Comments on: Reverse engineering the Elco heating protocol /2012/12/14/reverse-engineering-the-elco-heating-protocol A collection of note-to-self's Sun, 24 Mar 2019 23:04:45 +0000 hourly 1 By: xAPPO /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-261407 Mon, 03 Apr 2017 12:56:01 +0000 @Pasi Google has been my friend for those two English docs… now reading.. thanks

By: xAPPO /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-261406 Mon, 03 Apr 2017 12:03:52 +0000 Just found this .. very interesting.

I have a Honeywell EC65 boiler and a Siemens QAA70 thermostat and I’m hoping this is pretty similar as I’d established the BatiBus basis. I’d been intending reverse engineering to try and integrate with my own home automation system but it’s a tedious task so it never made the top of the list. This makes it so much easier.. thankyou.

At 65KW I too have an overpowered boiler as ‘recommended’ by my installer – so a lot of cycling every minute or so and even when heating water. It can’t modulate down low enough. I have plans to use a two coil tank to improve heat transfer into the water.

I’ll let you know how I get on , I use Pi’s and have a BeagleBone Black so some commonality there. Any further progress you have made I would be most interested in hearing about.

Also @Pasi – some of your English URL links are now broken – if you do have any updated ones that would be good or maybe I could contact you via email.

Cheers Kevin

By: Merijn /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-261403 Tue, 13 Dec 2016 14:30:12 +0000 Parallel universes do exist 🙂 Switched to floor heating too, but we’ve kept the radiator circuit for upstairs. It sounds like we even have the same installer :-)! Where are you from (if I may be so curious)? I think most installers go with the high power heaters just to be on the safe side. And I must admit, it works. Just not as efficient as could be, but that would probably require calculating heat losses for our building. That might be a challenge. I’m kind of hoping I can get that info from monitoring my system. Anyway; continuous burning is never achieved at our place. On a bad day, it starts every 5 minutes and runs for about 10 seconds. This has to change. For the moment I only have a unidirectional channel because I don’t want to break anything. I guess I’ll have to take it to the next level. And for the graphs, I’m thinking about using dygraphs ( for the fun of learning javascript and creating SPA’s.

By: Niobos /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-261402 Tue, 13 Dec 2016 13:22:37 +0000 I have a similar situation, and came to a similar conclusion. The answer that I got from my installer is that heaters nowadays are scaled for making hot tap water, which requires a lot more power than “regular” heating. Therefor, they usually can’t modulate low enough for continuous heating.

I’ve since moved from radiators to floor heating, and that gives better results. I’ve had days with only 1 burner start, and a continuous burn throughout the day. But with the current weather (9ºC, little wind) it pulses on/off again.

If you can deliver a bidirectional channel between the bus and the RPi, you can simply use my scripts to generate the graphs I’ve shown in the blog post.

By: Merijn /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-261401 Tue, 13 Dec 2016 13:16:15 +0000 I had a new boiler installed last winter and it registered approximately 20000 burner starts in one year. I find this to be a lot but my installer said it’s normal. I’m not convinced so I want to bring this number down by tweaking the settings. But to see the results, I need to log as much as I can. For now, I’m using an Arduino Mega to read the bus and send the data to my laptop, but I have been playing around an ESP8266 to send messages to an MQTT server on a RPi. On the RPi, I will run a python-script to connect to that MQTT-server and store the packets in a database. Then, I want to create a web interface to visualize everything. And if my boiler is still in use after I’m finished with all this, I hope my installer – or anybody else with knowledge on the subject – is willing to give me some tips on how to optimize my system (but I fear my boiler is just to powerfull for my house).

Thanks for the link. I think I read trough most of it back when I first started this project, but a lot of info was added since. Very interesting! It will be a good read this evening 🙂

By: Niobos /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-261400 Tue, 13 Dec 2016 09:00:33 +0000 Hi Merijn,

coincidentally, I’m also picking this up again. I was going to log a lot more information, but I was unhappy with the duplex mismatch caused by my current design. So I’m re-implementing the communication protocol in the PRU of a BeagleBone Black. What are you planning to do?

To answer your question: indeed, these messages are only sent on-demand. I have my computer send the question-messages every minute, and record the answer.

I found an interesting forum (in German) that has reverse-engineered the protocol to a much greater extend than I did:

By: Merijn /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-261399 Mon, 12 Dec 2016 20:26:39 +0000 I see my last reply dates back almost 3 years. I finally found some time to pick up my project, this time using an ESP8266 with webinterface and MQTT support. Your blog has been of great use for this (again). I just wanted to ask: does your heater send those values continuously? I don’t get values for outdoor temperature etc. unless I explicitly ask for them at the room controller.

Also, do you have any idea what the 3 bytes after the length mean? They must have something to do with the circuit number. I have 2 heating circuits and I see a difference in those bytes for the same requested values (same command bytes). I noticed that the second and third byte of those 3 get swapped between request and reply.

By: dzairo /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-244675 Sun, 11 Jan 2015 15:55:58 +0000 Hi. I find problem .. in my Delphi Component I have set Discard null .. then if received $00$00 then delete this char .. and I received bad data ..

now all working ..


By: Merijn /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-223710 Tue, 11 Mar 2014 18:47:18 +0000 Hi Niobos

I’ve ordered a couple of JeeNodes to monitor my gas utility meter and the Elco-bus.

I assume you have my private email-adres trough this blog. I’m not sure it’s a good idea to post my github details here… In the meantime, I’ll start thinking about CSMA/CD and I’ll study the links in the replies above.


By: Niobos /2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1#comment-223607 Mon, 10 Mar 2014 09:38:06 +0000 Merijn,

I had the same goal: integrate my existing domotica system (Velbus-based) with the heating to get a more efficient end result. But I’ve apparently lost my drive halfway through… Anyway, I would gladly join forces!

I think the first step would indeed be to start monitoring your setup. In order to do that the correct way, I would suggest to go with the Arduino from the start, so you can have proper CSMA/CD.

If you provide me with your GitHub username, I’ll add you to the repository.