Reverse engineer Takagi tankless WH control protocol

Discussion in 'Tankless Water Heater Forum' started by KI7OM, Feb 20, 2012.

  1. KI7OM

    KI7OM "Retired" HVACR contractor - currently university

    Messages:
    5
    Location:
    Salt Lake City UT
    I’m wondering if anyone has reverse engineered Takagi’s TK-x remote control protocol. Takagi uses a twisted pair for remote communication with any of the TK series tankless water heaters out to a TM-RE30 remote controller. The TM-RE30 is able to report inlet and outlet water temperature, flow rate, set point, time, and error codes. Up to this point I have only checked for the presence of DC (measured at about 15VCD) and the presence of an AC signal in the mV range. I have yet to put a oscilloscope on the line to determine the frequency of the AC or to capture any signaling. My interest is in integrating this information into a centralized residential energy management system.
  2. allan-sf

    allan-sf New Member

    Messages:
    1
    Location:
    SF Bay Area, CA
    I would love to know too. Got the same setup.

    If you're in the Bay Area, my work has a lab of fairly expensive
    scopes and digital signal analyzers. Though it probably
    is some very simple rs-232 like protocol with that DC offset.

    I'm using mine for radiant hydronic, so getting data on usage
    and cycles would be nice, though it might be easier to
    use a fancier thermostat (thermostat turns on 2 pumps
    which triggers the Takagi)



    allan
  3. Jim Evans

    Jim Evans New Member

    Messages:
    3
    Location:
    Washington
    I have two Takagi JRs used for hydronic heat, and I just received a remote control unit for one of them. I'm thinking it's definitely worth my time to put a 'scope on it and check out the protocol and try to roll my own simple remote with an Arduino, rather than pay $80 for the second remote. I'll let you know if I have any success.

    -J
  4. DonL

    DonL Jack of all trades Master of one

    Messages:
    4,509
    Location:
    Houston, TX
    If it is twisted pair it may be RS422.

    Are you wanting to build one ? Why reverse engineer it ?

    The protocol that it uses will depend on the type of CPU that it uses.
  5. DonL

    DonL Jack of all trades Master of one

    Messages:
    4,509
    Location:
    Houston, TX

    You may find that Takagi uses a Honeywell protocol.

    This may be some nice reading for a energy management system integrator.

    http://www.prosoft-technology.com/content/download/7044/92244/file/06.PLNX.DEM.OO.01.EN.pdf

    The Honeywell stuff is good.
    Last edited: Feb 10, 2013
  6. LLigetfa

    LLigetfa DIYer, not in the trades

    Messages:
    4,185
    Location:
    NW Ontario, Canada
    Does the remote have a FCC ID? If so, you might be able to find some info on the FCC site. It's amazing how much one can glean from the FCC submissions. Barring that, if you (the OP) purchase and disassemble a unit, you might be able to identify the chipset used if they didn't sandblast or encase it in epoxy. There could be two-way communication so you may need to have one anyway if you want to eavesdrop on the conversation.

    One time I was emailing back and forth with an engineer at Carlon (Lamson & Sessions) trying to get some technical details for off-label use of one of their products. They were giving me the hard line of it being "proprietary" information to which I showed them a link to what was on the FCC site (99%) and I just wanted the last 1% of details. It didn't help.

    Sounds like an interesting project. The 15VDC is probably to power the remote and if it is a single twisted pair then that narrows down the list of communication protocols.
  7. Jim Evans

    Jim Evans New Member

    Messages:
    3
    Location:
    Washington
    The two wires have 22VDC on them. The heater unit blindly transmits a 20 bit packet 5 times a second at about 500bps burst. Just roughly looking at the bit patterns on the scope, I'm guessing it alternates between two types of packets. The remote, if connected, responds after every other packet with a 20 bit packet of its own. I'm not sure of the bit encoding, it does not have the distinctive look of I2C or the Honeywell protocol.

    I'm guessing it's just a simple proprietary frame, with the bit encoding being a .5ms pulldown for a 0 bit and a 1.5ms pulldown for a 1, repeated at 500bps. It could be some PSK encoding, but I don't think so.

    That's as much as I want to do with the 'scope. Next time I have time to sit down with it, I'll have an Arduino dump the frames and start looking at what the fields are in it and how it's encoded. I'm sure it's simple.

    takagi bits.jpg takagi packet.jpg
  8. Jim Evans

    Jim Evans New Member

    Messages:
    3
    Location:
    Washington
    PS: in the second picture, the first, higher-amplitude packet is the transmission from the heater. The second, lower-amplitude packet is from the remote.

Share This Page