Reverse Engineering of a VMC - Nather Twinea

Hardware
1

Hello,

I have a VMC (mechanical air controller) Nather Twinea in my house that I’d like to pilot through Home Assistant.
Unfortunately the manufacturer doesn’t provide with a module for that, nor documentation of any kind on how the internals works.

The VMC is linked to a control panel (a few meters away) to manage the speed (3 possibilities) and the by-pass.
The idea is to get those 4 buttons available in HA for automated control of the air in the house.

Now the control panel have 4 wires going in from the VMC:

  • 24V (which is more like 28V on my voltmeter)
  • RX (3V Measured)
  • TX (3V also)
  • GND

I guessed that the RX and TX are used for serial communication between the 2 devices, and so I tried various adapters just in case (RS232 - I heard it can go as low as 3V as per the spec, RS485 - Which i doubt would work as they go with +/- instead of RX and TX).
The wiring is done in parallel of the control panel to “spy” onto the communication and try to understand what is going on.
None of that worked (and have triggered the alarm symbol on the panel).

Since the voltage is low I also tried to plug the TX of the control panel to the RX of the UART on my RPi.
I opened up a serial console (tried screen, minicom) and I can see something going on there, but the data is garbage.
I tried every possible baud rate I know of, and changing the settings from 8N1 to 7E1 which seems to have been used at some point too.

But I can’t get anything but garbage on the console output.

Now I’m at the limit of my knowleges on this but keen to learn.
Any hint on how to proceed next? What could I do to understand what is happening between the 2?

As a side note, I have a USB Port available on the VMC which is recognized by Windows as a TTL to USB adapter and is used to reconfigure (flash?) the system (speed parameters and all).
IDK if this is useful but this led me to think that there’s a microcontroller in there, with at least one UART, and possibly another for the communication with the serial panel.

Picture of the panel wiring:

signal-2023-01-12-165339_005
signal-2023-01-12-165339_0051536×2048 272 KB

Thanks!

2

Hello,

I come back with some good news!
I managed to understand the protocol and recreate it through my Raspberry Pi.

The first step was to disassemble the control panel and look at the circuit behind it.
I found out that the main chip on the circuit was an STC8F2K16S2.
Then digging through the Internets, I found the documentation of it’s pinout (there’s a 44 pin and a 32 pin models, here they used the 32 pins one).

Then I was able to confim what kind of communication system they used.
Based on the pinout, RX/TX are connected to a Serial Port (UART) - Pin 13 and 14.

Once I was sure about it, I got adviced to use a Logic Analyser to better understand the Signal.
That’s what I did (I found one from AZ Delivery for 15 Euros ~ on Amazon).

Then from there I was able to understand the protocol.
The microchip is sending continuous messages (one every 100ms ~) to the VMC with the speed and status of the bypass.

The speed is encoded on the first 2 bits of the message, and the bypass on the 4th one.
The Serial communication is using 8N1 at 600 bauds.

So I’ve created a small Python program on my Pi that is replicating this with PySerial and the integrated UART.
I use a thread to connect to HomeAssistant MQTT Broker and subscribe to some custom topics for the Speed and ByPass status.

On the HomeAssistant side it’s simply an MQTT Select with an MQTT Switch.
So far, it’s working like a charm!

The code is not really “open-source-ready” but if anyone is interested, I can share it.

My long-term plan is to move this from a RPi3 to probably an ESP32 or a RPi Pico since it’s not doing much most of the time.

3

Hi there! Awesome work. I also have the same vmc model and was thinking about doing a similar approach. Do you mind sharing the code? Cheers