How to tap my thermostat's serial line

Question

This is a home heating system hack.

I want to add an arduino in-line between my thermostat and air handler; and possibly between the air handler and outdoor compressor. The long-term goal is to post long-term statistics to an RRD web page (run time, power consumption, temp, etc.) and control the blower (without the heat) automatically when we are burning our wood stove.

The product is a Nordyne IQDrive (notable in that the equipment comes with 5 separate brand logos to adhere to the equipment: Tappan, Frigidaire, Westinghouse, Nutone, and Broan).

At this stage, all I want to attempt to do is to tap the serial links and record the conversations. I would prefer not to shoot myself in the foot.

The "System Field Wiring Instructions" describe both links as "serial." The wiring diagrams label the connection points as:

air handler interface board --> [description] --> thermostat

      G --> GND --> C
      - --> DX- --> B-
      + --> DX+ --> A+
      R --> R   --> R

Googl'ing these might indicate that this is an RS485 (never heard of it).

How do I tap and record the communication?

Answer 1

I does sound like RS-485.

You can get cheap RS-485 transceivers from the usual sources. These take the 0..5v TX line and convert it to RS-485 voltages, or RS-485 voltages and convert to the 0..5v RX expected by your Arduino. You would normally enable only one direction at a time - sending RS-485 from the Arduino TX or receiving RS-485 to the Arduino.

In your case, you just want to receive, so keep the transmit side (TX to RS-485) disabled, while enabling the receive side (RS-485 to RX).

RS-485 is just an electrical standard, and they could be sending any pattern of on and off signals they want, but often they will be sending asynchronous data with one start bit, 7-8 data bits, and one stop bit per character - which the Arduino's Serial port can handle. So it's worth testing to see if that works.

The next thing you need to know is the clock rate, or "baud rate", which is how many bits per second (including start and stop bits) it is sending. Often you can figure this out by trying some standard rates like 1200,2400,4800,9600,19200,38400,57600,115200 (there are others) and printing the results to your screen - when you are at the wrong rate you will get nothing, or some odd garbage. When you get the right rate, it will look more reasonable.

If no speed works, you may need to reverse A and B.

You might temporarily hook up an LED and a resistor (say 2.2K or higher) between the RX from the RS-485 and your 5v power. This will give you an idea of when there are transmissions from or to the thermostat. If it only transmits once a minute, say, you might have to wait a while for each speed test. Or changing the set temperature may trigger a send.

You may be able to test the lower speeds at least using Software Serial, and then echo the received data to the hardware serial port which goes to the Serial Terminal in the Arduino IDE.

From there, you may need to figure out the protocol - the structure of the data. Protocols vary widely. It may be text or it may be binary; if it's binary you may want to have the arduino convert each character (values 0..255) into hexadecimal (00..FF) for printing.

Most protocols for this kind of control send data in a burst, or packet. You will likely be able to detect the start and end by the timing (ie: a long pause between the end and the start of the next). Of course, some protocols might send several packets continuously, but still the first character (or binary value) after a long pause will often be the packet header.

Remember that there may be packets from the themostat, and packets to the thermostat, and you will see both without knowing which is which (so long as you are just passively tapping the line).

I hope this is enough of a pointer to get you started. Decoding protocols is a more extended subject.

Answer 2

I read the WikiPedia article on RS485 (http://en.wikipedia.org/wiki/RS-485). The more I learn about RS485, the more likely it seems this is the right track. RS485 is typically wired in a bus with as many as 32 nodes. It's noise tolerant and more than fast enough for a heating/cooling system. At slower data speeds, it can run as far as 4000 feet.

The next step appears to be trying to record some traffic. I found this question on the EE Stack Exchange about tapping RS485: https://electronics.stackexchange.com/questions/30511/hijack-observe-rs485-communication-data-by-wire-tapping

A USB widget appears to be affordable. Inserting the widget between the two ends (I'll try and test to see whether the ends both have termination resisters) should be some easy wiring.