Toshiba home AC control

Hello,
I just installed new AC system from Toshiba. It’s connected to local network by wi-fi adapter RB-N101S-G.
Are there any plans for integrating it into home-assistant?

Thanks in advance
Tibor

I have purchased RB-N103S-G and RB-N104S-G wi-fi modules for Toshiba AC. Did you found any solution for integration?

Unfortunatelly no.

I control AC Toshiba with Toshiba ac control. But I cannot find a method to control with home assistant without implement IR control… Someone have success with it?

1 Like

Interested also with this topic. I use also this shitty app from toshiba and would be really interested in HA integration.

1 Like

Any joy yet, I am also interested in integrating it

I have a toshiba shorai 25 that they sell the same RB-N102S-G module for. But since that solution is just a cloud solution, i made a solution myself with a esp32 and python. So now i have it in HA trough mqtt.
Can read room temp and outdoor temp.
Control setpoint, fan mode, swing mode and operating mode.

screen1

1 Like

Can you share how you did it?

Can share the circuit and code on github soon.

Any progress? I’ll gladly help with anything.

Hi Ztripez, put some stuff together at github.

https://github.com/toremick/shorai-esp32

1 Like

I’ve done a very very little investigation (I have 3 rb-n104s-g) but it looks like it is connecting to AzureIot (toshibasmaciothubprod.azure-devices.net) and according to copyright information they are probably using MQTT 3.1, a pcap dump confirms it is doing communication over port 8883 (MQTTS)

Are there people who can advise how to proceed with this information ?

@toremick how did you implement this? Is this a single split unit? Or a single outside with 2 inside units?

My AC guy is offering Toshiba as well, not sure if it’ll be Shorai or one of the other 2 RAS inside units. It’ll be an outside with dual inside units. Would it require 2 ESP32’s, or will it be controllable from 1 esp?

Any chance it’ll work straight away against any of the other RAS inside units not being shorai? Daisekai and Kazumi are the other models. Have you had any feedback from other users on this?

Hi @helix77 . Have no tried with other units than a shorai as i have.
There is atleast one more who has made it now, a dude from sweden, and it worked for him.

For your dual setup i have no idea. But if it would require two original gateways from toshiba, you will need two of these too.

-Tore

I think I can confirm that. I just talked to the AC guy again. He said that for 5 units I’m planning I’d need 5 WiFi modules. Apparently it’s plug&play by a cable, apparently the cable you utilised as well (as what I see from the photo). I’ll make the assumption the protocol will be the same and I’ll figure it out by doing some testing. First it’s the long wait until they have time to build it in. (3,5 months!!)

I have a multisplit outdoor unit with 3 indoor units, Each AC has a module, it also looks like the WiFi modules are ESP based so maybe its also possible to flash them with a custom firmware in the future

I do have the same AC (with the wireless adapter) and I am having the same problem. Therefore I tried to reverse-engineer the app.

I started by downloading the APK from https://apkpure.com/toshiba-home-ac-control/com.toshibatctc.SmartAC/versions - I used the oldest version as it was the smallest and so I assumed was the easiest to start with.
The APK is basically a zip file that holds the android application - usually a .tex file where the java code needs to be extracted. In this case the app uses assemblies - meaning there are like 100 .dll files that are used as a library.
Those can be easily copied and looked into using tools like ILSpy (Releases · icsharpcode/ILSpy · GitHub) or dnSpy (Releases · dnSpy/dnSpy · GitHub).
I noted that there is a SmartAC.dll which seems to handle most of the logic and the communication of the app.
In this dll I also found out about the propertyStore on the phone which holds some mapping information about the connected ACs (see later).

Here are my findings so far:

The app uses two interfaces:

  1. a normal HTTP API to get the current state of the AC and stuff like pairing and programmSettings
  2. a MQTT (or better an AMQPS) interface to update the current state (like change temperature or modes)

I made a small PHP script that is able to connect to the HTTP API and get some basic informations - see here: Toshiba AC API Client - Get status and settings from Toshiba AC Services (used e.g. in RAS-18PKVSG-E + RAS-18PAVSG-E + WIFI Adapter RB-N103S-G) · GitHub

The the problem with the AMQPS interface is, that I can’t find a working client. I tried it with py-amqp without success.

The AMQPS connection seems to be opened to:
amqps://toshibasmaciothubprod.azure-devices.net:5671/devices/XXXXX/messages/events

whereas XXXXX is your deviceId.

I have extract that part directly from my phone propertyStore using adb.
basically you install android studio, connect your phone to your PC, start the app, start the debugger and run:

adb shell
su
cat /data/user/0/com.toshibatctc.SmartAC/files/.config/.isolated-storage/PropertyStore.forms

this did work for me on a non-rooted phone and gave me an output similar to this:

@ArrayOfKeyValueOfstringanyTyp9http://schemas.microsoft.com/2003/10/Serialization/Arrays       i)http://www.w3.org/2001/XMLSchema-instance@KeyValueOfstringanyType@
  Key�[email protected]:string    a http://www.w3.org/2001/XMLSchema�en@KeyValueOfstringanyType@
  [email protected]:string  a http://www.w3.org/2001/XMLSchemaXXXXXXX@KeyValueOfstringanyType@
  Key�[email protected]:string a http://www.w3.org/2001/XMLSchema�$5XXXXXXX3@KeyValueOfstringanyType@
  Key�[email protected]:string a http://www.w3.org/2001/XMLSchema�@4XXXXb@KeyValueOfstringanyType@
  Key�   [email protected]�a:int a http://www.w3.org/2001/XMLSchema�@KeyValueOfstringanyType@
  Key�[email protected]�
a:dateTime      a http://www.w3.org/2001/XMLSchema�>�
ݼ\I@KeyValueOfstringanyType@
  Key�[email protected]�a:base64Binary     a http://www.w3.org/2001/XMLSchema�xxx@KeyValueOfstringanyType@
  [email protected]:string    a http://www.w3.org/2001/XMLSchema�'toshibasmaciothubprod.azure-devices.net@KeyValueOfstringanyType@
  [email protected]:string        a http://www.w3.org/2001/XMLSchema�pxxxb@KeyValueOfstringanyType@
  Key�[email protected]:string     a http://www.w3.org/2001/XMLSchema�,oxx8=

From here I extracted:

  • the UserName
  • a ConsumerID (which is the same when using the HTTP API)
  • the HostName: toshibasmaciothubprod.azure-devices.net (which differs from the http api)
  • my DeviceID (which included my Username and is used for the amqps connection)
  • and a SharedAceeskey (yes it has this typo)

Using another APP (Packet Capture https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture&hl=en_US&gl=US) I was able to read out the communication from the app to the server - unfortunatelly this amqps seems to be some kind of binary protocol and a single on/off request, results in multible queue entries like this:

[RANDOMBYTES]
IoThub-methodname: smmobile
{"sourceId":"4xx8","messageId":"0000000a68","targetId":["pxxxA"],"cmd":"CMD_FCU_FROM_AC","payload":{"data":"ffffffff31ffffffffffffffffffffffffffff"},"timeStamp":"0060dce13c"}
[MORERANDOMBYTES]

So far I found out that data is just a string of all attributes as 2-byte hex-values concationated - where ff means that it did not change. Position 9+10 - like above - is reserved for the air swing mode and 31 means its off. 41 would swing it vertically.
In the HTTP API this data/payload is named ACStateDataForProgram - in my example it has the value: 31421a3131640010197ffe0b00001002010000 - 31 … means currently off, 42 … is cooling mode, 1a … is hex for 26 degrees target temperature and so on…

So - I really hope someone with more experience using amqps will pick it up from here and we can somehow get a working integration out of this.

5 Likes

very interesting discovery, I will try your script on my installation asap
this works very well, putting out some information

because I wanted to have the firmware I have postponed the firmware update since the airco’s got installed, I’ve now managed to get the firmware with help of your script, in the file there are some mentions of MQTT, I will report back when I have better information

I’ve dumped the firmwarefile ota_0000_3201.bin onto wetransfer if it is of any interest for you: https://we.tl/t-LqWN1ULlme
fyi I have the Toshiba RB-N104S-G, it seems to be based on Realtek Ameba RTL8195A platform

1 Like

I started to port the script to python and prepare a home-assistant integration:

(currently only the example.py works - the rest is scaffolded from home-assistant)

the plan is to use the daily scheduler to send start and stop events to the AC unit. this may not be the best (or even the right) way, but until someone figures out how to do it correctly this could be sufficient.

foreseeable downsides:

  • the device will not react immediatly to any changes - it will be necessary to post status updates with at least one minute (probably more) lead time.
  • you will not be able to use the scheduler as intended, due to the updates made to it.

I just stumbled over this thread. :slight_smile:

I’m not an owner of a Toshiba unit, but in another corner here in this forum, there is a group of people working on an ESPHome component for Midea A/Cs. :slight_smile: As we started to put a list of all manufacturers (label) together, I noticed that someone is using the ESPHome component for Midea in combination with a Toshiba A/C.

Would someone of you check, if your A/Cs would work with this component? Maybe there is already a working component for the integration in HA. :slight_smile:

Here is the thread with some pics and instructions:

And here is the thread with the list of working devices:

1 Like