Thanks @leoshusar! I’ve got the RS232 communication tested and it’s working now. Finaly i can write a Crestron module for it to implement it in my home domotica system. Great!
1 Like
@leoshusar do you know, when using de serial RS232 commands, if there is a command dat list al de settings like de “SEL” command does when using the 4Heat?
Why dont you use arduino + mqqt?
Can you share code for on/off and exaust temperature? cause i wanna remote controll it.
Thanks
I haven’t done any test but I think the communication is a slip type with a start character 0x08 in hexadecimal and backspace in ASCII, and an end character 0x0D in hexadecimal and carriage return in ASCII.
As Leoš Husar says, the commands are the same, over wifi they are in ASCII and over RS232 in Hexadecimal.
If you use an ASCII HEX converter for instance
https://www.rapidtables.com/convert/number/ascii-to-hex.html
You can see that the respond file that Leoš Husar could not upload could be
J30001000000000000
J30002000000000000
J30005000000000024
J30006000000000000
J40007000000000100
B20364000000000002
B20575000000000001
J30026000000000191
J30012000000000000
J30017000000000026
J30020000000000000
J30084000000000000
B20381000000000005
B20385000000000000
B20493000000000040
B20199000000000068
B20225000000000055
B20369000000000006
B20570000000000001
B20369000000000006
B20365000000000045
B20366000000000080
B20374000000000045
B20375000000000070
It seems that the communication between the 4heat and the board is Tcp over rs232 port 80, not uart, it seems that you have solved it by hardware and not by software through a module.
I don’t have any converter module and never I have used one, but this cheap module, seems that can do the same thing.
But I don’t understand the hardware connection, it’s like the module receives the commands over UART, converts them and sends them as tcp using the same pins, it really works like that.
So, Can you tell me please what is your hardware wired setup, IP of Tiemme board and confirm if it is a tcp over rs232 communication ?
@maxgu i haves tested it with a USB to RS232 (UGreen) adapter and then a sub-d9 tot RJ11 cable connected to the RS232 RJ11 on the board. It works.
You’re right that each command starts with a 08h and ends with a 0Dh.
1 Like
Michel
Thank you for your useful information, I have done the first test to check what I thought.
The commands are the same over wifi as over rs232, but the program must be configured for ASCII or Hexadecimal.
This is the result of sending the command I30001000000000000 in ASCII, we must add the start and the end character (backspace and carriage return), setting the program for ASCII.
Briefly I think that the commands can be sent in ASCII or Hexadecimal, but programming their sending in ASCCII or hexadecimal
So I think the communication protocol is clear, is a rs232 Speed 9600 ,Data bits 8 ,Parity None ,Stop bits 1 ,Flow Control None
Here the meanings of the sensors,
EDIT
New tests
I have 2 air pellet stoves without water, with two different boards, an old sys100 and a new one Ng01
I think that Tiemme has slightly changed the hardware, and this affects the software.
Even the same model can have two versions, for instance, the NG01 board has the old one (before 2020) and the new one (after 2020)
Regarding the commands.
For instance, in air pellet stoves, the commands:
Set target room temperature
See
A20493000000000000
08 41 32 30 34 39 33 30 30 30 30 30 30 30 30 30 30 30 30 0d
Change
B204930000000000XY, XY Celsius Degrees
ON
J30253000000000001
08 4A 33 30 32 35 33 30 30 30 30 30 30 30 30 30 30 30 31 0D
OFF
J30254000000000001
08 4A 33 30 32 34 33 30 30 30 30 30 30 30 30 30 30 30 31 0D
POWER
SEE
A20364000000000000
Change/set
B2036400000000000X X 1-7 7=Auto
These commands work on new boards but not on old ones.
Command to see/set target room temperature in old boards
SEE
A21700000000000000
08 41 32 31 37 30 30 30 30 30 30 30 30 30 30 30 30 30 30 0d
Change/write
B217000000000000XY
08 42 32 31 37 30 30 30 30 30 30 30 30 30 30 30 30 XX YY 0d
Other commands such as room temperature, smoke exhaust temperature,etc are the same and work on both boards.
By the way, the commands can be sent by changing 0000 for this other SYEVO string, for instance you can send I30005000000000000 (08 49 33 30 30 30 35 30 30 30 30 30 30 30 30 30 30 30 30 0D) or I30005SYEVO0000000 (08 49 33 30 30 30 35 53 59 45 56 4f 30 30 30 30 30 30 30 0D) and it works in the same way.
Commands that I don’t know how to send on the old board are commands that can be sent by the remote control, and set temperature that can be sent is with a different command,so I don´t know the commands On,OFF and power for the old boards and I can’t help.
Do you have the old version and solved these commands, and how did you it?
EDIT
Now I have the 4heat module, I have only tested the communication over rs232, I have used a logic analyzer and two r232 ttl converters. I think the first thing is a kind of handshake communication between the 4heat and the board, in which the 4heat identifies and set up for this board, then it sends the commands that can work with that board
There are several boards ,from the oldest to the newest, and the communication between the 4heat module and the board is not the same.
The 4heat module not only sends the command corresponding to an order, but also begins a communication between the 4heat module and the board where, beside to sending the specific command, it sends others to update the rest of the parameters.
For instance on oldest boards the power off command does a very different communication I think it uses AT commands start by sending this request
0d 0a 2b 43 4d 54 49 3a 20 22 53 4d 22 2c 31 0d 0a in Hex
…+CMTI: “SM”,1. In ASCII
board response
41 54 2b 43 4d 47 52 3d 31 00 00 0d
AT+CMGR=1…
request
0x0d0x0a0x2bCMGR0x3a0x200x22REC0x20UNREAD0x220x2c0x220x2b0x330x390x310x310x310x310x310x310x310x310x220x2c0x2c0x0d0x0aStop0x0d0x0a0x0d0x0aOK0x0d0x0a
and the communication goes on sending and receiving commands.
But if you only want to put on/off the stove, then you only must send 2 commands with a delay about 1500 ms for be sure.
First command is the same for put on and off second command is this in ASCII7Hex for ON
\r (0x0D):\n (0x0A):+ (0x2B):C (0x43):M (0x4D):G (0x47):R (0x52): : (0x3A);’ ’ (0x20):" (0x22):R (0x52):E (0x45):C (0x43):’ ’ (0x20), ,U (0x55), ,N (0x4E), ,R (0x52), ,E (0x45), ,A (0x41), ,D (0x44), ," (0x22), ,COMMA (0x2C), ," (0x22), ,+ (0x2B), ,3 (0x33), ,9 (0x39), ,1 (0x31), ,1 (0x31), ,1 (0x31), ,1 (0x31), ,1 (0x31), ,1 (0x31), ,1 (0x31), ,1 (0x31), ," (0x22), ,COMMA (0x2C), ,COMMA (0x2C), ,\r (0x0D), ,\n (0x0A), ,S (0x53), ,t (0x74), ,a (0x61), ,r (0x72), ,t (0x74), ,\r (0x0D), ,\n (0x0A), ,\r (0x0D), ,\n (0x0A),O (0x4F), ,K (0x4B), ,\r (0x0D), ,\n (0x0A),
Even you can check this with a rs232 usb module first send
0d 0a 2b 43 4d 54 49 3a 20 22 53 4d 22 2c 31 0d 0a
and when you receive
41 54 2b 43 4d 47 52 3d 31 00 00 0d
send
0x0d0x0a0x2bCMGR0x3a0x200x22REC0x20UNREAD0x220x2c0x220x2b0x330x390x310x310x310x310x310x310x310x310x220x2c0x2c0x0d0x0aStop0x0d0x0a0x0d0x0aOK0x0d0x0a
These commands also work on the new Tiemme board, so you can power on and off using these commands, or thees ones .
J30253000000000001
J30254000000000001
that the 4heat module sends to the new board to put ON/OFF.
So I think it could be interesting before programming anything to see if the commands we are going to use will work or not, so I would try them with a usb rs232 adapter module. The first one I would use would be on or off.
xxxx
@leoshusar To reset the alarms, the stove must be OFF(J30001000000000000), safety or block the command J30255000000000001 (unblock), only works with my new board, the same as on, OFF and power, so I think you have an old board, and these commands shouldn’t work on your board.
In your own contribution MODES = [[ON_CMD, OFF_CMD, UNBLOCK_CMD], [ON_CMD_OLD, OFF_CMD_OLD, None]], for old boards, UNBLOCK_CMD_OLD does not appear, says None.
If you have an old board and you have problems to unlock it I would try AT Haynes commands, the same as to turn it on/off by changing Start/stop by Reset.
0x0d0x0a0x2bCMGR0x3a0x200x22REC0x20UNREAD0x220x2c0x220x2b0x330x390x310x310x310x310x310x310x310x310x220x2c0x2c0x0d0x0aReset0x0d0x0a0x0d0x0aOK0x0d0x0a
As turn ON/OFF this command works over new board
About the command A20385000000000000 on my old board it is missing, I do not receive anything but on the new one I receive the response B20385000000000006
I would like to know when the legacy commands “SEC”,“1”,“1”, “SEC”,“1”,“0” and even “SEC”,“1”,“2” are sent, what are the commands over RS232,
xxxxxxxxxxxxxxxxxx
As in this forum I can’t upload a Microsoft Word file from this link
UPDATED 23/04/2024
You can download in spanish this file Comunicacion 4heat RS232.docx and see my tests.
2 Likes
I don’t understand clearly your problem, I don’t know the model of your board, but if what you want is to setup the speed of the auger in each of the stages, in other words the speed of the pellets switch on the controller I think you should enter tpar, password, and auger menu and set on it
this is the technical manual for the NG01 hydro board
But if what you want is to see the speed of the pellets , I would try this command I50010000000000000
Hi all… Summer time is almost ended and maybe this winter would be possible to ellaborate some kind of solution to integrate our stoves with Home assitant without the 4Heat module that works really bad… Thank you all for your effort!
I’m cooking something.
Seems like the main stove controller itself is… also bad.
When I’m just sending queries to it in a loop every x seconds, it sometimes completely stops responding until I turn it off and on again. One time it works for 30 minutes, another time it stops after one query.
When I just send all queries in one message, it responds to every other one.
Looks like they have everything implemented poorly. I think they are discarding RX data while transmitting and who knows what happens in it when I send my query at a wrong time. I’m currently playing with timing.
EDIT: For now it looks like waiting for each response + few ms delay is enough to not break it. So much about full-duplex communication!
EDIT2: I’m getting somewhere. I’ll release it hopefully in next few days.
2 Likes
@leoshusar
I think that the Tiemme board’s rs232 communication is half duplex communication, not full duplex.
When I send several queries in the same message to the board with a usb-rs232 converter I only get responses to the queries that reach the board when it is not transmitting,
For instance, if I send I30006000000000000I30005000000000000I30008000000000000I30009000000000000A20364000000000000A20493000000000000
I only get a response to 3 of the six
When the 4heat module sends several queries, it does so sequentially, it sends one wait for a response, then sends the next one,… and there is no delay
So I think it expects to receive the 0x0d and then sends the next query
There are no delays in queries A and short delays in queries B (state change) and very long if you have to use AT commands to on,0FF unlock for having an old board.
Result in the logic analyzer.
EDIT
Time
Time to send a query/response including 08 0D about 20 ms.
Delay between sending query B and response about 20ms.
If it is an old board and you have to use AT commands to turn off, turn on or unlock.
Delay between query 0x0d0x0a0x2b0x430x4d0x540x490x3a0x200x220x530x4d0x220x2c0x310x0d0x0a
and response
41 54 2b 43 4d 47 52 3d 31 0d
about 450 ms
Edit 2
As I said in my long post above, I think you have an old board model, in the 4heat setup to connect to internet, setup also configure 4heat for that specific board, so if you change the board model after setup it doesn’t work.
I don’t think the J commands work to turn on, turn off and unlock so I think you will have to use AT commands.
Are you interested in knowing the complete communication over rs232 to turn on/off/unblock?
I don’t know anything about Python programming, but since all commands have the same fixed data size, for instance 0x08I300060000000000000x0D 20 bytes/characters including 08 0D
Is it not possible that it waits for receiving that size before it begins to transmit?
2 Likes
@maxgu thanks! I wanted to get my own logic analyzer or oscilloscope for a long time now, but I was always delaying it and right now it would be really useful 
I mean I would at least expect it to not break completely when I’m sending data when it doesn’t expect to, but I guess that would be too much to ask.
I have implemented waiting for a response + 5 ms tx throttle and now it seems stable, it survived whole night.
Too bad ESPHome currently doesn’t support setting entities as unavailable, so when the controller stops responding (either it breaks or you turn it off), it will still report values to HA. And because HA stopped supporting NaN for sensors last month, setting NaN is not an option either.
But the controller, when it works, it works, so I guess it’s not a big issue now.
2 Likes
You all are working hard with it!! Thank you so much!!! We look forward to it!!
I have great news! We were finally heating yesterday so I was able to fully test my ESPHome integration. Everything works - and much better than the official 4Heat toy I can finally query the state every 5 seconds and without getting timeouts lol.
I spent last few hours writing documentation. I used similar style to the official ESPHome one, so you should find it familiar.
you can find everything here: leoshusar/4heat-esphome (github.com)
Let me know if you find any issues.
Thanks to you all here who did the comms analysis!
4 Likes
@leoshusar Wonderful and great job, as I told you before, I don’t know anything about Python programming, I don’t have homeassistant nor esphome, I’ve only read the readme.md
I’m glad that the J commands to turn on, turn off and unlock work The unlocking works on my new board with the 4heat app.
I think it could be interesting to add the speed of the smoke/combustion fan I30008000000000000 , if it has flow control, air flow (Nr) must always be the same for each power, (P1=a,P2=b etc) and it is setup on the board through tpar. This air flow controls the speed of the combustion fan, and if that speed is not more or less constant it can say problems of the smoke duct.
About app 4heat “It also doesn’t report too often, only like once or twice per minute”
I think it does not polling, if you change a parameter through the display, for instance the power, its status is not updated in more than 20 minutes, it is only updated if you change a parameter through the app.
In other words, the data is fixed data from the last time you changed something. If you want to read the data updated, you have to go to the main page and enter again.
With the 4heat module connected, stove turned on by itself twice, to avoid this I put a cheap wifi socket
@maxgu Thank you for your kind words!
I haven’t tried the unlocking yet, because I haven’t got any alarm yet. But I assume it should just work, I’ll see. I have only verified the command is sent and the stove responds to it.
I can try the I30008 later, though the official module had neved asked for this one. Also I still don’t know what the Nr means, do you have any idea? I asked my engineer friend and ChatGPT and they both think this unit doesn’t mean anything I think it’s from a MAF sensor, that would be g/s or kg/h. But I really have no idea.
If I remember correctly, the Android app polls the module every like 5 seconds or something like that, but the module asks the stove 1-2x per minute. I checked this with wireshark + RS232 sniffer.
I guess the 5 seconds polling is because when the module isn’t polled for some time, it tends to timeout more often (that was my observation). I ran a Python script which was sending the ["SEL","0"] command every minute and it was timeouting quite often. This wasn’t happening in the app which was spamming it very often. I then also tried every 5 seconds and it seemed more stable. But it still timeouted sometimes.
They just messed up the software part of it. And I’m quite sure about this, by looking at their Android app. It is using Ionic framework. You can pull the whole non-minified (readable) javascript from it and read the mess yourself. There are even commented out things like their local testing IP addresses and passwords, development test commands etc. Even part-time students in our company would write better code.
I get it, for their use case it might work fine, but IMO it doesn’t look good.
Finally if anyone is bored, here is a firmware dump from their module (they conveniently left a JTAG port on it): firmware.bin
I only zero-byted my WiFi credentials (address 3F806).
Playing with this is far beyond my skills, but maybe someone will know what to do with it 
I only found some OTA links in the strings section of the binary:
http://wifi4heat.blob.core.windows.net/wifi4heatblobs/radio_v1973/m2m_ota_3a0.binhttp://%s/api/firmwares/micro/lastVersion?deviceKey=http://%s%s%s/api/firmwares/wifi/lastVersion?deviceKey=
EDIT: I tried I30008 and I’m getting some values, they indeed are changing with the fan speed. It’s currently sitting at 190 RPM(?) in ignition state.
@leoshusar Briefly, before answering you I have done some tests and I have seen that I have made a mistake, the command to see the instantaneous speed of the combustion fan is I30025.
For instance, if you send I30025I000000000000 and receive J30025000000001800
You can see on the display Fan 1800, meaning 1,800 r.p.m.
Regarding Nr, about manual picture, I think that it must be that it is not a standard unit of measurement, like Tiemme does not use m/s or another standard measurement unit but has made its own, unit that is is why Tiemme says Nr., Its value is between 0-2,000.
For instance, if you send I30026000000000000 and receive J30026000000000400, you should see 400 on the AirFlow/Fl display in Tiemme units. Since I do not have Air flow control, I can not test it.
About unlock command J30255000000000001,It only works on J30001000000000009 block does not work if J30001000000000007 extinguishing.
Regarding updating data in the 4heat app, I have done a very simple test, I open the app, 4heat I manually change several parameters: power, temperatures (heating sensors) and nothing changes in 20 minutes, it seems as if the 4heat module do not send any status changes to azzure
EDIT
On post 186 you can download the NG01 Hydro manual, there you can see more examples of what NR means for Tiemme that is without unit of measeurement
I have done all update tests connected the 4heat and the Android smartphone to the same Wi-Fi , the first tests updating data, stove were OFF. Now another test, I turn on the stove using 4heat, Check appears, I change by display parameters, nothing happens, after 5 minutes I returns to the main page, and I enter the stove again, all the parameters are updated and it shows ignition.,same happens is I change any parameter with app
I think normal values would be 1190,2190,1900. not 190. Does the application allow more than 3 digits to be displayed? Another value that may need four digits is the airflow.
In each of the stages the combustion fan has different values that are defined on page 38, TP02, V01-V24, but which are adjusted by the values on page. 43/44 TP16 FL22-FL30.
The speed of the combustion fan is adjusted to reach the value belonging to the FL of each stage, so main parameter is FL.
I think the command I30008 is not useful but its meaning could be the values V01/V24.
Through rs232 you can get more data than with the official application, but I think it could be interesting some data that you can see on the display
Edit
The air flow sensor is in the fresh air intake tube,
I recently bought a Godin Artemis pellet stove and it uses this stuff. Unfortunately the provided code from the integration do not work so I did a fork with the specific codes that match the Artemis.
MODE_TYPE = "30001"
ERROR_TYPE = "30002"
POWER_TYPE = "20575"
ROOM_TYPE ="50006"
CONSERVATION_TYPE="50138"
STOVE_TYPE = {
"GODIIN PELLET STOVE": [564, "GODIN", "ARTEMIS"],
}
SENSOR_TYPES = {
"20801": ["Heating power", None, ""],
"20118": ["Service Time", TIME_HOURS, ""],
"20119": ["UN 20119", None, ""],
"20364": ["Combustion", None, ""],
"20369": ["UN 20369", None, ""],
"20493": ["Room temperature set point", TEMP_CELSIUS, ""],
"20570": ["UN 20570", None, ""],
"20575": ["Heat Power", None, ""],
"20614": ["UN 20614", None, ""],
"20638": ["UN 20638", None, ""],
"30001": ["State", None, ""],
"30002": ["Error", None, ""],
"30003": ["Timer", None, ""],
"30004": ["Ignition", None, ""],
"30005": ["Exhaust temperature", TEMP_CELSIUS, ""],
"30007": ["Inputs", None, ""],
"30011": ["Pellet dropping", None, ""],
"30012": ["Puffer temperature", TEMP_CELSIUS, ""],
"30017": ["UN 30017", TEMP_CELSIUS, ""],
"30020": ["UN 30020", PRESSURE_MBAR, ""],
"30025": ["Fan speed rpm", None, ""],
"30026": ["Fireplace", TEMP_CELSIUS, ""],
"30033": ["Exhaust depression", PRESSURE_PA, ""],
"30142": ["Contrast", None, ""],
"30143": ["UN 30143", None, ""],
"30144": ["UN 30144", None, ""],
"50006": ["Room temperature", TEMP_CELSIUS, ""],
"50046": ["UN 50046", None, ""],
"50053": ["UN 50053", None, ""],
"50138": ["Room termostat", TEMP_CELSIUS, ""],
"50139": ["UN 50139", None, ""],
"50140": ["UN 50140", None, ""],
}
there are values which I did not understand what theyy were, so I assume this is parameters as this is not moving at all when I switch it on / off.
here is a snapsot:
I gave up adding the cloud connection as there are no interesting information and 4Heat has already Alexa and Google Home native integration that works fine to switch on/off
What RS232 module do you reccomend for esp32, can you show me example?
cause I found only usb to rs232
@bbday Look for TTL <-> RS232 modules. I used this one based on MAX3232.
You will definitely find it somewhere from your local reseller too, in my country they are for like $0.5.
@maxgu interesting findings!
It seems like my stove maybe has the combustion fan tachometer on a different ID. 30025 was returning zero for me. Or it might not be exposed at all.
We aren’t heating today, but I managed to try it yesterday for a few minutes. The 30008 value definitely matches the airflow amount:
But the value is interesting. I think either it’s divided by 10 or a PWM? The highest I’ve seen was 240, PWM max is usually 255…
Look at this video - they’ve got some software called SYSTEM PRO and in the bottom graph there is a combustion fan with values matching mine.
I wish we could find this software… I don’t see any download link, so it might not be for consumers.