Hack Your HRV

Our house came with an HRV system that I have pulled apart and had a bit of a play with. The design of the system is very hackable.

The HRV control panel and the motor controller communicate via TTL level serial signals at 1200 baud (8N1).

An unusual feature of the communication is that a single serial line is used, i.e. RX and TX are on the same wire.

The motor controller provides 5V power for the control panel. A 6 core cable with an RJ11 connector is used.

The control panel contains a DS18B20 temperature sensor IC. The indoor/roof temperatures and motor/fan speed are sent over the serial link and can be easily read. Temperatures are sent in 16ths of a degree C, in two’s compliment format – the same as how they are represented in the DS18B20. See the datasheet.

The control panel sends message ID 1 and the roof controller responds with message ID 0. This occurs once per second.

HRV Serial Protocol

1200 bps, 8N1, 0-5V levels.

Message Definition

[Start][ID][Data][Checksum][End]

All fields are one byte except [Data].

[Start]    = 0x7E
[ID]       = Message ID
[Data]     = Message data (multiple bytes)
[Checksum] = Message checksum (see below)
[End]      = 0x7E

Escaped characters in message body:
7E -> 7D 5E
7D -> 7D 5D

Example:
7E 31 01 A6 00 14 00 78 9C 7E
[7E] Start
[31] Message ID
[01 A6 00 14 00 78] Data
[9C] Checksum
[7E] End 

The checksum is calculated by starting with zero and subtracting 
(modulo 256) each byte in [ID] and [Data].

Checksum calculation: (0x00 - 0x31 - 0x01 - 0xA6 - 0x00 - 0x14 -0x00 - 0x78) % 0x100 = 0x9C

Message ID 1

Control panel data.

[ID] = 0x31 (ASCII ‘1’)
[Data]: 6 bytes

2 bytes: Control panel temperature
1 byte: Unknown (Possibly fan speed?)
1 byte: Control panel set temperature (in whole degrees C)
2 bytes: Unknown

Example:
7E 31 01 A6 00 14 00 78 9C 7E

Temperature 01A6 hex = 422 decimal
422 * 1/16 degrees = 26.375 degrees C.

Set temperature 14 hex = 20 decimal = 20 degrees.

Message ID 0

Response from roof controller.

[ID] = 0x30 (ASCII ‘0’)
[Data] = 3 bytes:
2 bytes: Roof temperature
1 byte: Unknown

Example:
7E 30 02 1D 00 B1 7E

Temperature 021D hex = 541 decimal
541 * 1/16 degrees = 33.8125 degrees C

Todo/coming soon

Logic analyser captures
Internal photos of control panel
Pinout of RJ11 connector

40 thoughts on “Hack Your HRV”

gene on April 1, 2015 at 8:24 pm said:

I am trying to add in a heat transfer system to our HRV. They quoted me 2,500 to put in one of their systems which seems very steep. any ideas on how to add one in and trick the HRV into converting into a transfer system?

Reply ↓
- Spencer on April 2, 2015 at 11:13 am said:
  
  I suggest adding an inlet duct in the room with the heat source. Connect this to the inlet of the HRV fan unit with an insulated duct. The HRV reads the air temperature within the fan unit, so it will think your roof space is warmer than it actually is. If the indoor sensor is cooler than the set point, the HRV will go into heat mode.
  
  The problem with the HRV is that the system is not insulated.
  You will need to insulate the HRV outlet ducts or replace them with insulated ones, or you will lose all the heat through them before it reaches the rooms. You will also need to insulate the fan unit. This may be why their quote was so high. You may also want to install an adjustable baffle that allows you to switch between the heat transfer and normal ventilation modes.
  
  Reply ↓
Scott on May 30, 2015 at 2:14 pm said:

I had a problem with my HRV series 1 system saying it had an error (Error code 1) which was a faulty roof temp sensor. I tried to get a replacement but as I’d purchased the system secondhand and installed it myself they (Chch) wouldn’t sell me a new sensor. I hunted around on Ebay and ended up purchasing a DS18B20 temp sensor, fitted it with an RJ plug and took the gamble it would work. Bingo it did. Upon stripping down the old sensor I found it be exactly the same sensor as I’d purchased, so very happy but not very happy with HRV.
My unit also has another outlet for adding an additional fan unit which I may setup with it’s own home made filter etc

Reply ↓
- Spencer on November 17, 2015 at 12:48 pm said:
  
  Good to hear that a simple replacement of the temperature sensor is possible.
  
  Reply ↓
  - Alistair Clark on October 11, 2016 at 5:10 pm said:
    
    Hi I’ve stripped away the rubbery covering on the sensor and I find looking down on rounded part of component that left is the red wire , middle wire is green and right wire is black. I’ve got a replacement component but I’m not usually joining up such fine wires. How should I proceed to do this. (I’ve done some soldering in the past but i’m now almost 76). thx
    
    Reply ↓
    - Spencer on October 12, 2016 at 4:35 pm said:
      
      So long as you connect the wires to the correct pins, you should be OK. It may be easier to solder the wires to some stripboard then solder the sensor to the board.
      
      Reply ↓
      - Alistair Clark on October 12, 2016 at 7:59 pm said:
        
        Eureka! I found it easier than I expected. Rather than re-work the sensor end as I did probably just as easy to buy off Ebay one with a sensor and wires coded red,yellow and black and re-use the HRV phone plug.(I presume yellow=green). For many years I have had a DSmith weather station inside and 2 wireless remotes, one up in the roofspace and one outside. You will then be able to see what the fan is doing for you whilst monitoring temperature and relative humidity. Particularly useful when the RH is high and you don’t want that air blowing inside.
- Phil on September 10, 2016 at 10:22 pm said:
  
  Hi there, just looking to do the same but the wires are different colors – do you happen to recall which was vcc, which data and which ground on the original sensor?
  
  Reply ↓
Jimmy on March 8, 2016 at 12:51 pm said:

Thanks for your efforts and post on this. I’m going to integrate this with an Arduino or ESP8266 and tap into the back of the HRV control panel and send that info via MQTT to have it display in OpenHAB. Did you get any further with the pinouts etc?

Reply ↓
- Spencer on March 8, 2016 at 1:16 pm said:
  
  Here are the pinouts from my notes. I haven’t checked this information for some time so please verify these before you connect to anything!
  
  RJ12
  Pin connections are mirrored across the connector, so it doesn’t matter which way the connector is installed on the cable. Pins are shorted together on the HRV control panel circuit board.
  
  If you connect the RX pin of a 5V serial port to the data line, you should be able to read the messages being sent in both directions.
  
  1/6: 5V
  2/5: Gnd
  3/4: Data
  
  Reply ↓
  - Jimmy on March 8, 2016 at 4:28 pm said:
    
    Legend cheers mate I’ll give it a go and let you know the results!
    
    Reply ↓
    - Erin on March 20, 2016 at 4:26 pm said:
      
      I’m curious as to how you got on, i’d like to do something similar to get my raspberry pi to be able to read the temperature readings so I can display them next to my power usage readings
      
      Reply ↓
      - Jimmy on March 21, 2016 at 1:20 pm said:
        
        Hi Erin, I’m part way through building this using an ESP8266 (due to it being small in size) I’ll report back once I make progress
      - Jimmy on April 19, 2016 at 8:57 pm said:
        
        Hi Erin,
        Go to here for the code if you want it:
        
        Cheers
        http://www.geekzone.co.nz/forums.asp?forumid=141&topicid=195424
Jimmy on March 31, 2016 at 10:50 pm said:

Having quite a few issues with this. I have an ESP8266 connected to a bidirectional TTL converter (ESP is 3.3V only, HRV is 5V) and I’ve put RX pin to wire 3 (and tested with 4) and I don’t get any data showing in my debug console. If I put a multimeter on that wire I can see the voltage going up and down so its definitely that wire. If I GND the HRV back to the ESP8266, I get ER02 on the HRV control unit (which apparently means “Drop in airflow has been detected of the fresh air supply fan. Please check for blockages, especially around the external vent”) but I think that’s just a red herring – it could be because I now have 2 devices reading the data so would possibly get a voltage drop causing some issues. Any ideas? I’m not massively technical when it comes to electronics! Cheers

Reply ↓
- Spencer on April 1, 2016 at 8:17 am said:
  
  Sounds like you have a ground loop between the ESP and the HRV. You would normally connect the ESP to signal GND and the data line. Depending on how you are powering the ESP, there may also be a GND connection through the power supply. Are you connected to the ESP via USB? Or is it powered by a plugpack? Another issue may be that the 5V to 3.3V converter may be loading the data lines too much. You could try connecting a 10k resistor in series with the data line. Another thing I would suggest is to use a FT232 connected to a laptop (running on batteries and not plugged in to mains). This would let you debug the data before adding Wi-Fi to the mix.
  
  Reply ↓
  - Jimmy on April 1, 2016 at 8:38 am said:
    
    Thanks for your suggestions Spencer, I’ll check my wiring properly tonight. I have a breadboard with ESP8266 and TTL converter on it. The TTL converter is powered by a breadboard power supply (one side provides 5V the other 3.3V) and the PS is plugged into the wall with a 7.5V power supply. I’ve measured V at the TTL converter and its spot on both sides. The ESP is connected (and powered) separately by the USB line (which I also use to debug. I was concerned the USB power didn’t have enough grunt to power everything)
    
    I think you’re right that its something GND related – as that’s what I was having problems working out where the GND wires should go specifically from the HRV. I think I had the HRV GND going to the ESP GND – so you’re saying that’s not right and that’s creating the loop? That would make sense in hindsight. Just looking briefly at it now before I head to work, I need to run HRV GND to the GND pin that’s beside the RX/TX pins? Is that a GND specific for serial data? I can try the resistor if that doesn’t work. Also, because the debug console “Serial” is shared with the RX/TX, I can type in the serial monitor and I get feedback on the serial console so I know the code is ok. Thanks for your help.
    
    Reply ↓
Jimmy on April 5, 2016 at 9:02 am said:

Still absolutely stumped on this. I can’t work this out. On the 5V side of the TTL converter, I have HRV 5V going to TTL HV, HRV GND going to TTL GND and HRV data line going to TTL HV1. On the 3.3V side of the TTL converter, I have ESP 3.3V going to TTL LV, ESP GND going to TTL GND and ESP RX going to TTL LV1. I’ve also tried with a 10K resistor in series on the 3.3V side of data line too no difference. I’m just not getting any serial data output to my debug window.

I have pretty much referenced info from here for TTL connections:
https://learn.sparkfun.com/tutorials/bi-directional-logic-level-converter-hookup-guide

And the code is quite simple at the moment, similar to this (although 1200 baud)
https://www.arduino.cc/en/Serial/Read

What am I missing?!

Reply ↓
- Spencer on April 7, 2016 at 7:30 pm said:
  
  Do you have access to an oscilloscope or logic analyser? If not, you could try an FT232 module like this one I used successfully: https://www.sparkfun.com/products/12731
  
  Try to get the most basic setup going first. Using the FT232 will eliminate a lot of things that could be going wrong. It also has an LED that blinks when it is receiving data.
  
  You don’t say whether you are using a desktop or a laptop to connect for USB debugging. Try using a laptop that is running on battery power – not plugged into the mains. I think there could still be a grounding problem. You should only make two connections to the HRV system – gnd and data. It would be better to power your breadboard from the laptop’s USB port while you are trying to get it working. The 7.5V power supply could also be a source of a ground loop. Remember that the HRV is also conencted to ground through its mains cable, which will be up in your attic somewhere.
  
  Reply ↓
  - Jimmy on April 7, 2016 at 10:26 pm said:
    
    Hi,
    
    Thanks for the reply. I’m using a laptop for debugging. I’ll give it a go on battery only, although think I may have already doing this (so many different tests hard to recall what I’ve done and what I haven’t!). I do still suspect its a ground loop after reading about it, but it seems a bit of a catch 22 with the way its wired.
    
    Will an Arduino Nano work in replacement of an FT232? (its pretty much similar isn’t it?) I also have an Arduino Uno but that’s sitting in the garage and programmed up with a relay to open the garage door at the moment, but I could use that as a test instead as it operates at 5V (no TTL converter which is possibly whats mucking me around) Actually,… I’ll go rip it out of the garage now and give it a try since it will be a quick and easy test!!
    
    Cheers
    
    Reply ↓
  - Jimmy on April 7, 2016 at 11:02 pm said:
    
    Using the Arduino Uno, with data line wired to RX and GND wire to Arduino GND, I now get a constant stream of TTL serial data in the debug window (it must be something to do with the TTL converter or wiring, perhaps its faulty)
    
    I also however, get the Err 02 back on the HRV display. I have the serial coming down from the roof going to a splitter, which then feeds out into the HRV control panel and the other to the Arduino (continuity tests are all good so wiring is fine) I tried the resistor in series with the data line but get no data (perhaps a smaller resistor then?)
    
    Cheers
    
    Reply ↓
  - Jimmy on April 18, 2016 at 4:03 pm said:
    
    Hey Spencer,
    Well I’ve finally got this working! At least, working with an Arduino Uno and successfully displaying room and roof temperature in the Serial debug window. I found I had to use software serial, define RX/TX on pin’s 7/8 (well, anything higher than 5 worked, anything less didn’t – no idea why) and also power the Arduino using the 5V from the HRV. Any combo outside of that threw up an Err02 on the HRV control panel display. So its now working a treat. Just have to get it going on an ESP8266 now. Thanks for your help!
    Cheers
    
    Reply ↓
Jimmy on April 16, 2016 at 12:43 am said:

I have got an Arduino Uno reading HRV control panel temperature and displaying to the debug window. I do still get an Err 02 on the control panel screen as soon as I plug the Arduino into it though. Only GND and RX are connected. I’ll try various size resistors in series perhaps that may help?? I would also *really* like to get this working with the ESP8266 though, because the Uno is larger large – the ESP can at least sit inside the wall space!!! Once code is complete (need to add checksum validation, reading and processing messages from roof controller and as you’ve mentioned, possibly fan speed in the other 1 byte) I’ll post it and link to it from here. In the meantime if you have any thoughts about the Err 02 message and how to fix, would be most appreciated, likewise with the ESP8266 failing!

Reply ↓
Sam on April 30, 2016 at 1:05 am said:

Hi, interesting project and write-up, thanks.
I’m attempting something similar in the other ventilation camp – DVS.
I have an old G3 model, with touchscreen, room and roof temp sensors, and what is actually a really nice EC fan from ebm pabst inside the DVS fan housing. Super quiet and speed controllable.

I have the controller panel open, and although there is a set of pads near a label ” serial/boot/VPP”, I can get nothing sensible (ie UART) from any of the pads. Looking up the data sheet for the micro (http://www.mouser.com/ds/2/76/cirrus%20logic_ep7312_f2-322933.pdf) , and metering the both of the two TXD lines from the micro – none of them go to the pads I assumed were the serial port. One goes to another set of pads labelled RS485 (assume this is either the fan comms, or other peripherals not fitted). The other goes to a MAX202 IC, but I’m still not clear why I can’t get a sensible serial read out of that (garbage at all baud rates).

I know the fan itself is PWM 0-10V controlled, so may just bypass the controller with an ESP8266 outputting PWM, but I’d like to work WITH the controller (since it houses the room sensor and information display).

Reply ↓
- Jeff on January 31, 2017 at 2:30 pm said:
  
  Did you have any luck with this? I also have a DVS and would like to attempt the same thing these guys have done with the HRV systems.
  
  Reply ↓
  - Jp Wise on April 20, 2017 at 12:17 pm said:
    
    I’m in the same boat. DVS G3 unit I’d love to do some integration with home automation, but would also prefer not to blow up on the control panel testing. :/
    
    Reply ↓
  - Sam on May 3, 2017 at 10:01 pm said:
    
    Jeff, no this has stalled, still have it in mind though. Will post here if I make any progress.
    
    Reply ↓
Jimmy on June 15, 2016 at 1:02 am said:

Hi Spencer,

Here’s a full write up on getting HRV data to an OpenHAB using MQTT messaging, thanks to your investigation into the data structure:

http://www.chimera.co.nz/electronics/esp8266-hrv-wireless.htm

Its all working well now, no Err 02 messages – they occurred originally due to some buggy code and secondly, if the ESP wasn’t earthed properly (one of the pins I was testing with was dodgy)

The only issue I have left is if the ESP is restarted, it triggers the HRV Control Panel to restart. Not an issue obviously when its all running ok. Oddly this never occurred when running off the breadboard, so perhaps a loop again of some sort.

Cheers

Reply ↓
- Jimmy on June 24, 2016 at 8:14 am said:
  
  Found out the HRV control panel restart when the ESP restarted was due to a poor earth on the ESP board. I need to learn to solder better 🙂 Its all working perfect now! Cheers
  
  Reply ↓
rian on August 6, 2016 at 7:43 pm said:

Hi there, we have recently installed a second hand six room hrv unit and on start up the controller keypad hascom up with a error code E10. Does anyone know what this is and how to fix. Hrv don’t want to know as its second hand and they didn’t install etc.

Reply ↓
- Trw on April 24, 2018 at 4:11 pm said:
  
  Did you have any luck sorting out what error 10 is?
  
  Reply ↓
Lucas on May 24, 2017 at 11:12 am said:

Hi,

Thanks for sharing your work here.

At the moment, I’m thinking of following what Jimmy did with esp8266 + logic level converter. However, I would like to be able to turn on/off hrv fan as well.

Would it be possible to send a certain packet to fan controller to turn it on/off via TTL serial connection?

Regards
Lucas

Reply ↓
- Jimmy on May 29, 2017 at 8:52 pm said:
  
  Hey Lucas, I did some very basic testing in this but every time I tried a ttl serial send of data the control panel through an Err 02 (or may have been slightly different number) I didn’t spend too much time testing further as I suspected the control panel would have been getting confused receiving jumbled up serial data from both the roof controller and esp8266 simultaneously. It still may be able to be done if you can temporarily turn off comms from the roof controller first (this shouldn’t be hard if you rewired so all serial comms came into the esp8266 first then got resent back out, or came in to a switch on the esp8266 that you could turn on or off). Report back if you do get it working I’d be interested in doing the same. Cheers
  
  Reply ↓
  - Lucas on May 29, 2017 at 11:03 pm said:
    
    Hi Jimmy,
    First of all, thanks for your feedback.
    
    I guess, from the looks of the chip name ds18b20 and 1 data line + GND for connection, the communication betwen control panel and fan seems to be a 1-wire.
    
    In a parasatic mode, 1-wire can supply power through data line, so it would require only 2 wires – data and GND.
    
    I’m not too sure but it’d be a worthwhile to check how esp8266 can talk to DS18B20.
    
    At the moment, everything for hrv hacking is flying from china so it would take some time for me to follow what you did. If I can find anything, I will share here. Thanks.
    
    Reply ↓
Andrew on May 29, 2017 at 7:06 pm said:

I have a newer model HRV and have been trying to read data from it using a NodeMCU. However I’m not seeing the 0x7E start/end marker in the data I’m logging and I don’t think I have the skill to figure the data out myself. Here’s a sample I logged:

000801FC1F0000000108001F0000001F000004011F000000000000040000000000001F0074033F00000100000007037F000100001F00000300000100000003010000097D0008000201000F0008081A020000020A081A080000020A000002000000020409000000FC180A00011F0000FC09120001010000080430F000000000020401FC1F0000FC020801001F00001F000200011F1F00000000000400001F00001F1F0074033F0000007F00000E03FF006000FF0000062E03FF0000000000000608080060097D0008001A00080F0002081C01000002280003090000602A0820080000000A0400020018080828000000001801000200020000010900021F0000FC01100002000000FC091200011F0000FC091200021F000000091200021F00001F090400F20000000912000202000102000202000009120001020000011000020200000110000202000000120002020000001000020002007E09100002000000FC09120002000200FC01120002000000FC091230F2001F0000FC090430F200000000FC080430F0001F000000280430021F00001F080400F2001F00001F280030FC00000000010801FC00000000020801FC1F000000000801FC1F00001F020801FC1F000000020001FC000200FC08003002000200FC080430F20000020000090218F200000200FC

Any ideas?

Reply ↓
- Jimmy on October 12, 2017 at 9:39 pm said:
  
  Best thing you can do is press the HRV buttons while sampling the data coming in. See if you can determine what changes and what doesn’t.
  
  Reply ↓
David Oberholzer on April 1, 2018 at 11:14 am said:

Hi There,
I have a new Positive Pressure HRV and have lost some settings on the display screen.
Is there a way of hacking the system so that I can get to the fan% speed. This was available on installation, but not any more.

Reply ↓
- Spencer on May 9, 2018 at 11:29 am said:
  
  Maybe you could intercept the fan speed data and show it on an additional display?
  
  Reply ↓
David Oberholzer on April 7, 2018 at 5:55 pm said:

Looks like this site is dead…….

Reply ↓
- Spencer on May 9, 2018 at 11:29 am said:
  
  Almost but not quite 🙂
  
  Reply ↓

Hexperiments