Appliance:2REF11EIDA__4

Brand name: Standard-Depth 4-Door French Door Refrigerator
Official model name: LF29H8330S
ThinQ Model ID: 2REF11EIDA__4

This is a fridge/freezer, with a flex temp drawer, in door water/ice maker, and a freezer ice maker.

It communicates with the "AABB" protocol.

Packet format

The packets below are described excluding the AA..BB framing. This means that each full packet is 4 bytes longer.

device-to-cloud messages

236-byte message

This message contains various interesting data about the state of the fridge. Thanks to @jseyfert3 for the analysis:

• Door Status
  Byte 9 is prior status, byte 77 is current status
  1 = open, 0 = closed
  No differentiation between each of the 4 doors/drawers. Set to 1 if any door is open.

• Fridge temp setpoint:
  Byte 3 is prior, byte 71 is current
  Formula = 44 - value (in decimal). E.g. if byte 74 is 10, then setpoint is 34 °F

• Freezer temp setpoint:
  Byte 4 is prior, byte 72 is current
  Formula: 6 - value (in decimal, for °F). E.g. if byte 75 is 12, then setpoint is -6 °F

• Flex drawer setpoint:
  Byte 15 is prior, 83 is current
  Values: 1 - chilled wine. 2 - deli/snacks. 3 - cold drink. 4 - meat/seafood. 5 - freezer

• Ice Plus command:
  Byte 5 is prior, 73 is current
  1 = off, 2 = on

• Cubed Ice command (freezer drawer ice maker):
  Byte 35 is prior, 103 is current
  0 = off, 1 = on, 2 = ice full

• In door ice command:
  Byte 34 is prior, 102 is current
  0 = off, 1 = on, 2 = ice full

• Smart grid command:
  Byte 7 is prior, 75 is current
  0 = off, 2 = on
  What's 1 then? Power reduced by grid command?

• Panel lock command:
  Byte 12 is prior, 80 is current
  2 = locked, 1 = unlocked

cloud-to-device messages

initial query

The following message needs to be sent before the fridge will produce any useful output:

F0ED1211010000010400

change settings

All the settings appear to be settable with a single complex message.

F017FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000FFFF00FFFFFFFF00FFFFFFFFFFFFFFFFFF00FFFFFF1EFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0AFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Byte numbers indexed from zero:

• byte 3 specifies the temperature setpoint for the fridge (encoding as above)
• byte 4 specifies the temperature setpoint for the freezer
• byte 15 specifies the temperature preset for the flex/convertible drawer
• the remaining bytes are not yet understood

Setting any of these bytes to 0xff means "leave unchanged".