I didn’t think it was going to be easy, and indeed it is not. I built the same setup as for my Hitachi AC units, added the debug_discovery text sensor and buttons and gave it a go. But the ESP32 board doesn’t start.
When unplugged, I checked the voltage of the heater’s CN7 pins:
When plugged, 5 and 6 get shorted, and I measure ~2.4V between 1 and 5. I have tested the same setup and buck converter on a climate split and it was working.
I don’t have an oscilloscope so I’ll leave it at that for now, and try not to fry the motherboard of the heater.
Thank you for your efforts in reverse-engineering the Yutampo h-link protocol.
Were you able to figure out which device is supposed to be connected to the CN7 connector on the Yutampo? I have found several adapters listed as compatible with the Yutampo series, such as the ATW-HCD-01 or ATW-TAG-02, but all of them appear to use the 2-wire H-Link connection.
As far as I understand, the ATW-HCD-01 is an adapter that converts the 6 pins CN7 H-Link connection into a 2 wires one, on which you can plug the ATW-TAG-02.
On Hitachi ACs, pin 6 controls whether the AC accepts ST commands. When pin 6 is logical HIGH (the default value, that’s what you measured), the AC accepts and responds only to MT (read AC status) commands. When it is LOW (connected to GND), the AC handles both MT and ST requests. Pin 3 is also NC in Hitachi ACs CN7, so in general the connector pinout looks quite similar.
Therefore, even without pins 6 and 5 shorted, you might still observe some UART communication from the device. The main question though is what protocol is being used and whether it can be reverse-engineered without a reference device.
Thanks for the insight. Unfortunately, when I short 5 and 6, pin 1 doesn’t deliver 12V anymore and I am not able to power the esp32. If I understand correctly, the fact that pin 6 is HIGH means that I wont be able to control the water heater features, and would only be able to read them at best (if I can make some sense off the protocol). Disapointing, but an interesting hack nevertheless.
My next step will be to scratch current setup and restart with some lower level logic analysis. I don’t want to polute this thread with non-AC related stuff so I might reach out in DM for a couple of questions, and will update the community if I find or make anything useful.
that is correct. I asked my supplier on how to integrate or get an app on the Yutampo and got this chain ATW-HCD-01 → ATW-TAG-02 → AHP-SMB-01. I would love an integration to controll and / or read temperatures / modes from the tank.
Hi there, i like to join in with my problem. Just follow you guide (thanks for your work @lumixen) and already got 2 AC Units working just fine. (RAK-35RPC & RAK-18RPB) - on the third one i (RAK-18RPB) - i always got the message
ok just found out that my two RAK-18RPB AC Units have 2 different boards "RRZK36496 V1" & "RRZK36496 V2"- after some research, it seems that V1 missing some sensors, but it let me start "cool"/"heat" - if you have a solution, great, otherwise i going to live with it ^^
Problem:
The AC sends binary data proactively without waiting for MT requests from the ESP. I never get ASCII responses like MT A P=xxxx. Same MT request returns completely different binary data each time. RX buffer overflows on every cycle.
at the beginning i also used the TXS0108E - i think OE Port used to much power to start, which the CN7 doesn't provide.
After the switch to the simple logic level shifter my RAK-35RPC working fine.
When you unit board have 1 beside RRZK3496 - you will have the same issus as my problem mention above. (still working - but with "warnings in the logs)
Thanks a lot for all your work on this project!
Works almost perfectly on old multisplit with 3 heads. 2 of them are:
RAS-L36X2 (in HomeAssistant) but it's RAK-35QH8(B) on device sticker
RAS-FF20X2 (in HomeAssistant), no access to device sticker
Works everything except ... swing. ESP logs shows that 0x0014 always reporting NG. Tried both ST/MT - no difference, always NG. This model seems has swing somewhere else, and I need help/ideas to figure this out.
What I've tried:
debug discovery with swing off and then with swing on - no difference. Here is what I've got so far:
Changed to 0900:5241532D4C3336583220
Changed to 0302:00
Changed to 0301:FFFF
Changed to 0201:0000
Changed to 0102:1E
Changed to 0101:7E
Changed to 0100:1A
Changed to 0006:00
Changed to 0005:7E
Changed to 0003:0017
Changed to 0002:01
Changed to 0001:0040
Changed to 0000:01
Tried to push 0x0001 / 0x0000 to registers 0x0007 / 0008 / 0009 / 0010 / 0013 / 0014 - always NG, both ST/MT
Tried #2 with Remote Controller locked / unlocked - no difference
Any other ideas what can I test ? Looks super strange that function works from RC but invisible via HLink And that is really needed feature in our apartment...
Thanks a lot for your reply, very helpful. I have the exact same board (RRZK3496-1) and I'm using an Adafruit ADA757 (BSS138 4-channel bidirectional level shifter). Wiring: CN7 pin 1 → 12V step-down, pin 2 (RX) → B1, pin 4 (TX) → B2, pin 5 → GND, pin 6 → GND. ESP32 GPIO16 → A1, GPIO17 → A2. HV = 5V, LV = 3.3V, common GND. The AC never responds (RX buffer empty, timeouts on every MT). Could you share your exact wiring and confirm if you had to do anything specific for the "-1" board revision? Do you know the ADA757 or have any info on it?
Thanks for the recommendation. I switched from a TXS0108E to an Adafruit ADA757 (BSS138 4-channel bidirectional level shifter). The oscillation noise is gone, but the AC is now completely silent — RX buffer empty and timeouts on every MT request. Wiring: CN7 pin 1 → 12V step-down, pin 2 (RX) → B1, pin 4 (TX) → B2, pin 5 → GND, pin 6 → GND. ESP32 GPIO16 → A1, GPIO17 → A2. HV = 5V, LV = 3.3V, common GND. My board is RRZK3496-1 (RAK-35RPC). Is the ADA757 a suitable replacement for your component, or do you see anything obviously wrong?
Unfortunately, I can’t provide more context on this. It seems you already did a decent investigation, and your board may simply not expose swing controls through h-link for some reason.
It could actually be that the remote controller offers more functions than the h-link interface. For example, I wasn’t able to set the particular swing louver direction using the h-link protocol, even though it is possible through the remote.
Unfortunately, I’m not able to give you additional details on missing features in certain board revisions like RRZK36496, or for particular AC models. It seems that different models might expose a different subset of available features. I might need to adjust the component to scan dynamically on launch and exclude unsupported addresses from the polling cycle.