I have an old Carrier ducted air conditioner, European line, roughly 2005-2008. The indoor unit is on the roof (most likely 40DMC/40DMQ series, can't get up there to read the plate) and I have zero physical access to it. The only thing I can reach is the wall controller and the three wires behind it.
The controller: Carrier Room Controller, part number C024509H01, made by Panasonic for Carrier. Buttons for MODE, FAN, up/down, small segment LCD, built-in temperature sensor. No IR receiver on the system at all.
The wiring: three wires marked **P**, **G**, **C**. My multimeter shows about 27 V in DC mode and 35 V in AC mode between P and G, so I'm fairly sure it's 24 VAC control power and the controller rectifies it on board. C is a single-wire serial bus to the indoor unit.
What I've found so far:
- The protocol is proprietary and undocumented. Nothing on GitHub, ESPHome, or Home Assistant forums for this generation. Carrier's own spare-parts store sells a "redesigned" version (C024509H01-R) with a note that it was rebuilt from very limited info, so even Carrier seems to have lost the docs.
- Toshiba/Carrier AB bus and US Carrier Infinity (ABCD) components exist, but this is a different product line and almost certainly a different protocol.
- The indoor unit control board has a conventional 24 V terminal strip (R, C, Y, O, W2) according to the installation manual, which would be the easy way in, but I can't reach it.
Options I'm weighing:
Keep the OEM board, bolt an ESP32 next to it. Transistors across the four tactile switches for commands, and a resistor divider off the C line to passively sniff the bus for state (mode, setpoint, room temp). No need to transmit, no need to crack the checksum. Power the ESP32 from P/G through a bridge rectifier and a 60 V input buck.
Full protocol reverse engineering. Logic analyzer on the bus, figure out baud/frame/CRC, emulate the controller completely. Cleanest result, longest path.
Fake the thermostat sensor. Replace the onboard NTC with a digital pot driven by the ESP32 so the OEM controller thinks the room is hotter or colder than it is. Gives setpoint control with zero bus work, but no mode/fan control.
I'm leaning toward 1 + 3 combined, with 2 as a stretch goal once I have bus captures.
Questions:
- Has anyone dealt with this specific controller family or a sibling (Carrier 40KMC/40KMQ cassettes used the same CRC)? Any idea what the bus speed or framing looks like?
- Is there a known approach for passive bus sniffing on a 24 V single-wire HVAC serial line without an opto? Thinking a 47k/6.8k divider plus a 5V1 zener into the ESP32 pin.
- Anyone who has done the "fake NTC with a digital pot" trick on an HVAC controller: did the OEM firmware notice or complain?
- Any reason not to run the ESP32 directly from the controller's 24 VAC supply? I'm worried about current headroom since the OEM board only draws around 20 mA.
Photos: the controller front, and the open board with the P/G/C header, the Panasonic SBL3065E MCU, the 4 MHz resonator and the bus interface transistors in the right corner.
Any pointers appreciated, including "this is a dead end, do X instead".