Page 1 of 1

Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Fri May 11, 2018 11:37 am
by jeroenterheerdt
Hi all,

happy to share that I successfully reverse engineered the protocol of the Mitsubishi ZMP AC series (product names: SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S. Remote control part number: RKX502A001P).
I have used ESPEASY and the excellent HeatpumpIR library to put the decoded protocol to work. The code is available on GitHub: https://github.com/jeroenterheerdt/arduino-heatpumpir (my fork) and corresponding PR: https://github.com/ToniA/arduino-heatpumpir/pull/51.

The protocol is 10 bytes. Values below are in HEX.

-Byte 0: 52
-Byte 1: AE
-Byte 2: C3
-Byte 3: 26
-Byte 4: D9
-Byte 5: 0x11 | swingH | (swingV & 0b00000010) | cleanMode
-Byte 6: inverse of byte 5
-Byte 7: 0x07 | fanSpeed | (swingV & 0b00011000)
-Byte 8: inverse of byte 7
-Byte 9: 00 | operatingMode | powerMode | temperature
-Byte 10: inverse of byte 9

The full protocol is in the Excel sheet attached. Also see the comments in the Excel sheet. Thanks to AnalysIR I was able to pull this off!

Re: Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Tue May 22, 2018 11:28 am
by AnalysIR
Thanks for sharing all your work :)

Re: Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Sat Jun 02, 2018 5:49 pm
by AnalysIR
FYI: There are tools in our AnalysIR application to help with reverse engineering & als a checksum calculator to help figure that out too :)

Re: Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Mon Nov 11, 2019 9:11 am
by agpecam
Hello!

Would you please tell me how many data bits the command from this console is?
I do automation, I need two commands - turn on 21 degrees heating and turning off.
There 's very little room for code.

Re: Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Mon Nov 11, 2019 2:13 pm
by AnalysIR
There are 11 bytes in all = 88 bits { There are 10 bytes in all = 80 bits}

However as 3 bytes are checksum, there are 8 unique data bytes = 64 data bits.{However as 3 bytes are checksum, there are 7 unique data bytes = 56 data bits.}

See next post for more details...

Re: Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Mon Nov 11, 2019 10:55 pm
by agpecam
0-10 bytes is 11 bytes. I also read that two parcels were needed. And plus a headline.
The total is 23 bytes = 184 bits. I 'll send the raw code. This team will eventually take me 184 * 2 * 4 = 1472 bytes in code. And there on esp for code only 2500 bytes (
That 's why I 'm clarifying. That exactly whether one parcel needs data or two.
Thanks you!

Re: Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Mon Nov 11, 2019 10:59 pm
by agpecam
There, in the code, the signal and pause of the signal is encoded by a 4 digit hex number. Values in milisecond signal and pause between them.

Re: Mitsubishi Heavy Industries SRKxxZMP-S (SRK25ZMP-S, SRK35ZMP-S, SRK45ZMP-S) reverse engineered

Posted: Mon Nov 11, 2019 11:47 pm
by AnalysIR
in this sketch we show a way to send long AC signals from the HEX value. You should be able to adapt this for your needs & save memory.

https://www.analysir.com/blog/2017/01/2 ... r-signals/