Reverse engineer Takagi tankless WH control protocol

Users who are viewing this thread

KI7OM

"Retired" HVACR contractor - currently university
Messages
6
Reaction score
0
Points
1
Location
Salt Lake City UT
I’m wondering if anyone has reverse engineered Takagi’s TK-x remote control protocol. Takagi uses a twisted pair for remote communication with any of the TK series tankless water heaters out to a TM-RE30 remote controller. The TM-RE30 is able to report inlet and outlet water temperature, flow rate, set point, time, and error codes. Up to this point I have only checked for the presence of DC (measured at about 15VCD) and the presence of an AC signal in the mV range. I have yet to put a oscilloscope on the line to determine the frequency of the AC or to capture any signaling. My interest is in integrating this information into a centralized residential energy management system.
 

allan-sf

New Member
Messages
1
Reaction score
0
Points
0
Location
SF Bay Area, CA
I would love to know too. Got the same setup.

If you're in the Bay Area, my work has a lab of fairly expensive
scopes and digital signal analyzers. Though it probably
is some very simple rs-232 like protocol with that DC offset.

I'm using mine for radiant hydronic, so getting data on usage
and cycles would be nice, though it might be easier to
use a fancier thermostat (thermostat turns on 2 pumps
which triggers the Takagi)



allan
 

Jim Evans

New Member
Messages
3
Reaction score
0
Points
0
Location
Washington
I have two Takagi JRs used for hydronic heat, and I just received a remote control unit for one of them. I'm thinking it's definitely worth my time to put a 'scope on it and check out the protocol and try to roll my own simple remote with an Arduino, rather than pay $80 for the second remote. I'll let you know if I have any success.

-J
 

DonL

Jack of all trades Master of one
Messages
5,205
Reaction score
72
Points
48
Location
Houston, TX
If it is twisted pair it may be RS422.

Are you wanting to build one ? Why reverse engineer it ?

The protocol that it uses will depend on the type of CPU that it uses.
 

DonL

Jack of all trades Master of one
Messages
5,205
Reaction score
72
Points
48
Location
Houston, TX
I’m wondering if anyone has reverse engineered Takagi’s TK-x remote control protocol. Takagi uses a twisted pair for remote communication with any of the TK series tankless water heaters out to a TM-RE30 remote controller. The TM-RE30 is able to report inlet and outlet water temperature, flow rate, set point, time, and error codes. Up to this point I have only checked for the presence of DC (measured at about 15VCD) and the presence of an AC signal in the mV range. I have yet to put a oscilloscope on the line to determine the frequency of the AC or to capture any signaling. My interest is in integrating this information into a centralized residential energy management system.


You may find that Takagi uses a Honeywell protocol.

This may be some nice reading for a energy management system integrator.

http://www.prosoft-technology.com/content/download/7044/92244/file/06.PLNX.DEM.OO.01.EN.pdf

The Honeywell stuff is good.
 
Last edited:

LLigetfa

DIYer, not in the trades
Messages
7,497
Reaction score
575
Points
113
Location
NW Ontario, Canada
Does the remote have a FCC ID? If so, you might be able to find some info on the FCC site. It's amazing how much one can glean from the FCC submissions. Barring that, if you (the OP) purchase and disassemble a unit, you might be able to identify the chipset used if they didn't sandblast or encase it in epoxy. There could be two-way communication so you may need to have one anyway if you want to eavesdrop on the conversation.

One time I was emailing back and forth with an engineer at Carlon (Lamson & Sessions) trying to get some technical details for off-label use of one of their products. They were giving me the hard line of it being "proprietary" information to which I showed them a link to what was on the FCC site (99%) and I just wanted the last 1% of details. It didn't help.

Sounds like an interesting project. The 15VDC is probably to power the remote and if it is a single twisted pair then that narrows down the list of communication protocols.
 

Jim Evans

New Member
Messages
3
Reaction score
0
Points
0
Location
Washington
The two wires have 22VDC on them. The heater unit blindly transmits a 20 bit packet 5 times a second at about 500bps burst. Just roughly looking at the bit patterns on the scope, I'm guessing it alternates between two types of packets. The remote, if connected, responds after every other packet with a 20 bit packet of its own. I'm not sure of the bit encoding, it does not have the distinctive look of I2C or the Honeywell protocol.

I'm guessing it's just a simple proprietary frame, with the bit encoding being a .5ms pulldown for a 0 bit and a 1.5ms pulldown for a 1, repeated at 500bps. It could be some PSK encoding, but I don't think so.

That's as much as I want to do with the 'scope. Next time I have time to sit down with it, I'll have an Arduino dump the frames and start looking at what the fields are in it and how it's encoded. I'm sure it's simple.

takagi bits.jpgtakagi packet.jpg
 

Jim Evans

New Member
Messages
3
Reaction score
0
Points
0
Location
Washington
PS: in the second picture, the first, higher-amplitude packet is the transmission from the heater. The second, lower-amplitude packet is from the remote.
 
Top
Hey, wait a minute.

This is awkward, but...

It looks like you're using an ad blocker. We get it, but (1) terrylove.com can't live without ads, and (2) ad blockers can cause issues with videos and comments. If you'd like to support the site, please allow ads.

If any particular ad is your REASON for blocking ads, please let us know. We might be able to do something about it. Thanks.
I've Disabled AdBlock    No Thanks