Tiemme 4Heat Stove WiFi Controller

[11125 (Тони Станојоски)]

Hello @Mecallie,
You can not reset such errors, since they are read by the controller from the sensors. That is a hardware job. You can just monitor those sensors.
This integration sets only the boiler temperature and on/off state.

[ico3d]

You can reset the error from the 4Heat app itself.

[Mecallie]

Ok, that is good to hear.
I thought it was a bit strange, since the 4heat app communicates with the main board.

I would think that, given the correct sequence, you would be able to set this via an integration? Or are some parts actually shielded/encrypted at a different level?

[MicDre (Michel)]

Did any of you ‘snif’ on the serial port (RS232) on the Tiemme board with the 4Heat connected?
I’m curious about the port speed and settings.
I have no 4Heat my self unfortunately.

[urikimgit]

Hi.
I have pillet stove Burnit Advant-Novation 13, based board NG01 this board can cinnect tiemme wifi module (4HEAT). I was looking for in internet, a communication protocol of data NG01 и wifi module, but fouded only PDF description NG01 without description communication protocol. But maybe this datasheet will help a little, for example, in the datasheet there is a more complete list of errors that matches the description of errors in the integration(const.py) and and other information.
Sorry for my English.

[igmsoft]

@carloda

SOLVED
I Solved using this fork: https://github.com/leoshusar/homeassistant-4heat

This fork solved all my problems also, I not even reinstalled the integration, just copy-pasted all files from github replacing my HA files and everything works perfect!

[aerodolphin]

It work also with Elfin-EW11?

[infromatica]

I Have been following this thread for a long time, but still did not install the integration because i can’t finding it on HACS (probably it still needs to be added manually).
Nevertheless yesterday I had a problem with my 4HEAT Module that lost connection to my home Wi-Fi. to solve this problem took me more then 5 hours to solve with many try and error processes. I know it is a bit off-topic but i want to share with you the solution to save you the need to go though all the trouble:

Problem:

• 4HEAT Module is set to AP more to receive new configuration, Android smartphone with 4heat app connects to “WI-FI 4Heat” gets IP but on the “connect the device to the system…” screen (bellow) the next button does nothing.
  
  

What was already tried:

• Multiple reinstall/ cash and data clear.
• Gave all the permissions possible to the app.
• 3 different phones (2 x Samsung/ 1x Xiaomi) with Android 13 & 11.
• The phone gets IP from “Wi-Fi 4 Heat” SSID 192.168.1.100 and is able to ping “gateway” 192.168.1.1.
• Tried an older phone and table (Android 6 & 8) but app does not even start.

Root cause:

• the bug is related with the 4HEAT app update 0.8.96. despite what is says on the change log (+ New configuration procedure + Bug fixed) it breaks the configuration of a new device procedure on 4HEAT Modules.

Solution:

• Download form alternative app repository and install previews version of 4HEAT app version 0.8.89 Grant app app permissions. Everything worked fine the first time and was able to configure the module without any issue.

Hope this can help anyone in the same situation.

[11125 (Тони Станојоски)]

I had similar situation testing commands and it went dumb… try to reset it and set fixed IP, outside the DHCP range.
there were talks about it in here.

Tiemme 4Heat Stove WiFi Controller

@zauberertz Thomas, I tried the wifi commands CF6 then CF7. After receiving the info of my wifi setup with CF7, the 4heat device went dumb, no communication, anything. Resetting from the power supply was not working, so I reset it via the button. During the setup with the app, the device didn’t save the config and was ready to setup again (blinking blue and red). At some moment I tried and added fixed IP, instead of using DHCP. That worked. Now I use fixed IP.

[jorgezazo]

Hi. I’ve finally have my yearly stove cleanning and I attached a cable to RJ11 port. Is a 4 wired cable inthe 4 central pins. So I would like to hep with this but not sure about the pinout configuration and the other connection params. Is there any advance with this?

[maxgu]

The rj11 pinout for rs232 is already written here, be careful with the tx/rx levels that are rs232.

I think that if you do not have the 4heat module connected, there may not be traffic on that port, as if you use the rj11 rs485 socket and you do not have a lcd display that uses that port connected.

´For me the aim of this challenge is not avoid to buy the 4heat module since the time to get it, is worth much more than the module, but to get other parameters such as the smoke temperature, rpm smoke fan, etc. that Timemme can see using the 4heat module with another program…

Briefly, if you don’t have the 4heat module or an lcd display, I think you can not see or sniffer any traffic

[hylyah]

Try but still have the issu of deconnecting

[MicDre (Michel)]

You are right. I know there’s no trafic.
You need to know what is the ‘handshake’ is.
So you need a 4Heat connected and then snif.
I tested with a RS232 to USB cable but couldn’t find the right port speed and settings. Only at 115 Kbaud i got some rubbish back. So i think that is the speed? But parity settings etc i didn’t know.

[jorgezazo]

Hi all. Any advance with RS232 connection? I tried some connection settings with no success…

[11125 (Тони Станојоски)]

I tried to contact the Tiemme company, they didn’t reply to my email

[11125 (Тони Станојоски)]

It’s missing the speed of the pellets switch on the controller. Can’t believe that it is not available

[leoshusar (Leoš Husar)]

I’m glad my fork works for you guys!

But it still doesn’t solve the thing the 4Heat module is crap. I still have a problem when I get an error on my stove, the module stops responding and I cannot disable it via Home Assistant. Also when it communicates with the remote Azure server (UNENCRYPTED OVER HTTP!!!) it’s just blocked and doesn’t respond to anything else.

For the price of 170€ I paid for it, even my $5 Chinese lightbulbs are working much better. And considering this does almost nothing and yet it does it badly… For non Chinese company I would expect much better.

I don’t know, this looks reaaally bad.
tcpdump:

tried to replicate the request (removed DeviceKey), successfully

Btw. you guys here are overthinking that RS232 too much I created sniffer using ESP32 and two MAX3232 (for both directions) and it’s just working with 9600 baud rate, everything else like parity bits etc. at default.

I am planning to make ESPHome component and some simple PCB for it, but since the winter is already ending, I will probably not push it hard, I will take my time with it.

I also have an idea to listen on RS485 for immediate notifications.
When something changes on the stove, you have to poll for it via RS232. But it immediately pushes that information to the LCD via RS485. So I’m going to buy RS485 module and try to listen what happens there.

[maxgu]

I have read your interesting posts, I know very little about programming and only IDE/arduino, but regarding the hardware I think that:
Tiemme does not use any hardware standard protocol, it has made a specific one, for instace:
The rj11/12 socket for rs232 is connected to IC max3232, max3232 datasheed gives this pinout.

The rj45 socket on board for rs485 is connected to the IC max485 and from the max485 datasheed tyou can get the pinout.

So if you use standard converters I think they might not work
My motherboard is an NG01
To have full control I use single converters for instance an usb ttl and a ttl rs232 instead of usb rs232 .
Communication rs232 between motherboard and 4heat module.
Briefly, you have to use the right hardware and in addition to the rs232 protocol, see which protocol or lenguage is used modbus type or another.
Tiemme says that the rj11 port can be used with a gsm rs232 modem

REMOTE CONTROL - Tiemme elettronica

This modem seems to be the wavecom
https://usermanual.wiki/Wavecom/WMO2-G1900.updated-user-manual-with-oem-section-82432.pdf
I think the communication protocol for the gsm modem should be the same as for the 4heat module. so the transmission could be a Serial Interface EIA-232 ,Speed 9600 ,Data bits 8 ,Parity None ,Stop bits 1 ,Flow Control None, where master is 4heat and slave motherboard Tiemme, but ¿which is the protocol?.
If you want to do tests, I think it is very interesting to have a ttl rs232 converter module, based on the max 3232 or another

Communication rs485 between motherboard and lcd100 display.
Master is motherboard and slave lcd display which address is 16, 17 if it works as remote control
Since the master is the motherboard you can see traffic even if the display is not connected
The firmware of each display is different for each motherboard, if a different firmware is used, keyboard not compatible appears on the display.

[maxgu]

My last post is for you Michel this is the pinout of rj45 rs485

[leoshusar (Leoš Husar)]

The RS232 is the same as what goes over the WiFi, just de-JSON-ized.

Request:
08:49:33:30:30:30:31:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:30:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:30:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:34:30:30:30:37:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:35:37:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:32:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:31:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:31:37:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:49:33:30:30:38:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:38:31:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:38:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:34:39:33:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:31:39:39:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:32:32:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:35:37:30:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:36:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:37:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:41:32:30:33:37:35:30:30:30:30:30:30:30:30:30:30:30:30:0D
Response:
08:4A:33:30:30:30:31:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:30:35:30:30:30:30:30:30:30:30:30:30:32:34:0D:08:4A:33:30:30:30:36:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:34:30:30:30:37:30:30:30:30:30:30:30:30:30:31:30:30:0D:08:42:32:30:33:36:34:30:30:30:30:30:30:30:30:30:30:30:32:0D:08:42:32:30:35:37:35:30:30:30:30:30:30:30:30:30:30:30:31:0D:08:4A:33:30:30:32:36:30:30:30:30:30:30:30:30:30:31:39:31:0D:08:4A:33:30:30:31:32:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:31:37:30:30:30:30:30:30:30:30:30:30:32:36:0D:08:4A:33:30:30:32:30:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:4A:33:30:30:38:34:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:42:32:30:33:38:31:30:30:30:30:30:30:30:30:30:30:30:35:0D:08:42:32:30:33:38:35:30:30:30:30:30:30:30:30:30:30:30:30:0D:08:42:32:30:34:39:33:30:30:30:30:30:30:30:30:30:30:34:30:0D:08:42:32:30:31:39:39:30:30:30:30:30:30:30:30:30:30:36:38:0D:08:42:32:30:32:32:35:30:30:30:30:30:30:30:30:30:30:35:35:0D:08:42:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:36:0D:08:42:32:30:35:37:30:30:30:30:30:30:30:30:30:30:30:30:31:0D:08:42:32:30:33:36:39:30:30:30:30:30:30:30:30:30:30:30:36:0D:08:42:32:30:33:36:35:30:30:30:30:30:30:30:30:30:30:34:35:0D:08:42:32:30:33:36:36:30:30:30:30:30:30:30:30:30:30:38:30:0D:08:42:32:30:33:37:34:30:30:30:30:30:30:30:30:30:30:34:35:0D:08:42:32:30:33:37:35:30:30:30:30:30:30:30:30:30:30:37:30:0D

Request:

Response (“sorry new users can only post one embedded item”)

There is always backspace character before each requested value and then the whole request ends with \r.

RS485 is Modbus RTU (already discovered above). I am able to see some values in it, but it just spams several requests + responses every second and some values are repeated in each response and sometimes even within single response and I don’t know if I want to play with this

Here is just one example of four requests + responses, there are also multiple others I omitted here:

10 41 09 24 03 10 0A 24 03 0C 81 0A 8E 87
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 00 0A 24 04 0C 81 01 32 00 01 10 00 00 00 00 00 00 44 00 0A 83 28
10 41 09 24 03 10 0A 24 03 0C 82 0A 8E 77
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 00 0A 24 04 0C 82 0F 04 00 96 06 01 01 00 00 05 03 00 00 0A C1 20
10 41 09 24 03 10 0A 24 03 0C 03 0A EE 27
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 00 0A 24 04 0C 03 00 00 00 05 00 06 16 42 00 39 00 06 00 0A 27 0C
10 41 09 24 03 10 0A 24 03 0C 04 0A EC 17
10 41 00 28 24 04 10 00 01 00 00 05 00 06 16 42 00 39 00 06 00 00 08 48 1F 0A 24 04 0C 04 00 00 00 05 00 06 16 42 00 39 00 06 00 0A F6 63

The 16 42 00 39 is time (16:42) and temp (0x39 = 57 °C), that’s all what I was able to decode for now.
You can see in those last two responses there is one whole block repeated here.

I don’t think I’ll spend more time with decoding Modbus. It also looks to me that it only sends values that are currently shown on LCD, so looks like no way of “just listening for when something changes” without actually sending custom requests. But don’t take my word on this.