This fork solved all my problems also, I not even reinstalled the integration, just copy-pasted all files from github replacing my HA files 
and everything works perfect!
1 Like
It work also with Elfin-EW11?
I Have been following this thread for a long time, but still did not install the integration because i can’t finding it on HACS (probably it still needs to be added manually).
Nevertheless yesterday I had a problem with my 4HEAT Module that lost connection to my home Wi-Fi. to solve this problem took me more then 5 hours to solve with many try and error processes. I know it is a bit off-topic but i want to share with you the solution to save you the need to go though all the trouble:
Problem:
- 4HEAT Module is set to AP more to receive new configuration, Android smartphone with 4heat app connects to “WI-FI 4Heat” gets IP but on the “connect the device to the system…” screen (bellow) the next button does nothing.
What was already tried:
- Multiple reinstall/ cash and data clear.
- Gave all the permissions possible to the app.
- 3 different phones (2 x Samsung/ 1x Xiaomi) with Android 13 & 11.
- The phone gets IP from “Wi-Fi 4 Heat” SSID 192.168.1.100 and is able to ping “gateway” 192.168.1.1.
- Tried an older phone and table (Android 6 & 8) but app does not even start.
Root cause:
- the bug is related with the 4HEAT app update 0.8.96. despite what is says on the change log (+ New configuration procedure + Bug fixed) it breaks the configuration of a new device procedure on 4HEAT Modules.
Solution:
- Download form alternative app repository and install previews version of 4HEAT app version 0.8.89 Grant app app permissions. Everything worked fine the first time and was able to configure the module without any issue.
Hope this can help anyone in the same situation.
I had similar situation testing commands and it went dumb… try to reset it and set fixed IP, outside the DHCP range.
there were talks about it in here.
Hi. I’ve finally have my yearly stove cleanning and I attached a cable to RJ11 port. Is a 4 wired cable inthe 4 central pins. So I would like to hep with this but not sure about the pinout configuration and the other connection params. Is there any advance with this?
The rj11 pinout for rs232 is already written here, be careful with the tx/rx levels that are rs232.
I think that if you do not have the 4heat module connected, there may not be traffic on that port, as if you use the rj11 rs485 socket and you do not have a lcd display that uses that port connected.
´For me the aim of this challenge is not avoid to buy the 4heat module since the time to get it, is worth much more than the module, but to get other parameters such as the smoke temperature, rpm smoke fan, etc. that Timemme can see using the 4heat module with another program…
Briefly, if you don’t have the 4heat module or an lcd display, I think you can not see or sniffer any traffic
Try but still have the issu of deconnecting
You are right. I know there’s no trafic.
You need to know what is the ‘handshake’ is.
So you need a 4Heat connected and then snif.
I tested with a RS232 to USB cable but couldn’t find the right port speed and settings. Only at 115 Kbaud i got some rubbish back. So i think that is the speed? But parity settings etc i didn’t know.
Hi all. Any advance with RS232 connection? I tried some connection settings with no success… 
I tried to contact the Tiemme company, they didn’t reply to my email
It’s missing the speed of the pellets switch on the controller. Can’t believe that it is not available
I’m glad my fork works for you guys! 
But it still doesn’t solve the thing the 4Heat module is crap. I still have a problem when I get an error on my stove, the module stops responding and I cannot disable it via Home Assistant. Also when it communicates with the remote Azure server (UNENCRYPTED OVER HTTP!!!) it’s just blocked and doesn’t respond to anything else.
For the price of 170€ I paid for it, even my $5 Chinese lightbulbs are working much better. And considering this does almost nothing and yet it does it badly… For non Chinese company I would expect much better.
I don’t know, this looks reaaally bad.
tcpdump:
tried to replicate the request (removed DeviceKey), successfully
Btw. you guys here are overthinking that RS232 too much I created sniffer using ESP32 and two MAX3232 (for both directions) and it’s just working with 9600 baud rate, everything else like parity bits etc. at default.
I am planning to make ESPHome component and some simple PCB for it, but since the winter is already ending, I will probably not push it hard, I will take my time with it.
I also have an idea to listen on RS485 for immediate notifications.
When something changes on the stove, you have to poll for it via RS232. But it immediately pushes that information to the LCD via RS485. So I’m going to buy RS485 module and try to listen what happens there.
4 Likes
I have read your interesting posts, I know very little about programming and only IDE/arduino, but regarding the hardware I think that:
Tiemme does not use any hardware standard protocol, it has made a specific one, for instace:
The rj11/12 socket for rs232 is connected to IC max3232, max3232 datasheed gives this pinout.
The rj45 socket on board for rs485 is connected to the IC max485 and from the max485 datasheed tyou can get the pinout.
So if you use standard converters I think they might not work
My motherboard is an NG01
To have full control I use single converters for instance an usb ttl and a ttl rs232 instead of usb rs232 .
Communication rs232 between motherboard and 4heat module.
Briefly, you have to use the right hardware and in addition to the rs232 protocol, see which protocol or lenguage is used modbus type or another.
Tiemme says that the rj11 port can be used with a gsm rs232 modem
This modem seems to be the wavecom
https://usermanual.wiki/Wavecom/WMO2-G1900.updated-user-manual-with-oem-section-82432.pdf
I think the communication protocol for the gsm modem should be the same as for the 4heat module. so the transmission could be a Serial Interface EIA-232 ,Speed 9600 ,Data bits 8 ,Parity None ,Stop bits 1 ,Flow Control None, where master is 4heat and slave motherboard Tiemme, but ¿which is the protocol?.
If you want to do tests, I think it is very interesting to have a ttl rs232 converter module, based on the max 3232 or another
Communication rs485 between motherboard and lcd100 display.
Master is motherboard and slave lcd display which address is 16, 17 if it works as remote control
Since the master is the motherboard you can see traffic even if the display is not connected
The firmware of each display is different for each motherboard, if a different firmware is used, keyboard not compatible appears on the display.
My last post is for you Michel this is the pinout of rj45 rs485
1 Like
The RS232 is the same as what goes over the WiFi, just de-JSON-ized.
Request:
08:49:33:30:30:30:31:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:30:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:30:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:34:30:30:30:37:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:35:37:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:32:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:31:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:31:37:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:38:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:38:31:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:38:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:34:39:33:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:31:39:39:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:32:32:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:35:37:30:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:37:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:37:35:30:30:30:30:30:30:30:30:30:30:30:30:0D
Response:
08:4A:33:30:30:30:31:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:30:35:30:30:30:30:30:30:30:30:30:30:32:34:0D:08:4A:33:30:30:30:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:34:30:30:30:37:30:30:30:30:30:30:30:30:30:31:30:30:0D:08:42:32:30:33:36:34:30:30:30:30:30:30:30:30:30:30:30:32:0D:08:42:32:30:35:37:35:30:30:30:30:30:30:30:30:30:30:30:31:0D:08:4A:33:30:30:32:36:30:30:30:30:30:30:30:30:30:31:39:31:0D:08:4A:33:30:30:31:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:31:37:30:30:30:30:30:30:30:30:30:30:32:36:0D:08:4A:33:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:38:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:42:32:30:33:38:31:30:30:30:30:30:30:30:30:30:30:30:35:0D:08:42:32:30:33:38:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:42:32:30:34:39:33:30:30:30:30:30:30:30:30:30:30:34:30:0D:08:42:32:30:31:39:39:30:30:30:30:30:30:30:30:30:30:36:38:0D:08:42:32:30:32:32:35:30:30:30:30:30:30:30:30:30:30:35:35:0D:08:42:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:36:0D:08:42:32:30:35:37:30:30:30:30:30:30:30:30:30:30:30:30:31:0D:08:42:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:36:0D:08:42:32:30:33:36:35:30:30:30:30:30:30:30:30:30:30:34:35:0D:08:42:32:30:33:36:36:30:30:30:30:30:30:30:30:30:30:38:30:0D:08:42:32:30:33:37:34:30:30:30:30:30:30:30:30:30:30:34:35:0D:08:42:32:30:33:37:35:30:30:30:30:30:30:30:30:30:30:37:30:0D
Request:
Response (“sorry new users can only post one embedded item”)
There is always backspace character before each requested value and then the whole request ends with \r.
RS485 is Modbus RTU (already discovered above). I am able to see some values in it, but it just spams several requests + responses every second and some values are repeated in each response and sometimes even within single response and I don’t know if I want to play with this 
Here is just one example of four requests + responses, there are also multiple others I omitted here:
10 41 09 24 03 10 0A 24 03 0C 81 0A 8E 87
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 00 0A 24 04 0C 81 01 32 00 01 10 00 00 00 00 00 00 44 00 0A 83 28
10 41 09 24 03 10 0A 24 03 0C 82 0A 8E 77
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 00 0A 24 04 0C 82 0F 04 00 96 06 01 01 00 00 05 03 00 00 0A C1 20
10 41 09 24 03 10 0A 24 03 0C 03 0A EE 27
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 00 0A 24 04 0C 03 00 00 00 05 00 06 16 42 00 39 00 06 00 0A 27 0C
10 41 09 24 03 10 0A 24 03 0C 04 0A EC 17
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 1F 0A 24 04 0C 04 00 00 00 05 00 06 16 42 00 39 00 06 00 0A F6 63
The 16 42 00 39 is time (16:42) and temp (0x39 = 57 °C), that’s all what I was able to decode for now.
You can see in those last two responses there is one whole block repeated here.
I don’t think I’ll spend more time with decoding Modbus. It also looks to me that it only sends values that are currently shown on LCD, so looks like no way of “just listening for when something changes” without actually sending custom requests. But don’t take my word on this.
3 Likes
Thanks @leoshusar! I’ve got the RS232 communication tested and it’s working now. Finaly i can write a Crestron module for it to implement it in my home domotica system. Great!
1 Like
@leoshusar do you know, when using de serial RS232 commands, if there is a command dat list al de settings like de “SEL” command does when using the 4Heat?
Why dont you use arduino + mqqt?
Can you share code for on/off and exaust temperature? cause i wanna remote controll it.
Thanks
I haven’t done any test but I think the communication is a slip type with a start character 0x08 in hexadecimal and backspace in ASCII, and an end character 0x0D in hexadecimal and carriage return in ASCII.
As Leoš Husar says, the commands are the same, over wifi they are in ASCII and over RS232 in Hexadecimal.
If you use an ASCII HEX converter for instance
https://www.rapidtables.com/convert/number/ascii-to-hex.html
You can see that the respond file that Leoš Husar could not upload could be
J30001000000000000
J30002000000000000
J30005000000000024
J30006000000000000
J40007000000000100
B20364000000000002
B20575000000000001
J30026000000000191
J30012000000000000
J30017000000000026
J30020000000000000
J30084000000000000
B20381000000000005
B20385000000000000
B20493000000000040
B20199000000000068
B20225000000000055
B20369000000000006
B20570000000000001
B20369000000000006
B20365000000000045
B20366000000000080
B20374000000000045
B20375000000000070
It seems that the communication between the 4heat and the board is Tcp over rs232 port 80, not uart, it seems that you have solved it by hardware and not by software through a module.
I don’t have any converter module and never I have used one, but this cheap module, seems that can do the same thing.
But I don’t understand the hardware connection, it’s like the module receives the commands over UART, converts them and sends them as tcp using the same pins, it really works like that.
So, Can you tell me please what is your hardware wired setup, IP of Tiemme board and confirm if it is a tcp over rs232 communication ?
@maxgu i haves tested it with a USB to RS232 (UGreen) adapter and then a sub-d9 tot RJ11 cable connected to the RS232 RJ11 on the board. It works.
You’re right that each command starts with a 08h and ends with a 0Dh.
1 Like