Skip to content

issalig/toshiba_air_cond

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

201 Commits
air
air
 
 
airlogs
airlogs
 
 
pcb
pcb
 
 
README.md
README.md
 
 
WEB_INTERFACE.md
WEB_INTERFACE.md
 
 
circuitjs.txt
circuitjs.txt
 
 
platformio.ini
platformio.ini
 
 

Repository files navigation

toshiba_air_cond

This project implements functions to decode Toshiba AB protocol from indoor units to wired controllers and provides a hardware design for communication.

Gerbers are available but remember if you improve the design please share it, that's how open source works, if you do not want to share, this project is not for you.

I strongly recommend to use makusets' board instead of my custom hardware. My hardware is designed assuming a voltage level of the AB line around 15.6V when "1" and 14V when "0". Different voltage values will not work for writing while reading will work.

In particular, this project has been tested with remote control unit RBC-AMT32E and central unit RAV-SM406BTP-E (http://www.toshiba-aircon.co.uk/assets/uploads/product_assets/20131115_IM_1115460101_Standard_Duct_RAV-SM_6BTP-E_EN.pdf)

You can find the service manual from central unit and wired controller here: http://www.toshibaclim.com/Portals/0/Documentation/Manuels%20produits/SM_Gainable_Std-Compact--DI_406566806110614061606_GB.pdf, https://rednux.com/mediafiles/Hersteller/toshiba/Toshiba-Bedienungsanleitung-RBC-AMT32E-Englisch.pdf

Index

Software installation

Web Interface

Home Assistant & MQTT

Hardware Installation

Custom hardware

Data format

Message types

Other info

Software installation

Up Previous Next

Code is developed in PlatformIO for ESP8266 and in particular for Wemos D1 mini board. It is basically a WebServer that serves a webpage and communicates with the client by means of WebSockets. It also offers Home Assistant integration and has nice features usch as OTA updates, file uploading, WifiManager and others.

Dependencies

This project uses libraries and code from different authors, they are installed automatically from platformio.ini file

Compilation

First things first. Compile it with VSCode and upload it to the board with PlatformIO.

Minimal hardware is ESP8266 and the pcb for adapting signal from serial to AB line.

  • ESP8266 (Wemos D1 Mini R2)
  • Toshiba AC serial interface (SoftwareSerial D7=RX, D8=TX)
  • Optional I2C sensors (shared bus D1=SCL, D2=SDA):
    • AHT20 (temperature + humidity) [enabled with #define USE_AHT20]
    • BMP280 (temperature + pressure) [enabled with #define USE_BMP280]
    • BME280 (temperature + humidity + pressure) [enabled with #define USE_BME280]
  • Optional OLED 128x64 SSD1306 (I2C D1=SCL, D2=SDA) [#define USE_SCREEN]
  • Reset / Config button on D4 (WiFiManager AP)

To sum up, the following defines are available and features are disabled by commenting its #define in config.h

  • USE_OTA OTA updates
  • USE_SCREEN OLED status display
  • USE_MQTT MQTT + Home Assistant integration
  • USE_AHT20 AHT20 sensor support
  • USE_BMP280 BMP280 sensor support

WiFi setup

Once you have the code uploaded it is time to configure your WiFi. This project makes use of the great WiFiManager library so there is no need to hardcode your WiFi settings.

  • Plug you esp board. It will start blinking.
  • Connect to airAP wifi network from your cellphone or PC.
  • Open a browser and the WifiManager will appear.
  • Select your WiFi network and the password.
  • If everything is correct, airAP shuts down and board connects to your WiFi.
  • Connect to your normal WiFi from computer/cellphone.

Connect

Now the esp8266 is connected to your network and can be reached as http://air.local

Upload files

Connect to http://air.local/filemanager, type index.html and upload it.

This will store index.html file and http://air.local should show the main page. You can use this endpoint to modify the webpage or add more functionality. If you do it please share.

Delete files

Similarly to upload page you can use http://air.local/filemanager to delete a file.

OTA and file update

OTA updates are available, so you do not need to unplug the esp everytime you want to flash it. In the Arduino IDE just set Tools->Port->air at xxx. If you are using PlatformIO it is done in platform.io Default OTA password is esp8266

; OTA upload configuration
upload_protocol = espota
upload_port = air.local        ; Replace with your device's actual IP from OTAName in config.cpp
upload_flags = --auth=esp8266  ; Replace with your OTA password from OTAPassword varialble in config.cpp

If you just want to upload individual files you can use http://air.local/edit.html

Web Interface

Up Previous Next

This section describes the features available through the embedded web interface served by the ESP8266 air conditioning controller.

Access

  • URL via mDNS: http://air.local (See mdnsName in config.h)
  • HTTP Port: 80
  • WebSocket Port: 81

web interface)

Main Features

  1. Control Functions

    • Power ON / OFF
    • Set target temperature (bounded 16–30 °C; internally enforced 18–30 in MQTT handler)
    • Change mode: cool, heat, dry, fan_only, auto, off
    • Change fan speed: auto, low, medium, high
    • Save mode

  2. Timer

    • ON/OFF Timer. Software based relying only in esp8266

  3. Chart

    • Shows current temperature, external temperature and pressure/humidity if sensors are available.

  4. System

    • Info: IP, boot time and decoding errors.
    • Sensors: Internal / External AC sensors.
    • Address: Address configuration for master/remote in case your system uses different from default or you want to install different remotes.
    • Mode:
    • Autonomous mode indicator: Use it if there is no remote connected (sends pings like remotes). It is necessary to have a temperature sensor to report room temperture.
    • Simulation mode indicator: Simulates a physical AC
    • Admin: Upload files. Use it to upload index.html and others.

  5. Debug

    • Send RAW messages to AC, i.e., "00 FE 10 02 80 8A E6"
    • Debug output: Shows serial raw and decoded messages
    • Log

  6. MQTT Configuration (if USE_MQTT)

    • Runtime modification of: host, port, username, password, device name
    • Persisted to /mqtt_config.json in LittleFS

Home Assistant & MQTT

Up Previous Next

If USE_MQTT is enabled, the device integrates with Home Assistant using MQTT Discovery.

Discovery

The device automatically publishes configuration to: homeassistant/climate/toshiba_ac/config

Manual Configuration / Topics

If discovery is not used, here are the available topics:

Topic Type Topic Path Payload / Description
Status homeassistant/ac/status/mode cool, heat, auto, fan_only, dry, off
Status homeassistant/ac/status/fan_mode auto, high, medium, low
Status homeassistant/ac/status/temperature Target Temperature (e.g. 22)
Status homeassistant/ac/status/current_temperature Room Temperature (e.g. 21.5)
Command homeassistant/ac/set/mode Set mode (same values as status + on/off)
Command homeassistant/ac/set/fan_mode Set fan speed
Command homeassistant/ac/set/temperature Set target temperature

Configuration

MQTT settings (Broker, User, Password) can be configured via the Web Interface and are saved to /mqtt_config.json. The device status (Power, Mode, Fan, Temperature) is periodically published and updated in real-time when changed via Web or Remote.

Hardware installation

Up Previous Next

You will need an esp8266, a circuit for adapting signals to esp8266, a USB power supply, a a couple of dupont (female) wires.

  • Take out the cover of your remote controller
  • Loose the screws of AB terminals. WARNING: My PCB assumes A is positive and B is negative. If this is not your case you can damage the PCB. (#40 (comment))
  • Pass the wires through the ventilation holes of the cover.
  • Insert dupont wires on the terminals and screw them again
  • Close the cover
  • Connect dupont wires to the pcb (A,B)
  • Plug the Wemos D1 mini into the pcb
  • Power Wemos with usb cable and the led will start blinking (if you have already programmed it)

Just switch it on/off while you are in bed. If you like it just send me a beer and/or improve the project!

image image

Data acquisition

Up Previous Next

This is how I managed to decode the information from the AB bus. First I plugged a multimeter to check the range of the signal and not fry anything. Then I used a DS0138 oscilloscope to monitor the signal and to guess voltages and baudrate (a resistor divider is suggested in order to lower the voltage). Later, an 8-channel USB logic analyzer (4-5 USD) can be used to capture data into the computer. REMEMBER to convert voltages to 0-3.3v before connecting it to logic analyzer or you will make magic smoke. You can use the read circuit below.

To capture data you can use pulseview with uart decoder 2400 bps, 8bits, start, stop, EVEN parity

In case you need it you can install the following packages

sudo apt install sigrok-cli
sudo apt install sigrok-firmware-fx2lafw

When the data has been validated visually you can use the following command line that reads RX data annotations and print one message per line according to 4th byte (message size).

sigrok-cli -P uart:rx=D0:baudrate=2400:parity_type=even -A uart=rx_data -i  YOURFILE  | awk '{pad =" "; b[len%4]=$2; if(len==3) {bytes="0x"b[len];  printf("%s%s%s%s%s%s%s%s",b[0],pad,b[1],pad,b[2],pad,b[3],pad)} if(len>3) {printf("%s%s",$2,pad);} len=len+1; if(len==4+bytes+1) {print "";len=0;bytes=0}}'

sigrok-cli -d fx2lafw -c samplerate=250000 -t D0=r -P uart:rx=D0:baudrate=2400:parity_type=even  -A uart=rx_data --continuous

Custom hardware

Up Previous Next

Note: I strongly recommend to use makusets board instead of my custom hardware. My hardware is designed assuming a voltage level of the AB line around 15.6V when "1" and 14V when "0". Different voltage values will not work for writing while reading will work.

I have designed some circuits to read and write the signal

Read

I will use an optocoupler because it simplifies things and also isolates microcontroller from the rest of the system.

  • Air conditioning side: Voltage is around 15.6 volts when "1" and 14 when "0". A zener diode in reversed position provides 13V reference given that voltage is in the range [14, 15.6] and is > 13V. Thus, the signal is now in the range [1V, 2.6V]. Then, after diode 1N4001 (0.7V drop) voltage is 0.3V .. 1.9V, enough to activate the photodiode (1.2V) when "1" and to not activate it when "0".

IR led from optocouple drops 1.2v, and from signal we have a difference of 15.6V-13V=2.6V, thus 2.6V-1.2V=1.4V/100ohm = 14mA which has a maximum CTR=140% Ic=3.3, If=14 CTR=Ic/If

Type     VZnom  IZT  for  rzjT    rzjk  at  IZK    IR  at  VR
1N4743A  13     19        <10     <100      0.25   <5      9.9

Now, let's calculate the resistor value Izt=19 mA -> 2.6/19=130ohm P=VI 2.6*19 =52mW

  • Microcontroller side: 1k resistor limits the current. ESP8266 max current is 12mA > 3.3/1k = 3.3 mA
Air                                         Microcontroller
Conditioner

                          1N4001  _______
  A ---------+----100R ---->|----|       |-------3v3
             |                   | PC817 |
            10k                  |       |
             |                   |       |
  B --->|----+-------------------|_______|------ OUT               
                                             |
     zener 13v                              1k
      1N4743A                                |
                                            GND

Write

Write circuit performs similarly to read circuit.

  • When OUT signal is "1", transistor and pullup resistor are "0", thus optocoupler is OFF and voltage is 15.6 (HIGH).
  • When OUT signal is 0, transistor is off and pullup resistor sends 1 and activates optocoupler and zener diode gives 13V (LOW). Some systems recommend to set the Follower in the remote unit.

Here I attach the datasheets of the components. https://www.onsemi.com/pub/Collateral/P2N2222A-D.PDF https://learnabout-electronics.org/Downloads/PC817%20optocoupler.pdf


              3v3                                    1N4001
               |                             |-----+---|<------- A               
              200                 _______    |     |               
               ------------------|       |---|     ^ zener 13v
               /                 | PC817 |         /
 OUT --1k- ---|   2N2222     |---|_______|---1k---| 2N2222
               \             |                     \
               |             |                     |
              GND           GND                    ------------- B

Plan B. (In fact it was plan A but then I managed to decode AB protocol, yeah!)

To solder wires to button pads on the remote controller and close circuit to simulate pressing them (with and optocoupler).

                       _________
    uc OUT --- 200R----| PC817 |------- PAD+
                 GND---|_______|---4k7--PAD-

ESP8266 high level is 3v3 and the maximum current per pin is 12mA (but we will go safer with 10mA). Thus, the resistor for the IR diode of the optocoupler is 3.3-1.2/10=210 -> 200 ohm. 4k7 is a safe value since we just want continuity.

Following traces from button pads end in 2k resistors that we will use to solder wires. As R46 is common, we can think is button GND ON button is connected to R25 and R46 Temp down button is connected to R23 adn R46 Temp up button is connected to R24 and R46

Data format

Up Previous Next

Data packages have the following format:

Source Dest Opcode 1 Data Length R/W mode Opcode 2 Payload CRC

Source/Dest (1 byte):

# Description
00 master (central unit)
40 remote controller in the range [0x40..]
FE broadcast
F0 Group
52 ??

Data length (1 byte)

  • Length of data field

R/W mode (1 byte)

Mode Desc
08 for Write mode (from remote 40)
80 for Read mode (from master 00)

Payload can be empty such as in ping message 00 FE 10 02 80 8A E6.

CRC is computed as Checksum8 XOR of all the bytes (Compute it at https://www.scadacore.com/tools/programming-calculators/online-checksum-calculator/)

OpCode1 (byte 2) indicates the function of the message and OpCode2 (byte 5) specifies the feature or register being targeted.

OpCode1 Description Type Example
10 Ping / Alive MSG_MASTER_ALIVE 00 FE 10 02 80 8A E6
11 Write / Control MSG_POWER, MSG_SET_... 40 00 11 03 08 41 03 18
15 Request / Query MSG_MODEL_REQUEST... 40 F0 15 02 00 08 AF
17 Sensor Query MSG_SENSOR_QUERY 40 00 17 08 08 80 EF 00 2C 08 00 02 1E
18 Response / Report MSG_MODEL_ANSWER... 00 40 18 14 80 08 52 41 56 2d 53 4d 31 31 30 36 42 54 50 2d 45 20 03 37 8e
1A Sensor Answer MSG_SENSOR_ANSWER 00 40 1A 07 80 EF 80 00 2C 00 2B B5
1C Status MSG_STATUS 00 FE 1C 0D 80 81 8D AC 00 00 76 00 33 33 01 00 01 B9
52 Remote Start - -
55 Remote Temp MSG_REMOTE_SENSOR_TEMP 40 00 55 05 08 81 00 69 00 F0
58 Ext. Status MSG_STATUS_EXT 00 FE 58 0F 80 81 34 A8 00 00 6C 6D E9 00 55 55 01 00 01 DC
OpCode2 Description Type Example
02 DN Codes MSG_DN_CODE 40 00 15 05 08 02 F5 00 01 AE
07 Save Ratio MSG_SAVE_RATIO_... 00 40 18 03 80 07 4B 97
08 Model Info MSG_MODEL_... 00 40 18 14 80 08 52 41 56 2d 53 4d 31 31 30 36 42 54 50 2d 45 20 03 37 8e
0A Temp Limits MSG_TEMP_LIMITS 00 40 18 10 80 0A 00 2F 0F 80 6A 80 6A 80 6A 80 6A 04 56 00 B0
0C Pong / Ping MSG_REMOTE_PING 40 00 15 07 08 0C 81 00 00 48 00 9F
0D Announce MSG_ANNOUNCE 40 F0 15 02 00 0D AA
0F Setpoints MSG_SETPOINT 00 40 18 09 80 0F 7A 74 78 78 25 52 05 A2
10 Fan Caps MSG_FAN_MODES_... 00 40 18 0E 80 10 00 35 33 35 33 35 33 35 33 00 00 00 C6
27 Errors MSG_SENSOR_ERROR 00 40 18 05 80 27 08 00 48 BA
41 Power MSG_POWER 40 00 11 03 08 41 03 18
42 Mode MSG_SET_MODE 40 00 11 03 08 42 01 19
4C Temp/Fan MSG_SET_TEMP_FAN 40 00 11 08 08 4C ...
54 Save MSG_SAVE 40 00 11 04 08 54 01 01 09
80 Sensor ID MSG_SENSOR_QUERY 40 00 17 08 08 80 EF 00 2C 08 00 02 1E
81 Status MSG_STATUS 00 FE 1C 0D 80 81 8D AC 00 00 76 00 33 33 01 00 01 B9
86 Mode Stat MSG_STATUS_MODE 00 52 11 04 80 86 84 01 C4
8A Alive MSG_MASTER_ALIVE 00 FE 10 02 80 8A E6
A1 ACK MSG_MASTER_ACK 00 40 18 02 80 A1 7B
A3 Busy MSG_MASTER_BUSY 00 40 18 02 80 A3 79
E8 Time MSG_TIME_COUNTER 40 00 15 06 08 E8 00 01 00 9E 2C
EF Sensor Val MSG_SENSOR_ANSWER 00 40 1A 07 80 EF 80 00 2C 00 2B B5

Message types

Up Previous Next

The protocol relies on a command/response structure. Most control commands are sent by the Remote (0x40), and the Master (0x00) responds with status updates or acknowledgments.

Temperatures are coded with the formula: (Value >> 1) - 35. That is, for a value of 0x78, the temperature is (0x78 >> 1) - 35 = 120/2 - 35 = 60 - 35 = 25°C.

1. Control Commands (Remote -> Master)

These commands control the state of the AC unit.

Command OpCode 1 OpCode 2 Type Data Structure (Example) Description
Power 11 41 MSG_POWER 40 00 11 03 08 41 [Value] [CRC] Value: 03=ON, 02=OFF
Mode 11 42 MSG_SET_MODE 40 00 11 03 08 42 [Mode] [CRC] Mode: 01=Heat, 02=Cool, 03=Fan, 04=Dry, 05=Auto
Temp/Fan 11 4C MSG_SET_TEMP_FAN 40 00 11 08 08 4C [Mode+] [Fan+]... Combined Setpoint (Temp, Fan, Mode)
Save 11 54 MSG_SAVE 40 00 11 04 08 54 01 [Value] [CRC] Value: 01=ON, 00=OFF
Ping 15 0C 81 MSG_REMOTE_PING 40 00 15 07 08 0C 81 00 00 48 00 9F Keep-alive / check presence
Timer 11 0C 82 - 40 00 11 09 08 0C 82 00 00 30 05 01 01 EB Timer settings
Req. DN 15 02 MSG_DN_CODE_REQUEST 40 00 15 05 08 02 F5 00 01 AE Request DN Code value. Code in byte 6
Save Ratio 15 07 MSG_SAVE_RATIO_REQUEST 40 00 15 04 08 07 00 C2 9C Request power save ratio
Model 15 08 MSG_MODEL_REQUEST 40 00 15 02 08 08 AF Request model information
Limits 15 0A MSG_TEMP_LIMITS_REQUEST 40 00 15 02 08 0A 55 Request temp limits
Features 15 0D MSG_ANNOUNCE 40 F0 15 02 00 0D AA Announce / Request features
Setpoints 15 0F MSG_SETPOINT_REQUEST 40 00 15 02 08 0F 50 Request setpoints
Fan Caps 15 10 MSG_FAN_MODES_REQUEST 40 00 15 02 08 10 4F Request fan capabilities
Time Cnt 15 E8 MSG_TIME_COUNTER 40 00 15 06 08 E8 00 01 00 9E 2C Request time counter (?)
Sensor Query 17 80 MSG_SENSOR_QUERY 40 00 17 08 08 80 EF 00 2C 08 00 02 1E Request specific sensor value
Remote Temp 55 81 MSG_REMOTE_SENSOR_TEMP 40 00 55 05 08 81 00 [Val] 00 [CRC] Temperature in byte 7

Temperature and Fan Speed (OpCode 4C) Breakdown: The 4C packet is used when changing Temperature or Fan Speed. It contains multiple state variables. 40 00 11 08 08 4C [Byte6] [Byte7] [Byte8] 00 [ModeCheck] [ModeCheck] [CRC]

  • Byte 6 (Mode): 0x10 + Mode (02=Cool, 01=Heat, etc.)
  • Byte 7 (Fan): 0x18 + Fan (0=Auto, 1=High, 2=Med, 5=Low) -> Note: bitmasks vary
  • Byte 8 (Temp): ((TargetTemp + 35) << 1)
  • ModeCheck: 0x33 for Cool/Dry/Fan/Auto, 0x55 for Heat.

2. Status Reports & Answers (Master -> Remote)

The Master unit periodically broadcasts its status or responds to specific queries.

Message OpCode 1 OpCode 2 Type Data Structure (Example) Description
Status 1C 81 MSG_STATUS 00 FE 1C 0D 80 81 8D AC 00 00 76 00 33 33 01 00 01 B9 Standard periodic status (Power, Mode, Fan, RoomTemp)
Ext. Status 58 81 MSG_STATUS_EXT 00 FE 58 0F 80 81 34 A8 00 00 6C 6D E9 00 55 55 01 00 01 DC Extended status (Filter, Preheat, Errors, Extra Temps)
Alive 10 8A MSG_MASTER_ALIVE 00 FE 10 02 80 8A E6 Frequent Keep-Alive broadcast from Master
ACK 18 A1 MSG_MASTER_ACK 00 40 18 02 80 A1 7B Acknowledgment after a valid setting change
Busy 18 A3 MSG_MASTER_BUSY 00 40 18 02 80 A3 79 Master is busy processing command
Pong 18 0C MSG_MASTER_PONG 00 40 18 08 80 0C 00 03 00 00 48 00 97 Response to Remote Ping
Mode Stat 11 86 MSG_STATUS_MODE 00 52 11 04 80 86 84 01 C4 Mode confirmation
DN Code 18 02 MSG_DN_CODE 00 40 18 07 80 02 01 02 05 00 00 DB Response with DN Code value
Save Ratio 18 07 MSG_SAVE_RATIO_ANSWER 00 40 18 03 80 07 4B 97 Response with power save ratio
Model 18 08 MSG_MODEL_ANSWER 00 40 18 14 80 08 52 41 56 2d 53 4d 31 31 30 36 42 54 50 2d 45 20 03 37 8e Response with model string
Limits 18 0A MSG_TEMP_LIMITS 00 40 18 10 80 0A 00 2F 0F 80 6A 80 6A 80 6A 80 6A 04 56 00 B0 Response with temp limits
Features 18 0D MSG_FEATURES 00 40 18 12 80 0D 08 00 FE FE FE FE FE FE FE FE FE FE FE FE FE FE CD Response with supported features
Setpoints 18 0F MSG_SETPOINT 00 40 18 09 80 0F 7A 74 78 78 25 52 05 A2 Response with setpoints
Fan Caps 18 10 MSG_FAN_MODES_ANSWER 00 40 18 0E 80 10 00 35 33 35 33 35 33 35 33 00 00 00 C6 Response with fan capabilities
Errors 18 27 MSG_SENSOR_ERROR 00 40 18 05 80 27 08 00 48 BA Error history report
Time Cnt 18 E8 MSG_TIME_COUNTER_ANSWER 00 40 18 07 80 E8 00 01 00 01 83 B4 Response with time counter
Sensor 1A EF MSG_SENSOR_ANSWER 00 40 1A 07 80 EF 80 00 2C 00 2B B5 Response with sensor value

Status Packet (OpCode 1C): 00 FE 1C 0D 80 81 [D1] [D2] 00 00 [Temp] 00 [Chk] [Chk] [Sv] 00 [Pwr] [CRC]

  • D1 (Mode): Mode is in bits 7-5. 0x80 mask often seen.
  • D2 (Fan): Fan speed in bits 7-5.
  • Temp: ((Value >> 1) - 35) = Room Temperature.
  • Sv (Save): Bit 0 indicates Save Mode.
  • Pwr: Bit 0 indicates Power (1=ON).

3. Remote Announce Protocol

1. Announce / Discovery (Remote -> System)

In the master bootup process (you need to switch off and on the master), the remote controller sends an Announce message to the broadcast address (0xF0).

  • Message: 40 F0 15 02 00 0D AA
    • Source: 0x40 (Remote)
    • Dest: 0xF0 (Discovery / Broadcast)
    • OpCode: 15 (Request) ... 0D (Announce)

If the master is busy it will respond with MSG_MASTER_BUSY

  • Message: 00 40 18 02 80 A3 79
    • Source: 0x00 (Master)
    • Dest: 0x40 (Remote)
    • OpCode: 18 (Response) ... A3 (Busy)

otherwise it will respond with MSG_FEATURES and that means the remote is linked. Take into account that for the remote to work it needs to be linked to the master. This is not necessary if you already have a remote linked to the master (i.e. your RBC-AMT32E).

  • Message: 00 40 18 12 80 0d 08 00 fe fe fe fe fe fe fe fe fe fe fe fe fe fe cf
    • Source: 0x00 (Master)
    • Dest: 0x40 (Remote)
    • OpCode: 18 (Response) ... 0D (Features)
    • Payload: 0x12 (18 bytes)
    • Data: The sequence FE FE... likely represents a bitmap of supported features (modes, fan speeds, louvers, etc.) enabled on the indoor unit.

After the reception of MSG_FEATURES the remote will ask for the following information:

  • Model info
  • Temperature Limits
  • Capabilities
  • Power Save Ratio
  • Current Setpoint

Model:

  • Request: 40 F0 15 02 00 08 AF
  • Response: 00 00 18 0D 00 08 [Model String] [CRC] (e.g. RAV-SM406...)

Temperature Limits:

  • Request: 40 00 15 02 08 0A 55
  • Response: 00 40 18 10 80 0A 00 2F 0F 80 6A 80 6A 80 6A 80 6A 04 56 00 B0 (Example)
    • Byte 9: Max Temp (0x80 -> 29°C)
    • Byte 10: Min Temp (0x6A -> 18°C)
    • Byte 17: Frost Protection Flag (0x04 = Enabled)
    • Byte 18: Frost Protection Temp (0x56 -> 8°C)
    • Formula: (Value >> 1) - 35

Power Save Ratio:

  • Request: 40 00 15 04 08 07 00 C2 9C
  • Response: 00 40 18 03 80 07 4B 97 (Value: 0x4B = 75%)

Current Setpoint:

  • Request: 40 00 15 02 08 0F 50
  • Response: 00 40 18 09 80 0F 7A 74 78 78 25 52 05 A2 (Example)
    • Bytes 6-9: Default temperatures for Auto, Heat, Dry, Cool.
    • Formula: (Value >> 1) - 35
    • Example Values:
      • Auto: 0x7A -> 26°C
      • Heat: 0x74 -> 23°C
      • Dry: 0x78 -> 25°C
      • Cool: 0x78 -> 25°C

Capabilities: This message is still UNDER STUDY, so it is not yet clear what the values mean.

  • Request: 40 00 15 02 08 10 50
  • Response: 00 40 18 0E 80 10 00 35 33 35 33 35 33 35 33 00 00 00 C6 (Example)
    • Bytes 6-9: ??.

Time Sync / Counter:

  • Message: 40 00 15 06 08 E8 00 01 00 9E 2C (Sent every minute by Remote in some units)

4. Sensor & Maintenance

Query Sensor: Request specific sensor ID (see Sensor Addresses)

  • Request: 40 00 17 08 08 80 ef 00 2c 08 00 [SENSOR] [CRC]
    • Opcode 17 80
    • Byte 11: Sensor ID
  • Response: 00 40 1A 07 80 EF 80 00 2C [ValH] [ValL] [CRC]
    • Opcode 1A EF
    • Byte 9: High Byte
    • Byte 10: Low Byte
    • Value: (Byte9 << 8) | Byte10
    • If Value == 0xA2, the value is undefined.

Sensor addresses

| No. | Desc | |---|---|---| | 00 | Room Temp (Control Temp) (°C) | | 01 | Room temperature (remote controller) | | 02 | Indoor unit intake air temperature (TA) | | 03 | Indoor unit heat exchanger (coil) temperature (TCJ) Liquid | | 04 | Indoor unit heat exchanger (coil) temperature (TC) Vapor | | 07 | Indoor Fan Speed| | | 60 | Outdoor unit heat exchanger (coil) temperature (TE) | | 61 | Outside air temperature (TO)| | | 62 | Compressor discharge temperature (TD) | | 63 | Compressor suction temperature (TS) | | 65 | Heatsink temperature (THS) | | 6a | Operating current (x1/10) | | 6d | TL Liquid Temp (°C) | | 70 | Compressor Frequency (rps)| | | 72 | Fan Speed (Lower) (rpm) | | 73 | Fan Speed (Upper) (rpm) | | f1 | Compressor cumulative operating hours (x100 h) | | f2 | Fan Run Time (x 100h) | | f3 | Filter sign time x 1h | | f8 | Indoor Discharge Temperature |

5. DN Codes

DN Codes are configuration settings for the Toshiba AC unit. Here only read functionality is described.

Request

The specific DN code is requested using OpCode 15 02.

40 00 15 05 08 02 [Mode] [Code] [Offset] [CRC]

  • Mode: Defines the traversal method.
    • 0xF5: Request Current specific code.
    • 0xF1: Request Next available code.
    • 0xF2: Request Previous available code.
  • Code: DN Code address
  • Offset: Typically 0x00 for current, 0x01 for next/prev.

Response

The Master returns the value for the DN code.

00 40 18 07 80 02 [RefCode] [Value] [Unk1] [Unk2] [Unk3] [CRC]

  • RefCode (Byte 6): Often points to the next code or context.
  • Value (Byte 7): The value of the requested DN Code.
  • Unk1-3: Unknown data (possibly related to min/max or permissions).

Example:

  • Request: 40 00 15 05 08 02 f5 01 00 ae (Request Code 01)
    • Response: 00 40 18 07 80 02 01 02 05 00 00 db
    • Here, Byte 7 (0x02) is the value. Byte 6 (0x01) is current code given F5 "current" mode was used.

DN Codes List

These codes define various configuration parameters.

Code Description
01 Filter alarm time
02 Dirty state
03 Central ctl address
04 Specific indoor priority
05 Fan control heating
06 Heating temp shift
0C Preparing indication
0D Auto mode existence
0E FS Box
0F Heat mode
10 Type
11 Indoor unit capacity
12 System address
13 Indoor unit address
14 Group master/slave
16 Indoor fan speed
1E Dead band
1F Max set temp cool
20 Min set temp cool
21 Max set temp heat
22 Min set temp heat
23 Max set temp dry
24 Min set temp dry
25 Max set temp auto
26 Min set temp auto
28 Auto restart
2A CN70
2E CN61
31 External fan control
32 TA sensor (0 Body, 1 Remote)
33 Temperature unit (0 C, 1 F)
45 Anti-smudge louver
49 24h ventilation
4C Night purge
5D Standard ducted
60 Timer set
62 Anti-smudge fan speed
69 Louver position
77 Dust set point
86 Correction strong heating
88 Air direction setting
9A Fan control cooling
9B Hot start
D0 Power saving
F0 Swing mode
F1 Louver 1
F2 Louver 2
F3 Louver 3
F4 Louver 4
F6 Application ctl kit
FE Group control

TO-DOS

Up Previous Next

Other info

Up Previous

If you want to know about error codes and sensor addresses you can check the following links. http://www.toshiba-aircon.co.uk/assets/uploads/pdf/sales_tools/Technical_Handbook_ver._13.1.pdf https://www.cdlweb.info/wp-content/uploads/2020/10/1-CDL-Toshiba-R32-Technical-Handbook-V10-2020.pdf https://www.toshibaclim.com/Portals/0/Documentation/Manuels%20produits/SM_CassetteUTP_DI-SDI-111416-E_GB.pdf

I found this projects interesting even that it is not the same protocol https://github.com/H4jen/webasto_sniffer https://echonet.jp/wp/wp-content/uploads/pdf/General/Standard/Release/Release_F_en/SpecAppendixF_e.pdf

Info about commercial gateways but no info about protocol :(

Connections https://www.toshibaclim.com/Portals/0/Documentation/Manuels%20produits/SM_CassetteUTP_DI-SDI-111416-E_GB.pdf Sensor addresses (pg 52) http://www.toshiba-aircon.co.uk/assets/uploads/pdf/sales_tools/New_Technical_Handbook_version_14_1_3.pdf Sensor addresses (pg 73) https://www.toshibaclim.com/Portals/0/Documentation/Manuels%20produits/SM_CassetteUTP_DI-SDI-111416-E_GB.pdf Sensor addresses (pg 42) http://www.toshiba-aircon.co.uk/assets/uploads/pdf/sales_tools/Technical_Handbook_ver._13.1.pdf

Error codes from Toshiba (pg 38) https://cdn.shopify.com/s/files/1/1144/2302/files/BP-STD_Toshiba_v1_08.pdf Temperature formula TCS-Net https://www.toshibaheatpumps.com/application/files/8914/8124/4818/Owners_Manual_-_Modbus_TCB-IFMB640TLE_E88909601.pdf https://www.toshibaheatpumps.com/customer-support/owner-manuals https://www.intesisbox.com/intesis/product/media/intesisbox_to-ac-knx-16-64_user_manual_en.pdf?v=2.2

The unit where I have tested the project is model RAV-SM406BTP-E which stands for

RAV-SM406BTP-E 
|     | |    |- CE marking
|     | ||-Duct
|     | |-gen
|     |-duty 4.0 kW 
|   |-Digital inverter
|- Light comercial

About

AB protocol decoder for toshiba air conditioners

Topics

esp8266 air hvac toshiba conditioner tcc-link

Resources

Readme
Activity

Stars

65 stars

Watchers

4 watching

Forks

12 forks
Report repository

Releases 3

Version 2.1 Latest
Feb 12, 2026
+ 2 releases

Packages

 
 
 

Contributors 1

Languages