Hack my Heat Pump and publish data onto emoncms

Excellent job Arnold, thanks a lot!

I have the same experience with the circuit. The original schematics did not work for me. With modifications (1) and (2), the circuit works OK. There are errors, but still OK for the purpose of decoding the data. I am too scared to do modification (3).
Did you try to connect the transmission part of the schema? Maybe the readability of P1P2 improves once we have the transmission part connected.

It works! I am able to read the data with Arduino Nano and your P1P2Serial, P1P2Monitor. The good news is that protocol data format is very similar. With some minor differences:

  • Some packets are longer (400013, 400015)
  • I have some additional packets (000016, 400016)

You can find my initial readings in this Excel file. (22.3 KB)

Each packet (I only did the data packets) has its own sheet in xls. My readings (hex) are in the 3rd column, GREEN means I have confirmed your readings. ORANGE means something new or different from your readings.

My next plans: connect Arduino (via USB/serial) to Raspberry running Node Red. Once I have the data in Node Red, it will be much easier for me to filter the data and detect changes to the data. Maybe there are easier ways to do that, but I am not a developer. Node Red is one of the few programming tools I am familiar with.

Oh and about my Daikin: Altherma LT EHVX08S26CB9W. Two heating zones (main, add). Main is used for floor heating, additional zone is for ceiling cooling. My unit is currently in “RT control” (thermostat control), weather dependent.

Great to see it working, and glad it is helpful to you! Actually I am surprised to see so many similar data in a different heat pump type. This is really helpful to better understand the format.

If you are afraid to do modification (3), there is always a plan B and C. I don’t think it helps to add the writing circuitry to improve the reading reliability. Plan B: I looked into the circuitry of the thermostat itself, but haven’t tried copying that yet. The thermostat uses a MM1192, and it does not use the resistors of modification (2), but it does use 130k Ohm resistors instead of 100k Ohm resistors in modification (1). It also has ferrite beads in the incoming P1/P2 lines. Plan C: I am preparing a slightly more complex schematic including a SI8662 digital isolator to provide galvanic isolation so it is safe to do modification (3).

I haven’t tried writing at all yet, as writing is not easy: how to sync writing with the messages from the thermostat? And above all, I am not sure whether the heat pump will accept my written messages if they are not conforming to unknown rules. I noticed quite some “interesting” data patterns in the final “00F030…” message, which may be used as verification by the heat pump. There are two patterns in the “00F030” message. First, there is a “walking bit” that moves from one location to another, and stays for a number of messages in its place. How many messages it stays in a certain location is fixed (but different for each location). The first “00F030…” message after a restart is of a different type and indicates per byte how many packets the bit stays in that position. Additionally, some of these bytes fluctuate now and then (by -1 … +2), and this seems to happen more often after additional packets (such as a request for energy consumed) were communicated in a package. I don’t see a pattern in these yet. Not sure if the heat pump checks for this.

Meanwhile I have also looked at the data upon a (re)start. The heat pump communicates upon each restart (and upon request by the thermostat) all the field settings. For each field setting (for example [8-09] comfort heating temperature) 4 bytes are transmitted:

-the field value (often plus 0xC0 added)
-the minimum/offset value (to be added to understand the value)
-the maximum value
-a byte characterizing how to use this field: whether the step size is 5, 1, 0.5, or 0.1; whether the value involves a comma or not; whether the field is in use or not.

I need to document this also on github - later.

As to your data, just a guess, but could
-400016:4-5 bytes 0x0C1F be a 12.1 degrees temperature?
-000016:6-7 bytes 0x1432 be 20.2 degrees room temperature (a repetition of elsewhere)?

I think that instead of messing with the thermostat (main user interface) <-> heat pump communication, better way would be to emulate some other device.

I have a LAN adapter, so I can have a look how it communicates. But I do not know whether LAN adapter has full access to the heat pump.

Another option would be to emulate second user interface (second thermostat). Daikin allows you to have 2 user interfaces (EKRUCBL) and it seems that both of them have full access. But Daikin requires some kind of synchronization between both user interfaces. From Installer Reference Guide:

For proper operation of the system, the local data on the two user interfaces must be the same.

If the data are not the same (do not know how this is detected), both user interfaces will display error and you need to do some kind of manual sync between the two.

I only have one user interface, so I can not sniff the communication.


I have a Daikin Altherma HT and a RTD-W on its way to me along with a RS485 module.

I have built a lot of projects with the ESP8266 and also with serial (RS232) but nothing with RS485 or ModBus. Would you be willing to share your code as it sounds like just what I am trying to achieve and could save me a lot of time getting started with RS485?

Much appreciated.


Hey Gary, sure, I can share the code… Take a look at

Hey Michael, sorry for the late reply. I see you have figured out the problem by yourself already… Yes, the pins are reversed…

@SubOrbit, thank you, it looks great, I look forward to trying this out soon.

Hey @Egyras can You describe how You managed to get data from Your Panasonic Heat Pump? Maybe some photos? It will be a lifesaver for me;)

You need for H series Panasonic ? I did some Protocol “hacking” and have some values, but need to write a proper code in C++ for MQTT integration. Dont have time and my codding skills are very limited :frowning:
You need to send “magic” packet to query heat pump via serial

@Egyras I am also very interested in knowing about your experiences with extracting data via the CN-CNT connector. I own a H series Panasonic heat pump (WH-ADC0916H9E8AN). Could you share more information about the wiring and “magic” packet"?

@Egyras yes I own Panasonic SDC 9kW WH-SDC09H3E5.
As I know my Aquarea Wifi BOX ( CZ-TAW1) is connected by CN-CNT port.
How to read protocol values?

Just connect addtional USB to RS232 (TTL) and sniff with software as IOninja and you will have all information in HEX :slight_smile: Keep in mind that you can listen to RX or TX at once. But its just easiest part as decoding is required, which I did for most interesting values.
Here is my new repo -
Will publish deconding information later today.

Will post info here -

@Egyras I have ttl, but where to connect it?:wink:

I have provided all information in my github repo, just connect to existing TX or RX and use software as IOninja to get HEX values. So you connect to existing TX and GND to get values send in one way to sniff protocol between CZ-TAW1 and Heat Pump.


Just wanted to pass on my thanks. I now have this working, I can see the data and control my Altherma HT via the RTD-W over Wi-Fi.

Now I need to figure out how best to optimise it to run from my PV during the day, without importing any power if possible. Rather than switching on/off I was thinking about varying the Leaving Water Setpoint to reduce power load.

Any thoughts or ideas most welcomed.

Many thanks


@Egyras please help. I have to connect to cable between het pump and CZ-TAW1 ? which is which??
And what IOninja software to use ??

Hello GizmoB…

I am right in the middle of figuring this all out. I have two Daikin HT units talking thru the RTD to my Arduino and I am now trying to figure out what to do with it all… : )

My goal is to try and squeeze a bit more efficiency out of my setup. Depending on how you read Daikin’s sketchy info, the efficiency goes down by as much as 30% between extremes of outside vs circulating temp, or ~13% in my setup.

I figure that the heat output from the emitters is determined by the temperature difference between emitter and house. House temp varies a bit, but not that much, so heat output and hence heat load to the Daikins is determined primarily by circulating temp.

So, I believe you can reduce circ temp and hence demand on your heat pumps to match PV output, but your system will then deliver less heat inside your home on a cloudy day. Slightly worried that this could be the wrong way round…

I do have in mind to crank up the circ temp just before the end of the night-time electricity rate, my thinking being that it will store more heat inside the house while I can get it at cheap rate, so reducing demand during daytime, which is similar-ish to your problem. That does involve giving the thermostats a nudge too, but that’s a separate project…

Do you have a buffer tank…? Seems like it would work well to crank the temp up inside your buffer when the sun is out, then draw on that heat in the shade…?


1 Like

Just a short status update: plan C works. An MM1192 IC with an (SI8621) digital isolator and a (Murata) isolated DC/DC converter is able to read the P1/P2 bus, and to write to the P1/P2 bus. The heat pump answers any request sent to it, even if the requests are out of the usual order. I am running it now for weeks, and uploading the received data to my local emoncms works very reliably. The full schematic and code is on The emoncms glue code is not on github yet, but it is model-specific and reasonably trivial.


Hi @bart.ellast, could you give us any details about this RS232 converter? Does it connect to the P1/P2 interface on the Altherma heat pump, or something else? Is it the official Daikin EKPCCAB1? The Altherma LT (EHBH08CB etc) installer reference manuals talk about using this cable to configure settings remotely. Is your Daikin an LT or HT model?

Thanks, Chris.