IT Protocol Reference
Packets sent on Mitsubishi's CN105 port seem to follow a general structure, but the specific content is still not entirely well mapped out. Eventually I'm hoping to have this wiki compile all the known information, but quite a bit of data is available nonetheless. Because this reference manual is not based on any formal documentation, developers should expect significant changes to both layout and information as new findings are discovered.
This protocol reference covers solely the air-to-air variant of the IT protocol (identifier 0x0130). The
air-to-water protocol variant (identifier 0x027A) uses significantly different data layouts, even if the general
structure is the same. Even so, there appear to be regional differences between version of the IT protocol. For
example, Japanese units currently expose fields that are not present on NA/EU/AUS units, though it is not known if this
is purelymissing features or if the Japanese market actually has a different protocol. This reference assumes the
former for now; that is, the protocol is globally consistent but features are not available in non-JP markets.
For reference purposes, Mitsubishi-internal names are included in this documentation. However, community-defined names will be used more frequently and tend to be preferred as they're overall less confusing.
Packet Layout
All packets have a 5 byte header at the beginning, and a 1 byte checksum at the end. Most packets seem to have a paired request/response structure.
Header Structure
| Byte | Purpose | METUS Name | Possible Values | Supported by mUART |
|---|---|---|---|---|
| 0 | Sync | Control Code | 0xFC | Yes |
| 1 | Packet Type | Service Code | See below | Most types to some extent |
| 2-3 | Protocol Identifier | Model Code | 0x0130, 0x027A | N/A |
| 4 | Payload Size | Data Length | 0x00-0x10 | Yes |
The protocol specification appears to require packet lengths of 0x01, 0x02, or 0x10, depending on the packet type.
Most packets will use a length of 0x10 even when the extra bytes are not relevant. Similarly, most units seem to
accept packets of any length (though caution is advised).
Checksum
The final byte of any packet is the checksum, which can be calculated with (0xFC - sum(packetBytes)) & 0xFF.
Known Packet Types
The following table represents all known packet types, our names for them, and (known) METUS/IT Protocol information for them.
| Packet Type | Name | METUS Name |
|---|---|---|
| 0x41 | Set Request | Operation setting |
| 0x61 | Set Response | Response of operation |
| 0x42 | Get Request | Demand of condition information |
| 0x62 | Get Response | Response of condition information |
| 0x5A | Connect Request | Communication setting |
| 0x7A | Connect Response | Response of communication setting |
| 0x5B | Identify Request | Demand of communication setting data |
| 0x7B | Identify Response | Response of communication setting data |
Known Command IDs
The below table is a quick reference of all known command IDs (otherwise known as attribution groups in Kumo's code)
that are currently known. These only apply to packets 0x41 - Set Request and
0x62 - Get Response (and their companions 0x42 and 0x61, respectively).
| Command ID | Name | Communication Flow |
|---|---|---|
| 0x01 | Set Settings | Kumo/MHK -> HP |
| 0x02 | Get Settings | HP -> Kumo/MHK |
| 0x03 | Get Temperatures | HP -> Kumo/MHK |
| 0x04 | Get Error State | HP -> Kumo/MHK |
| 0x05 | Get Timer Info | HP -> Kumo/MHK |
| 0x06 | Get Operation State | HP -> Kumo/MHK |
| 0x07 | Set Remote Temperature | Kumo/MHK -> HP |
| 0x08 | Set Run State | Kumo/MHK -> HP |
| 0x09 | Get Run State | HP -> Kumo/MHK |
| 0x1F | Set Function Page 1 | Kumo/MHK -> HP |
| 0x20 | Get Function Page 1 | HP -> Kumo/MHK |
| 0x21 | Set Function Page 2 | Kumo/MHK -> HP |
| 0x22 | Get Function Page 2 | HP -> Kumo/MHK |
| 0xA6 | Kumo Sensor Status | MHK -> Kumo |
| 0xA7 | Thermostat Hello | MHK -> Kumo |
| 0xA8 | Thermostat State Upload | MHK -> Kumo |
| 0xA9 | Thermostat State Download | Kumo -> MHK |
| 0xAA | Unknown Kumo Packet | MHK -> Kumo |
| 0xAB | Unknown Kumo Packet | Kumo -> MHK |
| 0xCA | Unknown | Unknown |
The following command IDs are used as part of the identify cycle:
| Command ID | Name | Communication Flow | Notes |
|---|---|---|---|
| 0xC9 | Identify Base Capabilities | HP -> Kumo/MHK | |
| 0xCD | Unknown Identify Packet | Unknown | |
| 0xCE | Unknown Identify Packet | Unknown | Extracted from KirigamineRemote |
| 0xD0 | Unknown Identify Packet | Unknown | Extracted from KirigamineRemote |
| 0xD1 | Unknown Identify Packet | Unknown | Extracted from KirigamineRemote |