power on/off) and register 1 (mode - gives values for 0, 1, 3 for eco/hybrid etc).

Once you’ve confirmed your modbus connection, my integration will work a treat.

LoneWombat47 · November 28, 2025, 8:02am

Hi,

Thanks for the reply, That sounds promising!

I have also taken this picture when I was inspecting the PCB box

The black connector on the right is connected to the integrated display on the outside.

You mention the PQE wires might be the Modbus connection, and not the AB wires.
How would I connect these to the EW-11A connector?
All the guides speak of grey / black / yellow, but mine seem to be brown / black / yellow.
Do you think that the brown wire is just a regional thing and that brown wire = grey wire?

doenau · November 29, 2025, 12:11am

No idea on the colours tbh.
And as for A/B vs P/Q I don’t know.
Try both - assuming there’s no wild voltages on them.