Hacking Daikin protocol
Posted: Tue Sep 25, 2007 5:04 amHi everyone,
browsing through forums here I found couple of useful
pieces of information about Daikin IR remotes, but not
much conclusive data. Since I am trying to incorporate
Daikin control in my setup - I have attempted to explore
this issue a bit further.
Below is the outcome of testing based on AirCon Daikin
FT18GV1LS (but looking at sample output from others
it probably apply to other models too).
As mentioned on this forum every burst of data contains
complete set of settings for the AC unit.
Burst size: 432 bytes
It looks like every burst is organized in 4 byte 'packets',
first three packets are probably some kind of header.
Next follows 104 packets of data. Last, there is one EOT
kind of packet.
Data packets are always 00-0c-00-xx sequence, where
xx can be either 0x19 or 0x3d. It seems that 0x19 stands
for '0' and 0x3d stands for '1' respectively. Which gives:
1 = 00000000-00001100-00000000-00111101 = 00 0C 00 3D
0 = 00000000-00001100-00000000-00011001 = 00 0C 00 19
Hence every packet corresponds to one bit of data.
Following is commented image of a single burst. I have
already identified some sections, for those that are still
not - everybody is welcome to fill it in.
Notes:
1. 5 'bits' in temperature section contain temperature data
as a (binary value + 10), i.e.
77 = 1
78 = 1
79 = 1
80 = 1
81 = 0
01111 = 15
15 + 10 = 25 deg C
2. (dh) denotes 'bits' that were affected by Dehumidifier
function, while it was tested (since it was just single setting
test - most likely other bits in relevant sections may be
affected too).
3. Section 2 of On-Timer and Off-Timer probably contains
clock settings, but I have not test it.
4. Cancel button for timers sends just complete set of
settings sans timer data.
Please note, all data above are based on USB-UIRT input,
since I did not manage to get myself to check it on the
scope, hence raw data may differ. Also USB-UIRT reported
frequency in vincinity of 33.5 kHz, which probably is not
much a standard one.
HTH, sorry for a long post.
browsing through forums here I found couple of useful
pieces of information about Daikin IR remotes, but not
much conclusive data. Since I am trying to incorporate
Daikin control in my setup - I have attempted to explore
this issue a bit further.
Below is the outcome of testing based on AirCon Daikin
FT18GV1LS (but looking at sample output from others
it probably apply to other models too).
As mentioned on this forum every burst of data contains
complete set of settings for the AC unit.
Burst size: 432 bytes
It looks like every burst is organized in 4 byte 'packets',
first three packets are probably some kind of header.
Next follows 104 packets of data. Last, there is one EOT
kind of packet.
Data packets are always 00-0c-00-xx sequence, where
xx can be either 0x19 or 0x3d. It seems that 0x19 stands
for '0' and 0x3d stands for '1' respectively. Which gives:
1 = 00000000-00001100-00000000-00111101 = 00 0C 00 3D
0 = 00000000-00001100-00000000-00011001 = 00 0C 00 19
Hence every packet corresponds to one bit of data.
Following is commented image of a single burst. I have
already identified some sections, for those that are still
not - everybody is welcome to fill it in.
- Code: Select all
pkt byte [1] [2] [3] [4]
------------------------------------------ HEADER
001 000 00 00 00 7B
002 004 00 00 00 6A
003 008 00 A9 00 49
------------------------------------------ ?
004 012 00 0C 00 3D
005 016 00 0C 00 19
006 020 00 0C 00 19
007 024 00 0C 00 19
008 028 00 0C 00 3D
009 032 00 0C 00 19
010 036 00 0C 00 19
011 040 00 0C 00 19
012 044 00 0C 00 19
013 048 00 0C 00 3D
014 052 00 0C 00 19
015 056 00 0C 00 3D
016 060 00 0C 00 3D
017 064 00 0C 00 19
018 068 00 0C 00 3D
019 072 00 0C 00 3D
020 076 00 0C 00 3D
021 080 00 0C 00 3D
022 084 00 0C 00 3D
023 088 00 0C 00 19
024 092 00 0C 00 19
025 096 00 0C 00 3D
026 100 00 0C 00 19
027 104 00 0C 00 19
028 108 00 0C 00 19
029 112 00 0C 00 19
030 116 00 0C 00 19
031 120 00 0C 00 19
032 124 00 0C 00 19
033 128 00 0C 00 19
034 132 00 0C 00 19
035 136 00 0C 00 19
036 140 00 0C 00 3D
037 144 00 0C 00 3D
038 148 00 0C 00 19
039 152 00 0C 00 19
040 156 00 0C 00 3D
041 160 00 0C 00 19
042 164 00 0C 00 3D
043 168 00 0C 00 3D
------------------------------------------ POWER
044 172 00 0C 00 p1 1 = ON
------------------------------------------ ?
045 176 00 0C 00 19
------------------------------------------ ON-TIMER (1)
046 180 00 0C 00 z1
------------------------------------------ OFF-TIMER (1)
047 184 00 0C 00 y1
------------------------------------------ MODE (1)
048 188 00 0C 00 m1 1 = FREEZE
049 192 00 0C 00 3D
050 196 00 0C 00 m2 1 = FAN
051 200 00 0C 00 19
------------------------------------------ SWING (1)
052 204 00 0C 00 s1
------------------------------------------ ?
053 208 00 0C 00 19
054 212 00 0C 00 19
------------------------------------------ POWERFUL
055 216 00 0C 00 L1
------------------------------------------ SWING (2)
056 220 00 0C 00 s2
057 224 00 0C 00 s3
058 228 00 0C 00 s4
059 232 00 0C 00 s5
------------------------------------------ ON-TIMER (2)
060 236 00 0C 00 z2
061 240 00 0C 00 19
062 244 00 0C 00 19
063 248 00 0C 00 z3
064 252 00 0C 00 19
065 256 00 0C 00 19
066 260 00 0C 00 19
067 264 00 0C 00 z4
------------------------------------------ OFF-TIMER (2)
068 268 00 0C 00 y2
069 272 00 0C 00 y3
070 276 00 0C 00 19
071 280 00 0C 00 y4
072 284 00 0C 00 19
073 288 00 0C 00 19
074 292 00 0C 00 19
075 296 00 0C 00 y5
------------------------------------------ ?
076 300 00 0C 00 19
temperature 1 ---------------------------- TEMP
077 304 00 0C 00 t1 (dh)
078 308 00 0C 00 t2 (dh)
079 312 00 0C 00 t3 (dh)
080 316 00 0C 00 t4 (dh)
081 320 00 0C 00 t5
082 324 00 0C 00 19 ?
------------------------------------------
083 328 00 0C 00 m3 (dh) 1 = DEHUM MODE (2)
------------------------------------------ FAN
084 332 00 0C 00 n1 (dh)
085 336 00 0C 00 n2
086 340 00 0C 00 n3
087 344 00 0C 00 n4 (dh)
------------------------------------------ ?
088 348 00 0C 00 19
089 352 00 0C 00 19
090 356 00 0C 00 19
091 360 00 0C 00 19
092 364 00 0C 00 19
093 368 00 0C 00 19
094 372 00 0C 00 19
095 376 00 0C 00 3D
096 380 00 0C 00 19
097 384 00 0C 00 19
098 388 00 0C 00 19
099 392 00 0C 00 19
------------------------------------------ CHECKSUM (?)
100 396 00 0C 00 x1
101 400 00 0C 00 x2
102 404 00 0C 00 x3
103 408 00 0C 00 x4
104 412 00 0C 00 x5
105 416 00 0C 00 x6
106 420 00 0C 00 x7
107 424 00 0C 00 x8
------------------------------------------ EOT
108 428 00 0D 03 DF
------------------------------------------
Notes:
1. 5 'bits' in temperature section contain temperature data
as a (binary value + 10), i.e.
77 = 1
78 = 1
79 = 1
80 = 1
81 = 0
01111 = 15
15 + 10 = 25 deg C
2. (dh) denotes 'bits' that were affected by Dehumidifier
function, while it was tested (since it was just single setting
test - most likely other bits in relevant sections may be
affected too).
3. Section 2 of On-Timer and Off-Timer probably contains
clock settings, but I have not test it.
4. Cancel button for timers sends just complete set of
settings sans timer data.
Please note, all data above are based on USB-UIRT input,
since I did not manage to get myself to check it on the
scope, hence raw data may differ. Also USB-UIRT reported
frequency in vincinity of 33.5 kHz, which probably is not
much a standard one.
HTH, sorry for a long post.