Emulating a Nibe AXC40 as ECS_S3 (address 0x03)

[Philiphall6]

I'm working on extending the ESPHome NibeGW component to emulate an AXC40/ECS circuit on a Nibe heat pump.

Current status

The heat pump successfully detects the accessory as:

• ECS_S3 (address 0x03)
• Accessory token EE is acknowledged
• No communication alarms

Current ESPHome configuration:

- address: ECS_S3
  token: ACCESSORY
  data: [0x01, 0x0F, 0xA2]

- address: ECS_S3
  token: ECS_DATA_MSG_1
  data: [0x02, 0x02, 0x77, 0x20, 0x06]

- address: ECS_S3
  token: ECS_DATA_MSG_2
  data: [0x02, 0x00, 0x00, 0xA0, 0x06]

- address: ECS_S3
  token: ECS_DATA_REQ
  data: [0x00, 0x93]

Observations

Real ECS_S2 traffic:

5C 00 02 A0
5C 00 02 55
5C 00 02 90

ECS_S3 traffic observed from the heat pump:

5C 00 03 A0
5C 00 03 A3
5C 00 03 A4
5C 00 03 AF
5C 00 03 EE

The heat pump actively requests A3, A4 and AF for address 0x03.

I added support for:

ECS_DATA_A3 = 0xA3
ECS_DATA_A4 = 0xA4
ECS_DATA_AF = 0xAF

but I do not know the expected payload structure.

Problem

The heat pump creates circuit S3 correctly, but sensor values are wrong:

BT2 (Supply temperature S3) = 0.0°C
BT3 (Return temperature S3) = 20.8°C

Changing the payload contents does not seem to affect BT2.
According to the Nibe register database:

40006 = EP22-BT2 Supply temp S3
40128 = EP22-BT3 Return temp S3
40031 = EP22-BT50 Room temp S3

(all s16 with factor 10)

Additional information requested

I am also looking for information regarding the control of the mixing valve and circulation pump for an AXC40/ECS circuit.

Specifically:

• Which messages/tokens contain the mixing valve position command?

• Which messages/tokens contain the circulation pump enable/disable command?

• Addresses/registers used by ECS_S3 for:

  • BT2 (Supply temperature)
  • BT3 (Return temperature)
  • BT50 (Room temperature)
  • Mixing valve position
  • Circulation pump status

If anyone has:

• AXC40 packet captures
• ECS_S3 traffic dumps
• Nibe service documentation
• Reverse protocol information

I would be very interested in knowing:

Token
Payload format
Data length
Expected values

for:

0xA3
0xA4
0xAF
0xEE

and any messages related to:

Mixing valve control
Circulation pump control
Heating demand
Circuit status

The objective is to fully emulate an AXC40/ECS circuit using ESPHome and NibeGW, including temperatures, mixing valve operation and circulator control.

[elupus]

Ecs is mostly supported already with the climate entity feature.

[elupus]

Nevermind, no it is not. I got confused.

[elupus]

Ecs s3 and s1 is identical format. So you can just look at s1 data (which i think you have). Its just different base address.

[Philiphall6]

I wanted to share some progress regarding AXC40 / ECS_S3 emulation.

After comparing traffic from a real ECS_S2 module and my ESPHome/NibeGW emulation, I found that my previous ECS_DATA_REQ (0x90) response was far too short.

I was using:

• address: ECS_S3
  token: ECS_DATA_REQ
  data: [0x00, 0x93]

which resulted in:

Response to address: 0x3 token: 0x90 bytes: 6

After analyzing the captures, I switched to:

• address: ECS_S3
  token: ECS_DATA_REQ
  data: [0xE3, 0x02, 0xE3, 0x02, 0xD0, 0x02, 0xFF, 0x03,
  0xFF, 0x03, 0xFF, 0x03, 0xFF, 0x03, 0xFF, 0x03]

This significantly improves the behavior and BT2 / BT3 are now present.

However, I still have no information regarding:

What each value represents.
Which bytes correspond to BT2, BT3, BT50, etc.
How to modify these values correctly.
Whether these are actual temperatures, ADC values, NTC resistance values, or another internal format.

At the moment I am using values derived from my real ECS_S2 captures, but I have the impression that the heat pump may simply be copying or reusing the S2 information for S3 rather than receiving fully independent sensor values.

[elupus]

A suggestion is to use the python nibe client to parse all of your real s2 (create parsers for all values) that will document what each value is. Then looking at emulating same for S3.

[Philiphall6]

https://github.com/Philiphall6/esphome-nibe/blob/master/components/nibegw/README_AXC_ACCESSORIES.md

[yozik04]

Unfortunatelly I don't read that language in the link.
Maybe you can at least tell us what you mean by sending that link?

[Philiphall6]

You’re right, the documentation is currently only available in French. I’ll translate it into English soon.

At the moment, the virtual accessory framework is about 95% functional. It already supports dynamic sensor injection from Home Assistant and can emulate several NIBE accessories such as ECS S3, POOL310, SCA35, and DEH310.

I’m still validating some packet mappings and a few accessory-specific behaviours before considering it stable.

I’ll update the documentation in English as the project progresses. Feedback and testing are always welcome!

By the way, I have a question: do you know if it would be possible to add support for the EP30 accessory to the Modbus implementation for the VVM310? I’m particularly interested in accessing the solar thermal system registers. If you know the relevant Modbus register map (or have documentation), it would be extremely helpful for continuing the implementation.