Yesterday, I took some time and installed a serial sniffer on my laptop and peeked at the commununication between the Avanta P1 boiler and my laptop. I ran the Recom software and requested the boilers identity. The following command is sent by the Recom software:
02 52 05 06 01 0B 5B 03
Where 02 equals STX and 03 equals ETX. The rest is Remeha specific. After sending the request, the boiler answers with:
02 41 06 16 01 0B 01 00 00 12 10 01 00 00 00 00 00 06 11 41 06 80 89 03 02 = STX 41 06 = ???? 16 = framesize without STX, ETX = 0x16 = 22 bytes 01 = ???? Boilertype = Avanta 0B = ???? Manufacturer = Avanta 01 = Msg byte 0: ???? 00 00 = Msg byte 1 and 2: ???? 12 = Msg byte 3: (Software version / 10) 10 = Msg byte 4: (Parameter version / 10) 01 = Msg byte 5: Parameter type 00 00 00 00 00 = Msg byte 6 - 10: ???? 06 11 41 06 80 = Msg byte 11-15: Serial nr, my Recom shows 41 = A 89 = ????, no part of the data payload 03 = ETX
I also have other messages but I need to analyze these first before posting them. I hope this will help you along. The config files that comes with the Recom software are very helpfull. They contain the layout of the datagram. I did post an XSL to print the XML content as tables to make it a bit more readable. Check the following link: http://www.domoticaforum.eu/viewtopic.php?f=70&t=7219
I already discovered that there are differences between the Avanta and the Calenta messages that Robert Hekkers showed on his blog. His analysis on this link shows completely different datasents than I have. I’ll give you my request and response when the Recom software asks for realtime data (actuele waarden):
Request: 02 52 05 06 02 00 53 03 Response: 02 41 06 3E 02 00 E4 16 BC 16 80 F3 00 80 00 80 00 80 A2 12 40 07 4C 04 7C 15 08 07 00 00 00 00 00 00 00 00 00 00 64 00 00 00 11 01 09 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 74 03
I need some time to figure out the data above, and the Recom files will certainly help but I want to understand the rest of the protocol also since it is my daytime job also.
If someone of Remeha Netherlands is reading this also, a hint or suggestion would be very welcome 🙂
The result from a C application:
Sending 8 bytes to Remeha: 0x02 0x52 0x05 0x06 0x01 0x0b 0x5b 0x03
Waiting for an answer from Remeha…
Received 24 bytes from Remeha: 0x02 0x41 0x06 0x16 0x01 0x0b 0x01 0x00 0x00 0x12 0x10 0x01 0x00 0x00 0x00 0x00 0x00 0x06 0x11 0x41 0x06 0x80 0x89 0x03
Boiler type: 1
Manufacturer: 11
Software version: 12
Parameter version: 10
Parameter type: 01
Serial number: 0611410680
Freddy