Notes on Gree Amber Nordic GWH09YD-S6DBA1 Heat Pump

Gree GWH09YD-S6DBA1 indoor PCB with IR and WiFi modules
Gree GWH09YD-S6DBA1 indoor heat exchanger power connectors, PCB with IR and WiFi modules.

As part of an experiment to add domestic water heating capabilities to conventional mini-split ACs, I purchased an air-source heat pump Gree GWH09YD-S6DBA1 which has an inverter controlled compressor and an electronic expansion valve that allows it to work efficiently even down to -30℃ (-22℉).

  • Model GWH09YD-S6DBA2A where GWH09YD is the outdoor unit and S6DBA2A is the indoor unit.
  • Product code: CB466000100/CB466000102
  • Cooling capacity: 2.7kW
  • Heating capacity: 3.5kW
  • Refrigerant: R32
  • Remote model: YAG1FB3

IR Remote Protocol

I used an infrared photodiode attached directly to pins GND and D3 (which is pulled high) of Wemos D1 mini and the IRrecvDumpV3.ino sketch bundled with v2.8.1 of the IRremoteESP8266 library to decoded the messages.

Here are the infrared bit sequences captured by the Saleae logic analyser:

Gree YAG1FB3 remote signal capture
Capture of the IR signal from the YAG1FB3 remote when turning on the device.

We can clearly see two sets of messages that are repeated twice. Each message has two parts and the first one starts with a longer sync header.

Initially it complained about the packets being too large to fit in the allocated buffer:

WARNING: IR code is too big for buffer (>= 1024). This result shouldn't be trusted until this is resolved. Edit & increase `kCaptureBufferSize`.

That is because of the kTimeout constant which is set to 50 by default and is 10ms above the actual period of 40ms between the groups of messages that we see in the logic analyser output above. By setting the value to 30:

const uint8_t kTimeout = 30;

it started decoding the packets as expected:

Protocol  : GREE
Code      : 0x0C084070000000E0 (64 Bits)
Mesg Desc.: Model: 1 (YAW1F), Power: On, Mode: 4 (Heat), Temp: 24C, Fan: 0 (Auto), Turbo: Off, Econo: Off, IFeel: Off, WiFi: Off, XFan: Off, Light: Off, Sleep: Off, Swing(V) Mode: Manual, Swing(V): 0 (Last), Swing(H): 0 (Off), Timer: Off, Display Temp: 0 (Off)
uint16_t rawData[139] = {9004, 4474,  664, 540,  664, 540,  666, 1642,  664, 1644,  664, 542,  664, 540,  664, 542,  664, 542,  664, 542,  664, 542,  664, 542,  664, 1642,  664, 542,  664, 540,  666, 540,  664, 540,  664, 542,  664, 542,  664, 542,  664, 540,  664, 540,  664, 542,  664, 1642,  664, 542,  664, 540,  666, 540,  666, 540,  664, 540,  666, 1642,  664, 1642,  664, 1642,  664, 540,  664, 542,  664, 1642,  664, 540,  664, 19974,  664, 542,  664, 542,  664, 542,  664, 542,  664, 542,  664, 542,  662, 542,  662, 542,  664, 542,  664, 542,  664, 542,  664, 542,  662, 544,  662, 544,  662, 544,  662, 542,  662, 544,  662, 542,  662, 542,  662, 544,  662, 544,  662, 542,  664, 544,  662, 542,  662, 544,  662, 542,  662, 542,  664, 542,  662, 544,  662, 1644,  662, 1644,  662, 1644,  662};  // GREE
uint8_t state[8] = {0x0C, 0x08, 0x40, 0x70, 0x00, 0x00, 0x00, 0xE0};

In the decoded bit timing sequence above we see a 9004us header mark followed by a 4474us space and then the actual message bits where the bit mark is 664us, logical 0 space is 542us, logical 1 space is 1642us and with 19974us between the two packets of the message.

Enabling the I-feel mode (where the remote sends the indoor temperature to the indoor unit) does append another packet to the end which isn’t parsed correctly, though:

Protocol  : UNKNOWN
Code      : 0x5EF985F1 (18 Bits)
uint16_t rawData[35] = {6008, 2986,  658, 546,  658, 548,  658, 548,  658, 1648,  658, 1648,  658, 546,  658, 548,  658, 548,  658, 1650,  658, 546,  658, 1648,  658, 546,  658, 548,  658, 1648,  658, 548,  658, 1648,  658};

It appears that this packet is supported by the arduino-heatpumpir library. According to the GreeYACHeatpumpIR::send() method we’re expecting a header followed by two data bytes (using the following logic) and one closing GREE_YAC_BIT_MARK:

  • 6008, 2986 are the two header marks,
  • 658,546 | 658,548 | 658,548 | 658,1648 | 658,1648 | 658,546 | 658,548 | 658,548 maps to 0x00011000 in binary which is 24 in decimal (the temperature measured by the remote).
  • 658,1650 | 658,546 | 658,1648 | 658,546 | 658,548 | 658,1648 | 658,548 | 658,1648 maps to 0b10100101 or 0xA5 in hex as expected.
  • 658 is the closing GREE_YAC_BIT_MARK.

IR Receiver Module

Attached to the back of the inner block cover is a display module combined with an IR receiver. I was wondering if the IR receiver logic could be handled there and forwarded to the main PCB via something like UART. Turns out the LCD elements and the IR receiver diode run down to the main PCB so there is nothing to hijack.

Gree GWH09YD-S6DBA1 front cover LCD module with IR receiver
Back of the PCB for Gree GWH09YD-S6DBA1 front cover LCD module with IR receiver.

Wi-Fi Module

There is a built-in Wi-Fi module which uses a protocol that has been reverse-engineered and enables full control over the local network once the unit has been added to the Wi-Fi network using the GREE+ app for iOS and Android. There is even a fully functional HomeAssistant integration.

Gree GWH09YD-S6DBA1 built-in WiFi module top
Gree GWH09YD-S6DBA1 built-in WiFi module top.
Gree GWH09YD-S6DBA1 built-in WiFi module back
Gree GWH09YD-S6DBA1 built-in WiFi module back.

The COM-MANUAL label and the four wires going to the module from the PCB indicate that this is possibly an UART-to-WIFI bridge. However, attaching the digital logic analyser probes to the dark-brown, light-brown and GND pins produced a lot of noise without clear indication of the data being transfered.

BMS and COM Manual Connections

There are two additional wire connections that are coming out of the PCB that are left not connected:

  • BMS which is potentially a Modbus or CAN connections for Building Management Systems.
  • COM-MANUAL which is designated as “Wired Controller (optional)” in the service manual.

There is a lot of potential for gaining full read-write access to the device through these ports but I haven’t gotten to that yet.

Gree GWH09YD-S6DBA2AO indoor PCB diagram
Gree GWH09YD-S6DBA2AO indoor PCB diagram.
Gree GWH09YD-S6DBA2AO indoor PCB
Gree GWH09YD-S6DBA2AO indoor PCB.

Service Manual

Wired Controller XK76

Some of the Gree models support wired controllers or thermostats in addition to the RF remotes. This indoor unit has two unpopulated connectors labeled BMS and (forgot the other one) in addition to the WIFI cable that is connected to the WIFI module.

The BMS connector is attached to the wired controller and it appears to be using some kind of serial protocol (potentially Modbus over RS485 similar to their commercial units) to communicate with the remote controller.

Unfortunately, it isn’t very clear which wired controllers support which indoor units especially because the model numbers don’t appear to be shared between units sold in EU and US, for example. Your best option is to review the service manual for the heat pump and determine the controller model by the picture. I decided to get what appeared to be the most recent version of the wired controllers XK76 and just hoped it would work with my device. And luckily it does!

Important: Make sure to turn off the heat pump completely before connecting the controller or it will return an error code E6 and fail to communicate with the device. I almost thought it just doesn’t work and put it on sale…

XK76 comes in a box with two back panels, a four wire cable and a patch cable.

And here is the photo of the PCB which appears to have just a single microcontroller and three physical connection ports with matching drivers and a bunch of passives to drive the screen:

The PCB of the Gree Gree XK76 wired controller thermostat
The CN4 connector on the top-right is used to attach the communications cable. With markings GRJ4K-B on the PCB.

And here is a photo of the main controller which appears to be NXP LPC3100 series ARM9:

Gree XK76 wired controller with NXP LPC3100 ARM9 microcontroller
Gree XK76 with NXP LPC3100 ARM9 microcontroller.

The next step is to attach a logic analyser to the wiring and log a few messages between the controller and the indoor unit to confirm the communication protocol. It would be nice if it matched some of the documented Modbus spec for commercial Gree units that can be found online.

Leave a Reply