Internet module ecoNet 300 and ecoLINK2

Question

Hello I got the ecoNet 300 internet module. After connecting to the network, it works (it reports itself as the Plum module) - i.e. it connects to the econet24.com server, in the diagram tab - the central heating installation diagram is visible. Unfortunately, I do not have an ecoLINK2 cable for...

iron64 · Answer

I think that's the wrong section for such a question. There are many specialists in this forum, but this imho question is not related to computers, and if you were you, I would ask the moderator to be transferred to the appropriate section.

kamka27 · Answer

Hello, do you have the ability to read the firmware from the memory of this module?

jamrjan · Answer

If you write in what way, I may be tempted to read

kamka27 · Answer

You need a flash memory programmer, desolder the bone and read it. Maybe you would like to resell this router?

jamrjan · Answer

I have a programmer, but I will not desolder,
Besides, I guess so smd.
The router itself downloads the software from the network (updates).
When I used MicroTik as a router, I had logs of what and where it is downloaded from.
Unfortunately, I have been using LTE for a year and this equipment does not have such possibilities.

At the moment, I have bought a cable and connected it to the stove.
The router itself can be purchased.

niewiem9 · Answer

Hello, I will dig up the topic a bit. I have an ecoNet 300 and ecoLINK2 internet module and an ecoSol500 controller. Unfortunately, the ecoNet300 does not see wi-fi despite entering all parameters correctly in the controller

SławekSS · Answer

Updates are downloaded from the ftp site: /plumconnect.net login and password are needed, which is embedded in the firmware

jamrjan · Answer

Hello

From what I remember, the wifi settings can be done over ethernet.
The address is taken from dhcp. After connecting via lan, you can try to configure WiFi. Important note here WiFI - SID distinguishes between lower and upper case letters.
A SID named "My-WiFi" is not the same as "My-WIFI".

miszko · Answer

Hello,

RS485 intercepted the communication sent via the G2 port from the controller to the econet module.
The connection parameters are very standard: speed 115200, data bits 8, stop bits 1, parity none.
The controller transmits continuously, so the data is flying all the time.
It seems to me that the data for connection is ok, because I can see the name of the touch module in the packages, which I gave myself (OFFICE)
and the name of the device (ecomax 920). So if I can see the text that I can read it, the parameters are probably good for transmission.

I read all the data from the display and noted it from the side (temperatures, flame, boiler power).
The boiler was working in fairly stabilized conditions, but the temperatures changed (quite slightly, but still).

In all communication, I found that there are 3 types of packages, but one of them is the largest (361 bytes).
There is a repeating data structure in it and only selected cells change.
However, I can't figure it out right now - i.e. translate it into values read from the furnace.

Maybe someone wants to help? I am sending a package, and in it packages are discussed and the entire record of the intercepted transmission.
In addition, temperature data readings from the display.

Observations show that it is not transmitted via modbus (the CRC sums do not match). At the end of each package you can see that there must be a cheksuma
the whole package. And at the beginning of the package you can see that the values are changing there and I suppose that the data in question is here.

I will add that exactly the same is sent on the port to which room control panels (ecoster touch) are connected.
Data appearance and structure are the same.

coorass · Answer

miszko

Were you able to read this data?
i have the same driver
I tried to connect it via usb because I have no other way to do so so far

reports to me as

[ 6462.615550] usb 1-1.3: new full-speed USB device number 6 using dwc_otg
[ 6462.718652] usb 1-1.3: New USB device found, idVendor=03eb, idProduct=2404
[ 6462.718675] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 6462.718689] usb 1-1.3: Product: ecoMAX920P1-T
[ 6462.718701] usb 1-1.3: Manufacturer: Plum Sp. z o.o.
[ 6462.719957] cdc_acm 1-1.3:1.0: ttyACM0: USB ACM device

on ttyACM0 it throws out some data right after connecting it then goes silent

maybe someone knows how to talk to him?
what is the interface?
rs485?

SławekSS · Answer

Yes, there is rs485. To read / decode this data, you need to know the frame structure. Without it, this data is useless

miszko · Answer

Yes, there is rs485 and data parameters as I gave.

As far as I know, the USB port is only used for updating the on-board software. Nothing is connected to this port (I'm talking about the ecotouch or econet panel). For this there are G1 and G2 ports which are respectively GND, D-, D + and 12V. G2 has 5V instead of 12V. G1 is for connecting the ecotouch panel and G2 to the econet. Exactly the same data goes on G1 and G2.

Yes, you need to get to the frame structure or find some anchor point. I thought that maybe there are no temperature values in the frame, and the Ohm readings and based on the values in the controller (there are nominal values in the manual) only then displays the appropriate temperature.

I am still trying to find a frame diagram here.

coorass · Answer

How did you get into this port? Some kind of converter or ordinary cable?
From your post I conclude that you have econet300. For me, there is no communication at all on this port, the driver probably sits quietly for this, because I do not have an econet module.
You would be able to intercept the communication as soon as the econet is connected. I suppose there is some handshake - specific code when connected that will say more about the connection than looping status sending

SławekSS · Answer

I don't know much about it, and maybe there will be some hint here there is not much here, but maybe you will catch something :) Maybe such passwords will help you GAZ-MODEM, GAZ-MODEM 2, GAZ-MODEM 3,

miszko · Answer

I do not have econet, I only have ecotouch (it works when I was taking readings from the G2 port). There is the same transmission on both ports (G1, G2), at least for me. Rather, there is no handshake. There is simply the address of the device, which, as I guess, can be seen in communication as a separate data packet (it is probably 10 bytes). You can see it in communication, download the zip from my previous post and there is a file with a record of about 5 minutes of what the port sent. Since this is rs485, I assume that they did not combine and kept the rules of this bus. Although maybe that's why it flies with me because I have ecotouch and maybe they have actually set up a handshake. Hence the active ports and continuous communication.

I am using an ftdi ft232 based konwer with rs485 output and usb on the other. I bought from alledrogo (auction number 7126998882).

My plan assumes that if I can choose the data, I will write a web server plus login and connect it to the Raspberry pi on which I will host this service and it was constantly connected to the driver to receive data.

I thought that I can unplug the ecotouch and see if the data will continue to fly and what impact it will have (if it continues) on what is in the data packages sent by the driver.

coorass · Answer

It's a good plan

My plan is to integrate this driver with the domotics in which I already have lighting at home, the far plans include the integration of the alarm installation and the google assistant with all this, but I'm not in a hurry with it because the assistant has just started speaking Polish.

Let me know if the driver sends you data without ecotouch

miszko · Answer

I looked at this GAZ structure, but in this case there are too many variables. You don't need that many here, but it may lead you to a trail.

miszko · Answer

I hooked up to the G2 port again. During the operation of the stove, I read what the controller is spitting on this port. It was like always.

Next:
20.24:42 shutdown of the stove (you can see that the last packages are already wrong)
20.24:52 on without ecotouch
20.26.42 shutdown
20.26.58 inclusion With ecotouch

The G1 and G2 ports were always active, no matter if there was something plugged into them or not.
Ecotouch makes no difference to port activity.

I have not analyzed the differences yet, the main thing is that the name OFFICE in packages is no longer present, which was expected.
After all, there is no panel on the network.

In the packages you can also see what is happening at the start of the device. Some small packages are going - it is possible that someone will see something somewhere.

coorass · Answer

Miszko - any progress in decoding? I bought this rs485 -> usb converter and fumbled a bit in what the stove sends out, but unfortunately I did not find anything that would indicate the frame structure. I am beginning to assume that this is meaningless data, and to read something specific from the driver, you have to ask it.

Maybe someone from the honorable forum members is able to suggest whether the ecolink2 interface (the one attached to the econet300 set) is an ordinary rs485-> usb converter or maybe something more? I have seen such a cable on the Internet, but the cost is 160 PLN, so it is not worth buying just to check what is different from the converter for 30 PLN

I am also puzzled by the fact that after connecting the econet to the stove controller, the option to configure wifi appears in it.
you can see it in this video: https://youtu.be/HjG9TaWmz2c?t=82

jamrjan · Answer

Hello

Ecolink2, the one attached to the econet300 set - this is an rs485 converter, but unfortunately its soft is something more than an ordinary converter.
Connection: The controller - Ecolink2 - Econet300 - establishes the connection and transfers the data to the router.
Connection: Controller - RS485 converter - Econet300 - unfortunately no connection.

However, a curiosity
Connection: Controller - RS485 - PC converter (via USB) allows you to read data from the controller (the controller transmits without interruption)
Connection: Controller - Ecolink2 - PC (via USB) exactly as above.

Unfortunately, there is so much data that it is impossible to compare them. especially since the controller transmits via RS485 even in the off state.
The data is almost identical (Ecolink and RS485), unfortunately "almost" makes a difference.

Somewhere in the software or the Ecolink2 identifier there is something that allows the Econet300 to interpret the data.

coorass · Answer

I have already checked this and failed in an attempt to interpret this data And does the stove controller recognize econet / ecolink with such a configuration? After almost a week of fighting with an ordinary converter, I started to suspect that there must be something special about this cable, but there are no sources on the Internet from which you can learn something specific about this cable.

miszko · Answer

This module in econet is simply a modified tplink router, which has a transmission from the rs485 port in the furnace controller (ecomax) plugged into the USB port.
The scheme of these packages looks quite stable, so I think that simply the modified software of this tplink can read these packages.
I do not know the possibility of extracting any information from this firmware, maybe someone will succeed in it someday, but I would aim to simply work out the schematic of this package sent via the rs485 port in the ecomax driver, to which we connected with this rs485-> usb-> comX.
The data looks quite "repetitive", but a permanent group of them is changing all the time. It is possible that certain values are counted or reported based not on the temperature (e.g. 53C) but on the resistance / voltage reading of the element that is reading and transmitting as such. This implies that in each element of the system there must be some array, such as 1000Ohm is 0C, but that's not a problem.

I haven't had time this week to look at it, so I don't have any new insights, but I'm not giving up.

coorass · Answer

It would be nice to have a look at the firmware of this tplink, it would probably save a lot of time.

I saw a similar thread where the gentlemen recently worked out a slightly different stove controller, I recommend reading, maybe someone will lead you to the trail how to get to ecomax ( Link )

By the way, I also checked other connection parameters and at any speed you can read the data, but they differ radically.
at 9600 it is something like this:

00000000007fffffebdbdbdbdbf70000c400000000f7b573dbdbdbdbf70000c4
00000000f773dbdbdbdbf7000084000000007fff73dbdbdbdbf7000084000000
000000f7f3dbdbdbdbf70000c400000000f77fdbdbdbdbf70000c400000000f7
63dbdbdbdbf70000c400000000f7ebdbdbdbdbf70000840000000000007fed63
dbdbdbdbf700008400000000f7e3dbdbdbdbf700001f00000000f767dbdbdbdb
f7000000c400000000f776c6dbdbdbdbf70000c4000000000000f763dbdbdbdb
f700008400000000f763dbdbdbdbf700008400000000f7ebdbdbdbdbf70000c4

and at 19200:

1f23e5ecc6df32f9e5502ece2e2e2e2e2e2ededcdcecfaffebfb00000f00ac
f74c000b00070007001f23e5ecc6df1276402ede2e2e2e2e2e2ededcdcecfaff
ebfb00000f007af7cc000b00070007001f23e5ecc6df32f5e5402ef62e2e2e2e
2e2ededcdcecfaffebfb000f007af7cc000b00070007001f23e5ecc6df3216c5
402ee62e2e2e2e2e2ededcdcecfaffebfb00000f007a5a8c000b0056000b0007
0007001f23e5ecc9df3256d5502e8d2e2e2e2e2e2ededcdcecfaffebfb00000f
007af7cc000b00070007001f23e5ecc9df3246d5102ec62e2e2e2e2e2ededcdc
ecfaffebfb03000f007af78c000b00070007001f23e5ecc9df120ef5402ea47f
2e2e2e2e2ec8dedcdcecfaffebfb000f007a508c000b00070007001f23e5ecc9
df122d002efe2e2e2e2e2e2ededcdcecfaffebfb000f007af9cc000b0056000b
00070007001f23e5ecc9df323732102e182e2e2e2e2e2ededcdcecfaffebfb00

and at 115200:
here you can see the repeatability for '0x1f' where largely the beginning is 1f1d and the end is 8685
yesterday I left the recording overnight and in this pattern of 'frames' I caught about 4500 (about 8h)

1f1d26efff37efff7ff9cd536f86f5eff2ffff59d61df33fef6bef11ee87de01c201c22deb0deeffffffffffffffffffffffffffffffffffffffffffffffffa367e7f63fd9c67b77ff6b7b8f31da7bbf3e7ffa7fc296edfdff7f02ffff7f0261b6f5fe9776e3f6ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f027dffa9ffd391ffffffffffbbbbffffffffbbbbffffffeffff7ffe7e7ffffffffffefefffffffffefefffffff7f0e02ffffff35fbfffffffffff3ffffffffffff0df1e9c55ffdffd9fffffffffdfffffffffffffffdffff4bffffffffffffffff69fa69fd6df7fdfee3ffcbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff8fd30069ef5f7553d2ebbfa600e9dbff5f09d2edae6d6575fdf18d39e2fbe1f5ebd3fffffffffffb536f8685

1f1d26efff37efff7ff9cd536f86f5eff2ffff5bd61bf33fef6bef13ee87de01c201c22deb13eeffffffffffffffffffffffffffffffffffffffffffffffffbb0ae7f6df36c67b77ff6b7b8f31da7b5f027ffa470b4b7bffff7f02ffff7f02af5df5fe8feacaf6fdff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f027dffa9ffd391ffffffffffbbbbffffffffbbbbffffffeffff7ffe7e7ffffffffffefefffffffffefefffffff7f0e02ffffff35fbfffffffffff3ffffffffffff0df1e9c55ffdffd9fffffffffdfffffffffffffffdffff4bffffffffffffffff69fa69fd6df7fdfee3ffcbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7bd30069ef5f7553d2ebbfa600e9dbff5f09d2edae6d6575fdefe539e2fbe1f5ebd3fffffffffffb536f8685

1f1d26efff37efff7ff9cd536f86f5eff2ffff5dd619f33fef6def13ee87de01c201c22deb1beeffffffffffffffffffffffffffffffffffffffffffffffffd799e7f6ef6bc67b77ff6b7b976fda7b4f717ffa370f4b7bffff7f02ffff7f02e5d6f5fe43cecef6fdff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f02ffff7f027dffa9ffd391ffffffffffbbbbffffffffbbbbffffffeffff7ffe7e7ffffffffffefefffffffffefefffffff7f0e02ffffff35fbfffffffffff3ffffffffffff0df1e9c55ffdffd9fffffffffdfffffffffffffffdffff4bffffffffffffffff69fa69fd6df7fdfee3ffcbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff33d30069ef5f7553d2ebbfa600e9dbff5f09d2edae6d6575fdefc339e2fbe1f5ebd3fffffffffffb536f8685

miszko · Answer

Looking and extracting something from the firmware of such a tplink also requires a lot of knowledge, it is after all a sequence of binary data. Of course, probably someone would be able to say something more.

As for your requests at different speeds, I've tried to do so too. Only with 115200 I had the name ecoMAX 920-p1 and the name OFFICE visible in some of the packages.
Since I read the blocks written in plain text, I found this speed to be good. I also found in some materials from the producer of this driver from PLUM that there was an open parameter regarding the speed of this prot, i.e. the mentioned 115200, which was the default value.

Thanks for the link, I'll read it.

davidcie · Answer

Colleagues, something more happened with the decryption of this communication? Or maybe I would try from the other side, i.e. from what I saw in the ecoLINK2 manual, the driver and probably the panel seems to use the ATmega processor. Maybe it wouldn't be stupid to try to dump flash and go a bit and try to decode what it's doing?

I am interested in the topic because the ecoMAX810P3-L Touch controller is in the furnace, which we will be installing in the fall, and it would be nice to be able to operate it at least a little with openHAB. For now, I am at the stage of looking for an ecoSTER TOUCH panel for it at a good price, and it promises to be fun for long winter evenings.

przemo_ns · Answer

From the Miszko logs you can see:
1Byte - STX = 0x68
2Bytes - flax
(len -6Bytes) = data
2Bytes crc
1Byte - ETX = 0x16
crc nothing came to me, you could download the firmware from EcoNet and bury it, but there we'll probably only find crc checking because it probably only transfers to the appropriate server, but maybe it would be possible to get ftp passwords and download firmware updates from the driver and maybe something take it out of it, ATMEGA on the bank is secured against reading so you will not get anything from it. If someone was from the vicinity of Ostrów Wlkp and had EcoNet, I can play it.

Added after 5 [minutes]:

Oftop and ecolink do not provide a PC software that displays data? The protocol can be drawn more easily from it.

Added after 11 [hours] 2 [minutes]:

68 25 00 00 50 fc 15 89 54 49 4d 45 14 17 36 e3 07 02 06 03 0d 3c 00 00 00 00 00 00 00 02 56 04 aa 3d 1b 3d 6e 16
TIME frame
STX = 0x68
len = 0x0025
? = 00.50
fc, 15-common or fc, 14 some identifier?
? = 89
54,49,4d, 45 = TIME
14 = 20 o'clock
17 = 23 minutes
36 = sure sec
07e3 = 2019
02 = February
06 = day
?? = 03,0d, 3c, 00,00,00,00,00,00,02,56,04, aa, 3d, 1b - what repeats some frame, sensors?
crc = 3d, 6e
etx = 16
What sensors do they use? It is best to connect permanent equivalents in their place and change the values individually and check which fields to change.

przemo_ns · Answer

Fragment with readings:
time: 12:33
boiler temperature 55.1C
feeder temperature 26.5C
return temperature 49.8C
flame around 82%
boiler power 8.5kW
blowing 22%

Log in, to see the code

Well, then there are the remaining fields of the structure and determining the sum of crc

Added after 2 [minutes]:

If someone has soft for ECOLinka2, let it zapoda.

miszko · Answer

I hang a beer. In fact, in these places, reading backwards and composing this hex, then converting it to float, we get these values.
Why do you have to read it backwards?

The next data are probably other data, such as the number of hours of operation on a given boiler power, the number of boiler ignitions. Of the most important things, it was possible to extract the percentage of blowing and boiler power. The latter value can be taken from another parameter. The controller indicates how many kg / h it is feeding fuel. Knowing this parameter plus conditions (such as airflow), it is possible that they calculate this power from the formula.

I don't have ECOLink2, I have ecotouch, but that's probably not what you mean, more probably about extracting data from the controller.
Theoretically, it could not be dumped, and wireshark pulled out communication, maybe after https / ftps it does not go ...

przemo_ns · Answer

Because i process little Endian i send the data structure byte by byte from memory.
I wanted to know if there is any software for this EcoLink on a PC on which you can read data from the furnace, or if some firmware is loaded with it, maybe some batch is attached. I need to check this crc how it is counted, if you can, pull the login password with the wireshark as it connects to ftp and checks for updates.

Internet module ecoNet 300 and ecoLINK2

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary