Our house came with an HRV system that I have pulled apart and had a bit of a play with. The design of the system is very hackable.
The HRV control panel and the motor controller communicate via TTL level serial signals at 1200 baud (8N1).
An unusual feature of the communication is that a single serial line is used, i.e. RX and TX are on the same wire.
The motor controller provides 5V power for the control panel. A 6 core cable with an RJ11 connector is used.
The control panel contains a DS18B20 temperature sensor IC. The indoor/roof temperatures and motor/fan speed are sent over the serial link and can be easily read. Temperatures are sent in 16ths of a degree C, in two’s compliment format – the same as how they are represented in the DS18B20. See the datasheet.
The control panel sends message ID 1 and the roof controller responds with message ID 0. This occurs once per second.
HRV Serial Protocol
1200 bps, 8N1, 0-5V levels.
[Start][ID][Data][Checksum][End] All fields are one byte except [Data]. [Start] = 0x7E [ID] = Message ID [Data] = Message data (multiple bytes) [Checksum] = Message checksum (see below) [End] = 0x7E Escaped characters in message body: 7E -> 7D 5E 7D -> 7D 5D Example: 7E 31 01 A6 00 14 00 78 9C 7E [7E] Start  Message ID [01 A6 00 14 00 78] Data [9C] Checksum [7E] End The checksum is calculated by starting with zero and subtracting (modulo 256) each byte in [ID] and [Data]. Checksum calculation: (0x00 - 0x31 - 0x01 - 0xA6 - 0x00 - 0x14 -0x00 - 0x78) % 0x100 = 0x9C
Message ID 1
Control panel data.
[ID] = 0x31 (ASCII ‘1’)
[Data]: 6 bytes
2 bytes: Control panel temperature
1 byte: Unknown (Possibly fan speed?)
1 byte: Control panel set temperature (in whole degrees C)
2 bytes: Unknown
7E 31 01 A6 00 14 00 78 9C 7E
Temperature 01A6 hex = 422 decimal
422 * 1/16 degrees = 26.375 degrees C.
Set temperature 14 hex = 20 decimal = 20 degrees.
Message ID 0
Response from roof controller.
[ID] = 0x30 (ASCII ‘0’)
[Data] = 3 bytes:
2 bytes: Roof temperature
1 byte: Unknown
7E 30 02 1D 00 B1 7E
Temperature 021D hex = 541 decimal
541 * 1/16 degrees = 33.8125 degrees C
- Logic analyser captures
- Internal photos of control panel
- Pinout of RJ11 connector