Reverse Engineering the Buderus KM217 – And Making It WiFi-Flying on ESPhome and Home Assistant

Reverse Engineering the Buderus KM217 – And Making It WiFi-Flying on ESPhome and Home Assistant

The PCB for this project was sponsored by PCBway.

And I really liked what I received. I ordered a few times in the past and always received excellent PCBs from this manufacturer. And also the engineering service is best in class. They ask you what to do, if any problem occurs and either you send new gerbers or they fix it themselves (if possible by editing the gerber). Sooner or later, I’m sure, I’ll also try their assembly and milling services…

If you want to read an article about preparing your data for PCBway, stay tuned, it will be also linked here.

Motivation

As you all know, my home is stuffed with more sensors than the ISS, but I still have some heating installation burning oil… and it stops working quite often (approx. once a week), raising an error from the flame sensor that easily can be commited and everything is working fine for the next days or weeks. In summer-time this is only nasty, and sometimes when I want to take a shower, I realize, that there is no hot water left, the boiler decided to raise an error and I (a) need to wait for the water to heat up or (b) need to take a cold shower if I’m in a hurry… In wintertime, this is worse, because not only the hot water, but also the whole heating is stopped. Not a satisfiying situation 🙁

While I’m planning to renovate the house and switch to some heat pump installation, there is still plenty of time to take cold showers. If I only would know that the heating has an error in advance or when the error just have been raised… For sure, I could simply attach some binary sensor to the flame detector and make an alarm bell ring, by using some analog interface or simply a 230 VAC relay. But this would be way too easy…

My heating system is running a Buderus Logamatic 2107 M main control unit and this has some free slot for a so called KM217 communication module… In my control unit, it is unpopulated 🙁

Here are some additional information that helped me to dig through:

Remote Reverse Engineering

Since I have no KM217 available, I need to do the reverse engineering without some real hardware. For sure I could buy one, but the effort to dongle it to my smart home would not be much less and I don’t want to spend 100 € for a nasty level converter and some chicken feed, only because it has the buderus sign on it…

OK, I found some pictures online of top and bottom sides of the original KM217 module. Then I compared my measurements of the slot inside the LM 2107 with the sizes from the photos and started to draw the PCB outline…

Some handy online tool to take measurements out of photos can be found here.

What you can also see on the photo is the main IC on this board, namely the LT1281ACSW (datasheet), which is a simple 5V-to-EIA/RS-232 level converter. From it’s datasheet, we can see, what are the supply pins and which are the relevant signals. The FG-Connector is just to wire an exhaust probe head, which is irrelevant for us.

LT1281A

Tracing some signals…

Tracing REC2 Out (RX input of Logamatic, upper image is mirrored)
Assumed trace of TR2 In (since TR2 Out at pin 7 is used, TR2 In at pin 10 must also be, upper image is mirrored)

I also found some information on mikrocontroller.net about some possible pinout.

OK, we have quite some information collected about the module and now we can start to create some PCB…

Here come some details to the mechanics and to the the circuit, we want to develop. At first, I really don’t need a EIA/RS-232 signal to connect it with my smart home. What I really need is some wireless network connection. So, I decided to implement some ESP32 directly. With this, I can easily flash ESPhome, run OTA updates, push decoded data to MQTT or whatever I deserve, with a simple click of my fingers (or some more clicks, but not many 🙂 ).

Schematic & PCB Design

Given these requirements, we will use an ESP32 (WROOM-32D module). We will also need to shift the levels of the 5V-TTL serial interface to comply with 3.3V of our ESP32 and vice versa and we also need to generate 3.3V from 5V for our supply…

For the serial interface, getting down from 5V to 3.3V could be easily done with a resistor. Ideally, the heating control will accept the 3.3V as a high level, but to make sure, we will put a simple MOSFET level shifter in between.

On the other side, we are not yet sure, if we identified the signals correctly. To accompany that, we added a connector 1:1 connecting the signals of the blade connection to some standard pin header, so we can easily add a flat ribbon cable to it and use a second board to get a simple „range extender“ for measuring every signal without a risk of shorting them.

Additionally, we add some dual row header. On this header, we can use jumpers if we guessed correctly and jumper wires, if we got it wrong.

OK, here is the first shot of the design:

My Own PCBs

I ordered a bunch of PCBs (Think BMS, Think-Balancer-Adapter, ESP32-18650-Humidity-Temperature-Board and this KM217-WiFi Adapter) on Juli, 27th 2021 from PCBway. And it was lightning fast… Today (August, 4th 2021), one week after I placed my order, it was delivered by FedEX-IP. As I mention in my other post on designing PCBs (coming soon), do not use DHL. It is expensive and they will draw another 12,50 € from you for a short tie credit of the taxes and duty.

You can order the PCB and the parts from my tindie shop.

I also want to thank PCBways, to support my projects with sponsored PCBs. And also the ones I paid

The PCBs look great and also the 0.3mm holes are totally in the center of the vias. There is no visible offset between any of the layers and I totally believe, that going down to 6 mil (0,15mm) with traces and spacings will be no problem.

I already rasped one of it to better slide into the socket. I’ll now prepare two boards to act as a wire extension using a flat ribbon cable between th AN_DEBUG (J3) headers and see, if I can measure the supply correctly and if I’m able to connect to the Buderus controller via TTL-UART. If this succeeds, I’ll populate the components of one card and start the implementation via ESPhome.

Important mechanical adjustment

As you can remember, I took the measurments from images from the internet. I simply had no real hardware. And as murphy tells, the one side of the PCB is a little to long for the connector to slide in. So, the short edge beside the ESP-Module needs to be cut by one millimeter (I used a rasp). This should be done before soldering the components.

You should also sharpen the connector to make it easier to slide it into the receptor of your buderus control unit.

PCB Assembly

Assembling a prototype should always be done step by step and intermediately checking, if everything still works. First, we should start with the ESP32-WROOM-Module (U1) and put the blocking capacitor (C1@100nF) into place. Then soldering the resistors need to connect to the programming interface (R19, R20, R12, R22). Their values do not matter too much. You can simply take something between 100 Ohms and 1 KOhm. It’s just to eventually compensate a 5V adapter and to protect a bit against overvoltages. Now you should solder J4 to connect the programmer.

Already assembled completely (forgot to take photos of intermediate steps)

You should connect the supply, ESP32-RX to CP-TXD (orange1) and ESP32-TX to CP-RXD (yellow). Also CP-RTS should be connected to ESP-EN (green) and CP-DTR to ESP-IO0 (orange2). If you did this correctly, you do not need to place the RESET and the BOOT button since programming mode can then be entered correctly.

After wiring this, connect the USB to the converter, got to ESPhome and add a new target. Select ESP32 as the platform and if you are connected via HTTPS (e.g. with nabu casa) to ESPhome/Home Assistant, you can simply select to flash it locally using USB

If not connected with HTTPS, you can manually download the binary and then flash it e.g. using ESPhome flasher. After the first successful flashing, you can use wireless mode (OTA) to transfer new firmwares. Home Assistant will inform you, that a new device is available with the name given by you during create.

When this was successful, disconnect your PCB again and continue with assembly. I would suggest, to first put the LEDs (D1@green, D2@green, D3@yellow, D4@red) and their resistors (R23, R24, R25, R26) in place and edit your ESPhome device configuration to contain the following lines

switch:
  - platform: gpio
    name: LED1_Green
    pin: 
      number: 21
      mode: OUTPUT
      inverted: true
  - platform: gpio
    name: LED2_Green
    pin: 
      number: 22
      mode: OUTPUT
      inverted: true
  - platform: gpio
    name: LED3_Yellow
    pin: 
      number: 23
      mode: OUTPUT
      inverted: true
  - platform: gpio
    name: LED4_Red
    pin: 
      number: 25
      mode: OUTPUT
      inverted: true

After installing the new firmware, you should see four new switches in Home Assistant (maybe refresh the page). As soon as you switch one of them, the correlated LED will light up.

After succeeding with this, finish the assembly and put some jumpers on, to make the supply work. I first only jumpered the supply (two leftmost pins of J2), switched the buderus control off and put my module in place. Then I switched on again and checked, if I can still switch on the LEDS.

To get it out again, you need release the little plastics lock at the bottom, that catches the rectangular hole in ur PCB.

Putting On The Software Sauce

Since this will be a much harder task than designing just another ESP32 board, you need to wait some days (maybe weeks) for me to figure all that stuff out. I’ll need to send a control word on the serial connection to activate the reporting of the Buderus controller and then I also need to parse the data that is thrown out. I’m not yet excatly sure, how I’ll do it, but I plan to implement a new Sensor, that can be used also with a breadboard-type of electronics.

In the meanwhile, I received some help from Michael. He already connected some ATmega and a WiFi module to the original KM217 and implemented the reverse engineered protocol with help of some forum guys on mikrocontroller.net:

https://www.mikrocontroller.net/topic/309075

https://www.mikrocontroller.net/topic/141831

Stay tuned, to keep updated…

You can get the design files in my project on GitLab (KiCad)…

Have fun!

themole

WordPress Cookie Plugin von Real Cookie Banner