K3A

Here is how to control a pellet stove with a Micronova controller remotely either via IR commands or using the serial line.

They installed a Laminox pellet stove in our house. It is a nice thing to have over the winter. Problem is that sometimes I am outside and I want to turn on the stove remotely so that when I arrive, it will be warm inside. So I needed a way to control it remotely. By google searching pellet stove controllers I noticed that mine looks very similarly as those made by Micronova so it was clear – the controller inside my stove is some board from Micronova (i023, i050 or who knows). It is used by various stove manufacturers like Laminox, Extraflame, Evacalor, Dalzotto, Ungaro, Arcestufe, Karmek, Tecnoflam, Termoflam, Clam, Cadel, Zibro, Sicalor, Kepo, EcoTeck and many others. I noticed a DB9 connector at the back of my stove but no! It is not an RS232, there is 20V on one of the pins and I destroyed my UART interface trying to connect it to the stove (right, I should have checked the voltage levels on each pins first, lesson learned, but the interface is not expensive and I have more pieces at home anyway).

I contacted one of Micronova employees just asking if it is possible to turn on the stove via that connector or if it would be just waste of my time trying to figure out how to do it. And he replied that if I am not from one of their partner companies they can’t tell me anything. Right, thank you. I bought this stuff and it’s now mine so I want and will do what can be done with it myself! So I decided to spend some time with this.

Fist I did some research on IR remote. Later I found some helpful information about the serial communication in Italian at stufapellet.forumcommunity.net (thanks!). It was not all in one place there and not complete. As I also recently purchased a Rigol oscilloscope and had a Salea logic analyzer available so I did more work on this subject and I am finally able to describe it in more details.

IR commands

This is the original IR controller

It’s not difficult to send IR commands for this stove using an Arduino.

Here is a table of commands I created by recording the IR LED voltage with a PC line-in sound card port, then analysing the recording with Audacity (before I had a logic analyser at hand):

== Setting the power ==
r up   11111111 00011110 01010011 10101010 01110010 11000000
       0xFF     0x1E     0x53     0xAA     0x72     0xC0

r down 11111111 00011110 01010011 11101010 01111010 11000000
       0xFF     0x1E     0x53     0xEA     0x7A     0xC0

== Setting the water and air temperature ==
l up   11111111 00011110 01010011 01101010 01101010 11000000
       0xFF     0x1E     0x53     0x6A     0x6A     0xC0	 

l down 11111111 00011110 01010011 11001010 01111100 11000000
       0xFF     0x1E     0x53     0xCA     0x7C     0xC0	 

== Power up ==	   
power  11111111 00011110 01010011 01001010 01101100 11000000
       0xFF     0x1E     0x53     0x4A     0x6C     0xC0

38 kHz modulation seems to work fine (36 kHz may work too). I created a testing Arduino code based on Infrared library. It sends the ‘power setting down’ command every four seconds. Just connect an IR LED to GND and D3 pins (ideally with a 100 Ohm resistor in series).

Serial communication

Well, first I was thinking of parsing LCD segment bits and getting textual LCD data as a form of feedback. But that is quite crazy and unnecessarily complicated. I knew there is a DB9 connector at the back of the stove and while I didn’t know the pinout I suspected that it may be connected to the SERIALE connector (CN13) on the main board. I have read some italian threads. They were mentioning there is ~20V, GND, +5V pins. Right. First – GND is not connected to stove’s metallic frame. This metallic frame is connected to protective earth but the stove has it’s own GND reference for all communication stuff. So I picked up known GND from the controller panel and measured voltages on every pin. Turned the stove off and measured resistance between GND and those pins. And here are the pinouts.

Out of curiosity, when the stove was off, I also measured resistance between IR pin on the controller panel and all pins in the DB9. And also resistance between +5 pin in the controller panel and all pins in the DB9. And guess what! There is about 500 ohm between IR pin and serial pin. Aha, so it uses almost the same path for IR as well as serial commands. Interesting. It seems that 500 ohm resistor is on the DB9 (CN13) side and there is no resistor on the IR side.

Unfortunately, as they mentioned in the forum, only one pin is used for RX and TX. UART logic levels are ~5V for logic 1 and ~0V for logic 0 (for exact ranges see 5V CMOS logic). When the stove or the PC wants to write a bit with logic value 0, it needs to pull down this serial pin (~ <1V). When it wants to send a bit 1 it can keep it at 5v (it is pulled up apparently so no need for an extra pull up resistor). In the forum they made some crazy schematics with optocuplers and transistors (here and there). :D But there was one simple schematic. I don’t have that chip nearby but it made me start experimenting. I created an arduino sketch again to just simulate me this NC7WZ07 device. You can connect TXD from CP2012 to pin 2 and on pin 3 you will get output to go on the stove’s serial line. UPDATE: you can use a diode instead of it, read on.

I created this simple schematic with just one PNP transistor and one diode. It works fine with 5V tolerant USB-to-TTL converter based on CP2102 and it doesn’t echo the sent bytes if the diode has higher forward drop, let’s say 0.7-1V. It’s a bit of trial and error but it works with SeramiNet.

It works like this: when TXD is logic 0 it’s 0V so the diode will act almost like a wire (with Vf though) so there will be Vf (around 0.8V depending on your diode on the serial line so the 5V stove logic will pick it up as a logic 0, when TXD is logic 1 it will be on 3.3V on that side, that will be reducing stove controller’s serial voltage to 3.3+Vf max (from it’s default pulled up 5V). But because the stove is pulled up with a high resistance pullup, there will be a very tiny current flowing so it’s fine. Because there will be ~0.8V on the stove’s serial line, it won’t be picked up by 3.3V logic of RXD (higher than it’s max low level voltage), thus cancelling up the echo, yay! To illustrate here are some screens from the oscilloscope at stove’s serial line and RXD of the CP2102 for the same request and response. White line is 1V, 0V is at the bottom of the screen. At the serial line of the stove there is max 3.8V.

I intend to control the stove using Espressif ESP8266, a cheap chinese SoC with wifi and IP stack. It is 3.3v and it’s not 5V tolerant. While receiving can be done using a voltage divider (two resistors), sending is problematic. UPDATE: as Gus suggested in the comment, one diode and NPN transistor is a better way to do the half-duplex trick. Also NPN transistors are probably more common. So for my ESP8266 project I used this idea and just added one zener diode on the TX side of the ESP to protect TXD from getting voltages higher then 3.6V. Here is the schematic I use and the board made in free version of Eagle:

What you see as REGULATOR is a tiny switching regulator to convert 20V from DB9 connector to the 3.3V needed for the ESP8266. Don’t use LDO (linear regulator) for that purpose as the voltage difference is high and current can be ~200 mA meaning it would produce more heat than the ESP would be consuming. :D

Serial Protocol

Their protocol is called Rwms. It’s a simple binary serial protocol which works half-duplex. You are either sending or receiving.

There are two accessible memories on board. RAM and EEPROM. RAM is volatile memory which can be rewrote many times safely. EEPROM is the memory used for storing settings which are preserved after the stove is turned off. EEPROM should not be rewrote many times as writing cycles are limited (commonly 10-100k depending on the memory technology).

Connection parameters are: baud rate 1200, 8 data bits, 2 stop bits, no parity, no flow control. There are two commands – Read and Write.

Read

two bytes (TYPE+ADDR_MSB) ADDR_LSB
– where TYPE is 0x00 for reading from RAM and 0x20 for reading from EEPROM
– ADDR_MSB optionally the most significant byte part if the address is longer than 8 bits (you can put 0 there/ignore it)
– ADDR_LSB least significant byte of address (item index) to write to
– ADDRESS is just a memory position index, starting from 0x00 to 0xFF

response from the stove are two bytes CHECKSUM VALUE
– CHECKSUM is (TYPE+ADDR_MSB+ADDR_LSB+VALUE) & 0xFF
– VALUE is the returned value (it can be 255 decimal max)

To read a temperature (looks like ambient temperature for my board) you would send 0x00 0x01. It seems that indices may be different for different board so you have to experiment. Index 0x67 was hour and 0x68 minute while for Italian forum people it was 0x65 for hours and 0x66 for minutes.

Write

four bytes (0x80+TYPE+ADDR_MSB) ADDR_LSB VALUE CHECKSUM
– TYPE again 0x00 for writing to RAM, 0x20 for writing to EEPROM
– ADDR_MSB optionally the most significant byte part if the address is longer than 8 bits (you can put 0 there/ignore it)
– ADDR_LSB least significant byte of address (item index) to write to
– VALUE value to write (so it can be 255 decimal max)
– CHECKSUM is ((0x80+TYPE+ADDR_MSB)+ADDR_LSB+VALUE) & 0xFF

stove responds with two bytes: ADDR_LSB VALUE
– repeating the values sent there

Known Variables

These are variables mentioned on the Italian forums. These addresses seem to be different for different boards though so it’s more just for a reference…

== RAM ==
0x00 internal timer of the program (ranging from 0-255 continuously)
0x01 temperature multiplied by 2
0x0D pellet loading in use (formula !!)
0x21 power state (0-stove off, 1-stove start)
0x37 speed 'fan fumes using (formula !!)
0x5A smoke temperature
0x63 seconds current
0x64 DOW (day of week)
0x65 current time
0x66 minutes current
0x67 date current
0x68 current month
0x69 current year
0x73 intake air temperature
0x7D copy of the set temperature from EEPROM

== EEPROM ==
0x08 FAN SMOKE IN POWER 5
0x7D set temperature

You can turn on the stove by writing 1 to 0x21 in RAM so the bytes to send would be 0x80 0x21 0x01 0xA2. The stove responds with 0xA2 0x01.
UPADTE: Another parameter table is mentioned in this thread.

UPDATE2: Parameters for my hydro pellet stove (all RAM):

0x00 some internal timer, constantly changed over time
0x01 ambient temperature (multiplied by 2)
0x02 ??? (started around C, maxed around 95)
0x03 water temperature
0x19 stove power control? Must be set in EEPROM I guess
0x21 state (0-off, 1-starting, 2-load pellet, 3-flame light, 4-work, 5-cleaning, 6-, 7-cleaning final)
0x34 current stove power
0x3B water temperature (copy of 0x03)
0x3C water pressure (multiplied by 10)
0x5A smoke/fumi temperature (started around 24 deg C, maxed to around 126 deg C)
0x65 current second
0x66 current day of week?
0x67 current hour
0x68 current minute
0x69 current day
0x6A current month
0x6B year since 2000
0x6D stove water temp control

My first custom control board (telecontrollo)

This was the first board I made (left). I decided to power it directly from the stove’s control panel. It was hidden in the stove. Worked fine, but one night I realised it may not be ok to stress the stove’s 5V regulator so much. ESP8266 can draw ~200 mA which is not that small. So I made a new board with switching regulator and DB9 connector to be connected at the back of the stove as an accessory.

My second control board

This is the final board I made. It looks like an accessory and has the board edge connector for programming the ESP8266. Currently I use my own firmware written in C but I am actually working on a scriptable firmware which I may opensource at some point. I didn’t want to use NodeMCU or Arduino for ESP because NodeMCU is unnecessarily big and consumes a lot of memory and both can’t be updated too easily remotely. But both are cool projects so you can definitely consider one of them if you don’t plan more projects and don’t need rapid updates over wifi.

Micronova stuff

Micronova have some “Serial interface”. It probably has an Atmel microprocessor inside which just does the half-duplex trick. And there will be some RS232 transceiver or USBtoUART chip. :)

Some crappy “serial interface” gadget I don’t own

They have a proprietary software SeramiNet. It can be used for reading RAM/EEPROM parameters. It has also a console allowing you to write values. There is also a tool for flashing firmware but I am not sure if it uses the same serial interface or the JTAG pins on the board. If you ever wanted to write a firmware though, you would have to get some .enc, .hex or .ben file from Micronova and I am almost sure they won’t give you one unless you are a partner company. :P That may be because it would be an executable Atmel code and you could potentially decrypt it and flash into your own Atmel chip. This one makes sense – not blaming them for that.

UPDATE3: Micronova developed their own remote control based on ESP8266 and Atmel and it looks quite nice. I haven’t tested it as I have my controller. It look like their board connects to their server and registers. Then you create an account at efesto.micronovasrl.com and somehow associate the device with your account. Then you control the stove through that website. This is how “cloud services” work normally nowadays.

So that’s it. As I had told the Micronova employer that I will figure it all out, I did. Hope it will help more people.