Controlling the comfoair-q using CAN

[djwlindenaar]

Hi,
I'm very happy with the code you've put up, since I'm trying to connect my comfoair-q 450 to my home automation using CAN. I've already figured out some more can messages ( have to double-check before I will upload), but the basis you've provided is great.
How did you figure these out? Did you have something to sniff? If so could you share that data?

Especially I'm still trying to figure out how to control anything on the system. When I send the command to change the bypass setting, nothing happens.
Is there something like a handshake needed or..?

I'd love to get some help and once I get things working contribute back to the project as well.

Best regards
Daniel

[djwlindenaar]

@marco-hoyer do you have any logs available?
Especially I'm wondering where there are some initialization messages between the comfoair-q unit and the comfoconnect. I'm suspecting that, since my unit is not responding to any commands given over CAN...

[marco-hoyer]

Hi @djwlindenaar, I started sniffing the CAN traffic going over the wire regularly and searched for some patterns and tried to find out how they encoded the values comparing what I saw to what was displayed on the device itself. Then I had a Zehnder ComfoSense C67 device for a while which helped finding some more things. I mostly bought it to reverse engineer how to send commands and thats where I failed so far. Even when I sent the exact same sequences I was not able to make the device do anything. The code is there but mostly for testing atm. I have returned the ComfoSense device and bought a ComfoConnect KNX C bridge and will try to find some time to make another try to find out how it works. I'm totally open for ideas and would be glad if you would contribute something.

[marco-hoyer]

I will see if I can find some logs from the traffic I recorded.

[marco-hoyer]

zcan show will log all so far unknown messages (makes it easier to look at)
zcan show --all will log all messages

[marco-hoyer]

I updated the readme with some information about how to execute the code. If you have any questions don't hesitate to ask.

[djwlindenaar]

Thanks for that, I had to figure it out from reading the code :)

I've been able to use the mapping.py for a different software that will output a json file with all the latest sensor data. I'm using the USBtin as well, but I'm using the SocketCAN interface in linux, which allows me to use standard candump and cansend methods to inject packets.

When I send the sequence for changing the ventilation level:

def write_ventilation_level(iterator):
    messages = [
        bytes("T1F0{}505180084150101000000".format(iterator), encoding="ASCII"),
        bytes("T1F0{}505180100201C00000300".format(iterator), encoding="ASCII"),
        bytes("T1F0{}14410".format(int(iterator) - 1), encoding="ASCII")
    ]
CanBus().write_messages(messages)

Nothing happens. It seems to me the 'iterator' is actually the ID of the device sending the request, which are listed nicely in the protocol.md of michaelarnauts/comfoconnect:

productId	type	description
1	ComfoAirQ	The ComfoAirQ ventilation unit.
2	ComfoSense	ComfoSense C
3	ComfoSwitch	ComfoSwitch C
4	OptionBox
5	ZehnderGateway	ComfoConnect LAN C
6	ComfoCool	ComfoCool Q600
7	KNXGateway	ComfoConnect KNX C
8	Service Tool
9	PT Tool	Production test tool
10	DVT Tool	Design verification test tool

You have listed in mapping.py the reference to T1F055051 as well as T1F075051, which makes sense considering you had both the ComfoConnect LAN C and the ComfoConnect KNX C.

Now it seems to me for the ComfoAirQ to accept commands, first a kind of handshake or identification has gone on. I've tried the following which seems to trigger something of that sort.
Normally I get about once per second a kind of ping:
slcan0 10000001 [0]

Now when I inject the same kind of ping like this:
slcan0 10000005 [0]

I get back:

  slcan0  10000001   [0]  remote request
  slcan0  10000001   [4]  01 01 00 00

So it seems this triggers something in the ComfoAirQ. But I'm not sure what to send next, hence a log would be nice :). Especially if you could get one right from bootup of the ComfoAirQ, so we can be sure any identification/initialization sequence is there. I'd appreciate it!

Best regards
Daniel

[marco-hoyer]

The idea of the iterator potentially being an id is an interesting one. I usually saw the ComfoSense sending 1,3,5 and 7 as iterator value for subsequent commands. It always repeated but I couldn't make sense of it so far. I recorded messages for setting the ventilation level. You see the value regularly alternating without any visible reference.

3 to 1
28.02.2018 01:44:31 INFO: type:T id:1F015051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F01505180084150101000000\r')
28.02.2018 01:44:31 INFO: type:T id:1F015051 length:8 data:[1, 0, 32, 28, 0, 0, 1, 0] (raw: b'T1F01505180100201C00000100\r')
28.02.2018 01:44:31 INFO: type:T id:1F015051 length:3 data:[130, 0, 0] (raw: b'T1F0150513820000\r')
28.02.2018 01:44:31 INFO: type:T id:1F001441 length:0 data:[] (raw: b'T1F0014410\r')

1 to 3
28.02.2018 01:45:14 INFO: type:T id:1F035051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F03505180084150101000000\r')
28.02.2018 01:45:14 INFO: type:T id:1F035051 length:8 data:[1, 0, 32, 28, 0, 0, 3, 0] (raw: b'T1F03505180100201C00000300\r')
28.02.2018 01:45:14 INFO: type:T id:1F035051 length:3 data:[130, 0, 0] (raw: b'T1F0350513820000\r')
28.02.2018 01:45:14 INFO: type:T id:1F021441 length:0 data:[] (raw: b'T1F0214410\r')

3 to 1
28.02.2018 01:45:31 INFO: type:T id:1F055051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F05505180084150101000000\r')
28.02.2018 01:45:31 INFO: type:T id:1F055051 length:8 data:[1, 0, 32, 28, 0, 0, 1, 0] (raw: b'T1F05505180100201C00000100\r')
28.02.2018 01:45:31 INFO: type:T id:1F055051 length:3 data:[130, 0, 0] (raw: b'T1F0550513820000\r')
28.02.2018 01:45:31 INFO: type:T id:1F041441 length:0 data:[] (raw: b'T1F0414410\r')

2 to 3
28.02.2018 01:52:19 INFO: type:T id:1F035051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F03505180084150101000000\r')
28.02.2018 01:52:19 INFO: type:T id:1F035051 length:8 data:[1, 0, 32, 28, 0, 0, 3, 0] (raw: b'T1F03505180100201C00000300\r')
28.02.2018 01:52:19 INFO: type:T id:1F035051 length:3 data:[130, 0, 0] (raw: b'T1F0350513820000\r')
28.02.2018 01:52:19 INFO: type:T id:1F021441 length:0 data:[] (raw: b'T1F0214410\r')

? to 1
28.02.2018 01:57:16 INFO: type:T id:1F075051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F07505180084150101000000\r')
28.02.2018 01:57:16 INFO: type:T id:1F075051 length:8 data:[1, 0, 32, 28, 0, 0, 1, 0] (raw: b'T1F07505180100201C00000100\r')
28.02.2018 01:57:16 INFO: type:T id:1F075051 length:3 data:[130, 0, 0] (raw: b'T1F0750513820000\r')
28.02.2018 01:57:16 INFO: type:T id:1F061441 length:0 data:[] (raw: b'T1F0614410\r')

1 to 3
28.02.2018 01:57:40 INFO: type:T id:1F015051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F01505180084150101000000\r')
28.02.2018 01:57:40 INFO: type:T id:1F015051 length:8 data:[1, 0, 32, 28, 0, 0, 3, 0] (raw: b'T1F01505180100201C00000300\r')
28.02.2018 01:57:40 INFO: type:T id:1F015051 length:3 data:[130, 0, 0] (raw: b'T1F0150513820000\r')
28.02.2018 01:57:40 INFO: type:T id:1F001441 length:0 data:[] (raw: b'T1F0014410\r')

3 to 1
28.02.2018 01:57:56 INFO: type:T id:1F035051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F03505180084150101000000\r')
28.02.2018 01:57:56 INFO: type:T id:1F035051 length:8 data:[1, 0, 32, 28, 0, 0, 1, 0] (raw: b'T1F03505180100201C00000100\r')
28.02.2018 01:57:56 INFO: type:T id:1F035051 length:3 data:[130, 0, 0] (raw: b'T1F0350513820000\r')
28.02.2018 01:57:56 INFO: type:T id:1F021441 length:0 data:[] (raw: b'T1F0214410\r')

1 to 3
28.02.2018 01:58:12 INFO: type:T id:1F055051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F05505180084150101000000\r')
28.02.2018 01:58:12 INFO: type:T id:1F055051 length:8 data:[1, 0, 32, 28, 0, 0, 3, 0] (raw: b'T1F05505180100201C00000300\r')
28.02.2018 01:58:12 INFO: type:T id:1F055051 length:3 data:[130, 0, 0] (raw: b'T1F0550513820000\r')
28.02.2018 01:58:12 INFO: type:T id:1F041441 length:0 data:[] (raw: b'T1F0414410\r')

3 to 1
28.02.2018 02:00:24 INFO: type:T id:1F015051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F01505180084150101000000\r')
28.02.2018 02:00:24 INFO: type:T id:1F015051 length:8 data:[1, 0, 32, 28, 0, 0, 1, 0] (raw: b'T1F01505180100201C00000100\r')
28.02.2018 02:00:24 INFO: type:T id:1F015051 length:3 data:[130, 0, 0] (raw: b'T1F0150513820000\r')
28.02.2018 02:00:24 INFO: type:T id:1F001441 length:0 data:[] (raw: b'T1F0014410\r')

1 to 3
28.02.2018 02:00:52 INFO: type:T id:1F035051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F03505180084150101000000\r')
28.02.2018 02:00:52 INFO: type:T id:1F035051 length:8 data:[1, 0, 32, 28, 0, 0, 3, 0] (raw: b'T1F03505180100201C00000300\r')
28.02.2018 02:00:52 INFO: type:T id:1F035051 length:3 data:[130, 0, 0] (raw: b'T1F0350513820000\r')
28.02.2018 02:00:52 INFO: type:T id:1F021441 length:0 data:[] (raw: b'T1F0214410\r')

3 to 1
28.02.2018 02:01:05 INFO: type:T id:1F055051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F05505180084150101000000\r')
28.02.2018 02:01:05 INFO: type:T id:1F055051 length:8 data:[1, 0, 32, 28, 0, 0, 1, 0] (raw: b'T1F05505180100201C00000100\r')
28.02.2018 02:01:05 INFO: type:T id:1F055051 length:3 data:[130, 0, 0] (raw: b'T1F0550513820000\r')
28.02.2018 02:01:05 INFO: type:T id:1F041441 length:0 data:[] (raw: b'T1F0414410\r')

1 to 3
28.02.2018 02:01:20 INFO: type:T id:1F075051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F07505180084150101000000\r')
28.02.2018 02:01:20 INFO: type:T id:1F075051 length:8 data:[1, 0, 32, 28, 0, 0, 3, 0] (raw: b'T1F07505180100201C00000300\r')
28.02.2018 02:01:20 INFO: type:T id:1F075051 length:3 data:[130, 0, 0] (raw: b'T1F0750513820000\r')
28.02.2018 02:01:20 INFO: type:T id:1F061441 length:0 data:[] (raw: b'T1F0614410\r')

3 to 1
28.02.2018 02:01:35 INFO: type:T id:1F015051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F01505180084150101000000\r')
28.02.2018 02:01:35 INFO: type:T id:1F015051 length:8 data:[1, 0, 32, 28, 0, 0, 1, 0] (raw: b'T1F01505180100201C00000100\r')
28.02.2018 02:01:35 INFO: type:T id:1F015051 length:3 data:[130, 0, 0] (raw: b'T1F0150513820000\r')
28.02.2018 02:01:35 INFO: type:T id:1F001441 length:0 data:[] (raw: b'T1F0014410\r')

1 to 3
28.02.2018 02:01:50 INFO: type:T id:1F035051 length:8 data:[0, 132, 21, 1, 1, 0, 0, 0] (raw: b'T1F03505180084150101000000\r')
28.02.2018 02:01:50 INFO: type:T id:1F035051 length:8 data:[1, 0, 32, 28, 0, 0, 3, 0] (raw: b'T1F03505180100201C00000300\r')
28.02.2018 02:01:50 INFO: type:T id:1F035051 length:3 data:[130, 0, 0] (raw: b'T1F0350513820000\r')
28.02.2018 02:01:50 INFO: type:T id:1F021441 length:0 data:[] (raw: b'T1F0214410\r')

[djwlindenaar]

hmmm, then it may be something else after all.

Anyway, something funky happened yesterday evening, where the ComfoAirQ suddenly decided to change the codings... now it sends:

  slcan0  10000028   [0] 
  slcan0  001E8068   [2]  27 0A

Somehow the last byte of the can_id has changed (and so my code does not function anymore...)

Did something like this ever happen to you?

Best regards
Daniel

[djwlindenaar]

@marco-hoyer, did you have a chance to track down those logs? It'd be really helpful!

By now the data changed again and I'm now getting 19 and 59 as last bytes of the can ID.

[gytisgreitai]

@djwlindenaar did you have any progress with this?

[djwlindenaar]

Yes I have :)

I've been reverse engineering the firmware for the comfoair Q and that has given some insights. Although it is quite limited, since of course all symbols were stripped from the firmware. Basically I found out that this ComfoConnect Lan product is not much more than a LAN2CAN bridge with some session management. Most of the commands for the ComfoConnect translate directly to CAN messages.

So the CAN messages starting with 0x1Fxxxxxx are the commands. And indeed, @marco-hoyer was right, there's a sequence number which allows to link responses to commands. The format is:

    def CanID(self):
        addr = 0x0
        addr |= self.SrcAddr << 0
        addr |= self.DstAddr << 6
        addr |= self.AnotherCounter <<12
        addr |= self.MultiMsg<<14
        addr |= self.A8000   <<15
        addr |= self.A10000  <<16
        addr |= self.SeqNr   <<17
        addr |= 0x1F         <<24

I've not yet figured out the two bits called A8000 and A10000. The first two addresses are the addresses of devices on the bus. This is by default determined for each device sold by Zehnder, but I found out the when you send a message with the same SrcAddr as the ComfoAirQ, it will pick a new random address. Probably to avoid collision? or maybe this allows multiple units on a single can bus.
The address at bit 12/13 is not completely clear to me, it seems to be another kind of counter or someting... Maybe it is used when several separate answers are sent in response to one command to keep them apart? Unclear...

Then the content of the message is structured like this:
Byte 1: Cmd
Byte 2: CmdUnit
Byte 3...: Data

CmdUnit is the submodule which Cmd is targeted to:

cmdMapping = {
        "NODE": 0x1,
        "COMFOBUS": 0x2,
        "ERROR": 0x3,
        "SCHEDULE": 0x15,
        "VALVE": 0x16,
        "FAN": 0x17,
        "POWERSENSOR": 0x18,
        "PREHEATER": 0x19,
        "HMI": 0x1A,
        "RFCOMMUNICATION": 0x1B,
        "FILTER": 0x1C,
        "TEMPHUMCONTROL": 0x1D,
        "VENTILATIONCONFIG": 0x1E,
        "NODECONFIGURATION": 0x20,
        "TEMPERATURESENSOR": 0x21,
        "HUMIDITYSENSOR": 0x22,
        "PRESSURESENSOR": 0x23,
        "PERIPHERALS": 0x24,
        "ANALOGINPUT": 0x25,
        "COOKERHOOD": 0x26,
        "POSTHEATER": 0x27,
        "COMFOFOND": 0x28,
        "COOLER": 0x15,
        "CC_TEMPERATURESENSOR": 0x16,
        "IOSENSOR": 0x15,
        }

Then the Cmd meaning depends on this subunit. F.e. for the Schedule unit (0x15) we have:

cmdSchedules = {
        "GETSCHEDULEENTRY": 0x80,
        "ENABLESCHEDULEENTRY": 0x81,
        "DISABLESCHEDULEENTRY": 0x82,
        "GETTIMERENTRY": 0x83,
        "ENABLETIMERENTRY": 0x84,
        "DISABLETIMERENTRY": 0x85,
        "GETSCHEDULE": 0x86,
        "GETTIMERS": 0x87,
        }

Then the data is defined by the Cmd and CmdUnit. For example for timers, I found this list:

1 Preset
2 Bypass
3 Temperature Profile
4 Standby
5 ComfoCool off
6 Exhaust Fan off
7 Supply Fan off
8 Preset Manual
9 Hood
A H23?

Now we can assemble a command to turn off the inlet fan for one hour:

cnet.write_CN_Msg(0x11, cnet.ComfoAddr, 1, 0, 1, [0x84,0x15,0x07,0x01,0x00,0x00,0x00,0x00,0x10,0x0E,0x00,0x00,0x01,0x00, 0x00, 0x00])

which decodes as:

0x84: EnableTimerEntry
0x15: Schedule unit
0x07: InletOff
0x01: ??
0x00000000: ??
0x00000E10: 3600 s = 1 hour
0x00000001: ?? I guess enable the timer?

Or to disable the timer and return to normal operation

cnet.write_CN_Msg(0x11, cnet.ComfoAddr, 1, 0, 1, [0x85,0x15,0x07,0x01])```

There's still a lot to document, which I'm not so fond of, so always loses from figuring out the next item...

I have a little python code which is far from complete/finished/usable, but I could put it up if you like.

Best regards
Daniel

[gytisgreitai]

Ok so you can actually send commands and they are accepted by the unit? That is great to hear. And yes please, if possible I would like to get the code.

I still need to mount my Q350 and order can-to-usb adapter, so that will probably take a month until i can play with it...

[gytisgreitai]

Hm but aren't commands the same as described here? https://github.com/michaelarnauts/comfoconnect/blob/master/PROTOCOL.md ?

So if you would like to set fan speed to 3 you would send:
8415 0101 0000 0000 0100 0000 03 | Switch to fan speed 3
which would look like this:
cnet.write_CN_Msg(0x11, cnet.ComfoAddr, 1, 0, 1, [0x84,0x15,0x01,0x01, 0x00,0x00, 0x00,0x00, 0x01,0x00, 0x00,0x00, 0x03])

Or am I missing something?

[djwlindenaar]

Yes I can send commands and they are indeed accepted.

They indeed closely resemble the commands to the comfoconnect Lan device. Some padding is required, but other than that it's the same.

[gytisgreitai]

That is really great, fantastic job. Already ordered can-to-usb adapter, and waiting for the code :)