Reverse engineer Takagi tankless WH control protocol

[KI7OM]

I’m wondering if anyone has reverse engineered Takagi’s TK-x remote control protocol. Takagi uses a twisted pair for remote communication with any of the TK series tankless water heaters out to a TM-RE30 remote controller. The TM-RE30 is able to report inlet and outlet water temperature, flow rate, set point, time, and error codes. Up to this point I have only checked for the presence of DC (measured at about 15VCD) and the presence of an AC signal in the mV range. I have yet to put a oscilloscope on the line to determine the frequency of the AC or to capture any signaling. My interest is in integrating this information into a centralized residential energy management system.

[allan-sf]

If you're in the Bay Area, my work has a lab of fairly expensive
scopes and digital signal analyzers. Though it probably
is some very simple rs-232 like protocol with that DC offset.

I'm using mine for radiant hydronic, so getting data on usage
and cycles would be nice, though it might be easier to
use a fancier thermostat (thermostat turns on 2 pumps
which triggers the Takagi)



allan

[Jim Evans]

I have two Takagi JRs used for hydronic heat, and I just received a remote control unit for one of them. I'm thinking it's definitely worth my time to put a 'scope on it and check out the protocol and try to roll my own simple remote with an Arduino, rather than pay $80 for the second remote. I'll let you know if I have any success.

-J

[DonL]

If it is twisted pair it may be RS422.

Are you wanting to build one ? Why reverse engineer it ?

The protocol that it uses will depend on the type of CPU that it uses.

[DonL]

I’m wondering if anyone has reverse engineered Takagi’s TK-x remote control protocol. Takagi uses a twisted pair for remote communication with any of the TK series tankless water heaters out to a TM-RE30 remote controller. The TM-RE30 is able to report inlet and outlet water temperature, flow rate, set point, time, and error codes. Up to this point I have only checked for the presence of DC (measured at about 15VCD) and the presence of an AC signal in the mV range. I have yet to put a oscilloscope on the line to determine the frequency of the AC or to capture any signaling. My interest is in integrating this information into a centralized residential energy management system.

You may find that Takagi uses a Honeywell protocol.

This may be some nice reading for a energy management system integrator.

http://www.prosoft-technology.com/co...M.OO.01.EN.pdf

The Honeywell stuff is good.

[LLigetfa]

Does the remote have a FCC ID? If so, you might be able to find some info on the FCC site. It's amazing how much one can glean from the FCC submissions. Barring that, if you (the OP) purchase and disassemble a unit, you might be able to identify the chipset used if they didn't sandblast or encase it in epoxy. There could be two-way communication so you may need to have one anyway if you want to eavesdrop on the conversation.

One time I was emailing back and forth with an engineer at Carlon (Lamson & Sessions) trying to get some technical details for off-label use of one of their products. They were giving me the hard line of it being "proprietary" information to which I showed them a link to what was on the FCC site (99%) and I just wanted the last 1% of details. It didn't help.

Sounds like an interesting project. The 15VDC is probably to power the remote and if it is a single twisted pair then that narrows down the list of communication protocols.

[Jim Evans]

The two wires have 22VDC on them. The heater unit blindly transmits a 20 bit packet 5 times a second at about 500bps burst. Just roughly looking at the bit patterns on the scope, I'm guessing it alternates between two types of packets. The remote, if connected, responds after every other packet with a 20 bit packet of its own. I'm not sure of the bit encoding, it does not have the distinctive look of I2C or the Honeywell protocol.

I'm guessing it's just a simple proprietary frame, with the bit encoding being a .5ms pulldown for a 0 bit and a 1.5ms pulldown for a 1, repeated at 500bps. It could be some PSK encoding, but I don't think so.

That's as much as I want to do with the 'scope. Next time I have time to sit down with it, I'll have an Arduino dump the frames and start looking at what the fields are in it and how it's encoded. I'm sure it's simple.

[Jim Evans]

PS: in the second picture, the first, higher-amplitude packet is the transmission from the heater. The second, lower-amplitude packet is from the remote.