I own a nuaire mrxbox eco 2, that has the data interface for the VSC controller.
The controller has the ability to run diagnostics, monitor the fans, and control speed. All of that is very useful for creating some automations.
The VSC they sell is ridiculously overpriced and does not have a wireless interface so also pretty useless.
I was wondering if someone has some tips to reverse engineer the port to create a simple ZigBee device to monitor and control the ventilation unit.
I asked nuaire for technical docs but they refused, and I know some people are installing relays to control the boost but that’s just a fraction of what can be done through the data interface.
Just beginning to investigate this myself as I am
shortly installing a Nuaire MRXBOX MVHR.
I managed to source a cheap display from eBay that (pre HA journey) was to be mounted remotely via the EcoSmart Classic bus.
Reading up on the specs and limitations I have a strong suspicion that the bus will use some form of RS485 to communicate - from what I can see there is a +15vdc pin, a shared 0v / data ground pin and 2 data pins (Data+ and Data-). This with the 32 device limit the specs mention leads me down the path of RS485
Hope that helps. If I ever get time I’ll investigate more with an RS485 to IP box
the relay is working fine for boost control, but of course I’d love to do more, as turning it off al together, monitor actual fans RPMs etc… commenting and following this!
I’ve a MrBox 4 that I’ve been controlling using Sonoff dual relay to operate boost and purge via HomeBridge/HomeKit automation. As I’ve now plunged into Home Assistant it would be good to have the further control you mention. The Sonoff dual relay is now being controlled vial HA automation.
Did you get anywhere??
I also own MRXBOXAB-ECO and I’m curious of HA integration possibility.
The communication to the user panel is quite certainly done over RS485.
There is WS3471 MSOP-8 IC next to pin headers on the PCB.
Inside the unit there is also a humidity/temp sensor (top right corner) that talks to the main PCB over the same bus. So I take some protocol RE can be done by sniffing on these lines.
ATM I’m developing my own controller by hardwiring to the main PCB.
MQTT device (RPi Pico W) will be able to read the MVHR state by front LEDs conditions.
As for control - turn the unit completely OFF (12V line on the main PCB), ON (speed1), Speed2, Speed3. All correctly reported to HA with auto discovery (over WIFI).
Let me know what you think and if you have any other suggestions.
BR
@chris178 I’m controlling my unit using the 12v, speed1, speed2, speed3 all controlled via the Sonoff relay. I’d be very interested int he RS485 interface. I’ve no experience with coding but can follow examples if you are needing any testing. I’ve recently gained control of my Samsung ASHP using an ESPhome Atom RS485 module that was super simple to implement once someone had done the sniffing and coding!
Did you get anywhere with this interface. My simple relay interface is working but with no feedback. I’d love to see the temp and humidity as well as th control the summer bypass.
I got the official display ordered and have it working locally but haven’t yet introduced any proxy that would be able to sniff data, being buried by other projects atm.
Should there be a kind soul that’d drop an easy-to-follow guide on what I need to get going inbetween the MRX Control touch screen and the MRXBOX I think I’ll be able to run some captures and help the group build something from it?
Is there anyone who can help with this project. I’ve now added Shelly temperature and humidity sensors to replicate the supply and circulation sensors.
I want to gain control over fan speed and summer bypass.
Using simple relays I have control of the boost and purge fan speeds.
I’ve ended up ordering a Waveshare ESP32-S3-RS485-CAN and will see if I can spend 15min on some quick R&D to see what VSC display sends and receives from the box. Might be able to get some ESPHome automation posted.
I still am very unhappy with my installation cause anything past 5% of the fan speed is very loud even in a few rooms over, but I guess £25 isn’t a big investment for now to at least automate it at night from HA.
RS485 settings + how I’m reading humidity & boost (no display controller)
For anyone tapping the display connector on an MRXBOX ECO2: I don’t have the display, but the unit broadcasts its status on the bus by itself, so a passive, receive-only tap is enough to read data — no polling needed.
Physical / serial layer
RS485 differential (there’s a WS3471 / SP3485-class transceiver on the PCB). Metered the data pair: idle-biased, A > B, A−B ≈ 0.3 V.
1200 baud, 8N1. (I first got a false ~2000-baud lock — measuring the actual bit width gave a clean 825 µs/bit = 1200.)
Wire it receive-only: transceiver RO → MCU UART RX, and DE/¬RE tied to GND so it can never transmit.
The one big gotcha — data is MSB-first
The unit sends each byte most-significant-bit first, so a normal LSB-first UART reads every data byte bit-reversed. You have to reverse each data byte to get the value:
rev(b) = int(‘{:08b}’.format(b)[::-1], 2)
This is why raw frames are full of 0xFE — that’s 0x7F (padding) reversed — and why humidity looks like noise until you reverse it.
Frame structure
Every ~0.7 s the unit broadcasts a burst of 9 short messages, each starting with a header byte. Decoded at 1200 8N1 (raw bytes, before bit-reversing the data):
21 AA F4 D4
11 F6 4C
51 FE FE FE 04
31 FE FE 9A
33 FE FE 98
85 2E FE 30 FE FE CE
A3 FE FE FE FE FE FE 08
75 FE FE FE FE DE
3B C2 54 06
Humidity (relative humidity %)
It’s the 3B message, byte index 1, bit-reversed = RH % directly.
e.g. 3B C2 54 06 → rev(0xC2) = 0x43 = 67 %.
Confirmed with a shower: value rose 67→70→72 as RH climbed, settled 70–73 while drying. Byte 3 looks like a mirror/check byte.
Boost / fan state
It’s the 21 message. Toggling boost, only that message changes:
boost ON: 21 AA F4 D4
boost OFF: 21 AA F6 D6
State = bit 0x02 of byte index 2: bit clear = ON, bit set = OFF.
(Byte 3 mirrors byte 2 with bit 0x20 cleared — an integrity copy, probably handy for building write commands later.)
Status: read-only for now — humidity + boost are live in Home Assistant via MQTT. I haven’t cracked writing controls yet (that needs capturing a real VSC display talking to the unit), and I don’t have a confirmed temperature field yet — the constant-looking bytes didn’t respond to warming, so I’m logging all the bytes long-term to work out what they are.
Thanks to this thread for the pinout pointers that got me started.
James, this is great. I’ve an MRxBox4 and have been looking for a starting point like this. As the NiAre wall controller and control, it would be great to see if control can be initiated. I’ll look into getting a copy of your hardware…