Skip to content

Constraints & open points

This page collects the constraints of the interface together with the points that are not yet conclusively determined. It therefore marks the starting point for further work.

The 9600 baud panel bus

A separate bus running at 9600 baud sits between the control panel and the PTC module. On the evidence of the measurements available, it is not suitable for read or control access:

  • The control state (operating mode, fan stage) is transmitted on this bus continuously, inside the master's regular poll frames; no separable individual command could be identified.
  • Frames generated by a foreign device demonstrably reach the device terminal byte-accurate and correctly encoded (verified with a logic analyser), yet the device does not answer them. Identical frames from the original panel are answered from the first byte onwards.
  • This behaviour was reproducible across several transceiver types and signal levels. It suggests that the device distinguishes the signal source by some analogue property of the waveform that is not readily reproduced with standard hardware.

Read and control access therefore go through the internal 19200 baud bus (HESP) at connector X7. Whether and how the behaviour of the 9600 baud bus can be fully explained remains open.

Further constraints of the unit

These points concern any implementation that replaces or supplements the control panel:

  • Time programmes and night setback are held in the control panel, not in the LPC1758 controller. Without the panel this function is lost and must be provided elsewhere.
  • Filter remaining runtime: the unit keeps a filter service life (displayed in days on the panel). If the filter is not changed once it has expired, the central unit shuts itself down after a grace period. The corresponding data point is identified as 0x00ed (see Data point reference).

Open points

Topic State
Assignment of the 12 flags in 0x0066 (switched outputs) open — the bypass status is held separately in 0x0160
Filter remaining runtime 0x00ed confirmed through its daily decrement; the moment of the decrement is not midnight — the timekeeping (presumably in the control panel) is open
Naming of the individual operating hour counters in 0x02df requires comparison with the panel's system information menu
Status word 0x01f6 (changes in step with the bypass) meaning open
Role of the STM32 (pure frame bridge or aggregating slave) open
Triggering a device restart over X7 no corresponding frame found
Naming of the parameter block 0x0233–0x023e requires comparison with the protected parameter menu
Full explanation of the 9600 baud bus behaviour open
  • FHEM forum, topic 96437 — the first public description of the HESP telegram structure of the same manufacturer family.
  • For the newer FWT 2.0 / T300 devices there are Modbus-based projects; these concern a different bus and do not transfer to the HESP binary bus described here.

Contributions

Measurements from further P series units, and from the related Hermes / WR3223 range, are welcome — data point assignments from other configurations in particular. They help to separate device-specific properties from range-wide ones. Feedback and additions can be submitted through the project repository.