Midea A/C via local XYE

Looks like my unit uses frames C0 and C3 byte positions 28 and 29 as the EEV Low and EEV High. You get a better picture of what the unit is doing with byte position 19, when the unit is active vs idle.

To save some typing Reverse Engineering Senville/Midea SComms - #18 by MidATRIX

I hope this is standard but I don't think it will be since I recently learned that mini-splits typically do not have an indoor EEV. I have both an indoor EEV and a outdoor EXV (This is how my manuals document them and we all know how accurate the manuals are)

I can try and help decode if yours is different.

Can you detail the connections you've made to the back of your wired controller? I have the same model and I'm likewise trying to tap into XYE while keeping the controller functional on HAHB.

Slightly adjacent, not the same protocol, but maybe useful for people working on local Midea/ESPHome/RS485 integrations.

I published an ESPHome Modbus RTU package for a Mitsui-branded Midea-platform hydronic heat pump:

This is not XYE / midea_xye. It is RS485 Modbus RTU on a hydronic heat pump using a Waveshare ESP32-S3-RS485-CAN board.

Current scope:

  • read-only runtime/configuration/diagnostic sensors
  • guarded write for the validated water setpoint register
  • no cloud dependency
  • tested on real hardware

Sharing it here only because the general theme is similar: local Midea integration via ESPHome and wired bus instead of cloud/app-only control.

For Clivet / Riello / Immergas / Airwell / Hyundai / Mundoclima and other Midea-platform hydronic units, start read-only and validate the register map against the wired controller before enabling writes.

One pin carries a 500Hz clock signal and the other carries data. It must be actively driven, otherwise the clock and data pin sit idle at 5V.

I bought one of those inverter testers from Aliexpres - that helps a lot with reverse engineering (even though the display is in Chinese).

Here is what I have so far: https://medium.com/@florian.mckee/reverse-engineering-mideas-odu-diagnostic-port-af603e159053

Nice! That looks like I2C communication. Which makes sense as the inverter tool manual labels the pins as 5V, GND, SCL, SDA i.e. latter two refer to I2C.

I spent a little time digging into the HA/HB thermostat interface on my KJR-120W/MBF. It uses Home Bus System (HBS) signalling, via MM1192 interface chip. So, not at all standard RS-485.

Since I don’t have any HBS equipment, I tapped the upstream pins on the interface chip, captured it with my scope at 48000 baud (double the actual rate) and fed it into Claude for analysis.

Bottom line: HA/HB does use the XYE protocol. Sort of. They’ve added 4 bit framing, where every byte is transmitted as 10 bits with a couple of extra zeroes stuffed in, presumably for improved clock recovery.

I captured one previously unknown packet, a 32-byte status broadcast (command code 0xD0) containing essentially everything you see on the thermostat screen. For my own purposes, I don’t see any advantage to using HA/HB over the XYE interface on my air handler.

Hi Everyone,

Do I need some speficifc hardware to connect to Midea MO1SE-H36B-2A controller board which is 16023000016273? I have esp32 and breadboards. Can I not use those to connect directly?

Do I need something like this along with ESP32?

Hi all. I have a Carrier 38MURA/40MUAA that I am hoping to collect some more information on, and maybe drive directly through XYE rather than the 24v ecobee thermostat my clueless installer insisted on. Currently, my system is wired 24v thermostat <> air handler, and also 24v air handler <> outdoor unit.
I have an esp32 with a UART <> RS485 adapter with flow control. Hooked up to the XYE terminals on my board, I see no RX light flashing, and I seemingly get no data. I’ve flipped TX/RX, and also X/Y. I see ~5V on one of the terminals. Is there a combination of dip switches or something else I need to do to enable communication on this port?