Support for Maxwell AC (Probably advanced Mirage support)

[akram]

Version/revision of the library used

IRremoteESP8266 2.7.18 which comes with Tasmota 9.5.0

Describe the bug

I have a Maxwell AC (not a very well known brand) that seems to be using Mirage protocol, however controlling it does not work. After receiving and replaying payload data, the IRSend command does not trigger any action on the AC side.

To Reproduce

Install tasmota 9.5 (uses IRremoteESP8266 uses v2.7.18 ) capture data from the remote controller and replay it. No reaction on the AC side
e.g.

15:48:47.093 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C000020D800000C320B00320F64","Repeat":0}}
15:48:48.596 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C0000201A00000C320B02320F5C","Repeat":0}}
15:48:56.001 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C000020D800000C320B09320F6D","Repeat":0}}
15:48:57.746 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C0000201A00000C320B0B320F65","Repeat":0}}
15:49:01.191 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C000020D800000C320B0E320F72","Repeat":0}}
15:49:19.560 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C0000201A00000C320B20320F5C","Repeat":0}}

Example code used

Using tasmota, enable raw mode with:

SetOption58 1
18:53:50.697 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x56700000201A00000C320B1D371256","Repeat":0,"RawData":"+8455-4135+590-570D-1590CeC-550CeCfCeCfCfCfCfCfCeC-1610DeCfCfCfCfCfCfCfC-575DfCfCfCdDfCdDhDfCfCfCfCfCfC-555CeCdDfCdDeCfCgDgDfCfCdDfCfCfCfCfCfCfCfCfCfCfCdDfCfCfCfCfCdDeCeCfCfCfCfCfCeCfCfCeCeCdDfCeCgDfCeCfChDfCdDeCfCeCeCeCfCfCfCgDeCeCfCeCeCfCdDhDeCfCfCgDfCfCfCdDeCeCdDgDf+595gDfC","RawDataInfo":[243,243,0]}}

and replay the received raw data after converting it

18:59:17.896 CMD: IRSend raw 8450,4130,590,575,570,1590,590,1610,570,550,590,1590,590,550,590,1590,590,550,590,1610,570,1590,590,1610,570,1590,590,550,590,1610,570,1590,590,550,590,570,570,550,590,550,590,570,570,550,590,550,590,570,570,570,570,570,570,550,590,550,590,550,590,550,590,570,570,550,590,550,590,570,570,550,590,550,590,570,570,550,590,1590,590,555,590,570,570,570,570,1610,570,550,590,1610,570,1590,590,550,590,570,570,550,590,550,590,570,570,570,570,550,590,550,590,550,590,570,570,570,570,570,570,570,570,575,570,575,570,570,570,555,590,570,570,570,570,550,590,570,570,1615,570,1610,570,550,590,570,570,570,570,570,570,550,590,1610,570,550,590,575,570,1590,590,1610,570,550,590,570,570,1590,590,1610,570,550,590,1590,590,575,565,555,590,550,590,550,590,575,570,570,570,1590,590,570,570,570,570,1590,590,550,590,570,575,1590,590,570,570,1590,590,550,590,1610,570,1610,570,570,570,550,590,570,570,1610,570,555,590,575,565,1590,590,550,590,550,590,550,590,550,590,1610,570,550,590,1610,570,1610,570,575,570,1610,570,570,570
18:59:18.001 MQT: tasmota_38B3E6/stat/RESULT = {"IRSend":"Done"}

Expected behaviour

The AC reacts to the command:

Output of raw data from [IRrecvDumpV2.ino]

I don't have the required hardware to run this thest.

Note: Output from Tasmota is not acceptable. We can't easily use their raw format.
arf....I just read this after submitting the bug.

What brand/model IR demodulator are you using?

YFJ IR Bridge (Tuya)

Circuit diagram and hardware used (if applicable)

None

I have followed the steps in the [Troubleshooting Guide]

Yes

Has this library/code previously worked as expected for you?

No

Other useful information

Before upgrading to 2.7.18 , I was using a Tasmota version embedding IRremote that does not support Mirage. At that time, Tasmota was IRReceiving an UNKNOWN protocol with a payload of 122bits. After upgrading, it is now seen as MIRAGE with 120bits payload.
During my AC remote captures, I was also seeing sometings for IRreceived with KELON protocol.
So, I wonder if the AC is really using MIRAGE and if its protocol is interpreted as is, but that could be a different protocol.

Also, one important thing: same commands and even same state does not have the same data. Some part of the payload is identical accross calls, but, some others always vary whatever the sent state.

[crankyoldgit]

Also, one important thing: same commands and even same state does not have the same data. Some part of the payload is identical accross calls, but, some others always vary whatever the sent state.

Can you please elaborate on this with examples/documentation/data etc?

After receiving and replaying payload data, the IRSend command does not trigger any action on the AC side.

Where is the IRSend command you're using? I can't seem to see it in your report. (Not that I know how that bit of Tasmota works, but I can make a good guess)

8450,4130,590,575,570,1590,590,1610,570,550,590,1590,590,550,590,1590,590,550,590,1610,570,1590,590,1610,570,1590,590,550,590,1610,570,1590,590,550,590,570,570,550,590,550,590,570,570,550,590,550,590,570,570,570,570,570,570,550,590,550,590,550,590,550,590,570,570,550,590,550,590,570,570,550,590,550,590,570,570,550,590,1590,590,555,590,570,570,570,570,1610,570,550,590,1610,570,1590,590,550,590,570,570,550,590,550,590,570,570,570,570,550,590,550,590,550,590,570,570,570,570,570,570,570,570,575,570,575,570,570,570,555,590,570,570,570,570,550,590,570,570,1615,570,1610,570,550,590,570,570,570,570,570,570,550,590,1610,570,550,590,575,570,1590,590,1610,570,550,590,570,570,1590,590,1610,570,550,590,1590,590,575,565,555,590,550,590,550,590,575,570,570,570,1590,590,570,570,570,570,1590,590,550,590,570,575,1590,590,570,570,1590,590,550,590,1610,570,1610,570,570,570,550,590,570,570,1610,570,555,590,575,565,1590,590,550,590,550,590,550,590,550,590,1610,570,550,590,1610,570,1610,570,575,570,1610,570,570,570

I can confirm that the library does decode the above as a MIRAGE protocol with a code of 0x566F0000201A00000C320B2435125A

Note: The library only has basic support for this (MIRAGE) protocol. That means it can send & receive state codes. Sort of like the number above. It does NOT have detailed support for this protocol yet. i.e. You can't set temperature & modes etc.
If you want that support, you need to do the protocol analysis. e.g. Follow the instructions here: https://github.com/crankyoldgit/IRremoteESP8266/wiki/Adding-support-for-a-new-AC-protocol

You can also read through #1289 & #1291

[akram]

Can you please elaborate on this with examples/documentation/data etc?

Here the example:
My AC is turned ON, temperatutre is 16°C (its minimum value)
I press the temperature Up button (temperature is now 17°C)
I press the temperature Up button (temperature is now 18°C)
I press the temperature Down button (temperature is now 17°C)
I press the temperature Down button (temperature is now 16°C)
I press the temperature Down button (temperature is now 16°C)
I press the temperature Down button (temperature is now 16°C)

Here are the captured data:

16:55:17.725 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566D0000201A00008C320B163A1064","Repeat":0,"RawData":"+8460-4135+590-555C-1590Ce+620-525C-1595C-550CeCdCeCi+615-1570CeCiCeJ-1565CiCiCiCdCdCdCiCiCdCdCiCdCdCdCdCiCiCiCdCdCiCdCeCdCdCdCeCd+640-1545Ce+585dCdCiCiCiCdCiCiCdJ-530+595iCiCiCdCiCiCiCiCdCiCdCeChCdCdCdCeCdCeCdOdCeChCiCdCeCeJpCeCdCiCdCdCdCeCeJpCeOdCiC-575+565iJlCiCeJkChFgCdOdCdCdCiCeCdCdCdCiCiChJgCdJlCeJpJ","RawDataInfo":[243,243,0]}}
16:55:22.466 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566E0000201A00008C320B1C3A106B","Repeat":0,"RawData":"+8475-4110+585-560C-1590C-1595C-555+590eHgCeHgHgCf+615-1570CfCg+610jC-1600D-580H-550HgInDgCgCdCdDmCdCdCgCdK-530CgCgCgHgCgCgCgCdCfHgCgHgCfCgHfIjHgCgCgCgHgCgHnDmDcKoCgHmDm+565gCgCgHgHgHnHnHgCfCfIoCgCdI-1565HgHeHgCgCfIqHdCgCfCfHgCfCdCgCgCgHgKoCfCfCfKoKoCmPnMlCgCfCfHeKoCgHgCdHgCgCeHgCdCdCfCfHmHqHdCeHfCgH","RawDataInfo":[243,243,0]}}
16:55:25.964 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566D0000201A00008C320B203A105F","Repeat":0,"RawData":"+8455-4115+635-535+585-1595Ef+590-555E-1600Eh+560-1620EjEfEhEiG-1590EhEfEiGhEhEhEjG-550GmG-580JhGnJhEjEhGhGhEhGmEhGhEhGhEmGhEfEhGhEh+615-1565EhEfEfGhJnEjEhO-530EjEhGh+610qJnRqEjGhNe+565nJhOmJhRqEhEjGlGlGhEhEhGlGhGfEhEjEfEfJnGhJkEiEjEfGhGhEhEh+605dEhGhJnGhEfEhGhEhJkGhGlR-1570GfGhEjGhEhEhGmEfGhGhOqGfEfEiElEfGjEfEhE","RawDataInfo":[243,243,0]}}
16:55:28.718 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C0000201A00008C320B233A1061","Repeat":0,"RawData":"+8455-4140+590-555C-1590+585-1595CdFgF-580C-1570ChH-560JdFgFgCdFgCgC-550CdCdFjFdFdFd+610jJdCdFdFjFdCkCdFdFj+600-545+615-530CdCkFjFgFdFjCkFgJfCeCgFdFdFdOpCdCdFdLpCdCdCdCdFdOpFjFdHjFjFdOkJdCgCgOpFdFdF-1600CjFgFdFjFgM-1580FdLpFqFqJhCeFjChJdCdCgFgChJdCdCgFdFdChFiFdFqF-1620JqHjFdFdCdCdFdFgHjLdJdCgLpCdLpFjFqFgFjF","RawDataInfo":[243,243,0]}}
16:55:31.717 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C0000201A00008C320B263A1064","Repeat":0,"RawData":"+8455-4140+590-555C-1590+615-1570+585-560CeC-580I-1595CdHiHdHkHkCdHkH-1620IjIdHdHdHiCdHdCdCdHdHiHdHdCdCdHi+610-530HdIjHdMnCdHkC-550HiCdHkMnHkCeCdHdHdCdHiCdCdCoHiHdHiCdCdHdHdHdCdMnCdHdCoHkCkCdHdCdMgHi+640-1545CdHiJkF-1565CdHdHeHkHdHkHdCdMnCdHdCkHkFnCjIeHdHdHdCeHdHkHkCeHdHiCdM-535HdHdHeCdCdCdHdHdHkHdCoCkHkCdH","RawDataInfo":[243,243,0]}}
16:55:38.467 MQT: tasmota_38B3E6/tele/RESULT = {"IrReceived":{"Protocol":"MIRAGE","Bits":120,"Data":"0x566C0000201A00008C320B2E3A106C","Repeat":0,"RawData":"+8450-4135+590-555+585-1595E-1590CdEgC-550CfEdE-580+560dEg+615-1565Ei+565gCfEdEj+610-530EiJdEjEdJiEdJiEjChEdCdEdEdIjChEjEdEhEdN-1570CdChNoCgCdIfCgEjChChEdCdCdEdCdEdEdEjEdEdEjEdEdCdEdEdJeEdNlCgEjEdEdCgCdEfEjChCfEfCdIjIfEfKoEfEdCdEdEdK-525Ef+605pEgEdCgEdEdEdEgCdIfCgEfIjChEdEdEdEdNpEdCdEdEdEdCgCfCdCgEgNoC","RawDataInfo":[243,243,0]}}

as you can see, for the same state (16°C), pressing 3 times the down button, the remote controller will send 3 differents payloads: 0x566C0000201A00008C320B233A1061, 0x566C0000201A00008C320B263A1064, 0x566C0000201A00008C320B2E3A106C

[crankyoldgit]

Looking at the data, it's fairly clear the temperature is stored in the second byte. i.e. state[1] if was captured by IRrecvDumpV2 etc. e.g. 0x6D = 17deg, 0x6E = 18deg. 0x6C = 16deg.

As for why the other digits are changing, as per the wiki that's why we recommend setting the clock to 00:00 etc. They seem to increase/match in a way the timestamps you recorded them. That is, I'm pretty sure its a clock value, with the time values including seconds.
This is why we recommend recording a lot of values in a spreadsheet to try to see what changes and what values link to what functions or things.

You are the one that has to do the break-down/analysis/reverse-engineering. We can provide assistance & help etc, but most of the leg work requires your effort.

I strongly suggest you follow that wiki link etc and let us know when you got all the bits that change explained.

[akram]

Thank you for your help and support.
Here is a first attempt to capture the data and different states in the following spreadsheet: https://docs.google.com/spreadsheets/d/1Ucu9mOOIIJoWQjUJq_VCvwgV3EwKaRk8K2AuZgccYEk/edit?usp=sharing

I will refine that to break-down the different bytes and states. By reading the Wiki page that you sent, I also understood that the varying bits/bytes are certainly checksum/CRC bits. I put some data into CRC RevEng too with no success for it to guess what is the CRC algorithm being used.

Thanks for your help again, and in the meantime, if you have more advices on how to decode this, as obviously your eye and experience on this in sharper than mine, please feel free to comment.

[crankyoldgit]

Good news, I was about to give up on your checksum value too after I tried a few things, then I got lucky.
The alg. is "Sum every nibble (except the last byte/8bits) and that gives you the last byte/8 bits."

e.g.
0x56730000201600000C000C0301003A is:
0x5 + 0x6 + 0x7 + 0x3 + 0x0 + 0x0 + 0x0 + 0x0 + 0x2 + 0x0 + 0x1 + 0x6 + 0x0 + 0x0 + 0x0 + 0x0 + 0x0 + 0xC + 0x0 + 0x0 + 0x0 + 0xC + 0x0 + 0x3 + 0x0 + 0x1 + 0x0 + 0x0 == 0x3A

I've tried it on a few values, and it works.

Also, state[11] (i.e. 4th last byte) looks like it might be a seconds value. For a large number of the values, it seems to track with the timestamp roughly. Also, I never see it go higher than 0x3B (59 dec) which is what we would expect.

The temp seems to be stored in state[1] (i.e. the 2nd byte) e.g. 0x77 is 27degC That is state[1] - 0x5C gives the temp in Celsius. e.g. 0x6E - 0x5C is 18degC

[crankyoldgit]

@akram How are you going with the analysis? Have you got enough of it worked out to do/explain what you want yet?

[akram]

@crankyoldgit I added "Decode" tab in the stylesheet to add bits or snipple signification findings. Until now I was not able to make the AC respond to this. I will continue this evening.

[crankyoldgit]

Cool. The key factors we need to add/support first are Power on/off control & Operation mode. After that, concentrate on Fan Speed. As we already have Temp figured out, you just need those before we can start on adding the beginnings of Detailed support to the library.

[crankyoldgit]

Looking at the data you've collected, a candidate for the operation mode is the 8th nibble (i.e high nibble of state[4]) i.e. https://docs.google.com/spreadsheets/d/1Ucu9mOOIIJoWQjUJq_VCvwgV3EwKaRk8K2AuZgccYEk/edit#gid=380909393&range=D35:D38

[crankyoldgit]

@akram How goes the analysis?

[akram]

@crankyoldgit I think I am almost done with it.
There is only the DISPLAY (on/off) and SLEEP(on/off) modes for which I cannot really understand the behaviour. Display on/off seem to be linked with sleep on off; but they are in too separated/distant nibbles.

Also, I still have many nibbles which seems to have fixed value to 0 or C.

What could be the next step to test my assumptions? trying to send IrSend based on these findings ?

[crankyoldgit]

Cool. Good work. I'll look at coding up something based on your Decode sheet soon. I'll let you know when it's ready for some testing. I'm sure I'll have questions as I go.