ELV MAX! first impression

Before I start digging up the protocol and will be staring at bits & bytes for quite some time, I thought it would be good to first give a short impression of the ELV MAX! products that arrived yesterday: a MAX! Cube LAN Gateway and a Radiator Thermostat.

The Radiator Thermostat feels good – it’s made of plastic, but it doesn’t make it feel light or cheap. And it’s big, but not too big. The big LCD is a smart choice IMO, cause with radiator valves just 20 cm above the floor you can still read the temperature set-point and the various icons very well – no need to get on your knees. I’m satisfied with the looks so far; the only thing that worries me a bit is the M30 nut which is also made of plastic. I would have preferred a metal one, just like the one on the Honeywell HR-80. But hey, look at the price difference between those two.. well, I guess we’ll know how this plastic nut performs soon enough 😉 The big knob with which the temperature setpoint can be altered works and feels good as well. No complaints so far.

The Cube is ehm, well, a cube. White, with a RJ-45 connector for LAN and a USB connector for power. The power adapter has a USB connector too, so you don’t need a PC nearby; working with the Cube is completely LAN based. 3 green LEDs on the top of the Cube show the status for power, Internet and Battery. Power consumption of the Cube: 0.9 W. That’s acceptable; I’ve seen worse!

After unpacking everything, I started with inserting the batteries into the Radiator Thermostat with the Thermostat still on my desk. After the batteries were inserted, it started doing its ‘adapter run’ so the thermostat can find out how/where the pin of the radiator valve is positioned and how much this pin can be moved. I immediately got an F2 error, which I already anticipated since the Thermostat didn’t get any resistance from a real radiator valve. So I mounted it to a radiator valve, started the ‘adapter run’ again and unscrewed the Thermostat from the radiator after it finished this run. Back on my desk with this Radiator Thermostat, cause I don’t like to walk back and forth between desk and the nearest radiator!

Next I started up the Cube, downloaded a MAX! App from the ELV site, installed, started the App and saw the Cube being auto-discovered. Default mode for the Cube’s LAN connection is DHCP, BTW. The App told me I needed a firmware upgrade before I could proceed, so I let the app take care of that. I teached-in the Radiator Thermostat and looked around in the MAX App; pushed some buttons, changed some settings, turned the Thermostat knob manually, adjusted a schedule etcetera; after 15 minutes or so I had seen enough; this app is not going to be used. Not because it doesn’t work good, has flaws or whatever reason, but it’s not integrated!

Depending on how well the ELV MAX! protocol can be dissected into all the details, I will maybe use it to teach-in new Thermostats; we’ll see. But that should be all, the rest of it all should be doable from my own system.

I’ve already started with decoding the incoming ‘H:’,’M:’ and ‘C:’ messages that are received when a TCP connection is opened to port 80 of the MAX! Cube. Those responses contain very interesting configuration data. More on that later… 🙂

Update: I posted some protocol information on the Domoticaforum. Enjoy!

Unravelling the ELV MAX! heating control system protocol

A German company called ELV has a new heating control system since a few months – it’s called MAX!.  With this system you have the ability to control your heating system via Smartphone, Internet and local PC (oh, and manually of course). The MAX! radiator thermostats seem to have all I need: flexible daily switching programs, auto/manual/holiday mode, temperature can be set between 5 and 30 °C in steps of 0.5 °. Other components of the MAX! system are wall switches for Eco mode, window sensors and wall thermostats. Prices are good too; very good actually, when you compare them to alternatives.

The interface for all these wireless devices is the MAX! Cube LAN Gateway; with this you can control, configure and adjust all your MAX! components. Cool..

Not so cool is the web portal that has to be used when you want to control the MAX! system from outside your own house (e.g. via Internet, with your smartphone or whatever). Some people, and I’m one of them, don’t like being forced to use a web portal controlled and secured by a 3rd party; I prefer making my own solution for these kind of  things, especially since every website seems to be hack-able these days and leaking all kinds of information… No, if someone is leaking information about me/us, it should be me doing that, not some company..

Last week someone posted some details about the MAX! Cube LAN Gateway on the Domoticaforum Europe. It seems possible to connect to port 80 of the Cube and even communicate with it. OK that’s a start, now all that’s left to do is finding out how the MAX! Cube works, which can be a tough job. The protocol that’s being used is another proprietary one and therefore nothing has been (and probably never will be) published about it. Time for some good old packet inspection – and for that, it’s better to have a MAX! Cube and a Radiator Thermostat at my disposal, so I bought those 2 items last weekend. After that I started searching for more detailed information about the protocol – but as expected, without result.

I reread the ELV MAX! topic on the Domoticaforum and looked at some lines of MAX! communication that were logged by a member called blb. At first sight I could not tell what it all meant, although I did see some lines that had Base64 characteristics: all characters were more or less human readable and they were ending on 1 or 2 ‘=’ characters. And yes, it’s Base64 encoded; I decoded one of the logged lines and it revealed a url pointing to a portal on the elv.de domain, another decoded line revealed the location and name that forum member blb probably assigned to one of his Radiator Thermostats. Finding out how the temperature had to be set wasn’t hard either. There still are some bytes unknown though 😉

Nevertheless, this is what I call a good start; so as soon as the ELV MAX! stuff I ordered has arrived, I’m gonna start dissecting the protocol, bit by bit – exciting!

Update: I posted some protocol information on the Domoticaforum. Enjoy!

Better than the real thing

This time I won’t post about my own Domotica adventures, but someone else’s: Menno van Gennip.  A few days ago Menno posted on the Domoticaforum about his self-made Remeha Calenta interface. For several reasons, his work just needed to be mentioned here.

First of all, the way Menno improved on the TTL-RS232 converter is beyond my knowledge and absolutely a great improvement. Menno added galvanic isolation to protect the Remeha. Second, he added an Ethernet interface based on a Ethernet-serial Wiznet module:

Galvanic isolation

Third, Menno put all the electronics in a nice enclosure including status LEDs:

Inside the enclosure Interface enclosure

Fourth, Menno created 2 Homeseer scripts that makes the whole thing ‘Homeseer-ready’, including CRC checks and all:


The screendump below shows the Homeseer status screen with all the information from the Remeha Calenta (click it for a larger view):

And last but not least, the reason why I like Menno’s effort so much is that this is a very good example of what can be accomplished by sharing knowledge; Menno’s knowledge about electronics combined with my earlier findings about the Remeha Recom protocol resulted in a interface that’s even better than the “real thing”, being the Remeha Recom and the Remeha Interface cable ! (for us Domotica enthusiasts, I mean).

Chapeau, Menno!

Remeha Calenta connected

The TTL-RS232 converter

The TTL-RS232 converter (click for more detail)

After nearly a full afternoon of soldering, testing, debugging I finished the board shown above. This is not my cup of tea, that’s for sure… 🙁

I forgot to add 1 wire (the red one to the right of the MAX3232) and the whole thing didn’t work… so I checked if all the wires were there, and I still thought they all were; next I checked if the cable coming from the Remeha was 100% OK – it still was; I re-checked all connections; and finally, after 2 hours, I found that capacitor with one leg connected to nothing. That can’t be right.. after I fixed this everything worked as well as on the breadboard. Pfff.. Next time when I solder something similar, I’ll make a hard-copy of the schematic and I’ll mark the components and wires I finished soldering on that hard-copy, so I won’t make this mistake ever again! After connecting the female DB9 to the RFXCOM RS232 module, I was good to go.

This was the hardest part. From this point everything went very smooth:

  • I changed the Calenta Interface settings from using a Serial to using a TCP Connection, as in:


  • I built my Domotica Delphi project (nothing more than Shift-F9 inside the Delphi IDE);
  • I set the Remeha Interface “AutoRun” property to True in the database, which means it will automatically start whenever my Domotica system restarts;
  • Created a backup of the executable I used until now (v145, with v1 being 5 years old right now);
  • Copied the newly built executable to my Domotica VM;
  • And restarted it…

Ooww yeah, this is it 🙂

A long-cherished wish has been realized; unexpected, relatively simple and cheap!

Calenta charts

Calenta charts


Connecting the Remeha Calenta

Normally, connecting a new device means more cables. And I want everything connected to my LAN (or WAN), so I need to convert the RS-232 to Ethernet somewhere.

Although I have Ethernet near the Calenta, that single cable I have over there is being used by my HA7Net, which takes care of counting the hot water usage with a 1-Wire DS2423 counter and measuring the Temperatures of the 5 floor heating groups. So that’s a no go; I can’t use that cable without adding another switch; and I don’t want to, for just 2 Ethernet connections.

Then I realised I still have an unused RFXCOM RS-232 module, and it’s put inside a RFXCOM LAN Interface that’s right above my head (between the ceiling and the roof, that is). This RS232 module was once used for one of my Sony EVI-D30 PTZ cameras with VISCA-protocol, but since this cam has been replaced with a fixed one I don’t actively use this RS-232 module anymore. This saves me a RS-232 to Ethernet converter with another power adapter…

So now I had to find a way to get the cable from the Calenta to this LAN Interface. Getting a 4-core flat phone cable through 2 narrow holes in 30 cm thick walls which are already populated with a bunch of other cables is no fun, but after a few hours I managed to get it through without damaging anything. Pffew..

Now it’s time to get the MAX3232 from the breadboard into an enclosure. I was thinking of creating something like this:

Add a few capacitors, wires, female DB9 connector, a small box and I’m done; and that’s what I’m working on right now. The fact that I’m not able to connect the Remeha directly to my PC anymore (to test the new interface) doesn’t really bother me anymore; I’ve seen enough comparisons of results of my Domotica system and the Remeha Recom software (which needs a COM port) that I’m confident enough that I won’t need Recom anymore to check things; and if I do, I can always use an 32-bit XP machine and a virtual COM port driver for that… it’s time to Ethernet-enable my Calenta and move on!

Calenta Interface under construction

I don’t think I ever wanted temperatures to drop and be forced to wear a coat when going outside. No, the warmer the better for me… but this time it’s different… I want to test my newest Interface! But as you can see by the chart below, the weather is not really cooperating:

Thermostat setback and temperature in the living room

Thermostat setback and temperature in the living room

So I think I’ll just have to wait a while for the temperatures to drop before I’m able to test my Interface really well. I finished the part that parses the samples from the Calenta and I created a page on my website that partly shows the values it returns (taken from a real sample coming from the Calenta), but I still have to look into the counters and blockings, of which the latter one can be very interesting with respect to being notified about problems with the Calenta. But first I want to thoroughly test the sample part before moving on. And I’m not going to raise the setback temperature just for the sake of testing…

Remeha Interface sample

Remeha Interface sample

So no more coding on this Interface until this first part is finished and working OK.

Ooh, BTW… DHL paid me a unexpected visit today with a nice surprise… more on that later! 🙂

Monitoring the Remeha Calenta

Last week I attached some 1-Wire temperature sensors to the floor heating tubes to monitor flow- and return temperatures. While I was doing that, I looked at my Remeha Calenta again and thought what a pity it was that I failed to monitor the Calenta with the Remeha Gateway. I’ve known for a long time that there’s a 2nd solution to this: Remeha Recom. A “special cable” and the Recom software make it possible to monitor your Remeha Avanta, Quinta, Calenta (and more). However the price for this cable is rather high; you won’t be able to get it below 130 Euros with as only result a Recom window on your screen where you can see all kinds of things being monitored… all you can do is make a screen-dump or log the values to a file… 🙁

And if I would buy that “wonder cable”, would I be able to understand the protocol? I didn’t want to risk the chance of buying that expensive cable and not coming any further than using Recom, so i stopped thinking about it. Untill last week.

I started roaming the Internet for more information; I read about “it” being a null modem cable; I looked at the PCB and saw the RJ-11 connector for the Remeha cable was labeled RS-232; I took a long cable with a RJ-11 plug and stuck it into the connector and started measuring with a voltmeter; I saw the outer 2 were 5V and the other GND; that leaves the inner 2 for the serial part. I started thinking about what this super duper Remeha cable could hide inside to make serial communication work? There has to be something special to it… converting TTL to RS-232 perhaps? Why not give it a try…

I have a MAX3232CPE laying around for some time; so I planted it on a breadboard, added some 0.1 μF capacitors and built this schema I found (click it):

Here’s the result:

TTL <--> RS232

TTL <–> RS232

Guess what… it works!! My Remeha Calenta was recognized immediately and I watched the data arriving in Recom:

Remeha Recom v4.1.1

With no more than 8 Euros I created my own interface cable; too ridiculous… Special cable?  My A!@&%#%^!!!

OK, but this was just the beginning. With a serial port sniffer i saw the Calenta being queried and I started recognizing the flow temperature, return temperature etc. in the responses that came back from the Calenta. These packets look like this:

02 01 FE 06 48 02 01 F0 14 AA 14 00 80 00 80 86 F3 00 80 B7 10

00 80 40 1F 70 17 00 80 00 00 00 00 00 BC 02 00 00 00 00 64 00

00 00 00 C2 0B 10 00 FF FF 00 00 00 00 FF FF 17 00 BC 02 00 00

00 00 00 00 00 00 00 00 00 C5 9B 03

After an hour or so, i knew where to find some temperature values and stuff like that. The F0 14 marked in red for example, means 53.60 degrees Celsius. That was easy… not good enough for a quiz 🙂 But I also saw on the amount of values Recom could produce from the incoming bytes, some things had to be stored in bits; the on/off, yes/no, open/closed values appeared not to be stored in a byte, but ‘hidden’ somewhere in a bit maybe? Hmm, how do I know exactly when the Gas valve opens or closes, so how I can locate the bit for that? If it is stored in a bit? This could become a bit more challenging and time consuming than I would like.

Aha! There’s a config directory belonging to the Recom software package, containing XML files; one of them was named exactly like the model that Recom detected. Let’s have a look inside that file… Bingo! These XML files contain very detailed information; they tell me that I can find that Gas valve value in bit 0 of byte 38… Yeeha!

Now it’s just a matter of finding out some more about the leading and trailing bytes and I can start creating my own Remeha Calenta interface to my Domotica system.

Finally I’ll know what the Gas is being used for: DHW or heating. And when the water pressure drops below a value I find alarming, I can be warned before it’s too late. And I can see how much power is actually being produced; and …

Update: RJ-11 is incorrect; it’s a 4P4C connector!

New sensor shipment

It took a while before the package arrived, but here they are:

10 1-Wire DS18B20 sensors

10 1-Wire DS18B20 sensors

These sensors are going to be used to monitor the floor heating. This floor heating is made of 5 groups which can be controlled separately (manually, however 🙁 ).

In the coming fall i want to be able to monitor the temperature decrease in each group and see what happens when i turn the knobs.. I’m not sure if this will be another job for a JeeNode with XBee or that i’ll use the EDS HA7Net this time because it’s in the neighborhood monitoring the central heating and hot water usage and it still has plenty of capacity for 10 more sensors, so we’ll see.

I don’t know where i got the idea from, probably because i went through a lot of RC hardware lately but those who don’t like soldering wires to these small DS18B20 sensor should consider this:

DS18B20 in a RC servo connector

DS18B20 in a RC servo connector

A DS18B20 fits perfectly in a RC servo connector; they come with 3 wires and you can buy these connectors in any RC hobby shop; this picture only shows the connector without the wire, cause i cut it off years ago for whatever reason. The male connector on the other end of the wire will fit (with a little bit of help) in a 0.1″ raster, like a breadboard..  good for building a test setup without any soldering!

Extra display option for Proliphix NT20e

One of the items shown on the LCD of the Proliphix NT20e IP thermostat is the Device name. First i had it set to the location of the thermostat, so there was “Livingroom” displayed. Not very usefull, i know where the thermostat is, since i only have one.  Next text i displayed was my last name… even less informative, i know who i am… OK, another item for my to-do list: can this line of text on the display be used for something really usefull?

Then Pieter Knuvers came with a very good idea; why not display the outside temperature and humidity here? Good idea! Tonight i had some time to have a look at it: 🙂

Outside temp on Proliphix LCD

Outside temp on Proliphix LCD

Proliphix NT20e Thermostat online

Today i created the beginning of a page that will show real-time information about the Proliphix thermostat i started using yesterday. Although not finished yet, it displays some status information and will be extended with several charts to see all you ever wanted to know. But for that, I’ll have to wait a while to have some data to work with. Click on the image to go to my website.

Website Thermostat page

Website Thermostat page