Help me crack this protocol

I’ve been sniffing a UART protocol and it seems really simple. I’ve figured it all out, apart form the checksum. I@m sure someone with a bit of experience in this area will probably instantly know what it is as everything else has been really simple…


Panel: BB 3 0 0 0 3 FD
Panel: BB 3 10 0 1 14 FD - heat+ pump on
Panel: BB 3 11 0 1 15 FD
Panel: BB 3 13 0 1 17 FD
Panel: BB 3 1B 0 1 1F FD
Panel: BB 3 10 0 1 14 FD - heat off
Panel: BB 3 10 0 0 13 FD - pump off
Panel: BB 3 00 0 0 03 FD
Panel: BB 3 10 0 1 14 FD - pump on
Panel: BB 3 10 0 0 13 FD - pump off
Panel: BB 3 00 0 0 03 FD
Panel: BB 3 20 0 0 23 FD - air on

byte 1: ID
byte 2: Number of data bytes
byte 3,4,5: data
byte 6: checksum
byte 7: termination

The checksum seems to be simple addition?

But what happens when the total of the bytes comes to more than FF?

@Nemiah, the checksum is module 0xFF meaning the sum just wraps around ignoring the carry-over.

As for the protocol, you need to establish if a single command like “heat + pump on” produces multiple commands - this is not clear in your comments.

This command BB 3 10 0 1 14 FD shows as heat + pump ON but then you have BB 3 10 0 1 14 FD as heat OFF. Later you show BB 3 10 0 1 14 FD as pump ON only. You are misinterpreting the sequence. From what I see, there seems to be a single command per device with multiple commands being issued when multiple devices are affected. Each command seems to have an ON or OFF state expressed as a 1 or 0 in the third command byte. The second command byte is always 0 so can be ignored. The first command byte represents the device ID.

By carefully logging what commands are issued and which devices are affected, you will be able to fully map the commands and sequences. One word of caution is that 11, 13 and 1B may be an important part of a command sequence and should not be executed alone (ie out of sequence). Again, that’s for you to discover by examining the data.


Thanks for the reply, sorry the comments weren’t clear. The commands are just in chronological order and the text comments were as that action was taken.

So where it says “heat + pump on” this was the instant that button was pressed, followed by the 4 commands that were sent.

I’ve since cracked it and figured out exactly what each bit does. It’s a really simple protocol.

Thanks for your help!