-
-
Notifications
You must be signed in to change notification settings - Fork 20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Documentation about this API #34
Comments
This "API" was entirely created by reverse engeneering. Here you can find some infos about the protocol (all in german though): https://loxwiki.atlassian.net/wiki/spaces/LOX/pages/1533935933/Java+Webinterface If you want to have a chat, you can send me an email at Regrding the GLT licence, I know a guy that took the reversing even further and was able to get the root password for ssh into the heatpump and even activate GLT without actually having the licence. But I'll not disclose how to do that for obvious reasons. |
Thank you for all of the work you apparently put into this.
Seems like you did quite a lot of reverse engineering. Really sad to see that this isn't officially documented, there is basically nothing to loose for the manufacturer and a lot to gain (integrations, etc.). In any case, the link to the Loxwiki is also interesting (I'm a German so no problem for me).
The current code is actually quite nice, although there are still many unknowns (not your fault). But the generic structure (from what I can tell), looks quite professional.
Will do.
Well, I also tried some well-known passwords, but they didn't work for me. Definitely interested in logging into my heat pump via SSH, though. Let's discuss this via mail. By the way: Does this API (TCP packets on port 8889) have some kind of semi-official name? Any obvious strings in the API / decompiled source code that you've worked with? Since there is also other APIs (websockets, etc.) I'm trying to find out what the differences are and what kind of services are exposed by my heat pump. I can see at least the following open ports:
So some of the questions that I'm currently looking answers for are:
I'm happy to create some basic documentation to explain this to the best of my knowledge, but so far my knowledge is still very limited ;-). |
8888 and 8889 are normal (unix?)-sockets which provides the raw values from the internal controller. 8888 is the legacy version.
The "socket"-api exposes 3 groups of values. I think they are all the raw values from the heatpump.
For example the flow in and out temperatures are calculations (3004) 10 and 11 in the socket.
In my case the heatpump pushes every 5 hours the current values to heatpump24.com. Also grep config changes.
For example you can unzip the firmware from download portal. In this is a client web app which connects the websocket.
Yes, but I get not much informations. |
Thank you for the valuable input @BenPru! I will try to write a summary, which could be used here (or in your repository) as an overview and starting point for new people joining the project.
Do you happen to know what kind of differences there are between those two versions? Websocket sounds nice of course, but I've read somewhere that the legacy API is more powerful? By the way: Since those services are exposed via network ports, those are not Unix-sockets. Unix domain sockets are basically (pseudo-)files that can be used for interprocess communication. They behave similar to TCP sockets in many aspects, but the main difference is that they are not exposed via network. See https://serverfault.com/questions/124517/what-is-the-difference-between-unix-sockets-and-tcp-ip-sockets for more details in case you're interested.
Thank you again for this summary. Are those terms (
So groups can also have IDs? Didn't know that yet. Are those groups similar to the available menu entries on the Luxtronik controller itself?
Okay, one more reason to block Internet access for my heat pump :-).
Cool, will look into this. I've also tested the websocket implementation and was rather shocked about how instable it is. I was able to crash my controller by sending 4 bytes to it. Maybe you can test/verify this: #! /usr/bin/env python3
import socket
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
client.connect(("192.168.1.5", 8214));
client.send("Lux_WS".encode()); For me this halts the controller. After about 5 seconds, it gets rebooted (via a Watchdog or so). I've also recorded a video about this: https://www.youtube.com/watch?v=lhcy8SzfIxY I've already reported this to Alpha Innotec, hopefully they are working on fixing it. Would be interesting to know if others are also affected by it, though.
Well, haven't asked specific technical questions, but they sounded helpful to me. Do we have a list of essential questions that we want to know more about? |
No.
Yes.
They are not official.
In the Websocket groups have ids. But all ids are temporarly! And the Names are hardcoded in german I think.
No.
Last week I have updated from 2.86.0 to 2.88.1 and the new version seems to be not so stable. Ait is bugfixing.
We use a internal api. 8889 can used without passwort or security. You can write all values. |
Thank you for your findings.
Do you know if the Luxtronik controllers can also be downgraded, or are you know stuck with 2.88.1? By the way: Support told me that they're currently working on a new version with new features (Energy monitoring), which is supposed to be released soon.
Will you try to get this integrated here? Is your repository just a fork with the intention to get changes integrated back here, or do you plan to run your own fork?
That sounds bad. We should probably try to report this. Have you ever had a look at the other open ports?
Probably not, but we could still ask and see what they will reply. I have quite a good and respectful person of contact. |
Yes, the support says the downgrade is possible. But I think I stay on 2.88.1. I have optimize the connection on request site.
Yes, 2.88.1 has energy monitoring features: see thread BenPru/luxtronik#59 (comment)
I have added two sensors for this
Currently I'm trying to extend BenPru/luxtronik and provide it as ha core integration. See repo https://github.com/BenPru/core-1/tree/luxtronik.
No, just the websocket port 8214. See python test.
ad hoc questions:
|
That sounds good.
Cool, wasn't aware of that yet.
Is this what you get by default, or after (heavily) customizing your integration? The amount of data looks pretty interesting.
Yes, definitely, that's also what I'm very familiar with. Happy to provide some infrastructure for unit testing Python code.
I would also like to know that. If you figure it out, let me know :-).
Good questions, unfortunately I cannot answer them. I have de-compiled the application by now and could try to figure out some of the details from the binary running on the controller. However most of this is really time-consuming, and so far that's my biggest limitation :-). |
The integration has grown over time. |
@kbabioch : Which decompiler do you use? I just have disassembled the firmware, but reading assembler is.... |
@BenPru : Do you think that circulation_pump_heating (calculations.ID_WEB_HUPout) is a electrical heating of the circulation pump? I would guess that this only means that the circulation pump (for the heat circuit) is running, i.e., "HUP" stands for "Heizungsumwälzpumpe" and "out" means that this is an output of the heat pump. This could be the "HUP" listed under "Ausgänge" in the websocket interface. |
No. It is the heating circulation pump. |
Concerning "custom" TDI time By looking at the firmware, I don't think that it is possible to say that the TDI should start now. It can only start at midnight. One workaround would be to change the clock (or the time zone?) of the heatpump such that midnight happens when the sun is shining (e.g. PV energy is available). However, I think there is a more reasonable approach. There is a parameter which allows the heat pump to use the heating rod (ZWE) if your requested warm water temperature is higher than what the inverter can accomplish (I did not yet checked the parameter number, it can be found under "Einstellungen" -> "Warmw. Nachheizung"). This is documented in the manual by AIT. Then, when you have PV energy you could raise the warm water temperature (parameter 2) to, let's say, 65°C. Then, the inverter heats until, e.g., 55°C and the heating rod should finish off. (Maybe one should also alter the hysteresis parameter 74). In theory, this should be roughly the same as using TDI. I did not try this approach, but I get PV in "the near future" and would like to try it. |
ghidra. It de-compiles most of the I'm not too familiar with ARM assembler, so anything that is not de-compiled is tricky for me.
Sounds to me that you're talking about the same thing here?
That's a pitty.
The problem with that approach is that it will turn on the inverter / compressor, which means there is physical stress to a component that has only limited amount of life time. I would rather prevent this from happening, and use the heating rod to heat up my water without wear and tear to the system. In my case I'm not even wasting energy, since my PV system needs to limit itself during peak hours ("70% Regelung"), so I would rather heat up my water than to not use the excess energy. Maybe I should ask the support, if they would be willing to add such a feature as |
Yes, but currently, TDI is doing the same thing? And in summer, when you only need warm water, you also start the inverter just for heating your water. I do not see why using the heating rod afterwards means additional stress to the system. |
Yes, currently that's the case. Would prefer to easily enable / disable the heating rod, though. I would like to implement some logic to turn on the heating rod, whenever there is an PV excess for more than a couple of minutes and when the energy would be "wasted" otherwise. I don't think I want to turn on the compressor on and off all of the time. Currently I'm just looking into the technical feasibility. Unfortunately it seems that what I have in mind is not easily possible. That's unfortunate. Thank you for looking into it, anyway. |
Looks like the discussion on TDI is taking place in 2 separate threads. |
Yes, I didn't know about the other thread. Thank you! |
Can anyone extract the names of the new values in V_.88._? |
As far as I remembered I extracted the names out of the Android App. |
I haven't found a comprehensive list of names / values for parameters yet. Only some references to @gerw Any more luck with this yet? Anyone (still) able to de-compile the Android app? |
No, I also do not see how to make the connection between the parameter names and their number. |
I decompiled the Android App but couldn't find any sort of list containing any names. To be honest I do net even remember where exactly I found the original list of names 🤔 |
Maybe the list is in the java-application of the old webinterface? (I do not have the java application since my heat pump is too new) Btw.:
|
Yes. V1, V2, V3 ist the heatpump Type. See download Portal |
As far as I know, no there is no official changelog. Talked to the support regarding this, they plan to do something like this in the future, since some people have been asking for it. Maybe if all of you could contact them regarding this ( |
Guilty 👀 - Asking for a friend. 🤣 |
The coupling between the parameter numbers and the names is done in the method In this method, there was presumably a
|
Cool, thank you for your analysis.
Yes, that sounds messy. Probably it will be difficult to reverse engineer all of that without having the sources available. I guess most of the developers don't even know all of the details about those parameters :-).
Do you understand why there are parameters and global variables? I guess parameters are read somehow from non-volatile storage (there are some param files in /home) during initialization. If I were to develop this, I would create some kind of struct (
In our codebase parameter 2 is: python-luxtronik/luxtronik/parameters.py Line 31 in 973f7c9
What does the change mean? Has the meaning of the variable been changed? Or only the name? Which firmware version are you working with?
Hm, in our code base those are Unknown parameters with some IDs / names extracted from somehwere. If parameters are being re-used / changed / no longer used, it will be very difficult to understand them and keep track of this in the code. python-luxtronik/luxtronik/parameters.py Line 37 in 973f7c9
python-luxtronik/luxtronik/parameters.py Line 48 in 973f7c9
python-luxtronik/luxtronik/parameters.py Lines 59 to 60 in 973f7c9
At least for |
I am currently working with version V3.85.6, since that version is running on my heat pump. I do not have any precise idea, why we have global variables and the variable array. Maybe, because And yes, the parameters are saved to the files Concerning parameter 2: I don't think that the meaning has changed. I think that this is just the temperature for the warm water which was demanded and which was achieved by the heat pump. Parameters 30 and 31: Which menu do you mean? In the code, there is no reference to variable names containing |
I think this is calulated on client side: calculations.ID_WEB_Zaehler_BetrZeitWP / calculations.ID_WEB_Zaehler_BetrZeitImpVD1. |
Okay, so the values itself are 4 bytes. Makes sense, was wondering myself why 8 bytes are occupied when the values could be easily represented in less bytes. Do you know anything about those flags? Are they "interesting"?
Ah, okay, then I mis-understood it. Because the name you've mentioned was different from what the library is referring to this parameter.
There is a menu on controller and also in the web interface, which displays the average runtime. I think its part of the |
This project is helpful and I was able to read off some parameters from my heat pump system. However I'm missing some kind of meta-information about this project and the API it uses.
Is there any kind of information about this API, or has all of this been reversed engineered? Is there anyone that can be contacted to answer some questions?
By the way: I also have the GLT license available, so I could double-check some aspects using the "official" Modbus API for instance.
The text was updated successfully, but these errors were encountered: