Hardware hacking Della Mini Split aircon unit

What I'm up to

I recently moved from Wisconsin back to my home state of Michigan. (Yes - I had to partially dismantle the Smart Range Hood; but that's a blog for another day) The new house has a nice large garage that we're upgrading & finishing. We picked up a Della branded mini-split unit for heat (and aircon in the summer). In the flurry of the move and amongst 12 other remodeling projects, I didn't think too much about the hackability of the unit. This had great reviews on Amazon and was about $700. I figured that if I wanted to hack it for control from OpenHAB/Home Assistant, I'd figure it out later. Well, "later" is now. Time to hack this thing.

I'll post project updates as I move through this. No guarantees I'll achieve the final goal, but I'm sure I'll learn a lot in the process. 

Project steps -

I'm breaking this down into the following basic steps:

1. Understand general architecture of the AC unit to know how I might be able to control it (hard wiring vs an IR blaster)
2. If using hard-wiring, connect first via oscilloscope to understand the connections
3. Next hook up logic analyzer to start looking at packets
4. As the packets can start to be decoded, start sniffing them in real time to review more data
5. Start trials with an ESP device to control myself
6. Maybe a custom blend of ESPHome?

Step 1 - Understanding the architecture

Somehow I ended up with a unit which already included a WIFI unit and a phone app. I literally don't even remember seeing that in the specs; but bought this based on various reviews and pricing. The app does seem to work well enough, but probably is a bit of security risk. At any rate, linking to something like Home Assistant seems like pretty much a no-go; nor would I be able to get all the sensor data that may be available. The Della uses a Tuya-style wifi chip. It is stuck just under the front facia and has a JST-style 4-pin connector running back inside the unit. They conveniently labeled the pins 5V, GND, Rx, Tx. Bingo. This looks like my ticket. The assumption on the system archetecture here is that the wifi-module is an add-on to a basic Mini Split. The unit's main control board does all of the normal HVAC controls stuff; and the wifi unit just transmits things like current room temperature, and updates the unit on desired temperature. The main unit should in theory be able to run without the wifi unit attached, just from the remote control. So if I can replace the wifi unit, I can control it.

I gave some consideration to using an IR blaster if none of this works. The unit has an infrared remote after all and they are pretty simple to capture packets and rebroadcast. This may still end up being what I do, but it is limited in being "write only" to the Mini split. I won't know its current operating mode or have any sensor data. So very limited.

The image on the left shows the Della's standard wifi module. WBR1 is a Tuya module; similar to the ESP style wifi chips. On the backside of this board, the four wires are labeled as noted above with 5V, GND, Rx, Tx.

Step 2 - Start probing connections

I quickly came across this project which would appear to make this a slam-dunk. Just replace the mini-split's own integrated wifi adapter with this new ESP-based one, running ESPHome. Then I have full local control of the unit and can easily integrate into my home automation system. They don't mention the Della system being compatible; but also don't say it's not. The creators list quite a few brand names of rebranded units that are confirmed working, so I ordered one and took a peek. Using a portable oscilloscope (MulticompPro MP720015)  that I purchased with a shopping cart from E14 , I climbed up on a ladder and started probing around. I was able to verify that the Della's Tuya wifi chip uses 5V logic levels at its connector to talk to the Mini Split.

I then checked the Smartlight SLWF replacement module and confirmed it also had 5V logic levels coming off the board. The replacement module uses a USB-A connector despite being a serial port. So I split a USB extension cable to get the flying leads, and then tapped them in to the mini-split.

Alas, no data ever came up in trying to just simply sniff the serial port.

So it looks like Della is not supported due to different protocols. At this stage, I was consciously assuming that the baud rates were the same between the new ESP and the Della. If this was going to work out of the box, this would have been the end of this post and no other analysis would have been needed.

Step 3 - Pulling out the logic analyzer

Since I felt that "out of the box" hacking wasn't going to work, then next step would be the much more involved protocol decoding method. I've never done this before; although I've written code following manufacturer's protocol manuals and even written my own simple ones before. I don't know if that qualifies me, but at least gives me somewhere to start .

With the four wires coming off the OEM wifi unit, I dropped in my Kingst LA2016 logic analyzer. (I also got his from a prize cart on E14). One channel on Tx and one on Rx. I was quickly able to see the packets going back and forth between the wifi unit and the Della control board. At a high level, there appears to be a 'status request' packet sent, followed by a much larger response packet. 

First thing to check was the baud rate. I was able to see that the Medea aircons use 9600 baud, but I was seeing packet errors on my analyzer using this. I was seeing pulse widths of 104.16 uS on the Status request message and 103.18 uS on the reply. For whatever reason, my analyzer wanted to see 8600 baud and 9000 baud respectively before it stopped showing packet errors. The Medea units were supposed to be 9600. So still not sure why the very slight, and very odd, differences. 

Then I was able to get useful data.

I have now started down the path of analyzing the packets to see what info they contain. Of course the nice thing with the logic analyzer is that it can convert the physical voltage levels into 1/0 and actual byte values easily. This is the start of decoding the packets. 

Sample packet of 'status request' - 5B 00 81 84 82 81 00 5D.

Immediately I could see that the packets all started with 0x5B on both Tx and Rx. So that represents the 'start of transmission' signal. I later found that the Medea units use 0xB5 as their start of transmission; but couldn't easily find any other info on their protocol. If anyone out there has come across this, please send it my way 

I then immediately looked at the last byte of the transmission. My guess is that the last byte was a checksum. In the example above we have 0x5D as the last byte. I did a quick web search for checksum calculator and dropped in the entire packet (minus the last byte) and got a pretty quick result in that it appears to use an 8-bit XOR. I checked this against a few of the longer 60-byte messages and it seems to hold true. For those that haven't worked with communication protocols, usually the first thing the receiver does with a new packet of data is a sanity check. It does some quick math on the packet and compares its internal calculated value against the checksum value included near the end of the received data. If the two numbers don't match, then there must be some issue with the data and it simply ignores the entire packet and moves on like it was never received. To have the ability to emulate the OEM wifi module, I will need to be able to calculate the checksum and include in the transmission.

The image on the right shows my current setup. The wifi module from the Della is in-between my pointer and middle finger, but edge-on facing the camera. You can see its wires running up in to the unit. The replacement module has the USB connector and an ESP chip on it. You can see the logic analyzer and the 'scope in the image as well. This is all on the top shelf of a storage shelf and I'm standing up on a ladder. 

Step 3.5 - the current status

And that gets us up to the current status. I've manually captured a number of packets. The Kingst logic analyzer doesn't seem to have an easy 'export' or copy-paste function, so each packet capture requires manually writing down the packet info. I'm using a Google Sheets document to hold the packets and some notes. I am starting the process of looking across the packets to see what values are changing, what is static. My assumption are that all temperature data is conveyed in Celsius; only converted to F within the Della phone app. Given that; the spreadsheet is nice to just have columns converting Hex to Decimal, and looking for things that might be temperatures in Deg. Celcius. 

I think I'm rapidly approaching the stage of setting up a secondary stand-alone module to just sniff the Rx/Tx lines and post to MQTT. Then I think something like Node-Red would make playing with the data pretty easy. I'm finding that Google Sheets is missing a lot of bitwise calculators like a two's complement converter for 16-bit binary values. It only supports 10-bit.  If anyone knows of any good serial-to-mqtt programs for the ESP chips let me know. There do appear to be some out there but I'll have to test them out.

That's it for today. The last ~year has been a real roller coaster with the move but I'm glad to be getting back to normalcy and doing more projects like this 

-James