Genuine Vitotrol 200A reverse engineered

[MarenB]

Guess what arrived yesterday :)

There is no dedicated M-Bus chip on this PCB, they solved with a couple of standard components. It's connected to the µC (Renesas UPD78F0455) via Pins 62 (TxD0) and 63 (RxD0).

The circuit doesn't block TX being received by its own RX, so keep that in mind when looking at the RX records, those are foreign and own data.

[MarenB]

I configured it for heating circuit 2 and set the according parameter A0 at my heater to 1.

This is TX:

Heater switchted from hot water only to off via the remote:

And back from off to hot water:

And this is RX:

It's seems to me, that the traffic increased a lot.

[dumpfheimer]

is it a 3.3 or 5v chip?

[MarenB]

I did not supply it externally with power, but it seems to be 5v tolerant on uart at least for a while ;)

[dumpfheimer]

You know your way around low level stuff..? You think you would be able to pull the firmware from the chip?

[MarenB]

My skills might be sufficient, but I think I don't have the rquiered tools available.

https://www.renesas.cn/zh/document/apn/78k0lx3-flash-memory-programming-programmer

Unfortunately I can't finde the datasheet anymore that I used to identify the UARTS. Might have it still in my downloads folder at home.

[MarenB]

Maybe the authors of https://github.com/openv/openv/wiki/KM-Bus still have the firmware? It was mentioned it can be downloaded using epromm-programmer...

[dumpfheimer]

I now have a modbus master. This made things much easier. I think I got the twist on the 3F BF commands.