Add support for Hyundai HTAC Air Conditioner (0x507a) #806

Activity

1. gabrielcolceriu commented on Jul 24, 2026

   

   gabrielcolceriu

   on Jul 24, 2026

   Author

   More actions

   Update — device fully reverse-engineered

   Since opening this, the 0x507A module has been fully reverse-engineered and a working, cloud‑free Home Assistant integration exists:
   https://github.com/gabrielcolceriu/hyundai-broadlink-ac

   Device

   • AC: Hyundai HTAC (HTAC-09/12/18/24CHSD/XA71-I); app: Intelligent AC.
   • Module: BroadLink "DNA", internal OEM name OEM_TCLISO_<mac-suffix>, chip Realtek RTL8195A.
   • Device type: 0x507A (the closely related TCL XA71I reports 0x507C).

   Transport / framing (BroadLink/DNA)

   • UDP, port 80. Discovery via the standard BroadLink UDP payload; devtype at 0x34, MAC at 0x3a..0x3f reversed.
   • Outer packet: magic 5aa5aa555aa5aa55, devtype@0x24, command 0x006a / response 0x03ee @0x26, MAC@0x2a, device id@0x30, plaintext checksum@0x34, encrypted payload from 0x38.
   • Checksums seed 0xbeaf, add bytes mod 0x10000.

   Encryption

   • AES-128-CBC, IV 562e17996d093d28ddb3ba695a2e6f58, inner plaintext zero-padded to 16 bytes.
   • Initial BroadLink auth key: 097628343fe99e23765c1513accf8b02.

   Auth / key

   • Standard BroadLink LAN auth (command 0x0065) works on unlocked units and returns the per-device AES key in decrypted response bytes 0x04..0x13 (device id at 0x00..0x03).
   • Some cloud-provisioned units report bl2 locked / AUTH_FAIL and refuse auth; on those the key is printed on the UART console at boot (Aes PWd: line).

   Inner payload

   • len(2) a5a55a5a checksum(2) action(1: 1=get,2=set) 0x0b jsonLen(4, LE) json.
   • Params: pwr 0/1, temp tenths °C, envtemp °C, tcl_mode 1=heat 2=dry 3=cool 4=fan 5=auto, tcl_mark fan speed 0..5, tcl_vdir/tcl_hdir swing, plus outdoor/coil/vent temps, error codes, filter flags.

   Prior art: jestempablo/home-assistant-tcl-intelligent-ac (tools + RE notes) and RazvanManolache/home-assistant-tcl-intelligent-ac-local.

   Happy to open a PR registering 0x507A/0x507C and adding a climate device class, once the auth path is confirmed end-to-end on an unlocked (freshly locally-paired) unit.