Custom Controller for
Broan B210E75RT AI ERV

0.1 — Install Toolchain

1. Install VS Code + PlatformIO extension. This is the recommended toolchain for this build — better library management than Arduino IDE and supports both boards.
2. Or use Arduino IDE 2.x with the ESP32 board package by Espressif (version 2.x or 3.x) installed via Boards Manager. URL: https://raw.githubusercontent.com/espressif/arduino-esp32/gh-pages/package_esp32_index.json
3. Install required libraries (PlatformIO: add to platformio.ini · Arduino IDE: Library Manager):
   • knolleary/PubSubClient — MQTT client
   • me-no-dev/ESPAsyncWebServer + me-no-dev/AsyncTCP — web server + WebSocket
   • olehs/UMODBUS or eModbus/eModbus — Modbus RTU master (Stage 2+)
   • ArduinoJson — JSON serialization
   • ESPmDNS — built-in with ESP32 package
4. For Stage 4 (WT32-SC01 Plus panels): install LVGL 8.x and the WT32-SC01 Plus board definitions.

0.2 — Flash Test Both Boards

Before touching the ERV, verify both ESP32-S3 boards enumerate over USB and accept a basic blink sketch. Identify serial port assignments on your machine.

Board: "XIAO_ESP32S3"  (for capture bridge board)
Board: "Adafruit Feather ESP32-S3"  (for controller board)
Upload speed: 921600
USB CDC on Boot: Enabled  ← important for Serial monitor on S3

1.1 — Physical Install of the Bridge

1. Power down the ERV at the breaker.
2. Open the ERV service panel. Locate the VTouch terminal block (A, B, GND, +12 V).
3. Use T-tap wire connectors or a 4-way terminal splitter to insert the bridge in series between the ERV terminal and the VTouch cable — do not cut the VTouch cable.
4. Connect bridge wiring:

   ERV terminal ─── [T-tap A] ──┬── VTouch cable A
                                 └── MAX3485 #2 (ERV side) A
   
   ERV terminal ─── [T-tap B] ──┬── VTouch cable B
                                 └── MAX3485 #2 (ERV side) B
   
   VTouch cable A ──────────────── MAX3485 #1 (VTouch side) A
   VTouch cable B ──────────────── MAX3485 #1 (VTouch side) B
   ERV GND ─────────────────────── Bridge GND
   ERV +12 V ──── Buck 12→5 V ──── Bridge USB-C / 5 V rail

5. Power up the ERV. VTouch should function normally. The bridge is invisible — it only listens.

1.2 — Stage 1 Firmware: Passive Capture

// platformio.ini board: seeed_xiao_esp32s3
// Both UARTs receive-only. DE=LOW, RE=LOW on both MAX3485 boards.

#include <WiFi.h>
#include <PubSubClient.h>

#define UART_BAUD   9600
#define RX_VTOUCH   4     // UART1 RX (VTouch side)
#define TX_VTOUCH   5     // UART1 TX (unused in Stage 1)
#define DIR_VTOUCH  6     // DE/RE — keep LOW
#define RX_ERV      7     // UART2 RX (ERV side)
#define TX_ERV      8     // UART2 TX (unused in Stage 1)
#define DIR_ERV     9     // DE/RE — keep LOW

HardwareSerial vtSerial(1);   // UART1 — VTouch side
HardwareSerial ervSerial(2);  // UART2 — ERV side

const char* WIFI_SSID = "YOUR_SSID";
const char* WIFI_PASS = "YOUR_PASSWORD";
const char* MQTT_HOST = "192.168.1.XXX"; // controller ESP32 IP (temp broker)

WiFiClient   net;
PubSubClient mqtt(net);

uint8_t vtBuf[64], ervBuf[64];
uint8_t vtLen = 0, ervLen = 0;
uint32_t vtLast = 0, ervLast = 0;
const uint32_t FRAME_GAP_MS = 5; // 3.5 char times @ 9600 baud ≈ 4 ms

void setup() {
  Serial.begin(115200);
  pinMode(DIR_VTOUCH, OUTPUT); digitalWrite(DIR_VTOUCH, LOW);
  pinMode(DIR_ERV,    OUTPUT); digitalWrite(DIR_ERV, LOW);
  vtSerial.begin(UART_BAUD, SERIAL_8N1, RX_VTOUCH, TX_VTOUCH);
  ervSerial.begin(UART_BAUD, SERIAL_8N1, RX_ERV, TX_ERV);
  WiFi.begin(WIFI_SSID, WIFI_PASS);
  while (WiFi.status() != WL_CONNECTED) delay(200);
  mqtt.setServer(MQTT_HOST, 1883);
  mqtt.connect("erv-bridge");
}

void publishFrame(const char* topic, uint8_t* buf, uint8_t len, uint32_t ts) {
  char json[200];
  char hex[100] = {};
  for (int i = 0; i < len; i++) sprintf(hex + i*3, "%02X ", buf[i]);
  snprintf(json, sizeof(json),
    "{\"ts\":%lu,\"hex\":\"%s\",\"len\":%d}", ts, hex, len);
  mqtt.publish(topic, json);
  Serial.println(json); // also to serial monitor
}

void drainUart(HardwareSerial& s, uint8_t* buf, uint8_t& len,
               uint32_t& lastMs, const char* topic) {
  while (s.available()) {
    buf[len++] = s.read();
    lastMs = millis();
  }
  if (len > 0 && (millis() - lastMs) > FRAME_GAP_MS) {
    publishFrame(topic, buf, len, lastMs);
    len = 0;
  }
}

void loop() {
  if (!mqtt.connected()) mqtt.connect("erv-bridge");
  mqtt.loop();
  drainUart(vtSerial,  vtBuf,  vtLen,  vtLast,  "erv/raw/vt");
  drainUart(ervSerial, ervBuf, ervLen, ervLast, "erv/raw/erv");
}

Flash this, open MQTT Explorer pointed at the broker, then operate the VTouch through every function.

1.3 — Capture Session Checklist

Run through each action multiple times. Let the unit idle between each group to capture poll cycles clearly. Log to a file in MQTT Explorer (File → Export).

1.4 — Decoding Modbus RTU Frames

All frames follow standard Modbus RTU framing. Decode each captured hex string:

── Read Request (VTouch → ERV) ──
[Addr][FC  ][RegHi][RegLo][CntHi][CntLo][CRC_Lo][CRC_Hi]
  01    03    00     01     00     06      XX       XX
FC 03 = Read Holding Registers
Reg 0x0001, count 6 → reading 6 registers starting at 0x0001

── Read Response (ERV → VTouch) ──
[Addr][FC  ][ByteCnt][Data × N bytes ][CRC_Lo][CRC_Hi]
  01    03     0C     [12 bytes / 6 regs]  XX     XX

── Write Request (VTouch → ERV) ──
[Addr][FC  ][RegHi][RegLo][ValHi][ValLo][CRC_Lo][CRC_Hi]
  01    06    00     01     00     03      XX       XX
FC 06 = Write Single Register
Reg 0x0001, value 0x0003 → set mode to High (or index 3)

── Write Response (ERV echoes request) ──
  01    06    00     01     00     03      XX       XX

2.1 — Wire the Controller (ESP32-S3 #1)

Adafruit Feather ESP32-S3 GPIO assignments:
  GPIO17 = UART1_RX  ← MAX3485 RO (ERV RS-485 A/B)
  GPIO18 = UART1_TX  → MAX3485 DI
  GPIO15 = DIR_ERV   → MAX3485 DE+RE tied (HIGH = transmit, LOW = receive)

MAX3485 → ERV terminal block:
  A → ERV T1
  B → ERV T2
  GND → ERV T3

Power: 5 V USB-C or 12V ERV → buck → 5 V → USB-C input

2.2 — Controller Firmware: MQTT Broker + RS-485 Master

// Controller ESP32-S3 #1 — Stage 2 sketch outline
// Libraries: PubSubClient, ESPAsyncWebServer, eModbus, ArduinoJson, ESPmDNS

// ── MQTT Broker ──────────────────────────────────
// Use uMQTTBroker (https://github.com/martin-ger/uMQTTBroker)
// Add to lib_deps: martin-ger/uMQTTBroker
#include <uMQTTBroker.h>
// Call uMQTT_startBroker(1883); in setup() after WiFi connect
// This ESP32 IS the broker — no external broker needed.

// ── RS-485 Modbus RTU Master ─────────────────────
// eModbus library: https://github.com/eModbus/eModbus
#include <ModbusClientRTU.h>
ModbusClientRTU MB(Serial1, DIR_ERV_PIN);
// MB.begin(9600); // baud confirmed from Stage 1

// ── Poll Loop (every 5 s) ──────────────────────
void pollERV() {
  // FC03: read 8 registers from 0x0001
  MB.addRequest(TOKEN_POLL, ERV_ADDR, READ_HOLD_REGISTER, 0x0001, 8);
}

// ── On Modbus Response ─────────────────────────
void onData(ModbusMessage response, uint32_t token) {
  // Parse registers into state struct
  // Publish to erv/state (retained=true)
  // Push via WebSocket: ws.textAll(stateJson)
}

// ── On MQTT Command ────────────────────────────
void onCommandReceived(const char* topic, const char* payload) {
  // Parse JSON → command + params
  // Validate (check register bounds, enum values)
  // Queue for next available RS-485 slot
  // Publish ACK to erv/command/ack/{client_id}
}

// ── Arbitration (simple FIFO, priority, TTL) ──
// See queue section below

2.3 — Upgrade Bridge to Active Proxy

In Stage 2 the bridge still passes VTouch commands through to the ERV, but it also translates them to MQTT so the controller is aware.

VTouch READ  → Bridge forwards bytes verbatim to ERV side
             ← ERV response forwarded back to VTouch
             → Decoded frame published to erv/audit (info only)

VTouch WRITE → Bridge:
  1. Forwards to ERV (executes on real unit)
  2. Publishes decoded command to erv/command/request
  3. Forwards ERV's WRITE echo back to VTouch

3.1 — Rewire the Bridge

Remove the bridge's tap on the ERV side. The controller is now the only device on the ERV RS-485 bus. The bridge only talks to the VTouch.

Before Stage 3:
  VTouch ── Bridge (pass-through) ── ERV

After Stage 3:
  VTouch ── Bridge (VTouch emulator)
                                      Controller ── ERV

The bridge now has a single MAX3485 (VTouch side only). It no longer has physical access to the ERV bus.

3.2 — Bridge Firmware: VTouch Emulator

The bridge now acts as a fake ERV slave to the VTouch. It answers all of VTouch's Modbus reads from a local state cache that is kept in sync with erv/state via MQTT. VTouch writes are translated to MQTT commands and sent to the real controller.

// Bridge ESP32-S3 #2 — Stage 3: VTouch emulator
// Only one UART now (VTouch side). DE/RE controlled for half-duplex.

// ── State cache (mirror of erv/state) ──────────
struct ERVState {
  uint8_t  mode;          // 0–4
  uint16_t supply_temp;   // °F × 10
  uint16_t exhaust_temp;  // °F × 10
  uint8_t  humidity;      // %
  uint8_t  filter_status; // 0=ok 1=replace
  uint16_t boost_remaining;
  uint8_t  defrost;
} cache;

// ── MQTT: subscribe to erv/state, update cache ──
void onMqttState(const char* payload) {
  // Parse JSON → update cache fields
}

// ── Modbus slave responder ────────────────────
// Listen on VTouch serial for requests
// When VTouch sends FC03 (read), reply with cache values
// When VTouch sends FC06 (write), publish to erv/command/request
//   then reply with Modbus write echo (confirm to VTouch immediately)

void handleVTouchRequest(uint8_t* req, uint8_t len) {
  uint8_t fc  = req[1];
  uint16_t reg = (req[2] << 8) | req[3];

  if (fc == 0x03) {          // READ — answer from cache
    uint8_t resp[64];
    uint8_t cnt = buildReadResponse(reg, req[4]<<8|req[5], cache, resp);
    sendRS485(resp, cnt);
  } else if (fc == 0x06) {   // WRITE — forward via MQTT
    uint16_t val = (req[4] << 8) | req[5];
    publishCommand(reg, val);
    // Echo write confirmation back to VTouch immediately
    uint8_t echo[8];
    memcpy(echo, req, 6);
    appendCRC(echo, 6);
    sendRS485(echo, 8);
  }
}

3.3 — Command Arbitration on the Controller

All commands — from VTouch bridge, replacement panels, and web UI — arrive on erv/command/request. The controller serializes them before issuing RS-485 writes.

4.1 — Why WT32-SC01 Plus

4.2 — Physical Installation

1. Cut a single-gang opening in drywall at the desired location (where VTouch was, or new location).
2. Install an old-work single-gang electrical box. Run USB-C power cable through a low-voltage opening or the knockout.
3. If replacing the original VTouch location: the existing VTouch cable (A/B/GND/12V) can either be capped (if bridge emulator handles the VTouch) or repurposed for panel power if convenient.
4. 3D print the Decora-size faceplate for the WT32-SC01 Plus. Secure the board to the faceplate with M2 standoffs (or hot-glue for prototype).
5. Connect USB-C, fold into the box, snap the faceplate to the Decora plate, and screw to the single-gang box.

4.3 — Panel Firmware (LVGL + MQTT Client)

// WT32-SC01 Plus — platformio.ini
// board: esp32s3box  (or use WT32-SC01-PLUS custom board def)
// lib_deps:
//   lvgl/lvgl@^8.3.0
//   knolleary/PubSubClient
//   ArduinoJson

// ── LVGL UI layout ───────────────────────────
// Screen: 480 × 320 px
// Top bar (40px): mode label + connection dot
// Center (180px): large current mode pill buttons
//   [ OFF ] [ LOW ] [ MED ] [ HIGH ] [ BOOST ]
// Sensor row (60px): supply °F | exhaust °F | humidity %
// Bottom bar (40px): boost timer countdown (hidden when not in boost)
//                    + settings gear icon (opens drawer)

// ── Mode buttons (LVGL lv_btnmatrix or lv_btn grid) ──
static const char* MODE_LABELS[] = { "OFF", "LOW", "MED", "HIGH", "BOOST" };
// On press: publish to erv/command/request, show pending spinner

// ── State sync via MQTT ───────────────────────
void onMqttState(const char* payload) {
  // Parse JSON → update LVGL labels + active button highlight
  // lv_label_set_text(temp_supply_lbl, "68.4°F");
  // lv_obj_add_state(mode_btn[mode], LV_STATE_CHECKED);
}

// ── Offline indicator ─────────────────────────
// If MQTT disconnects > 10 s: overlay red banner "Reconnecting…"

// ── Settings drawer ───────────────────────────
// Swipe up from bottom bar to reveal:
//   Poll interval slider, display brightness slider,
//   broker IP display, firmware version

4.4 — UI Sketch (480 × 320)

┌────────────────────────────────────────────────────────────────┐
│  ● ERV  ·  High Speed          🌡 Supply: 68.4°F   [●] online  │  ← top bar
├────────────────────────────────────────────────────────────────┤
│                                                                │
│   ┌──────┐  ┌──────┐  ┌──────┐  ┌ ──── ┐  ┌──────┐          │
│   │  OFF │  │  LOW │  │  MED │  │ HIGH │  │BOOST │          │  ← mode pills
│   └──────┘  └──────┘  └──────┘  └──────┘  └──────┘          │
│                           ↑ active = filled                   │
├────────────────────────────────────────────────────────────────┤
│  Supply: 68.4°F    Exhaust: 71.2°F    Humidity: 52%           │  ← sensor row
├────────────────────────────────────────────────────────────────┤
│  [Boost: 18 min remaining ████████░░░░░░░░░░░░]         ⚙    │  ← boost bar
└────────────────────────────────────────────────────────────────┘