# Conflict with dhw_real_temp

[MBRetrofit]

Indeed, the dhw_real_temp get the value from number.ebusd_dhw_dhw_target_temp and not from Current_temperature of the water tank. Any workarounds?

[ysard]

Yes, the target temperature is the set-point you set; real temp is the effective set-point in read-only mode.
There is always a little offset between the 2. As far as I know there is no sensor for the (very small) water tank in the Mira C Green; I think it is assumed that the temperature is around the set-point (even if this boiler is pretty crappy at continuously providing hot water at the desired temperature, especially if the central heating is on).
There is maybe another unknown id if the Celectic water tank is installed on the system. In this case, further analysis of the logs will be required...

[MBRetrofit]

I use a separate hybrid water tank with serpentine from DHW and electrical resistance. As the boiler does not support any management for DHW and indeed keep the water tank at maximum temperature without any logic , now because your incredible work I can start to build routines. Like, stopping the DHW if the Sun is up and there is request for hot water, for example. or to wait for fresh water ( very cold in my region ) to mix with warm and to start heating after a calculated delay. My boiler has Tank Temperature sensor connected to the main board and the Ariston App interpret the value correctly. Is there any way to sniff the messages between Cube S Net and Ariston server?

[ysard]

To avoid any misunderstanding, when I say that this boiler is a disaster as far as hot water is concerned, it is because when you want hot water you have a good chance of ascillating with completely frozen water without the system waking up (moreover, the venturi system is very insensitive). It is worse when the central heating circulation is active because the system seems to prioritize it over the domestic hot water... The "comfort" mode helps a little, personally I activate it as soon as I need water. The small buffer tank helps to avoid ending up taking a shower with water at 5°C. Without the Comfort mode, I calculated that for a shower, about 50% of the water consumed is wasted due to the lack of an acceptable temperature. Sorry to vomit my hatred of this boiler here but it had to come out :D

My boiler has Tank Temperature sensor connected to the main board and the Ariston App interpret the value correctly. Is there any way to sniff the messages between Cube S Net and Ariston server?

I think you could run ebusd in info mode (--loglevel=info --logfile=my_log_file.log) and analyze the generated file to find registers not supported by the configuration file (lines starting with "received unknown BC cmd"). What you are interested in are the commands of type 2000, 2010, 2020 (Primary & secondary command bytes (PBSB)) probably issued by your thermostat.

Example:
received unknown BC cmd: 37fe2000026047
Here the ID is 6047, which is unknown, but without any value associated (just a 2000 cast command).

It is also possible that the thermostat does not publish its data. In this case you would have to a bruteforce the registers by taking inspiration from the program here (if you are in Python coding...):

https://github.com/ysard/ebusd_configuration_chaffoteaux_bridgenet/blob/master/tools/bruteforce_registers.py

If you want to intercept the data sent on the internet network (IP), then yes it is also possible but it is outside the scope of this project.
You will have to configure a computer to play the role of MITM (Man In The Middle) and sniff the data sent. Data that could be encrypted.

[ysard]

To provide a clearer answer:

• Yes it is possible to sniff the data that transits on the ebus bus with the ebusd software that you must already be using if you are here; if you cannot process the data, post the file here (zip/tar.gz archive), someone may be able to look into it.

• Yes it is possible to sniff WiFi data with a MITM. Or more passively by being close to your thermostat with analysis software like Wireshark, capture software like airodump-ng or hcxdumptool, a computer running GNU/Linux and a WiFi card compatible with monitor mode (most of them today). But here we are entering medium level hacking techniques.

[MBRetrofit]

Far from me any hacking level, maybe you recognize some of the unknown messages.

2025-02-12 14:00:57.205 [update info] received BC cmd: 7ffe20380501c80e0708
2025-02-12 14:00:57.205 [update notice] received unknown BC cmd: 7ffe20380501c80e0708

2025-02-12 14:00:57.832 [update info] received BC cmd: 37fe2000026047
2025-02-12 14:00:57.832 [update notice] received unknown BC cmd: 37fe2000026047

2025-02-12 14:01:00.911 [update info] received BC cmd: 37fe2000026472
2025-02-12 14:01:00.911 [update notice] received unknown BC cmd: 37fe2000026472

2025-02-12 14:01:03.104 [update info] received BC cmd: 37fe2000026473
2025-02-12 14:01:03.104 [update notice] received unknown BC cmd: 37fe2000026473

2025-02-12 14:01:07.965 [update info] received BC cmd: 37fe20100c059100000691000007910000
2025-02-12 14:01:07.965 [update notice] received unknown BC cmd: 37fe20100c059100000691000007910000

2025-02-12 14:01:10.477 [update info] received BC cmd: 7ffe20710700ffffffffffff
2025-02-12 14:01:10.477 [update notice] received unknown BC cmd: 7ffe20710700ffffffffffff

2025-02-12 14:01:11.095 [update info] received BC cmd: 70fe207309000000000000000001
2025-02-12 14:01:11.095 [update notice] received unknown BC cmd: 70fe207309000000000000000001


2025-02-12 14:01:11.822 [update info] received MS cmd: 7f3c200004d1400e11 / 03034f00
2025-02-12 14:01:11.822 [update notice] received unknown MS cmd: 7f3c200004d1400e11 / 03034f00
2025-02-12 14:01:11.960 [update info] received BC cmd: 7ffe20500b55550c0100000000000000
2025-02-12 14:01:11.960 [update notice] received unknown BC cmd: 7ffe20500b55550c0100000000000000
2025-02-12 14:01:12.079 [update info] received BC cmd: 7ffe20000669966a966b96
2025-02-12 14:01:12.079 [update notice] received unknown BC cmd: 7ffe20000669966a966b96
2025-02-12 14:01:12.225 [update info] received BC cmd: 37fe200f0f6996f000006a96be00006b96be0000
2025-02-12 14:01:12.225 [update notice] received unknown BC cmd: 37fe200f0f6996f000006a96be00006b96be0000
2025-02-12 14:01:12.333 [update info] received BC cmd: 7ffe2000066c966d966e96
2025-02-12 14:01:12.333 [update notice] received unknown BC cmd: 7ffe2000066c966d966e96
2025-02-12 14:01:12.454 [update info] received BC cmd: 37fe200f0f6c96be00006d96be00006e96be0000
2025-02-12 14:01:12.454 [update notice] received unknown BC cmd: 37fe200f0f6c96be00006d96be00006e96be0000
2025-02-12 14:01:12.559 [update info] received BC cmd: 37fe2000020083
2025-02-12 14:01:12.559 [update notice] received unknown BC cmd: 37fe2000020083

2025-02-12 14:01:13.000 [update info] received BC cmd: 7ffe20510e040b555555555555555555555555
2025-02-12 14:01:13.000 [update notice] received unknown BC cmd: 7ffe20510e040b555555555555555555555555
2025-02-12 14:01:13.000 [bus info] poll cmd: 313c2000027647
2025-02-12 14:01:13.134 [update info] sent MS cmd: 313c2000027647 / 0301ff7f
2025-02-12 14:01:13.134 [update notice] sent poll-read boiler ext_temp QQ=31: 3276.7
2025-02-12 14:01:13.220 [update info] received BC cmd: 37fe20100c059100000691000007910000
2025-02-12 14:01:13.221 [update notice] received unknown BC cmd: 37fe20100c059100000691000007910000
2025-02-12 14:01:13.328 [update info] received BC cmd: 37fe2000026047
2025-02-12 14:01:13.328 [update notice] received unknown BC cmd: 37fe2000026047

2025-02-12 14:01:18.043 [update notice] received unknown BC cmd: 37fe20100c059100000691000007910000
2025-02-12 14:01:18.155 [update info] received BC cmd: 7ffe2020030a9000
2025-02-12 14:01:18.155 [update notice] received unknown BC cmd: 7ffe2020030a9000
2025-02-12 14:01:18.284 [update info] received BC cmd: 7ffe207309000000000000000002
2025-02-12 14:01:18.284 [update notice] received unknown BC cmd: 7ffe207309000000000000000002

2025-02-12 14:01:18.873 [update info] received BC cmd: 7ffe20500b55550d0100000000000000
2025-02-12 14:01:18.873 [update notice] received unknown BC cmd: 7ffe20500b55550d0100000000000000

2025-02-12 14:01:19.878 [update info] received BC cmd: 7ffe20510e040c555555555555555555555555
2025-02-12 14:01:19.878 [update notice] received unknown BC cmd: 7ffe20510e040c555555555555555555555555

2025-02-12 14:01:20.430 [update info] received BC cmd: 37fe20100f64976c020065976c020066976c0200
2025-02-12 14:01:20.430 [update notice] received unknown BC cmd: 37fe20100f64976c020065976c020066976c0200
2025-02-12 14:01:20.509 [update info] received BC cmd: 37fe20100567976c0200
2025-02-12 14:01:20.509 [update notice] received unknown BC cmd: 37fe20100567976c0200
2025-02-12 14:01:20.718 [update info] received BC cmd: 37fe2000026047
2025-02-12 14:01:20.718 [update notice] received unknown BC cmd: 37fe2000026047

2025-02-12 14:01:25.533 [update info] received BC cmd: 7ffe2020030b9000
2025-02-12 14:01:25.533 [update notice] received unknown BC cmd: 7ffe2020030b9000
2025-02-12 14:01:25.662 [update info] received BC cmd: 7ffe207309000000000000000003
2025-02-12 14:01:25.662 [update notice] received unknown BC cmd: 7ffe207309000000000000000003
2025-02-12 14:01:25.871 [update info] received BC cmd: 7ffe20500b55550e0100000000000000
2025-02-12 14:01:25.871 [update notice] received unknown BC cmd: 7ffe20500b55550e0100000000000000
2025-02-12 14:01:25.940 [update info] received BC cmd: 37fe200002c67a
2025-02-12 14:01:25.940 [update notice] received unknown BC cmd: 37fe200002c67a

2025-02-12 14:01:26.880 [update info] received BC cmd: 7ffe20510e040d555555555555555555555555
2025-02-12 14:01:26.880 [update notice] received unknown BC cmd: 7ffe20510e040d555555555555555555555555

[ysard]

• The report is too short, try to record for 15-20 min and write down the data you want to track.
  For example, if you are looking for a water tank temperature: make a recording where you know that the water is at, say 30°C;
  turn off the water heater, draw water, continue your daily life, then when you are sure that the temperature
  has decreased (write the value down), make a recording again.
  The idea is to know that a recording corresponds to a very specific change of the setting.
  Knowing what you are looking for helps considerably.

• To send an archive of the log:
  Compression command:
  tar czvf log.tar.gz log.log
  To send here simply drag and drop the file into the input area.

• It seems that you are not using the latest version of the configuration file?
  Commands that should be recognized are not in your recording, making it more complex to analyze:

7f3c200004d1400e11
37fe20100c059100000691000007910000
37fe2000020083
7ffe20510e040b555555555555555555555555
37fe200002c67a
37fe20100f64976c020065976c020066976c0200
37fe20100567976c0200

• Commands that are unknown to me are indeed encountered:

7ffe20710700ffffffffffff
70fe207309000000000000000001
7ffe20000669966a966b96
37fe200f0f6996f000006a96be00006b96be0000
7ffe207309000000000000000002
7ffe207309000000000000000003

We need to see if other repositories like the one of wrongisthenewright have these commands.

[ysard]

Erratum: IDs 6996, 6a96, 6b96 are for z*_heat_setpoint_temp_check of Ariston boilers:

37fe200f0f6996f000006a96be00006b96be0000
37fe200f 0f 6996 f00000 6a96 be0000 6b96 be0000
24°C, 19°C, 19°C

Not usable here for Chaffoteaux.

[MBRetrofit]

2ad9b828_ebusd_2025-02-13T13-49-20.357Z.log

313c2000026071 / 03013403 = 1: boiler z1_water_max_temp
313c2000026126 / 0301f401 = 1: dhw dhw_target_temp
313c2000026197 / 0301c201 = 2: boiler z1_target_temp
313c2000026271 / 0301e600 = 1: boiler z1_day_temp
313c2000026371 / 0301a000 = 1: boiler z1_night_temp
313c2000026471 / 030188ff = 1: boiler z1_thermoreg_offset
313c2000026571 / 0301f401 = 2: boiler z1_fixed_temp
7f3c2000026810 / 03019001 = 4: boiler water_temp_out
313c2000026847 / 03010000 = 1: boiler dhw_flowmeter
7f3c2000026910 / 03018901 = 3: boiler water_temp_in
313c2000026a71 / 03019600 = 1: boiler z1_thermoreg_slope
313c2000027118 / 0301df00 = 2: boiler z1_room_temp
313c2000027426 / 03010000 = 1: boiler ext_temp_offset
313c2000027647 / 0301ff7f = 4: boiler ext_temp
313c200002c028 / 020102 = 3: dhw dhw_comfort_mode_status_w
313c200002c079 / 020102 = 1: boiler z1_thermoreg_type
313c200002c279 / 02010a = 2: boiler z1_room_temp_infl
313c2002020400 / 0b210067207f0f1f1f3f0100 = 1: boiler error_slot_9
37fe2000020081 = 22: broadcast accept_telegrams_z1_heat_temp_range
37fe2000020120 = 49: broadcast accept_telegrams_heating_status
37fe2000020220 = 24: broadcast accept_telegrams_dhw_status
37fe2000020520 = 25: broadcast accept_telegrams_sra_status
37fe2000026147 = 106: broadcast accept_telegrams_domestic_hot_water_temp
37fe2000026471 = 22: broadcast accept_telegrams_z1_thermoreg_offset
37fe2000026571 = 21: broadcast accept_telegrams_z1_fixed_temp
37fe2000027647 = 194: broadcast accept_telegrams_external_temp
37fe200002c028 = 24: broadcast accept_telegrams_dhw_comfort_mode_status
37fe20101001910000029100000391000004910000 = 99: boiler heat_request_status_1
37fe2010056147f40100 = 19: dhw dhw_real_temp
37fe20100f6197c2010062976c020063976c0200 = 17: boiler hot_water_target_temp_1
37fe201004c04b0100 = 159: boiler boiler_status
37fe201004d1405f00 = 2: boiler settings_change_counter
37fe201010d7460200da469600dc464b00de464b00 = 18: dhw dhw_comfort_mode_status
703c2000040e11d140 / 0303005f = 137
7f3c200004c2046547 / 0403000000 = 1
7f3c200004d1400e11 / 03035f00 = 25



2ad9b828-ebusd:/# docker exec -ti ebusd ebusctl reload && docker log ebusd --since 2m
bash: docker: command not found
2ad9b828-ebusd:/# ebusctl info
version: ebusd 24.1.p20241114
update check: revision 24.1 available, device firmware v5-c6 1[4c15] available
device: 192.168.100.161:9999, TCP, enhanced, firmware 1.1[5114].1[5114]
signal: acquired
symbol rate: 44
max symbol rate: 146
min arbitration micros: 2
max arbitration micros: 322
min symbol latency: 0
max symbol latency: 56
scan: finished
reconnects: 0
masters: 5
messages: 75
conditional: 0
poll: 31
update: 0
address 00: master #1
address 31: master #8, ebusd
address 36: slave #8, ebusd
address 37: master #18
address 3c: slave #18, scanning
address 70: master #4
address 75: slave #4, scanning
address 7f: master #24
address 84: slave #24, scanning

[ysard]

Hum, there is still no change in the commands that should be supported by the configuration; This disturbs the analyzes.
Try to process my advice/questions/tips one by one.

It seems that you may be lost with the commands, the system and the GNU/Linux system.
If you want to speak French to facilitate communication, go for it.

Let's start from the beginning.

• Please describe your installation. You said that you have a "Tank Temperature sensor connected to the main board".

  • What are the name & reference of the device ?
  • Is it connected to the boiler board ? On which slot ? Maybe an image will help.
  • Indeed I see a device with the adresses 7f/84 (thanks for the ebusctl info log); Can I suppose that this is this water tank?

• I don't know what I have to search in the log. What temperature is supposed to be searched?
  Each log file must describe the evolution of the settings we are supposed to search.
  You have a device that is able to display these setting values.

• There are commands that should be supported by my configuration.
  Please update your file mira_c_green.csv with mine available on this repository and restart your ebusd service.

• The duration the of logging is correct but the longer the better;
  These files can be really big, please compress them with the following command:
  tar czvf archive_name.tar.gz path/to/your_log_file.log
archive_name.tar.gz is what we want and is created on your current directory.

• If you want to post not-formatted text; please enclose it with 3 ` characters (Altgr + 7 on french azerty keyboard; it's the grave accent) .

PS: message lastly edited at 20:58 on Friday Feb 13th

[ysard]

Analysis result:
I see a packet 7ffe 2010 09 7617 3c0000 c19a 0100 emitted every 2 minutes; the value of the ID 7617 could be 60°C (a logical temp for Domestic Hot Water), followed by an unknown ID c19a that could be a ON/OFF status.
These values do not change during the log you provided.

In addition to tests aimed at lowering the temperature of the hot water, you could do tests:

• changing the set water temperature
• switching on/off the heating functions of your domestic water

I also see packets of type 2050 with the following cyclic occurrences:

• sent every 7 seconds
• set of these packets could be composed of 16 packets; sent in a time-frame of 2 minutes
• they may be composed of some kind of time related programmation
  Does it mean something to you ? Since I have not the reference of the product, I can't use the user manual.

[MBRetrofit]

OK, thank you. I will change DHW setting and log separately.

[MBRetrofit]

The Writing value number.ebusd_dhw_dhw_target_temp is working great, is settled to 50 - but the actual value to I still did not successfully identified, maybe because the Ariston App display only 2 digits and when -for example convert 48 degree in hex an try to sniff, the value is in fat 47,6, so I should find another way.

Anyway, using @wrongisthenwright ..csv, I found some interesting parameters like:

2025-02-16 22:40:48.266 [update info] received MS cmd: 703c2000040e11d140 / 03030187
2025-02-16 22:40:48.266 [update notice] received poll-read boiler heating_flame QQ=70: on here I just replace your with 011d

2025-02-16 22:40:47.261 [update info] sent MS cmd: 313c2000026829 / 03011800
2025-02-16 22:40:47.261 [update notice] sent poll-read boiler nominal_power QQ=31: 24 this is quite OK

2025-02-16 22:40:59.164 [update info] sent MS cmd: 313c200002c328 / 020101
2025-02-16 22:40:59.165 [update notice] sent poll-read boiler pressure_monitoring_device QQ=31: pressure_switch - this maybe shows that the pressure sensor is just a pressure switch in my CCla EVO

2025-02-16 22:41:05.143 [update info] sent MS cmd: 313c200002c12a / 020106
2025-02-16 22:41:05.144 [update notice] sent poll-read boiler warning_pressure QQ=31: 0.6 this could be the fix value of the pressure switch,

2025-02-16 22:41:11.148 [update info] sent MS cmd: 313c200002c404 / 02015d
2025-02-16 22:41:11.148 [update notice] sent poll-read boiler boiler_current_modulation QQ=31: 93 this is very, veryy interesting, as if the value is percentage, means that is quite good for calculating consumption

2025-02-16 22:41:17.229 [update info] sent MS cmd: 313c2000027547 / 03012000
2025-02-16 22:41:17.229 [update notice] sent poll-read boiler boiler_pressure QQ=31: 3.2 this I think is wrong, as I really did not see any pressure sensor on the water intake - even Ariston App ccan not decode value of the pressure. I think in my case it's just a state 0,6bar sensor for signaling the error.

If you are so kind to update the config file to let those values to be published into my MQTT, I will be forever thankful....and of course I will keep sniffing.

2ad9b828_ebusd_2025-02-16T20-49-45.765Z.log

[ysard]

Could you please address most of / one by one my questions, and my comments on the formatting of the data in my previous replies;
Essential information is missing and we consume our time without moving forward :/

but the actual value to I still did not successfully identified

What values are you looking for in the data you sent?
What values are displayed on your thermostat during the time interval in which you performed the dump you published here?

• ID 011d:
  I think you meant 0e11? Yes, this is most likely the state of the flame.

• ID 6829:
  24 here too. You can see this value also on your CUBE S NET thermostat or is it something you deduced by approximation?
  My boiler comes in the following configurations: 25, 30, 35 kW.
  24 doesn't make sense here, if it were 25kW the value would be 0x19.
  Unless Ariston lies about its values or displays approximate values on their brochures;
  which is quite possible, I have no reason to believe 100% that this value corresponds to the nominal power.

• ID c328:
  Yes, this ID is a service parameter (menu 247);
  It is a hardware-specific value that should not be modified.
  
  0 = Temperature sensors
  1 = Primary circuit ON/OFF pressure switch
  2 = Proportional pressure sensor
  
  We have a pressure switch on the Mira C Green.
  This element is mechanical, so no pressure value is returned to us.
  Is “CCla EVO” the part number of your machine? I can't find this name on the Internet?

• ID c12a:
  If this is a minimal value, and since we don't have a pressure sensor, this ID is of no interest to us.
  Again, is it a validated value through any device or a guessed one ?

• ID c404:
  This value is 0 whatever my machine is doing. I don't know what it is, and how to investigate it.
  Also, if it's changing on your side, don't confuse power output with fan speed, which pulses the air exactly when the burner is actually active.

• ID 7547:
  Already discussed here: #3#issuecomment-2240881946, this ID seems to not be a valid pressure value on my machine (3.0).
  The value does not change over time and is not correlated to a legitimate pressure default value (3.2 is > 3bars limits).
  Unless it's the domestic water pressure?? Is there such a DHW pressure sensor? I don't think so...

[MBRetrofit]

• ID 011d: yes, sorry
• ID 6829: Ariston seams quite far from lying, my system is S/N 3300485 CLAS EVO SYSTEM 24 FF

1 3300473 GENUS EVO 24 CF 05-2012 09-2016
2 3300475 GENUS EVO 30 CF 05-2012 09-2016
3 3300472 GENUS EVO 24 FF 05-2012 09-2016
4 3300474 GENUS EVO 30 FF 05-2012 09-2016
5 3300476 GENUS EVO 32 FF 05-2012 09-2016
6 3300477 GENUS EVO 35 FF 05-2012 09-2016
7 3300481 CLAS EVO 24 CF 05-2012 09-2016
8 3300730 CLAS EVO 24 CF EU 03-2015 09-2018
9 3300732 CLAS EVO 28 CF EU 03-2015 10-2018
10 3300480 CLAS EVO 24 FF NG 05-2012 09-2016
10 3300482 CLAS EVO 24 FF LPG 05-2012 09-2016
11 3300738 CLAS EVO 24 FF NG TK 06-2015 11-2017
12 3300483 CLAS EVO 28 FF 05-2012 12-2016
12 3300484 CLAS EVO 28 FF LPG 05-2012 09-2016
13 3300486 CLAS EVO SYSTEM 24 CF 05-2012 11-2016
14 3300488 CLAS EVO SYSTEM 28 CF 05-2012 11-2016
15 3300485 CLAS EVO SYSTEM 24 FF 05-2012 11-2016
16 3300487 CLAS EVO SYSTEM 28 FF 05-2012 11-2016
17 3300489 CLAS EVO SYSTEM 32 FF 05-2012 09-2016

• ID c12a: could be interesting to signalize the low pressure - I think it is just a service value, like the "24KW"
• ID c404: I am not sure also
• ID 7547: maybe this is only available if ID c328: is 0 ( pressure not Temp sensor..)

Ariston Parts.pdf