Infinity interpreting data

When data is read to or written from a device, it must have a way to address this data. We refer to this entire address as a "register". This nomenclature is taken from ModBUS, an industrial protocol. It seems that this is always 3 bytes, and first byte is always 0x00. Often times this first byte is ignored since we only assume is it part of the register address.

Entire registers are read or written at once. Most read and write requests originate from the thermostat; if a SAM is in the system it can originate read and write requests directed to the thermostat.

Register	Our Name	Device Type	Fields	Notes
0104	DeviceInfo	all	char module_name[48], firmware_version[16], model_number[20], serial_number[36]
0202	SysTime	thermostat	uint8 hour, minute	stat writes every minute to broadcast address f1f1
0302	OutdoorUnit2	compressor	unknown[2]; uint16 outdoor_air_temp*16, unknown[2]; uint16 outdoor_coil_temp*16; unknown[2]; uint16 suction_temp*16; unknown[2]; uint16 superheat_temp*16; unknown[2]; uint16 unknown_temp*16; unknown[2]; uint16 discharge_temp*16	Observed on 24VNA9. Based on pattern, 1st unknown byte may be Temp Unit (degF=01)?
0303	OutdoorUnit2	compressor	unknown[2]; uint16 suction_pressure*16	Observed on 24VNA9. Units of psi
0304	OutdoorUnit2	compressor	unknown[7]; uint8 line_voltage; unknown[8]
0306	AirHandler06	airhandler	uint8 unknown; uint16 blower_rpm; uint16 indoor_airflow_cfm; unknown[5]	"all" airhandlers report blower RPM. Indoor Airflow CFM appears to update more frequent than 0316.
0307	AirHandler07	airhandler	uint8 hum_status; unknown[3]	On my Bryant 987M, hum_status is 0x00 when connected humidifer is off, 0x01 when humidifier on
0308	WriteDamper	damper ctrl	uint8 damper_position_for_zone[8]	damper controller will ignore either first 4 or last 4 zones
0316	AirHandler16	airhandler	uint8 state, unknown[3]; uint16 airflow_cfm; uint8 unknown; uint16 static_pressure; more unknowns	some airhandlers do not report CFM airflow. state: 00=no_heat, 01=low_heat, 02=med_heat, 03=high_heat. static pressure in in-wc is static_pressure/65536
0319	ReadDamper	damper ctrl	uint8 damper_position_for_zone[8]	either first 4 or last 4 zones will be 0xff (not present)
0402	Furnace	987M furnace	unknown[31]; uint8 gas_valve_percent; unknown[1]	gas_valve_percent (on a 987M) contains the percentage-open status of the furnace gas valve between 40 and 100%. it does NOT go to 0 when the gas valve is closed; you have to look at the 'state' variable in 0316 for that.
0604	OutdoorUnit6	compressor	unknown[2], uint16 compressor_rpm, more unknowns	Compressor RPM (observed on 186CNV cooling-only outdoor unit)
0604	OutdoorUnit2	compressor	uint16 target_compressor_rpm, uint16 actual_compressor_rpm, more unknowns	Compressor RPM (observed on 189BNV cooling-only outdoor unit)
060e	OutdoorUnit2	compressor	uiint8 outdoor_unit_stage; many unknowns
3b02	TStatCurrentParams	thermostat	uint8 temp_for_zone[8], humidity_for_zone[8], unknown; int8 outdoor_air_temp; uint8 unoccupied_zones_bitmap, mode, unknown[5], zone_displayed
3b03	TStatZoneParams	thermostat	uint8 fanmode_for_zone[8], zones_holding_bitmap, heat_setpoint_for_zone[8], cool_setpoint_for_zone[8], humidity_setpoint_for_zone[8], fan_auto_config, unknown; uint16 hold_duration_for_zone[8]; char name_for_zone[8][12]
3b04	TStatVacationParams	thermostat	uint8 vacation_active; uint16 days_times7; uint8 mintemp, maxtemp, minhumidity, maxhumidity, fanmode
3e01	HeatPump01	some heatpumps	uint16 outside_temp_times16, coil_temp_times16, more unknowns
3e02	HeatPump02	heatpump, compressor	uint8 stage	shift right by 1 to get the stage number

When learning about an unknown register, you can make use of a structure:

0x0201 00 21 53 59 53 54 49 4d 45 20 00 19 03 13 01 03 03 03 03
0x0202 0d 36 06               
0x0203 05 0c 0a 

The high byte of the register is the table number, and the low byte is the row in that table. This is how to interpret the data from the 0x02 table above, starting after 0x0201:

• 0021 - unknown
• The next 8 bytes are the name of the table = 53595354494d4520 is SYSTIME with a trailing space (ascii)
• 00 19 relates to the size of the table (25 bytes)
• 03 is the total number of rows in the table
• 13 is the bytes of this row (in hex) and 01 is unknown
• 03 is the bytes in the second row, and 03 is unknown
• 03 is the bytes in the third row, and 03 is unknown.

The first row of the table usually describes the structure of the table, with the exception of a few tables. The byte following the row length (the last three lines in the list above) may be bit flags for register permissions (b0=read, b1=write).

This is a list of possible tables. Please add confirmed models to the right if it matches for your unit.

Device	Table	Name	Confirmed Models
0E	0x3E	??
20	0x01	DEVCONFG	SYSTXBBUID01-B / SYSTXCCITW01 / SYSTXCCUIZ01-B
20	0x02	SYSTIME	SYSTXBBUID01-B / SYSTXCCITW01 / SYSTXCCUIZ01-B
20	0x03	RLCSMAIN / INGUI	SYSTXBBUID01-B / SYSTXCCITW01 / SYSTXCCUIZ01-B
20	0x04	DELUXEUI / SSSBCAST	SYSTXBBUID01-B / SYSTXCCITW01 / SYSTXCCUIZ01-B
20	0x05	EVEREST	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x06	LINESET	SYSTXCCITW01
20	0x2F	STARTUP	SYSTXCCITW01
20	0x30	EECONFIG	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x31	DUI DATA / INGDATA	SYSTXBBUID01-B / SYSTXCCITW01 / SYSTXCCUIZ01-B
20	0x32	LCD CTRL	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x34	4 ZONE	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x39	P MSCH	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x3B	AI PARMS / NVMINIT	SYSTXBBUID01-B / SYSTXCCITW01 / SYSTXCCUIZ01-B
20	0x3C	UI PARMS	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x3D	DISPDATA	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x3E	DCLEGACY	SYSTXBBUID01-B / SYSTXCCUIZ01-B
20	0x3F	WSAM CCN	SYSTXBBUID01-B / SYSTXCCUIZ01-B
22	0x01	DEVCONFG	SYSTXCCSMS01
22	0x02	SYSTIME	SYSTXCCSMS01
22	0x03	RLCSMAIN	SYSTXCCSMS01
22	0x04	SMT SNSR M	SYSTXCCSMS01
22	0x30	EECONFIG	SYSTXCCSMS01
22	0x32	SS SVCTL	SYSTXCCSMS01
50	0x01	DEVCONFG	264AN
50	0x02	SYSTIME	264AN
50	0x03	RLCSMAIN	264AN / 25HNB624A003
50	0x05	TWOCACTY	264AN / 25HNB624A003
50	0x3E	unknown - does not follow structure Coil temps and stage	264AN / 25HNB624A003
51	0x01	??
51	0x03	??
51	0x06	??
40	0x01	DEVCONFG	355CAV / 58MVC100
40	0x02	SYSTIME	355CAV / 58MVC100
40	0x03	RLCSMAIN	355CAV / 58MVC100
40	0x04	VARSPEED	355CAV / 58MVC100
42	0x01	DEVCONFG	FE4ANF002 / FE4ANF003
42	0x02	SYSTIME	FE4ANF003
42	0x03	RLCSMAIN	FE4ANF002 / FE4ANF003
42	0x04	VFANCOIL	FE4ANF002 / FE4ANF003
60	0x01	DEVCONFG	SYSTXCC4ZC01
60	0x02	SYSTIME	SYSTXCC4ZC01
60	0x03	RLCSMAIN	SYSTXCC4ZC01
60	0x04	04ZONE STL	SYSTXCC4ZC01
61	0x03	??
61	0x34	??
80	0x34	??

Endnotes