-
Some basic analysis
06/13/2020 at 01:30 • 0 commentsBefore I realized it already a month has passed since my last log so here is a little update.
Because my old and trusty laptop is undergoing a huge transformation to become a dedicated compact desktop computer for my hobby, all I had on hand to use with my cheap logic analyzer is my useless Nexus 7 tablet. Since there is an Android version of PulseView available I decided to give it a go. After 2 long weeks of flashing various ROM and trying all the USB cables I had I couln'd manage to have PulseView detect my logic analyzer... Until I realized all my USB cables were not OTG type and that I had an extension USB cable laying around long enough to connect my logic analyzer in the living room to my computer in the next room.
It strikes me how stupid I can be sometimes.
After this miserable failure, I hooked up everything and captured what was going on between the air conditioner and the RAC adapter with no controller connected and adjusting the settings via the remote control.
Results are:
- the RAC adapter sends the same message composed of 9 packets, each packet starting with "MT" and ending with 0D (hex). The time between each packet is about 48ms and the same message is sent every 4376ms. The packet structure is "MT P=xxxx C=yyyy[0D]".
- the air conditioner responds to each packet sent after roughtly 12ms. Each response packet starts with "OK" and ends with the same 0D (hex). The packet structure is "OK P=xxxx C=yyyy[0D]" or "OK P=xx C=yyyy[0D]".You can check the files "Analysis (2020_06_06).xlsx" and "No controller_OFF.sr" for more details.
-
It's alive... It's alive, IT'S ALIVE!
05/07/2020 at 07:55 • 0 commentsNow that I have all I need, I first decided to connect everything and see if it worked or not. Because my next move is to analyze what's going on between the RAC adapter and my air conditioner, I made a simple breakout board for easy debugging.
And here is my full setup, ready for a test:
After setting up the DIP switches according to the manual, performing a factory reset of the central station and waiting 10 long minutes for that station to finally boot up here is the result.
-
Finally, it's here!
05/06/2020 at 05:18 • 0 commentsAfter a few months of patience, I managed to buy the only RAC adapter that was for sale on Ebay. Thanks to a slightly favorable exchange rate and a seller who finally accepted my offer, I obtained it for less than 12000 yens (shipping fee included).
And while I was waiting to receive it, I looked for H-LINK compatible wired remote controls. But after a little bit of digging, I found that the RAC adapter can only be connected to what's Hitachi calls "central station" as shown in this products connectivity table:
(the "ワンタッチコントローラー (PSC-A16RS1)" only allows to turn the air conditioner ON and OFF)
Looking for those model numbers on Google, I discovered that even the simple PSC-5S central station retails for 70000 yens and is a built-to-order product. The cheapest touch-screen type of central station retails for 135000yens... Nevertheless I checked on Yahoo Auctions and Ebay for a possible second-hand central station but only found one PSC-A64S (seems to be the English version of PSC-A64S1) for roughtly 11000 yens excluding delivery costs.
With some more digging, I learnt with this PDF that products starting with "PSC-" are only compatible with themselves. Kinda makes a lot of sense but with this new information I looked for PSC products on Mercari (the Japanese equivalent of Leboncoin/Craiglist/Gumtree) and found two PSC-A64GT2 for sales for less than 4000 yens each. Could that be the older version of PSC-A64GT3!? A quick search and I confirmed that indeed it was! Right away I made a 3500 yens offer to the seller and finally here I am: a RAC adapter and a central remote.
-
No much luck...
02/07/2020 at 13:01 • 0 commentsSince my last update, I tried to find sites or specialized shops where I could buy a RAC adapter but failed miserably. I then turned my attention to second hand websites like Ebay or Yahoo auction but also classified ads sites and I've been checking them everyday for the last month.
There is one brand new RAC adapter on sale on Ebay France for something like 110 euros but doesn't seem possible to have it send to Japan...
I reached to people around me last week and a former work acquaintance put me in contact with someone working in a small company that provides LED lighting fixtures and air conditioner systems to corporates. The quotation he provided me was pretty expensive: about 25000 yens.
I will try to contact that French guy on Ebay, also try to reach to Hitachi directly and see from there.
-
Not yet at the end of the tunnel...
01/11/2020 at 05:38 • 0 commentsNow that I know the exact pinout of CN7, I decided to do a little test this morning: tie pin 6 to GND and see if any serial data come up on pin 4 (TX) when powering the air conditioner, swtiching it on/off and when pressing a button on the remote control.
But to my surprise and sadly, not data showed up on pin 4. I repeated that test a few times, also checked my connections 3/4 times but nothing. I would have hoped that by putting pin 6 low and so enabling H-LINK connectifity function the air conditionner would have spilled out information on pin 4 whenever its state and/or settings were changed...So I thought I should try to send data on pin 2 (RX) and see if anything appears on pin 4 before wrapping things up. So I connected my FTDI USB to TTL Serial Adapter, hooked up my oscilloscope too and started Termite.
I didn't try to change Termite settings and just sent a "0" and as you can see in the above photo, something showed up on pin 2!
So I tweaked my oscillo settings so I could measure a full frame, resent a "0" via Termite, captured data and exported it in CSV. After some time on Excel, I discovered it's a simple serial communication (see file Measurement (2020_01_11).xlsx for details).- 9600 bauds
- 8 bits
- odd parity
- 1 start bit
- 1 stop bit
And what I got from the air conditionner after sending a "0" is "NG P=01 C=FFFE " (yes there is a space after the E). I went back to Termite, changed the settings and I got the same result.
I tried to send other random commands, sent back what I got from the air conditionner but I always got the same result back. Interestingly, even if pin 6 isn't tied to GND I confirmed the same behaviour.
I've kind of reached a dead end here and I guess my next move will be to get my hand on a RAC adapter and a wall remote control and do some deeper reverse engineering.
-
The light at the end of the tunnel?
01/05/2020 at 10:16 • 1 commentAfter more than 5 days of intense search on the internet, either it was in Japanese or English or even French, using Google but also Yahoo and Baidu and Bing (shame on me) I didn't find anymore information regarding that RAC adapter or this CN7 connector. It's almost like I'm the first person ever to dig in Hitachi air conditioner! Giving it a second thought, that could be the case...
Let's start again with a different approach. I realized my air conditioner is a Japanese market limited model because no matter what, I coulnd't find even one document in English. And because I also couldn't find a service manual in Japanese I thought "maybe I should try to look for a similar model that was destinated for international market or at least for English speaking countries".
So here I am back to my old friend Google and I tried to search for "Hitachi air conditioner service manual". First result seemed to be a good one: HITACHI RAS-60YH5 SERVICE MANUAL Pdf Download.
I opened it and started to read. December 2005 so it's quite older than mine but nevertheless... and arriving page 35 I'm like "Are you kidding me?! That's a f***ing circuit diagram of the remote control!". So I rushed to look to the following pages and here it is, the circuit diagram of the air conditioner mainboard. Unfortunately no CN7 for this model but a CN9 with the label HA. Okey, let's go crazy and download as much service manual for Hitachi air conditioner as I can.Well, there is almost 2000 entries for Hitachi air conditioner on that site so I just downloaded 30 service manuals and after going through all of them 20 have a circuit diagram with CN7. Among those 20 service manuals, 13 are for models between 2008 and 2010 and 2 of them are for models quite identical to mine (almost same specification and same remote control).
Exactly as I confirmed before: pin 1 is 12V, pin 3 is unused and pin 5 is GND. No label regarding pin 6 but that CN7 is a 6 pins PA connector from JST (datasheet).
All that is left is this pin number 6...Well, it's an input with a 5V pull-up resistor directly connected to the microcontroller. I bet the state of this input enable or disable the air conditioner H-LINK connectivity function. And here is the final clue.
What a great detective job that was! I found the exact pinout of the CN7 connector, now know it must speak serial and that the last pin is an input active LOW to enable H-LINK connectivity function.
-
Seems it won't be that simple
01/03/2020 at 01:22 • 0 commentsSince I now have an easy access to that CN7 connector, I decided to hookup my oscilloscope to see if there is any signal on pins 2, 4 and 6.
I connected my Rigol DS1054Z and checked for any possible signal or change of tension when:
- connecting the air conditioner to main AC
- turning on the air conditioner
- turning off the air conditioner
- pressing a button from the IR remote control
Sadly this test didn't bring me any result. Once the air conditioner is connected to the main AC these 3 pins are at a 5V state and don't change. I also probe the 12V and NC pins but as expected just a constant 12V once the air conditioner is powered up and absolutely nothing on the NC pin.
I started to doubt that this old air conditioner could be connected to CS-NET via H-LINK but after digging in that site I previously found, I found this schematic/wiring diagram.
It is clear that this air conditioner can be connected to CS-NET via H-LINK. I will just have to keep playing detective for a bit longer and keep looking for clues.
-
More research (not so easy now)
12/27/2019 at 11:26 • 0 commentsNow let's look for information regarding this RAC adapter. Thanks to the pdf file I found the other day, at least I know its product number: PSC-6RAD.
I first looked for a high resolution image so I could try to identify the connector that plugs into the air conditioner mainboard and its pinout.
But even after a few hours on Google, all I could find is this (credit to https://shop.charles-hasler.ch):It looks like a 4 pins connector and from left to right: black, yellow, red, brown?
I tried again to look for a better image by searching selling ads on Ebay and others and managed to find this auction announce on a site that list all past ads of Yahoo Auction. The selling price of 1000 yens for 3 units really surprised me but most importantly there was the following close up photo of the connector.Glad I found a better image because it is in fact a 6 pins connector (only 5 being used), black - yellow - orange - red and brown. This remind me of this Hackaday project and my air conditioner being also designed by a Japanese company I hope this connector has a similar pinout (12V - GND - 5V - TX - RX).
But after looking at this photo a numerous time I realized I may have the exact same connector on a dust detector I salvaged from my old air purifier & humidifier combo and so I could plug that in the air conditioner mainboard and poke at it with a multimiter to figure out the pinout.
Yes, same connector it is! Let's just cut that cable, open the air conditioner, find where the CN7 connector is, plug this one in and poke at it with a multimeter. I removed the top cover of the air conditioner following the manual instructions and after also removing a metal cover enclosing the mainboard here we are.
At first look, I easily identified the CN7 connector but also notified these 4 test points: 5V, 0V, 8.5V and 12V (hidden on the right of the 8.5V one). So I connected my cable and without powering anything I checked for continuity between each pin and each test point. The result turned out a little bit different than what I was expecting: from top to bottom I got X - GND - X - X - X - 12V which means that for the photo of that connector I found yellow is GND and brown is 12V... "Things are not always what they seem". Under power, I indeed had 12V on that last pin and all remaining pins showed 5V except that 4th pin which seems to be unused.
Since I opened my air conditioner, had a proper connector and an all blue wires cable was really difficult to work with I made my own cable and plugged it in to allow me easy poking around in the future.
This time I managed to identify the connector that plug in CN7 and a part of its pinout. I also now have a cable hanging out of my air conditioner that allow me to easily probe it. All I have to do is keep looking for more information and find or figure out the rest of the pinout.
-
Identification and some research
12/17/2019 at 09:41 • 0 commentsTo begin, what am I dealing with?
It's an air conditioner made by Hitachi, model RAS-LJ22Y and manufactured in 2009.
First let's have a look at its manual and see if:- there is any mention of some sort of connectivity
- there is accessories that can connect to it (like a wall remote control for example)
- there is some details regarding its electronics (I highly doubt that but who knows!)
With the help of my friend Google and the magic keywords "取扱説明書" and "RAS-LJ22Y" here is the manual.
→ https://kadenfan.hitachi.co.jp/support/raj/item/docs/ras-lj22y_b.pdfAfter thorough reading, I found something quite interesting page 26.
The text in bold font enclosed in the small black rectangle says:
●To connect to HA system the HA connection cord sold separetly is required (service part number RAS-2810RX100).
●To connect to H-LINK system the RAC adapter sold separetly is required.
It also says that HA system connects to CN6 connector and the RAC adapter to CN7 on the mainboard.That's a promising result!
Despite being quite old, this model has 2 types of wired connectivities.Next step is to look for what this HA and H-LINK system are and what kind of functionnality they have. Again with the help of Google I found this PDF from Hitachi explaining what HA system is and how it works. HA stands for "Home automation" and it is a system for controlling the power operation and monitoring the power status of home appliances equipped with an HA terminal. In other words, it allows you to remotely turn on and off a device and know at any time if it's on or off.
That's not bad but very limited so let's have a look to H-LINK system.
After a brief search, I found another PDF from Hitachi just about H-LINK and RAC adapter. Google search engine power? Just some luck? After a closer look, that PDF is hosted on the same site I found that previous one about HA system... gonna have to look deeper in it, I may find some other useful information. Anyway, H-LINK is a Hitachi proprietary 2 wires communication system for connecting air conditioners to Hitachi building air conditioning management system called CS-NET. Here comes the best part so far:
●From CS-NET, you can control and monitor not only the power mode (ON/OFF) but also the set temperature, operation mode and air flow mode.This little explanatory diagram shows how a remote control is connected through H-LINK to the RAC adapter to the air conditioner.
As a conclusion, this model has 2 types of wired connectivies among which one is for connecting to a commercial management system that allows to remotely control its various settings. Next step will be to look for more information about this RAC adapter in order to figure out what kind of communication protocol is implemented between it and the air conditioner.