No announcement yet.

Tempurpedic Bed Control

  • Filter
  • Time
  • Show
Clear All
new posts

    Thanks both! Working great.


    MSI Cubi Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz, 2201 Mhz, 2 Core(s), 4 Logical Processor(s) 16GB DDRl RAM

    Enabled Plug-Ins
    BLRussound, BLSpeech, HSTouch Server, JowiHue, MyQ, Nest, Rain8, Squeezebox, Ultra1Wire3, UltraGCIR3, Vista Alarm, X10,Z-Wave


      Hey everyone, long time listener first time poster - literally just registered to post this and hopefully help others. I'm posting this a couple places around the web so you may see a duplicate if you happen to be searching for this topic. Like many others I've been wanting to automate my Tempurpedic bed for a while now, and the cleanest way seemed to be the one detailed in this thread, sending commands to the WiFi module (rather than hardware hacking using either multiple relays like the Quadromated guy or Chris Laplante's RF reverse engineering). However, like some others, my WiFi module is running firmware 1.2.2, which wasn't responding to the UDP commands detailed in this thread.

      I'd poked at this a couple times over the last 5 years, but tonight got really annoyed and decided I was going to figure it out if it was possible at all. I ended up going back to the source, which is to say doing the same thing the OP here did and packet capturing the Tempurpedic app's network traffic - luckily the app still runs on my S10, and the Packet Capture Android app was incredibly useful.

      To cut a long story short (too late), I discovered that the app, before it sends the UDP commands, sends what I assume is some kind of greeting/wakeup command. The Packet Capture app shows the text as ".LOGICDA TAOPEN", and the hex string for it is "FE-4C-4F-47-49-43-44-41-54-41-4F-50-45-4E". It also technically sends the hex string "35" after that, before sending a bed modification command, but that "35" command doesn't appear to be strictly necessary (I put a 500 millisecond delay in my script just in case).

      Now I have no idea if this is in fact a generic string, so the one caveat to what I'm posting is that if this is somehow tied to my specific WiFi module it won't work for you, but in that case if you can get your hands on an Android that'll run the Ergo app you should be able to repeat my results. Please note this message is NOT always sent - it looks to me like the app sends it at the beginning to open a session, and that session is open for some amount of time (5 minutes maybe?). During that time, the app does not resend this message, it simply sends the messages to set the bed to whatever button you push. So my barely-educated guess is that the firmware update to 1.2.2 added this functionality, and the WiFi module isn't sitting there listening all the time like perhaps firmware 1.0.2 does. Once you send the open command, the module starts listening for bed commands.

      Below is the script I'm using in Homeseer to automate the bed now, which is basically just a crude hack of the VB.NET script posted above - it adds a second command which is not variable and fires a command to send this initiation hex string before every bed command, so the session gets opened properly. It doesn't appear that the module cares whether you send the command even if you have a session open, so even if you've just sent a command, it still works to send another command immediately even though it's sending the open command again (in my limited testing, which is not much, so it's possible if you tried to send 50 commands at once the module would have a problem, but I have no idea why you'd be doing that anyway). Also, there are a couple changes of the bed command hex strings from what was originally posted here, based on my packet captures today.

      If you're running on Linux, you can do the same with xxd and netcat, issuing the open command and then the bed modification command:

      echo "FE4C4F474943444154414F50454E" | xxd -r -p | nc -n -4u -w1 <BED IP ADDRESS> 50007
      echo "<BED COMMAND HEX STRING>" | xxd -r -p | nc -n -4u -w1 <BED IP ADDRESS> 50007

      (the script below shows most of the hex strings - remove the hyphens when putting in the echo command, and obviously replace <BED IP ADDRESS> with the IP address of your WiFi module)

      Hopefully this helps others who may have found the various threads around the web on doing this and been stuck as I was by the fact that it worked perfectly for everyone with firmware 1.0.2 and didn't do anything on firmware 1.2.2. (The worst part for me is that at some point back just after I got the bed, I UPDATED the firmware to 1.2.2, on the assumption that newer firmware would be better, OF COURSE, so I've been kicking myself for 6 years about that).

      Happy automating.


      '*********************************************************** ************************
      '*** This Routine should send a 9 byte binary representation of a Hex code via UDP to
      '*** port 50007. The String Parameter "param" is sent to the script from the event
      '*** which "Case" select which command to send to the Tempur-pedic Adjustable Bed
      '*** The Commands are as follows:
      '*** Memory Position 1 Hex 33-05-32-03-94-5C-00-00-C8 TV Position
      '*** Memory Position 2 Hex 33-05-32-03-94-5C-01-00-C9 Sleep Position
      '*** Memory Position 3 Hex 33-05-32-03-94-5C-01-00-C9 Not Assigned
      '*** Memory Position 4 Hex 33-05-32-03-94-5C-01-00-C9 Sleep Position
      '*** Flat Position Hex 33-05-32-0A-94-5C-04-00-CC Flat
      '*** Vibration 1 Hex 33-05-32-03-94-8D-00-78-61 Head Vibration
      '*** Vibration 2 Hex 33-05-32-03-94-8D-01-78-60
      '*** Vibration 3 Hex 33-05-32-03-94-8D-02-78-63
      '*** Vibration 4 Hex 33-05-32-03-94-8D-03-78-62
      '*** Vibration Off Hex 33-05-32-0A-94-86-00-00-12 Vibration Off

      Imports System.Net
      Imports System.Net.Sockets
      Imports System.Text
      Imports System.IO

      Sub Main(ByVal foo)
      Dim udpClient As New UdpClient
      Dim GLOIP As IPAddress
      Dim GLOINTPORT As Integer
      Dim cmdlength As Integer = 9
      Dim opencmdlength As Integer = 14
      Dim pOpen As Integer
      Dim pRet As Integer
      Dim input As String
      Select Case foo
      Case "Memory 1"
      input = "33-05-32-03-94-5c-00-00-c8"
      Case "Memory 2"
      input = "33-05-32-03-94-5c-01-00-c9"
      Case "Memory 3"
      input = "33-05-32-03-94-5c-02-00-ca"
      Case "Memory 4"
      input = "33-05-32-03-94-5c-03-00-cb"
      Case "Flat"
      input = "33-05-32-0a-94-5c-04-00-cc"
      Case "Vibe 1"
      input = "33-05-32-03-94-8d-00-78-61"
      Case "Vibe 2"
      input = "33-05-32-03-94-8d-01-78-60"
      Case "Vibe 3"
      input = "33-05-32-03-94-8d-02-78-63"
      Case "Vibe 4"
      input = "33-05-32-03-94-8d-03-78-62"
      Case "Vibe Off"
      input = "33-05-32-0a-94-86-00-00-12"
      Case Else
      input = "33-05-32-0a-94-5c-04-00-cc"
      End Select

      Dim openInput As String = "FE-4C-4F-47-49-43-44-41-54-41-4F-50-45-4E"
      Dim bytCommand As Byte() = input.Split("-"c).Select(Function(n) Convert.ToByte(Convert.ToInt32(n, 16))).ToArray()
      Dim openCommand As Byte() = openInput.Split("-"c).Select(Function(n) Convert.ToByte(Convert.ToInt32(n, 16))).ToArray()

      GLOIP = IPAddress.Parse("<BED IP ADDRESS>")
      GLOINTPORT = 50007

      udpClient.Connect(GLOIP, GLOINTPORT)

      pOpen = udpClient.Send(openCommand,opencmdlength)
      pRet = udpClient.Send(bytCommand,cmdlength)

      End Sub