Identical ESP32-for-Haier_V1.1 inside Haier Washing Machine

[Benniepie]

Hello all

I've just opened up my Haier Europe HW90-B149598U1_UK Washing Machine, which uses the Hon app to have a nosey around (there goes the warranty). I've fished out an identical "ESP32-for-Haier_V1.1" board to the one you guys identified in Haier Hon AC units.

Here's my board:

Enclosure:

As a complete beginner in the world of Esphome, given that my device is not an AC unit, where would you advise I start?

I have other Esp32 and Esp2866 boards available. Would you suggest substituting one of these rather than attempt to re-use the original? How would I go about figuring out the parameters for an entirely new device?

Would really appreciate some pointers on how to approach this as you've been here before, albeit for a different bit of kit!

Given Haier's despicable behaviour to the dev of the Hon integration, I'm motivated to find a way for Haier customers liberate their devices from this awful company.

Apologies If this isn't the right place to post

Kind regards

Ben

[Benniepie]

Would perhaps a UART sniffer between the existing Haler ESP32 and the PCB to capiture traffic be a good start?

[paveldn]

Hi @Benniepie,

First of all, let me say that you are the first one with that module in non-AC equipment. I never tried to do anything with Haier's washing machines. So thanks for reaching me.

Yes, the best way is to put a sniffer in between you will need to have two ports on your PC (or other device that will sniff) one for ESP32 -> washing machine, another for washing machine -> ESP32. It should be something like this:

Sorry, I am not good at drawing, made it for ACs but it should be the same in your case. But the first step could be even simpler you can connect Haier ESP32 to a PC and see requests. AC ESP32 devices use 9600 bps speed I expect the same in your case. In the past I was using something like this https://www.tinytronics.nl/shop/en/tools-and-mounting/measuring/accessories/test-probe-with-clamp-pogo-pin-2x5p + ttl to USB convertor to connect ESP32 to PC to avoid cutting of cables. Let me know if I can help you with something,

[Benniepie]

Thank you so much for the prompt and practical reply!

The washing machine is only around 6 months old so this may become common place with new Haier appliances. I also have a Haier Tumble dryer which is around 3 months older than the washer but I haven't checked this one yet.

Thanks for the diagram, makes perfect sense. As my washing machine is in my bathroom, and because I havent got any USB TTL adapters (yet), I was thinking of using an Esphome ESP32 configured with 2xUART (one for the Haier ESP32 TX and one for Haier ESP32 RX) and then use WiFi connectivity and logging to give me access to the serial data wirelessly. This way I can safely reassemble my washing machine with the sniffer ESP32 inside collecting data. Do you think this would work? There is, fortunately a convenient connector I can use to temporarily connect the sniffer to the cables between the Haier ESP32 and PCB without cutting any wires (or soldering) fortunately.

Thank you for the bps rate info and the link to the test Probe/clamp thingy I will order it lt along with the USB TTL adapters for when I need to flash/backup the Haier ESP32.

I'm quite excited to see if this might lead to local control for Haier appliances!!

Kind regards

Ben

[paveldn]

@Benniepie Using ESP with 2 serial ports should work for sniffing. At least it worked for me in the past.
You came just at the right time a couple of days ago I thought that implemented everything I could for Haier ACs and was looking for a new hobby project 😄

[Benniepie]

@Benniepie Using ESP with 2 serial ports should work for sniffing. At least it worked for me in the past. You came just at the right time a couple of days ago I thought that implemented everything I could for Haier ACs and was looking for a new hobby project 😄

Thank you, I can confrirm the Esp worked and Im able to capture UART comms in both directions with it. I read a lot of the document's/code in your Haier Protocol repo and it appears that my washer follows the she same protocol 99% of the time, except with laundry related data. When changing the program on the washer, for example, this is transmitted to the ESP32 as per the Haier protocol with the data part of the frame, containing the program if converted to ascii eg "Eco 40-60", "Synthetics", "Quick".

I have had a bit craziness with the UART data not always behaving, eg missing line breaks or extra line breaks in the middle of a frame so am working to tidy this up and see what other data (or commands). I can reverse engineer. Happy to share data etc if it is of use.

With regard to your next challenge, I'm sure adding Haier appliances to your integration would be challenge (but great timing). it would be very well received by the community if you wanted to pursue it! Im more than happy to help - i have a couple of Haier appliances as a starting point and lots of enthusiasm for a local solution (although this is all new to me so learning as I go!)

Kind regards

Ben

[paveldn]

@Benniepie Great news! I expected something like this. Keep in mind that in the original Haier protocol used by AC (and most likely all other appliances) all 0xFF inside packet (except starting 0xFF 0xFF) should be followed by 0x55 to avoid false detection of frame start. So if you see 0xFF 0x55 inside the packet you should drop 0xFF before interpreting data. If you want me to help with analysis please share the data you collected. Also, it would be useful to see ESP's full flash image. If it is not encrypted you can get a lot of interesting things there especially if there is ASCII data included in packets.

[evlo]

from the haier site haigeek.om

https://resource.haigeek.com/ossdownload/resource/selfService/hardware/uartfile/U%2B%E5%BC%80%E6%94%BE%E5%B9%B3%E5%8F%B0washingMachineDrumIndustryUART%E9%80%9A%E8%AE%AF%E5%8D%8F%E8%AE%AE_20240123185102257.pdf

U+开放平台washingMachineDrumIndustryUART通讯协议_20240123185102257.pdf

a bit different device, but hopefully relevant parts of the protocol will be the same

[frlequ]

That a great side project. Following!

I have Haier Washer Dryer model hwd100-bd1499u1n, If I can be in any help, just ask.

[finalbillybong]

This is very interesting. I have a Haier dishwasher XIB 3B2SFS-80 that I would be a happy to open if this project works out and you'd need data to support.

I do like the idea of using ESP32 to capture the data - less time with the dishwasher in bits = happier wife.

If you could provide basic instructions on getting this going I would happy to supply the data I capture. I wouldn't be able to interpret it but happy to provide.

[paveldn]

@evlo , Thanks you always have the best douments. How are you getting them? I can't find anything there. Are there any other documents regarding other types of hOn hardware? And thanks for the document you provided that is exactly what I needed.

@ALL,
Let me check the document evlo provided. A quick glance shows that the protocol is almost the same, just the status frame is different but I need to check more. Anyway, I will need real communication dumps. My experience with Haier AC shows that not always everything described in the protocol document is working. I will make a short description of how to make an ESP32-based sniffer later (probably tomorrow).

[evlo]

1. login
2. create device - basically this is to add your own appliance to haier ecosystem, so it would need to use the same protocol they use - we already verified this is the case with AC :)
   
3. find the device of similar kind with the template
   for dishwasher I did not find any, but i did not search a lot, but there is an option to request the template
   

but I think there might be something in some other section as the machine translations from chinese, mao's version of chinese even, are not that great

anyway I think chances of them providing the template are rather good, when I wrote with them about the old "smartAir2" they did react, just seemed they do not want to support old / Europe's Haier stuff.

....

this is for the fridge, when there is template it will show the properties

next page again shows the protocol (which if you were creating your own appliance, you could add your custom stuff etc.)

next page has the protocol, you need to delete 预留 / "data backup", if you want to download, as those are unused and duplicate in the spec.

download

hope it is understandable

I did not go trough all the docs, there is general section for devs https://www.haigeek.com/haigeekWeb/#/docs-page/?id=250 but it seems to be that in general chinese hair does not use hON, but the UART level seems to be same

[paveldn]

Great, thanks. Never was able to get this far.
As for the documentation, I saw it in the past, it does not add anything new to the protocol description. There is some info but not really much new.

[Benniepie]

For those with a Haier washing machine here's a pic with the Haier ESP32 location (holding the front control panel upside down). Esp32 is in the black enclosure with a green sticker.

To access:

1. Remove lid (two screws at rear of machine then slide backwards)
2. Remove detergent drawer
3. Detach front panel (Two screws on either side of detergent drawer, four clips on top two of which have screws and then a bit of heft to detach)

The Haier ESP32 is inside the black enclosure with a green sticker. I followed the TX and RX cables from the Haier ESP32 to the connector (Haier ESP32 RX is green cable and the Haier ESP32 TX is white).

These correspond to MCU_TX and MCU_RX on the Esp32:

I inserted extra cables into the connector (the loose cables in the pic) and hooked them up to separate RX pins on my Sniffer ESP32 running Esphome (two UART buses, 9600 baud, debug set to VERBOSE)

I have no idea if this is the best way or even a sensible way of doing it but it is working and I didn't have to cut any cables/solder.

Will do some laundry and post my data shortly.

[Benniepie]

1. login
2. create device - basically this is to add your own appliance to haier ecosystem, so it would need to use the same protocol they use - we already verified this is the case with AC :)
   
3. find the device of similar kind with the template
   for dishwasher I did not find any, but i did not search a lot, but there is an option to request the template
   

but I think there might be something in some other section as the machine translations from chinese, mao's version of chinese even, are not that great

anyway I think chances of them providing the template are rather good, when I wrote with them about the old "smartAir2" they did react, just seemed they do not want to support old / Europe's Haier stuff.

....

this is for the fridge, when there is template it will show the properties next page again shows the protocol (which if you were creating your own appliance, you could add your custom stuff etc.)

next page has the protocol, you need to delete 预留 / "data backup", if you want to download, as those are unused and duplicate in the spec.

download

hope it is understandable

I did not go trough all the docs, there is general section for devs https://www.haigeek.com/haigeekWeb/#/docs-page/?id=250 but it seems to be that in general chinese hair does not use hON, but the UART level seems to be same

Thank you so much - these docs really help!

[finalbillybong]

So I took my dishwasher to pieces just too compare what I would find to your washing machine @Benniepie.

Mine is quite different and has the ESP module mounted onto the control board. It is also marked up as ESP Solo rather than ESP for Haier.

I do have access to the RX, TX GPIO0 and GND pins though. So I am happy to see if I can dump the contents of the chip but I will need some slight assistance with the method.

Hopefully I can help with this as my Wife asked me why I had the dishwasher in bits and the reply 'for the war effort' did not seem like a satisfactory answer for her for some reason.

[Benniepie]

Good work @finalbillybong glad I'm not the only one crazy enough to dismantle their home appliances! interesting that it is a different chipset in yours.

The ESP32-SOLO-1 is a single core ESP32 and just needs a bit of extra config to run Esphome, so based on what little I know doesn't rule it out. It has a single UART bus so RX and TX may allow you to listen in to the UART comms as I have. As for dumping the image, I haven't got that far yet with mine but hopefully others can advise.

Do you use the Haier Hon home assistant integration? If so can you press the 'show device info' button? It will generate a notification with info about your appliance. I'm interested in what it says under 'attributes' - particularly chipset?

Would be useful to collect this info to identify the same chipset in other appliances

E.g. for my Washing machine ESP32-For-Haier-V1.1 it says the chipset is ESP32D0WDQ5

P.s. 'for the war effort' is a great answer in more ways than one considering Haier's dubious corporate ethics 🇺🇦

[finalbillybong]

Do you use the Haier Hon home assistant integration? If so can you press the 'show device info' button? It will generate a notification with info about your appliance. I'm interested in what it says under 'attributes' - particularly chipset?

I do! More than happy to provide that. I also have a Hover washing machine and a Candy tumble dryer that use the hOn app..... but I'll dismantle one at a time for now.

Would be useful to collect this info to identify the same chipset in other appliances

P.s. 'for the war effort' is a great answer in more ways than one considering Haier's dubious corporate ethics 🇺🇦

Yeah that was my reference but seeing as she has no idea of the Haier/Andre situation she didn't appreciate the genius of my answer /s

data:
  additional_data:
    options:
      opt1: threeInOne
      opt2: ecoExpress
      opt3: halfLoad
      opt4: extraDry
      opt5: openDoor
      opt6: addDish
  appliance:
    applianceId: xx-xx-xx-xx-xx-xx#2022-07-02T13:40:31Z
    applianceModelId: 874
    applianceStatus: 1
    applianceTypeId: 9
    applianceTypeName: DW
    attributes:
      acuVersion: 0.0.0
      chipset: ESP32D0WDQ5
      dictionaryId: 292
      fwLabel: nuib
      lang: it-IT
      uiVersion: 5.5.0
    brand: haier
    code: 32901553
    connectivity: wifi|ble
    eepromId: 812
    eepromName: 70010344
    enrollmentDate: 2022-07-02T13:40:31.270Z
    firstEnrollment: False
    firstEnrollmentTBC: False
    fwVersion: 5.5.0
    id: 874
    lastUpdate: 2022-07-02T13:40:42Z
    macAddress: xx-xx-xx-xx-xx-xx
    modelName: XIB 3B2SFS-80
    purchaseDate: 2022-07-01T23:00:00.000Z
    sections:
      chatbot: True
      check_up: False
      ecoDelayStart: True
      enroll_under_norms: False
      quickPair_enabled: False
    series: haier2021
    topics:
      publish:
      subscribe:
        - $aws/events/presence/disconnected/xx-xx-xx-xx-xx-xx
        - $aws/events/presence/connected/xx-xx-xx-xx-xx-xx
        - haier/things/xx-xx-xx-xx-xx-xx/event/appliancestatus/update
        - haier/things/xx-xx-xx-xx-xx-xx/event/discovery/update
  attributes:
    active: False
    activity:
    commandHistory:
      command:
        ancillaryParameters:
          ecoIndex: 4
          energyLabel: 4
          functionalId: 8
          powerWashPrz: 1
          programFamily: [hidden|guided]
          programType: WD
          remainingTime: 39
          remoteActionable: 1
          remoteVisible: 1
          suggestedLoadD: 6.5
          temp: 60
          waterEfficiency: 5
          waterSaving: 83
        applianceOptions:
          opt1: threeInOne
          opt2: ecoExpress
          opt3: halfLoad
          opt4: extraDry
          opt5: openDoor
          opt6: addDish
        applianceType: DW
        attributes:
          channel: mobileApp
          energyLabel: 0
          origin: standardProgram
        commandName: startProgram
        device:
          appVersion: 2.0.10
          deviceModel: exynos9820
          mobileId: a14582a86464a7a0
          mobileOs: android
          osVersion: 31
        macAddress: xx-xx-xx-xx-xx-xx
        parameters:
          checkUpStatus: 0
          delayTime: 0
          extraDry: 0
          halfLoad: 0
          onOffStatus: 1
          openDoor: 0
          prCode: 21
          prPosition: 13
          prStr: Rapid 39' 60°C
        timestamp: 2024-01-23T03:30:00.185Z
        transactionId: xx-xx-xx-xx-xx-xx_2024-01-23T03:30:00.185Z
      timestampAccepted: 2024-01-23T03:30:02.0Z
      timestampExecuted: 2024-01-23T03:30:03.0Z
    lastConnEvent:
      category: CONNECTED
      instantTime: 2024-01-23T20:18:02Z
      macAddress: xx-xx-xx-xx-xx-xx
      timestampEvent: 1706041082276
    parameters:
      addDish: 1
      addDishStatus: 0
      armStatus: 0
      buzzerDisabled: 0
      cameraStatus: 0
      checkUpStatus: 0
      delayTime: 0
      doorStatus: 0
      ecoExpress: 0
      errors: 00
      extraDry: 0
      halfLoad: 0
      lang: 2
      lastCycleSavingStatus: 0
      macAddressCamera: 
      machMode: 1
      openDoor: 0
      photoSessionStatus: 0
      prCode: 15
      prCodeSuggest: 0
      prPhase: 0
      prPosition: 3
      program1: 514
      program10: 18
      program11: 0
      program12: 0
      program13: 0
      program14: 0
      program15: 0
      program16: 0
      program17: 0
      program18: 0
      program19: 0
      program2: 2
      program20: 0
      program21: 0
      program3: 0
      program4: 88
      program5: 0
      program6: 1
      program7: 0
      program8: 6
      program9: 5
      remainingTimeMM: 160
      remoteCtrValid: 1
      rinseAidStatus: 0
      saltStatus: 0
      specialAutomaticStatus: 0
      temp45to55: 161
      temp60to65: 94
      temp70to75: 7
      threeInOne: 0
      waterHard: 4
    programName: auto_universal_soil
    resultCode: 0
  extra_command_data:
    startProgram:
      extraDry:
        1: 189
      halfLoad:
        1: 139
      openDoor:
        1: 225
  settings:
    custom:
      category: setParameters
    parameters:
      buzzerDisabled: 0
      lastCycleSavingStatus: 0
      waterHard: 4
  startProgram:
    ancillaryParameters:
      ecoIndex: 4
      ecoIndexOpt3: 0
      ecoIndexOpt4: 0
      ecoIndexOpt5: 0
      energyLabel: 4
      functionalId: 2
      programFamily: [dashboard|guided]
      programRules: {'opt2': {'opt3': {'1': {'typology': 'fixed', 'fixedValue': '0'}}, 'opt7': {'1': {'typology': 'fixed', 'fixedValue': '0'}}, 'opt8': {'1': {'typology': 'fixed', 'fixedValue': '0'}}, 'opt4': {'1': {'typology': 'fixed', 'fixedValue': '0'}}}, 'opt3': {'opt2': {'1': {'typology': 'fixed', 'fixedValue': '0'}}, 'opt8': {'1': {'typology': 'fixed', 'fixedValue': '0'}}}, 'opt4': {'opt2': {'1': {'typology': 'fixed', 'fixedValue': '0'}}}, 'opt7': {'opt2': {'1': {'typology': 'fixed', 'fixedValue': '0'}}}, 'opt8': {'opt2': {'1': {'typology': 'fixed', 'fixedValue': '0'}}, 'opt3': {'1': {'typology': 'fixed', 'fixedValue': '0'}}}}
      programType: WD
      remainingTime: 179
      remoteActionable: 1
      remoteVisible: 1
      suggestedLoadD: RL100
      temp: 45
      waterEfficiency: 4
      waterSaving: 77
    custom:
      program: eco_bldc
    parameters:
      checkUpStatus: 0
      delayTime: 0
      extraDry: 0
      halfLoad: 0
      onOffStatus: 1
      openDoor: 0
      prCode: 8
      prPosition: 1
      prStr: 0
  statistics:
    drawerCleaning:
      count: 410
      percentage: 410
      remaining: -310
      tot: 100
    drumCleaning:
      count: 410
      percentage: 410
      remaining: -310
      tot: 100
    filterCleaning:
      count: 410
      percentage: 2733
      remaining: -395
      tot: 15
    lastCheckup: None
    mostUsedPrograms:
      - count: 316
        prCode: 8
        prPosition: 1
        programName: PROGRAMS.DW.ECO_BLDC
        programType: D
      - count: 83
        prCode: 10
        prPosition: 4
        programName: PROGRAMS.DW.IOT_FAIRY_QUICK_CYCLE
      - count: 13
        prCode: 10
        prPosition: 4
        programName: PROGRAMS.DW.RAPID_59
      - count: 10
        prCode: 10
        prPosition: 4
        programName: PROGRAMS.DW.undefined
        programType: D
      - count: 6
        prCode: 3
        prPosition: 8
        programName: PROGRAMS.DW.INTENSIVE_RAPID
    programsCounter: 428
    resultCode: 0
    sprayArmsCleaning:
      count: 410
      percentage: 410
      remaining: -310
      tot: 100
    tabs: 0
    temperatureUsage:
      temp45to55: -1
      temp60to65: -997
      temp70to75: -8
  stopProgram:
    parameters:
      onOffStatus: 0
commands:
  settings:
    buzzerDisabled:
      max: 1
      min: 0
      step: 1
    category:
      - setConfig
      - setParameters
    lastCycleSavingStatus:
      max: 1
      min: 0
      step: 1
    waterHard:
      max: 7
      min: 0
      step: 1
  startProgram:
    delayTime:
      max: 1410
      min: 0
      step: 30
    ecoIndexOpt3:
      - eyixijo1fq==
    ecoIndexOpt4:
      - eyixijoyldv9
    ecoIndexOpt5:
      - eyixijo1fq==
    energyLabel:
      max: 5
      min: 0.5
      step: 1
    extraDry:
      max: 1
      min: 0
      step: 1
    halfLoad:
      max: 1
      min: 0
      step: 1
    openDoor:
      max: 1
      min: 0
      step: 1
    program:
      - Auto Sensor
      - Rapid 29' 50°C
      - Rapid 39' 60°C
      - auto_sensor_soil
      - auto_universal_plus_soil
      - auto_universal_soil
      - dishwasher_care
      - eco_bldc
      - gentle_wash
      - glassware
      - hygiene_plus
      - intensive_rapid
      - iot_baby_care
      - iot_breakfast
      - iot_checkup
      - iot_china_crystals
      - iot_cocktail_glasses_soil
      - iot_daily_care_soil
      - iot_dinner_for_two_soil
      - iot_dreft_quick_cycle
      - iot_extra_hygiene
      - iot_fairy_quick_cycle
      - iot_happy_hour
      - iot_party_soil
      - iot_pizza_menu_soil
      - iot_plastic_tupperware
      - iot_porcelain
      - iot_pot_&_pans_soil
      - iot_power_mix_wash_soil
      - iot_pyrex_and_glassware
      - iot_single
      - iot_super_flash
      - iot_super_wash
      - iot_turbopower
      - iot_voice_automatic
      - iot_voice_eco
      - iot_voice_prewash
      - iot_voice_rapid_59
      - iot_voice_universal
      - iot_wok_grids_maxi_pans_soil
      - prewash
      - rapid_29
      - rapid_39
      - rapid_59
      - steam_plus
      - ultra_silence
    programFamily:
      - dashboard
      - guided
      - dashboard_guided
    remainingTime:
      max: 160
      min: 145
      step: 15
    temp:
      max: 60
      min: 50
      step: 10
rules:
  startProgram:
    extraDry:
      1:
        ecoExpress: 0
    halfLoad:
      1:
        ecoExpress: 0
        opt8: 0
pyhOnVersion: 0.13.0

It seems mine says the same as yours for chipset. I also checked my other two appliances and they say the same. Will have a closer look when I get time to take them apart.

[paveldn]

``@finalbillybong
I know your feelings my wife also complains about half-disassembled ACs that sometimes beep and do strange things during my experiments 😄 . @Benniepie right ESP32 Solo is single core version of ESP32
To make a full flash dump you will need a esptool . You can install it from repo or using pip (for python)
After you connect your board to the PC with TTL to USB you need to switch your ESP to "flash mode" by connecting IO0 and ground and powering the board at the same time. After that, you can run python esptool.py flash_id (or just `esptool flash_id` if you installed with pip)
it should show you something like this:

Connecting....
Detecting chip type... ESP32
Chip is ESP32-D0WDQ6 (revision v1.0)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: 24:0a:c4:ef:69:20
Uploading stub...
Running stub...
Stub running...
Manufacturer: d8
Device: 4016
Detected flash size: 4MB
Hard resetting via RTS pin...

This is just info for one of my ESP devices in your case it can be different. The most important part here is the Chip and flash size. Most likely your size will be 4 Mb.
After that, you can run:

python esptool.py -b 115200 --port <port_name> read_flash 0x00000 0x400000 flash_4M.bin

Or use another size if your flash is not 4 MB. After that you will have a flash file with backup if something goes wrong. Let me know if something will not work I will try to help. After you get your fullflash file we can try to figure out if it is encrypted. Hope it is not because it will make everything much more difficult. But will see.

[finalbillybong]

Excellent @paveldn thank you for that. I am in the proces of dumping the flash now.

I will repot back when I have the whole file to share.

EDIT: flash_4M.bin.gz

[finalbillybong]

So I have left dupont wire soldered to the ESP and refitted it to my dishwasher. There is loads of spare space in there so I can easily fit another ESP32 or ESP8266 to sniff the packets. Could someone could point me in the direction of the correct Arduino sketch or ESP yaml code that I can flash to start gathering data? Doing so wirelessly would be ideal as it means I don't need to interrupt our daily use of the appliance other than the ten minutes it will take to fit.

I have opened the .bin file in a hex editor and from my incredibly limited knowledge it does not look encrypted. I can see references to program cycles and also some kind of certs. I'll obviously leave it to those that know better to decided whether any of this is useful.

[paveldn]

@finalbillybong I checked your flash dump and good news it looks like unencripted (thanks for it). So the is good news.
Bad news that approach with ESP32 and 2 ports for sniffing will not work for you. This port it is not the same that used to communicate to dishwasher. All you will get there is logs (if we are lucky).
So it will be not that easy in your case.
There is 2 ways:

1. We need to figure out which pins is used to communicate to your dishwasher. I would start with TX 17, RX 16 but we need to check your board first. If you are good in soldering you solder wires to +5V, ground, and RX and TX pins and after that we can do the same sniffing thing as for washing machines.
2. We anyway need to figure out RX and TX as in 1. I am building custom esphome firmware for you with component that try to communicate with it and after that we try to make it work.

1st way will let us to sniff original module which is always good but it require to do some very carefully soldering. 2nd one is easier for you but we will be completly blind here.
So that is how we can proceed

[finalbillybong]

@paveldn Right OK, I understand.

I am mediocre at soldering, at best so if possible I would rather try and do it with the ESP Home firmware, first if that is OK?

If that fails I will try method 1. Can I just confirm that these are the correct pins to solder to?

[paveldn]

@finalbillybong you also need to have a common ground, in opposite case reading on RX TX can be wrong.
Making a special firmware for you will take some time, I will let you know when I will have something to test.

[finalbillybong]

OK , sure thing. I will await to hear from you.

[paveldn]

@ALL, I promised that I will make a post how to make sniffer for washing machine but unfortunatly I had a crazy day at work today. So didn't have a lot of time. I made a esphome config for sniffing but didn't have a time to test it. It should work but still. Hope tomorrow i will have time to try it and make photo with details. Config:

substitutions:
  device_name: "Dual UART sniffer for Haier project"
  device_id: uart_sniffer

esphome:
  name: ${device_id}
  comment: ${device_name}

esp32:
  board: esp32dev

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password
    
api:
  reboot_timeout: 0s

ota:

web_server:

logger:
  tx_buffer_size: 4096
  baud_rate: 0
  level: DEBUG

uart:
  - id: esp_board
    rx_pin: GPIO3
    baud_rate: 9600
    debug:
      direction: RX
      dummy_receiver: true
      sequence:
        - lambda: UARTDebug::log_hex(uart::UART_DIRECTION_RX, bytes, ' ');
  - id: haier_appliance
    rx_pin: GPIO16
    baud_rate: 9600
    debug:
      direction: RX
      dummy_receiver: true
      sequence:
        - lambda: UARTDebug::log_hex(uart::UART_DIRECTION_TX, bytes, ' ');

Ofcourse you will need to change config depending on board type and pins that you are using. My config is for general ESP32 dev board and for GPIO3 connected to TX of Haier ESP board and and GPIO16 connected to TX of washing machine control board. If you will try it let me know if it worked.

[finalbillybong]

Out of boredom I decided to have a look at the spares list for my dishwasher.

It turns out they sell the main board. So @paveldn if method 2 does not work out I would be prepared to purchase a main board specifically for this project and can then mess about with it without incurring the wrath of my wife if I break our dishwasher.

https://www.haierspares.eu/en/70014304/Nautilus%20Digit%20card

I assume I could power the chip with my FTID adapter and just test it on my desk rather than fitting it into my machine.

[Benniepie]

@ALL, I promised that I will make a post how to make sniffer for washing machine but unfortunatly I had a crazy day at work today. So didn't have a lot of time. I made a esphome config for sniffing but didn't have a time to test it. It should work but still. Hope tomorrow i will have time to try it and make photo with details. Config:

substitutions:
  device_name: "Dual UART sniffer for Haier project"
  device_id: uart_sniffer

esphome:
  name: ${device_id}
  comment: ${device_name}

esp32:
  board: esp32dev

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password
    
api:
  reboot_timeout: 0s

ota:

web_server:

logger:
  tx_buffer_size: 4096
  baud_rate: 0
  level: DEBUG

uart:
  - id: esp_board
    rx_pin: GPIO3
    baud_rate: 9600
    debug:
      direction: RX
      dummy_receiver: true
      sequence:
        - lambda: UARTDebug::log_hex(uart::UART_DIRECTION_RX, bytes, ' ');
  - id: haier_appliance
    rx_pin: GPIO16
    baud_rate: 9600
    debug:
      direction: RX
      dummy_receiver: true
      sequence:
        - lambda: UARTDebug::log_hex(uart::UART_DIRECTION_TX, bytes, ' ');

Ofcourse you will need to change config depending on board type and pins that you are using. My config is for general ESP32 dev board and for GPIO3 connected to TX of Haier ESP board and and GPIO16 connected to TX of washing machine control board. If you will try it let me know if it worked.

Thanks for this, great to see how fast progress is being made!

I have been using an ESP-Wroom-32 board with almost the same config as above but found no data was being received on GPI03 - I think because the UART0 bus on this variant uses these pins for the micro USB serial connectivity it caused some craziness to do with the voltage on GPIO3 when it booted (i was out of my depth at this point!). After a lot of fiddling I found repurposing GPIO1 for RX instead of GPIO3 along with GPIO16 did the trick and I was able to capture communication in both directions.

I've found I'm getting the occasional data error while the washer is running (missing bytes) which may be buffer related as mine isnt as high as in your config. However, when the washer does its spins cycle the log floods with FF bytes. Legitimate data is still present despite this and I assume this is the vibration causing connection issues/interference. I haven't yet logged a full wash cycle from start to finish yet, so that's tonight's job.

[paveldn]

It turns out they sell the main board. So @paveldn if method 2 does not work out I would be prepared to purchase a main board specifically for this project and can then mess about with it without incurring the wrath of my wife if I break our dishwasher.

It is quite an expensive board, it looks like you seriously want your washer machine to work with your smart home 😄 It is always better to have a backup.

I've found I'm getting the occasional data error while the washer is running (missing bytes) which may be buffer related as mine isn't as high as in your config. However, when the washer does its spins cycle the log floods with FF bytes. Legitimate data is still present despite this and I assume this is the vibration causing connection issues/interference. I haven't yet logged a full wash cycle from start to finish yet, so that's tonight's job.

Yes, probably it is vibration causing those FFs. Thanks for the update and we are waiting for logs from you

@ALL
So I checked the document we got from @evlo and information from @Benniepie and it looks like the basic protocol is the same. Not only transport level, but all commands and even subcommands are the same or almost the same. The only difference is content. That gives me the idea to create custom esphome-based firmware that we will be able to use for analysis and experiments. Haier protocol is a question-answer kind of protocol ESP asks asking the appliance is answering. So I will make a couple of buttons to make the most common things like request hardware version, request software version, request status, request active alarms, etc. Plus sending of custom commands. Nothing really new I did it all for Haier Air Conditioners already just this time it should be implemented as UARTComponent for esphome not as Climate. Then in cases like @finalbillybong's when there is no way (or too difficult) to sniff what is original module doing we would be able to flash this custom esphome and can make experiments. At least it will give us some info. That is my plan. But it will require some work.

[finalbillybong]

It is quite an expensive board, it looks like you seriously want your washer machine to work with your smart home 😄 It is always better to have a backup.

Yes it is expensive, but as I am not able to contribute to the software or analysis side of this project I am more than happy to contribute with testing and reporting, the firmware dump (and future dumps of other machines, if required) and this purchase, if it is required, so this project can hopefully benifit the whole community oh hOn users.

[paveldn]

I put the yaml files into my esphome directory and was able to build the firware using esphome web - is this the correct way to do it?

Yes, one of the possible ways

I flashed the .bin to my ESP32 devkit and it seems to work fine. I will be flashing it to my dishwasher and repoting back what I find as soon as the spare board is here.

Good luck! Keep in mind that it is possible that we were wrong about the UART port pins. Maybe it will require more "playing" with config, Anyway if you need help just let me know, Keep in mind that you can always restore you flash backup with esptool,

[finalbillybong]

I missed a package delivery today that should be delivered tomorrow.

It will either be the spare main board for the dishwasher or the pogo pin adapter, so I will have either dumped tumble dryer firmware or reports from the testing of the custom ESP Home image on my dishwasher to share tomorrow.

Edit: I'm still wainting on both packages....

[NickStallman]

I'm just dumping some initial notes from my exploration of a Haier HRF680YPC Quad Door Refrigerator Freezer, 91cm, 623L, Ice & Water.

The Wifi module is very convenient to access under a plastic cover on the top of the fridge that is accessible while the fridge is still on with just a couple of screws. The plastic cover also houses the door sensors so it may start beeping at you to close the door if you take it off while the fridge is still on.

The module looks different from the other appliances, it is a WCATA007 and appears to have a 5 pin wiring harness.

I'll remove the module later and figure out some pinouts and hook in a ESP to intercept the data.
I'm also curious to see if the fridge functions without the module which would be excellent - the wifi in a fridge feature is currently relatively useless so I'm hoping to be able to unlock some additonal functionality.

[paveldn]

@NickStallman
If what I found is correct https://fcc.report/FCC-ID/ZKJ-WCATA007/4188952.pdf this module uses RTL8711AM chip which is ARM architecture nor Xtensa nor RISC-V that used by ESP32. So, no way it can be flashed with ESPHome. There is a chance that document is outdated it is from 2019 so maybe there is a new gen based on ESP32. But in any case it still can use same protocol. Let me know if you can sniff protocol I will check.

[roberglezz]

Hi Everyone,

Is there any reason why this project is on standby, I just bouthg a new Fridge from Haier and I am more than welcome to collaborate in this project.

[paveldn]

Hi Everyone,

Is there any reason why this project is on standby, I just bouthg a new Fridge from Haier and I am more than welcome to collaborate in this project.

Hi. I think nobody is interested anymore. There is https://github.com/Andre0512/hon repository that uses Haier Cloud for HA. There was some tension between the author and Haier so everybody wanted local integration but now the problem is resolved so everybody is back to Andre's solution. Personally, for me, it is very difficult to add support without hardware on the hands. Also, I don't feel good asking people to risk their new shiny Haier appliance to do my crazy experiments 😃 . And the worst thing it will be difficult to recover the board if ESP is soldered there. So unless you are a highly professional hardware engineer who knows how to recover boards it can be difficult to do.

[finalbillybong]

Hi Everyone,

Is there any reason why this project is on standby, I just bouthg a new Fridge from Haier and I am more than welcome to collaborate in this project.

I am very much still interested in getting local access working for the Haier devices.

Unfortunately, the mainboard I ordered to use as a test for the custom firmware never arrived, and I ended up opening a PayPal case against Haier and getting a refund. As my wife won't allow me to use our appliances for testing, I'm afraid my contribution to the project has to end here.

[roberglezz]

Hi Everyone,
Is there any reason why this project is on standby, I just bouthg a new Fridge from Haier and I am more than welcome to collaborate in this project.

Hi. I think nobody is interested anymore. There is https://github.com/Andre0512/hon repository that uses Haier Cloud for HA. There was some tension between the author and Haier so everybody wanted local integration but now the problem is resolved so everybody is back to Andre's solution. Personally, for me, it is very difficult to add support without hardware on the hands. Also, I don't feel good asking people to risk their new shiny Haier appliance to do my crazy experiments 😃 . And the worst thing it will be difficult to recover the board if ESP is soldered there. So unless you are a highly professional hardware engineer who knows how to recover boards it can be difficult to do.

I did not open my fridge yet but I have the impresion will have the same esp32 board that newer AC has it. I also have 3 AC's with the new board but just waiting forn a JST conector to arrive in order to connect a flashed ESP32 for local control. I will advise once I open the fridge.

[paveldn]

@roberglezz
If inside will be a separate module we can give it a try. Of course, I will need a lot of support from you and we will need to perform a lot of tests. It should be fun 😄

[Webbeh]

Hey
I'm willing to let you use my Hoover HWash & Dry 500 for testing if you need.
I should have an esp32 handy.

[paveldn]

@GOinfo-Ltd
We can give it a try. But what I really need is a reliable recording of communication between the original Haier ESP module and the washing machine. I have some logs already and have some basic analysis but still a lot of data is not clear. And what is a completely dark area is how to control the washing machine. It would be great if somebody could make a recording with comments on communication between Haier ESP and the Washing machine when setting some parameters from hOn machine

[AussieMakerGeek]

I have a Haier washing machine and dryer, I don't mind hooking up whatever is needed and providing data for the greater good. Only problem is that the dryer is on top of the washer so it's a bit of an effort to get to the washer.

I have plenty of experience with microcontrollers, soldering, programming etc.

[NickStallman]

I too also recently got a washer / dryer. I did see some documentation that there was a diagnostics port inside the detergent drawer (which the dryer also has for the water tank) but my model doesn't hide it there unless I'm missing something.

Taking it totally apart isn't an option (wife approval factor), but the module for the fridge is easily accessible once you know where it is so I'm hoping the washer/dryer also hide it somewhere easy.

[AussieMakerGeek]

It's just behind the front panel in both from what I read. You just remove a couple of screws from the back for the lid, slide it off and they are relatively easy to access from there.

Same here with the WAF, I just have to do it in a slightly covert way.. She know's i'm crazy like that but it's easier to just avoid the conversation in the first place :)

[paveldn]

Hi everybody, thanks I would really appreciate your help. I am traveling this weekend and will be back next week. Once back I will write a post with detailed description what information I need and possible ways to get it But afraid it wouldn't be easy.

[KameDomotics]

Thank you for the work you are doing, it is very valuable. Unfortunately I don't have the technical skills to help you, but I am following this project with interest. I have a Candy washer and dryer (Haier Group, hOn app) and it would be really great to be able to control it with an ESP locally.

[paveldn]

@KameDomotics you are welcome unfortunately to advance in developing code for appliances which I don't have on my hands I need help from somebody who can implement some difficult scenarios.

@ALL sorry it took longer than I expected. Let me describe what kind of data I need and how you can help me.
What I need:

• Basic communication between ESP and appliance
• Getting status from appliance
• ESP controlling appliance

For Haier washing machines I have first and second but not first. For everything else (except ACs and washing machines) - nothing.
How can you get it? The most reliable and most difficult way is to "sniff" communication between the native dongle and appliance using the hOn application to control ESP. I would need a recording of this communication together with comments on what is done on the hOn side and what application is showing. Information on how to "sniff" communication is here: https://github.com/paveldn/haier-esphome/blob/experimental/docs/sniffing_serial_communication.rst
"Sniffing" is the only way I know to get "control" kind of information. If ESP is a separate module it is possible to cut the original wire and make a connection to "listen" communication. But if ESP is soldered to the board it is not really possible.

[paveldn]

Another thing you can do is to use https://github.com/paveldn/hon-test it is an ESPhome firmware for the ESP module (you can even try to flash the original Haier ESP module but make a backup first! https://github.com/paveldn/haier-esphome/tree/experimental?tab=readme-ov-file#how-to-backup-the-original-image-and-flash-esphome-to-the-esp32-haier-module ) and try to send some standard commands to appliance and see how it reacts. But of you want to do this please contact me first.

[paveldn]

Another thing you can do is describe what you want from ESPhome integration. For example: I can try to ESPHome component for washing machines that just listens and shows some of the parameters. I have all data required for this right now. But I have nothing regarding control.
What do you expect from ESPHome integration? What kind of data you would like to see? What parameters you want to control?

[KameDomotics]

Another thing you can do is describe what you want from ESPhome integration. For example: I can try to ESPHome component for washing machines that just listens and shows some of the parameters. I have all data required for this right now. But I have nothing regarding control.

What do you expect from ESPHome integration? What kind of data you would like to see? What parameters you want to control?

So currently I can see the status of the washing machine but not control it? For example the program and remaining time?

I have a CANDY washing machine model CSO496TWMB6/1S, I don't know where the wifi module is located though.

[paveldn]

@KameDomotics I have enough information to try to implement it. It is not ready yet.

[AussieMakerGeek]

So today I pulled apart my Haier Dryer. It contains a WCATA006 module https://fcc.report/FCC-ID/ZKJ-WCATA006 which is a realtek chip and not the ESP32. However, I have installed an ESP32 serial sniffer to check the protocol as per previous link

Where to from here? I don't know where/how to see the protocol data in HA.

[paveldn]

@AussieMakerGeek
Good news! So to use the ESP32 serial sniffer you will need to connect to it using esphome dashboard LOGS button: like this:

You should be able to see hex logs, a lot of messages that start with >>> and <<< with 0-9 A-H characters. For the beginning wait for 2-3 min and use the "Download logs" button you will get a file share it with me and I will at least identify the protocol. Later we can try to identify all the parameters and try to use scenarios.

But today I am starting my vacation so for the next 2 weeks I will be traveling so most likely I will not have s lot of time. I will be back 19 of August. But I will try to find some time at least to do some basic analysis. I am curious 😄

[AussieMakerGeek]

When I click on that it says no logging is enabled. I copied the logging section as written but perhaps there is a formatting issue?

[paveldn]

Strange. Logging is enabled:

logger:
  tx_buffer_size: 4096
  baud_rate: 0
  level: DEBUG

Yes, there is no serial logging but logging over WiFI should be available. Did the logger connect to your WiFi? Can you access it's web interface?

[paveldn]

Also, I have another news. My old washing machine (not Haier) died after years of humble service to our family. And I convinced my wife to buy a new Haier washing machine. My wife was not happy and made me promise that I would not break it or leave it in a half-assembled state 😅 and that it would be always available for its main purpose. So my hands are tied but nothing can stop an engineer's curiosity. After I will be back from vacation I will do my own experiments and will resume my work on ESPHome integration for washing machines.

[AussieMakerGeek]

Ah, that's awesome. I might not have to lift my dryer down after all :)

It was just me - Somehow i left out the logging section. I can see the data now :)

[KameDomotics]

So today I pulled apart my Haier Dryer. It contains a WCATA006 module https://fcc.report/FCC-ID/ZKJ-WCATA006 which is a realtek chip and not the ESP32. However, I have installed an ESP32 serial sniffer to check the protocol as per previous link

Where to from here? I don't know where/how to see the protocol data in HA.

Could you tell me in which part of the dryer the wifi module is installed? I have a Candy though (same Haier group)

[AussieMakerGeek]

Could you tell me in which part of the dryer the wifi module is installed? I have a Candy though (same Haier group)

For me, it was right behind the front panel display. I removed 2 screws from the back that secure the top/lid of the machine. It then slides back and lifts off.

From there, you can see the module but not really get to it. There was two screws on top that secure the front panel, and 3 inside the water tray opening (i have a heat pump dryer). Once they were removed I could maneuver the front panel off.

For the ESP32, I spliced into the 4 wires with enough wire to reach over to the water tray area and once re-assembled, I used some DS tape to secure it above the tray. This way I could still have access to it.

Side note - I think using GPIO3 is bad (as mentioned earlier). When I went to set up the wifi on the machine, it would error until I disconnected the ESP32 - I have not reconnected it just yet.

I took some photos but I don't have access to them right now.

Side note - the hOn service is not available in Australia - For us it is SmartHQ.