Hacking the Bosch Mini-Split

TL;dr: I’m reverse-engineering the Bosch Climate 5000 mini-split controller, but haven’t figured it all out yet. Come back for updates, and if you have any insights, please contact me!

Back in October (2022) I installed a 3-zone Bosch Climate 5000 mini-split heat pump. The thing works well enough at the cooling and heating, but like most of these systems, has a silly proprietary IR remote control system that isn’t terribly friendly to automation. Sure, you can buy products like the Sensibo IR blaster, but I wasn’t sure how amenable that was to integration into my bespoke home automation system.

So I figured I’d make my own IR blaster. The codes for these things are easily found online, and it wouldn’t be too hard to read the codes off the remote if not.

But in googling, I found that someone had figured out how to wire directly into the Mitsubishi mini-split controller, gaining not only the ability to control the system, but also get feedback from it. This is much better than a simple IR blaster.

Unfortunately for me, I didn’t install the Mitsubishi system.¹ I installed the Bosch instead, and AFAIK no one has reverse-engineered its controls yet. So, that’s one of my current projects.

Taking Things Apart

First thing I had to do was get the lay of the land. To do that I had to

1. Open the front panel
2. Detach the electronics compartments
3. Remove the cover protecting the power wiring to allow the electronics to fit through the cover
4. Pull the cover off (this was a pain. A couple of screws in the front, and some tenacious plastic clips along the top rear).

Under the front filter access cover I discoverd this promising wiring diagram:

Notice how it shows optional “Wire Controller” and “Wi-Fi Controller?” One of the modules attached to the inside of the front cover is embossed with the text “This interface is compatible only with Wi-Fi modules provided by the manufacturer” (more on this module later). The fact that it had provision for a wired controller was exciting! Maybe I could find the port that connects to and control it via that.

I emailed Bosch at this point to ask if they had a Wi-Fi module I could buy. They have yet to reply.

Inside the Wi-Fi module box is a small circuit board with what appears to be a small MCU, a serial connection to the rest of the system, and an empty USB-A port. I tried plugging in a USB Wi-Fi module I had lying around, but it doesn’t fit; the connector appears to have non-standard bumps preventing a regular USB connector from being inserted.

So I disconnected this circuit board and found that the system no longer responded to IR commands. That was nuts to me, as the receiver is two boards away, but it seemed like an integral part of the system.

So I attached ’scope probes to the TX & RX pins (helpfully labeled!)

Yellow is “TX” and blue is “REC” on this board. The traces for a single remote control button press looked like this:

I noticed that the traces were identical, so I started to suspect the board was just looping back whatever it got. Zooming in to look for a delay between them shows a slow rise time on the REC signal (to be expected, since it’s coming in from the cable connection), and a 13 µs delay before it’s fed back out, nice and square:

So I disconnected the board and did a simple wire loopback on the connector, and the unit continues to function normally. This is mixed news, because while it means I can control it, I don’t think it provides any feedback as to the status of the system. I will have to investigate the connectors further upstream.

I also notice that these aren’t 8-bit RS-232 bit streams; there are too many transitions between start bits. It’s possible these are the raw IR codes being received. So let’s put a probe on the IR receiver, and see what it sees.

The IR receiver is a Vishay TSMP91100 or simlar. I’ve used these before in previous projects, so I recognize it. I’m not sure exactly which one, but the datasheet tells me pin 3 is the output, so let’s connect that to channel 3 (pink) on the ’scope:

Yup! All of that is IR codes. Not ideal.

Things will have to stop here for now. There’s another IC on these three external boards, and there’s the main control board inside an impenetrable metal and plastic box inside the unit. I haven’t found a non-destructive way to open that yet.