logo elektroda
logo elektroda
X
logo elektroda

Internet module ecoNet 300 and ecoLINK2

jamrjan 143979 609
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
  • #61 18211044
    miszko
    Level 15  
    More or less such parameters when ripping:
    boiler temp: 57.59
    Burner temp: 29.23
    return temp: 54.85
    flame: 42:
    blowing: 15
    Boiler power: 8.48


    Written in ASCII.
    I changed the minimum temperature of the boiler in the range from 50C every 1 degree to 55C and the return immediately to 50C.
  • ADVERTISEMENT
  • #62 18211188
    maslak
    Level 14  
    You can see from the logs that the parameter number goes to 4byte from the end and the value to 3byte from the end of the shipment. 4-6-4 hysteresis
    68 0e 20 45 51 3c 20 56 05 01 08 06 12 16
    68 0e 20 45 51 3c 20 56 05 01 08 04 10 16
    53-60-53 set temperature
    68 0e 20 45 51 3c 20 56 05 01 2d 3c 0d 16
    68 0e 20 45 51 3c 20 56 05 01 2d 35 04 16
    80-85-80 max boiler temperature
    68 0e 20 45 51 3c 20 56 05 01 2f 55 66 16
    68 0e 20 45 51 3c 20 56 05 01 2f 50 63 16
  • #63 18211426
    przemo_ns
    Level 11  
    Does this touch panel work as a room regulator?
    If so, could you make logos showing the temperature he measures?
    I wonder if it only gives the temperature to the controller or keeps the set temperature in the apartment at home and sends stop and start commands in order to achieve the temperature in the room by the stove, but I bet that it only measures the temperature and gives it to the controller. I would be interested in the log as the temp of the touch panel increases from below to above the set room. Only in the manual I found: The room panel with the thermostat function for the boiler should be turned off when the entire central heating installation of the building is supplied by a mixing valve with an electric actuator (this is what I can not use a room panel?). Someone kaman what's going on? So when can a room panel be used?
    NOTE in the post above, it miraculously changed the 00 bytes to 20
  • #64 18211459
    SławekSS
    Level 24  
    maslak wrote:
    Pt1000 as a weather forecast, it was not a decade in ecomax830 and it showed 25 ° C at 1000ohm.
    I wrote that pt1000 is CT6-P and in some ecomaxes it is like this (I have the same ecomax860P2) and in some there is CT4-P and this is KTY81-110
  • #65 18211542
    miszko
    Level 15  
    przemo_ns wrote:
    I wonder if it only gives the temperature to the controller or keeps the set temperature in the apartment at home and sends stop and start commands in order to achieve the temperature in the room by the stove, but I bet that it only measures the temperature and gives it to the controller. I would be interested in the log as the temp of the touch panel increases from below to above the set room.


    The stove controller can choose from (in my case) 3 operating modes: two are built into the controller and the third one is ecoTouch. Then "ecoTouch" supposedly becomes his "eyes". It can work in some modes (winter, summer, schedule, comfort, domestic hot water heating, house ventilation, etc.). In this mode, in which the control is based on the set temperature in the house, it works in such a way that the ecoTouch itself measures the temperature itself. If it falls below the set value, it starts the furnace. If the temperature in the house is higher, the stove is stopped. There is a hysteresis for this, for example 1C, so if it is 19.5 at home and the ecoTouch setting is to be 20C, it will not start the stove. In this operating mode, ecoTouch practically commands what the controller should do. In my opinion, the action logic is here, and ecoTouch only "triggers" the start. Of course, the stove controller has its settings for maximum temperatures and probably if there was no heat reception, and ecoTouch would indicate that it is too cold, the stove will end up idle (it will reach the set boiler temperature + hysteresis). So if I have a hysteresis on the 5C boiler, the boiler temperature is set to 53C, when it reaches 58C and there is no heat reception, it will start the putting out procedure. Then it will wait for the boiler temperature to drop to 48C (53C - 5C hysteresis) and then fire it up again. If, of course, ecoToch keeps saying it's too cold. If not, then the stove will simply stand (and here, if there is no supervision - it will light it there from time to time) or if it has the DHW additional heating mode on, then if the temperature dropped there, then it would also fire the boiler, but after it is only to heat up the DHW.

    In general, the logic is extensive here and it all depends on what is installed. I use ecoTouch mainly as a home stove control. I do not use temperature measurement, because the room with this panel is not a good place. I have a relatively stable temperature in this room and the radiators are almost closed. And it would be cold in another part of the house.


    I don't know if you want, I can switch to ecoTouch mode and then you would see, but I need to have a little more time.

    I will add that STX 0x68 is sometimes not a good choice. You have to look for STX + frame length and CRC and then decode everything.
    Yesterday I had a situation where he suddenly stopped drawing charts. It turned out that the data matched that the first two hexes occurred somewhere in the string, and the parser was taking the wrong starting point. I reworked the script a bit, but I will follow my colleague's track, who did it nicer (mine was mainly POC) so that the charts were drawn to me and the code did not offend with its length.

    As for sending packages, I will also try to write something today in the evening and send it to the driver. We'll see.

    Last but not least, I called a service technician in the area, but the wheel is very stiff. He did not want to give a batch, at most I can come update to do it. Maybe it would have been easier on the spot if he had been and deleted PLN 350, but I didn't have time to visit him and so I can't make an appointment with him.
  • #66 18211543
    przemo_ns
    Level 11  
    To SławkaSS Well, I also edited my post back then and decided that I really should have a KTY81-110. Do you have a room regulator? How should it look like with him? From what I understood, how is a 4-way valve - and WHAT goes from the mixer, the room regulator cannot control the boiler, but it should control the mixer through module B? Miszko, how do you have your installations? Like me, the 4-way valve releases CO?
    I wonder what with the remark that then the regulator should not control the boiler, but the mixer.
    I had the opportunity to do a rip from connecting EcoNet to the server, but only connections to Econet24 (TLS), nothing to the server with updates. Unfortunately, I did not get bugs from a friend from the forum about stoves, so far ass.
    The flaws I had analyzed for bank loading are AES128 encrypted. We are left to play with ChipWisper, unless something from EcoNeta can be extracted. It would be best to rip the Econet firmware, but you need art for the day to play.
  • #67 18211689
    SławekSS
    Level 24  
    I do not have an ecoster, I do not have a room regulator because I do not need them. I also do not have a 4D valve, but I do have a 3D one :)
    The 4D valve is designed to protect the return and at the same time regulate the temperature of the central heating. Unfortunately, these two things cannot be reconciled.
  • #68 18211710
    miszko
    Level 15  
    przemo_ns wrote:
    Miszko, how do you have your installations? Like me, the 4-way valve lets out CO?

    I don't have any valve ;) I have a fairly simple installation. The stove was converted from eco-pea coal to this. The valves were planned, but first the house was insulated and the stove was replaced (i.e. I want to associate it with this clean air program).
  • #69 18259872
    coorass
    Level 11  
    I've had a while lately so I've tweaked my script a bit:
    a list of changes:
    - improved frame detection (now frame is valid if it has borders within 16 68 and has correct CRC)
    - CRC calculation fix
    - decoding frames in 4 ways simultaneously (helpful for value matching by trial and error)
    - writing out already guessed values
  • ADVERTISEMENT
  • #70 18270991
    kashue
    Level 11  
    Hello.

    Yesterday I was able to get sysupgrade from MR-3020-v3 router.
    I suspect that by flashing the router with full official openwrt and then sysupdade, we should have a copy of econet ...
    After unpacking with the bin you can see the construction of the web server and all .py scripts that communicate with ecomax.

    In the attachment bin.
  • #71 18271159
    miszko
    Level 15  
    Thanks! To bother less, I unpacked what I needed ;) The entire content of the extracted batch in the file below. In / var / www / you can see what you need.
    The filesystem on which it is saved is squashfs, and here it is not surprising. In the largest file, after a quick study, the frame values are almost at the beginning. They coincide with what we see and what we have come to. I haven't explored it yet, I'm curious how they read from this USB. Moving on, it's not a problem, even maybe it will upload all this soft to another tplink and make it a server like you noticed.

    Of course there is one "but". When registering the device on the website, you must enter the serial number of the device and it cannot be paired with the official website.

    While browsing the files, I saw sections related to the unit upgrade. This is another thing to review ;)
    EDIT:
    After a quick look at the files, you can see more information about the update in the config.py and regSoftUpdater.py, but it looks like
    the update is not FTP, but HTTPS.
  • #72 18271655
    maslak
    Level 14  
    I made a test applet with an attempt to download a file based on the data from miszko logs. It returns server status 200, but there is no download file, unless something is wrong :)
  • #73 18271996
    miszko
    Level 15  
    From what I have read, he constructs the following address:
    https://econet24.com:443/ecosrv/default/getControllerSoft/?uid=STRING


    Whatever you put in a string, the server will reply 200. This string is listed above in these functions. Probably the whole thing is the correct counting of this string.
    I didn't have any more time to talk about it today.
  • #74 18272081
    maslak
    Level 14  
    Well, this script, which I have uploaded, only counts that I took the wrong input data should be:
    message = "\ x68 \ x2b \ x00 \ x00 \ x45 \ xfc \ x14 \ xb9 \ x00 \ x33 \ x00 \ x0b \ x00 \ x0d \ x00 \ x0a \ x0e \ x38 \ x35 \ x30 \ x34 \ x59 \ x36 \ x33 \ x00 \ x02 \ x00 \ x0d \ x65 \ x63 \ x6f \ x4d \ x41 \ x58 \ x39 \ x32 \ x30 \ x50 \ x31 \ x2d \ x4f \ x39 \ x16 "
  • ADVERTISEMENT
  • #75 18273092
    miszko
    Level 15  
    Why are you using this "message"? How does this affect UID generation? I don't really understand, I was looking at the source code, but at the moment I don't see the connection.
  • #76 18273363
    przemo_ns
    Level 11  
    In ecomax.py you have FRAME_GET_UID_ANS = '\ xB9' definitions, and then you have frame analyzer functions and you can see that the command code is 8 byte
    Code: Python
    Log in, to see the code

    I looked in your logs for a frame with such an identifier on 8byte and substituted for the function that analyzes the received UID, i.e. to self.parseUID () if you suspect the variables with some python debugger in this function, these even parse nicely and e.g. reg_name takes the string 'ecoMAX920P-O'
  • ADVERTISEMENT
  • #77 18274729
    maslak
    Level 14  
    Kashue, you could also upload the contents of this file with decoded current parameters as it looks in the econet. Thanks in advance.
  • #78 18287530
    przemo_ns
    Level 11  
    Could someone who has econet do rs485 communication and the appearance of this file from econet with the current received parameters, I looked a little through these server files and it turns out that after turning on the power supply, a parcel with a list of parameters about 270 consisting of the parameter number and its parameter is sent from ecomax size (bit, byte, etc.) according to which the lists are then dropped the parameters analyzed by us from the driver, the problem is that I did not find a list of descriptions for these parameters, and since such a file is generated in the econet, it must take descriptions from somewhere, as if they are some descriptions in python and js files, but here parameters are sent with an index of e.g. 1500cos and I have not seen such a large list with descriptions.
  • #79 18288086
    SławekSS
    Level 24  
    kashue wrote:
    I suspect that by flashing the router with full official openwrt and then sysupdade, we should have a copy of econet ...
    I flashed the router with the official openwrt (openwrt.org/snapshots/targets/ramips/mt76x8/openwrt-ramips-mt76x8-tplink_tl-mr3020-v3-squashfs-tftp-recovery. bin) and uploading this screenshot (eco-mr3020-v3-3.23020 .3678-em-fda69db834b649919bfeeecd8d955327.bin
    ) as upgrade crashes the error that the file is inappropriate. I was uploading both via tftp (the router restarts non-stop) and via telnet or Puffy claims that the file is not from this router.
    What am I doing wrong?
  • #80 18288371
    miszko
    Level 15  
    What hardware version do you have of this mr3020? Secondly, what will clone do for you? You will not have access to their page, because you need to enter the serial number of the device and only let it pass.
  • #81 18288418
    SławekSS
    Level 24  
    mr3020 v3.2
    UID device serial is generated by the driver after connecting econet
    Internet module ecoNet 300 and ecoLINK2
  • #82 18288475
    miszko
    Level 15  
    And that changes things. Have you tried to extract only squashfs from this binary and upload it?
  • #83 18288492
    SławekSS
    Level 24  
    No, I haven't tried :) I don't even know how to approach it. I'm just getting started on this topic. I uploaded openwrt for two days :( I couldn't connect to the router via tftp, but finally succeeded :)

    Tell me how, I will fight.

    and this binary, from econet to what boiler? Because some are customized and may not connect to the controller, e.g. for Kostrzewa, metalfach, boiling, pellas, Lazar, they must be for these boilers
  • #85 18288784
    SławekSS
    Level 24  
    Thanks, I'll fight tomorrow. I have no idea where to start, but ... it's never too late to learn :)

    I can see it is based on the openwrt 18.06-SNAPSHOT ramips. I played the same but with the LuCi GUI
  • #86 18288810
    miszko
    Level 15  
    As for me, I think you can run on any tplink that openwrt / lede hit. There is a WWW server (/ www) and some files uploaded to different places. So wading on - prepare a clean openwrt, lose the differences and see what happens ;) As for me, there is a good chance. Worse, when the UUID is somehow generated from something that determines the device (read - it is able to trace that this is a different HW).

    I set up a WWW server, mysql base, php-fpm on a static tplink with uploaded openwrt / lede, plus scripts and make a "computer" for the stove too small for me.
  • #87 18289340
    SławekSS
    Level 24  
    Hi
    Successfully uploaded this image .bin econeta posted by @kashue.
    the upgrade had to be forced, and as I had nothing to lose, I took a risk.
    Now I have an econet that connects to the econet24 server

    Internet module ecoNet 300 and ecoLINK2


    I tried to enter via SSH but it asks for a password, unfortunately it is different than to the website
    Internet module ecoNet 300 and ecoLINK2 Internet module ecoNet 300 and ecoLINK2
  • #88 18289350
    miszko
    Level 15  
    Give info. How did you force the upgrade? Any additional flag to tftp? Or a link to the faq. I'm going to buy mr3020 today :)
    Has any UID been generated?
  • #89 18289366
    SławekSS
    Level 24  
    I forced the upgrade by updating the router's openwrt website.
    As I wrote, I uploaded openwrt version 19.06 (probably, but certainly 19.x) with LuCi GUI. After logging in to the router, there is an upgrade option, I substituted this .bin file with @kashue and update, a message popped up that the file does not match, not for that, etc. But there was the "continue anyway" option, I confirmed all these warnings that yes, I know, I agree, etc. It played and the router started as econet.
    Now I have to connect to the driver, but it is at a different time. I have a long way to the cauldron, I have to go to it.
  • #90 18289439
    webster21
    Level 12  
    Gentlemen, reading your posts, I must congratulate you for great fun and work :) Has anyone ever had fun sending a signal? (e.g. control of the set temperature)? I am waiting for the router :) just the question is it possible to have an ordinary adapter or do you need to buy ecolink2? From what I have seen, the adapter does not really want to cooperate with the Tplink econet. And if you accidentally want to connect to Econet24, you do not need to provide the UID of the boiler controller? :) But estimate for the work done for the scripts - it is possible that I will be tempted instead of econet24, maybe domoticz or blynk. There are many possibilities :)

Topic summary

The discussion centers on the ecoNet 300 internet module and the ecoLINK2 interface used for communication with central heating controllers, particularly Plum-manufactured ecomax series boilers. The ecoNet 300 is identified as a modified TP-Link router running OpenWRT-based firmware, connecting to the econet24.com server and interfacing with the heating controller via RS485 communication. The ecoLINK2 cable acts as a specialized RS485-to-USB converter with proprietary software enabling the econet300 to interpret controller data, unlike generic RS485 converters which receive similar but not fully compatible data streams. Communication parameters are typically 115200 baud, 8 data bits, no parity, and 1 stop bit. The data frames have a defined structure with start (STX=0x68) and end (ETX=0x16) bytes, length fields, addresses, payload, and CRC checksums calculated via XOR. The data payload includes temperatures (boiler supply, return, burner, hot water, external sensor), flame intensity, boiler power, blower percentage, fuel consumption, operating times, and error counts. Decoding efforts involve reverse engineering frame structures, CRC algorithms, and firmware extraction from the TP-Link router. Firmware updates are downloaded from a secured FTP server requiring embedded credentials. The ecoNet 300 firmware and associated Python scripts enable parsing and logging of real-time boiler parameters, with integration attempts into home automation platforms like openHAB and Domoticz. Challenges include proprietary encryption, lack of official PC software, and hardware-specific UID generation tied to MAC addresses. Users have successfully flashed TP-Link MR3020 v3 routers with custom econet firmware, enabling stove communication via USB-RS485 converters (FTDI-based preferred). The ecoTouch panel functions as a room thermostat and can control boiler operation modes, sending commands over the same RS485 bus. Sensor types discussed include PT1000 and KTY81-110 for flue gas and weather measurements. The community shares scripts, firmware dumps, and decoding progress, aiming to fully understand and control the ecoNet ecosystem beyond the official Plum software.
Summary generated by the language model.
ADVERTISEMENT