Panasonic PACi / commercial unit — wired controller protocol (2-wire bus) — anyone working on this?

Hi all,

I have a Panasonic W18BD3P (ducted/commercial unit) that I’d like to integrate with Home Assistant. The unit only has a wired controller (CZ-RD514C type) connected via a 2-wire bus — there’s no CN-CNT or CN-WLAN port on the PCB, so the DomiStyle/esphome-panasonic-ac project and the IngeniousMakers hardware don’t work for this unit.

I’ve started sniffing the 2-wire bus with an ESP32 and a simple voltage divider, and I’m making some progress decoding the protocol. It’s a low-speed serial bus (inverted logic, 12V idle) with structured polling rounds.

Before I go too deep down the rabbit hole — has anyone else been working on the Panasonic PACi / ECOi / commercial wired controller protocol? I’ve searched extensively and found plenty of work on the domestic CN-CNT protocol, but nothing on this 2-wire commercial bus.

Specifically I’m wondering:

  1. Has anyone reverse-engineered the protocol used by Panasonic wired controllers like the CZ-RD514C, CZ-RTC5B, or similar?
  2. Is anyone aware of open-source projects targeting Panasonic commercial/PACi units via the wired controller bus (not CN-CNT)?
  3. Does anyone know if this protocol is related to Panasonic’s P-Link bus?
  4. Anyone with a similar Panasonic commercial unit (ducted, cassette, PACi series) who’d be interested in collaborating?

I’m happy to share what I’ve found so far and my sniffer tools if others are interested in working on this together.

Thanks!

There is a place here to request new integrations.

Very superficial wild guess: RS485 protocol, with ModBus. Very common in commercial setups to connect multiple units together.

This wizard may make life considerably easier for you if that is the case.

Alternatively, it might be the common protocol that modulates a 24V AC link. Have you checked the two wires on AC with your multimeter as well as DC? Wires and connections marked W and R are a common giveaway.

Have you examined the service manuals? They often have wiring diagrams and discuss protocols. Work backwards from your controller to see what main units it is compatible with. I would be surprised if there wasn’t a generic internal protocol that applied across a generation of Panasonic devices.

Does the device support infrared or WiFi control. Check what pins are used for that.

Examining data sheets for chips the wiring connects to at either end can often yield clues. Most chip vendors release application notes and the examples given are often used as a template for final design.

Thanks for the reply!

I’ve checked with a multimeter — the bus is DC, around 12V idle. So it’s not a 24V AC modulated link. I also don’t think it’s RS-485 — the signal behaviour on the oscilloscope doesn’t match RS-485 characteristics, and the Intesis gateway manual for PACi units (INMBSPAN001R000) describes the R1/R2 bus as a simple two-wire bus with no polarity, which is different from RS-485’s differential pair.

I’ve been in touch with Arnold Niessen from the P1P2MQTT project — he confirmed this is likely not HBS either (those run at 15-16V). He pointed me to a Panasonic service manual that shows a transistor-based interface circuit on page 170: https://www.panasonicproclub.com/uploads/CZ/catalogues/cac/service-manual/CU-LxxDBE5_service%20manual_mac0504060c2.pdf

I’ve opened the wired controller and the indoor unit PCB. The controller uses a Renesas H8/3823 MCU with discrete transistors near the bus connector — no MM1192 HBS chip, no coil. No IR receiver either (it’s a concealed ducted unit), and no WiFi module or CN-CNT port.

I’m currently sniffing the bus with an ESP32 and a voltage divider. I can see structured data coming through but I’m still working on confirming the exact baud rate and framing. It’s definitely a proprietary Panasonic protocol.

Good suggestion on checking the chip datasheets — I’ll look into the Renesas H8/3823 application notes to see if they reference any communication peripherals that could hint at the protocol.

1 Like

Very interested in doing the same, thanks for posting. I don’t have an oscilloscope or logic analyser but might look at getting one to help.

I don’t know if it will help, but actually get CN-WLAN isn’t a problem. I bought (and waiting to receive) CZ-CAPWFC1 which is likely will be CZ-CAPWFC1 + R1/R2 + T10 → CN-WLAN + DNSK-P11 according to this thread. Help debugging interface for Panasonic CZ-CAPWFC1 · Issue #63 · DomiStyle/esphome-panasonic-ac · GitHub

But they didn’t figure out the protocol itself, yet.
That’s what I will be doing next months maybe.

Interesting, I didn’t realise the CZ-CAPWFC1 had R1R2 inputs. Why does it have to be so proprietary past this point Panasonic!

I have a similar challenge. Interested in your findings.

Edit:insee you already tried this. I’m surprised it is a different bus.

The simplest though expensive solution is to either buy a commercial wifi interface or wired controller with WLAN interface. Both are over 300 AUD.

What did you pay for CZ-CAPWFC1

Is there a PCB interface drawing? maybe you have other alternatives.

I would be very interested in assisting with this. I have an abode with a CZ-RTC4. It should be fairly easy to reverse engineer this protocol if somebody has access to the right tools.

The voltage divider method I think is too primitive, but a good start none the less @hugojm.

I am experienced with all sorts of ESP32 - but the trick will be building an interface to modulate the 2-wire 12v interface. Some captures with a scope would be a great start.