I previously established that my boiler uses the CAN bus to transfer data between the controller and the touch panel. The controller is somewhere inside and the touchpad is on the front as you can see ...

The CAN port is on the back - it looks like an ARK connector. There are also CANL, CANH, GND and optional 12V, so the external module (Estyma VideNET) does not require a separate power supply.

So, let's start hacking...

I quickly realized that I did not have the right tools to analyze CAN traffic, since I had only ESP32 and CAN transceiver module based on SN65HVD230 chip.

I tried several internet solutions to send data to Wireshark, but the messages were still difficult to analyze.

I found a program on the Internet that I can use to suit my needs - CAN-Monitor-3000 github repository. I ended up writing a program in Arduino to emulate one of it's supported adapters.

Visit my Canmon-Sniffer repository!

Troubles with temperature...

After searching the data stream, I found no interesting temperature value.
Then noticed message 0x2D6... it changes when temperature changes!

I figured out that I could send the crafted data to the bus. I had to add support for sending data to the CAN bus to the sniffer. 

I was in trouble when I sent the wrong frame. The boiler reported a sensor failure and turned off.

But eventually after few hours of headache, I ended with this small lookup table:

Approximate for the win!

I entered the given values on one of the pages for the function approximation. Then I put the given function into the test program.

CRAZY!

After uploading the program to ESP32, I got an approximate temperature reading.

There is still a lot of work ahead of me, but this adventure was really interesting.