Appliance:2REF11EIDA__4

Brand name: Standard-Depth 4-Door French Door Refrigerator
Official model name: LF29H8330S
ThinQ Model ID: 2REF11EIDA__4

This is a fridge/freezer, with a flex temp drawer, in door water/ice maker, and a freezer ice maker.

It communicates with the "AABB" protocol.

Packet format

The packets below are described excluding the AA..BB framing. This means that each full packet is 4 bytes longer.

device-to-cloud messages

"10EC" 138-byte message

This message contains various interesting data about the state of the fridge.

Example:

10EC0209060202020400000001FFFF0300FFFF00FFFFFFFFFFFFFF020001010100000102FF6161FFFFFF01FF00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0078FF00000209060202020401000001FFFF0300FFFF00FFFFFFFFFFFFFF020001010100000102FF6161FFFFFF01FF00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0078FF0000

The message can be split into three parts:

• 10EC - header?
• previous state of the appliance: a 68-byte block
• current state of the appliance: a 68-byte block

The following bytes in the state block have been identified

byte index (zero-based)	field	description
1	fridge temp setpoint	Formula = 44 - value (in decimal). E.g. if value is 10, then setpoint is 34 °F
2	freezer temp setpoint	Formula: 6 - value (in decimal, for °F). E.g. if value is 12, then setpoint is -6 °F
3	Ice Plus command	1 = off, 2 = on
5	Smart grid command	0 = off, 2 = on What's 1 then? Power reduced by grid command?
7	Door status	1 = open, 0 = closed No differentiation between each of the 4 doors/drawers. Set to 1 if any door is open.
10	Panel lock command	1=unlocked, 2=locked
13	Flex drawer setpoint	Values: 1 - chilled wine. 2 - deli/snacks. 3 - cold drink. 4 - meat/seafood. 5 - freezer
32	In-door ice command	0 = off, 1 = on, 2 = ice full
33	Cubed Ice command (freezer drawer ice maker)	0 = off, 1 = on, 2 = ice full

(thanks to @jseyfert3 for the analysis)

cloud-to-device messages

initial query

The following message needs to be sent before the fridge will produce any useful output:

F0ED1211010000010400

change settings

All the settings appear to be settable with a single complex message.

F017FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000FFFF00FFFFFFFF00FFFFFFFFFFFFFFFFFF00FFFFFF1EFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0AFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Skipping the F017 header, the following bytes have been identified:

byte index (zero-based)	field	description
1	fridge temp setpoint	same as the above table
2	freezer temp setpoint	same as the above table
13	Flex drawer setpoint	same as the above table

Note that the structure exactly matches the "state block" described above.

Setting any of these bytes to 0xff means "leave unchanged".