Tempurpedic Bed Control

[Bob_Linux_User]

Hi all,

I need a little help with this project. I am trying to control my Tempur pedic bed from HomeSeer. I have obtained the Hex commands to perform the functions that I need but I am having trouble converting the Hex command string to a binary representation of the Hex command. The bed must receive commands via UDP on port 50007 and responds with an "ACK3" when the command is accepted. In Linux I can send the below command line which works perfectly but xxd does the data conversion to binary:

"echo "33053203945c0000c8" | xxd -r -p | nc -n -4u -w1 192.168.1.XX 50007"

I and running HomeSeer on Windows 10 and would like to have a vb.net script to perform the functions. Right now I have a convoluted method to control the bed. I have a .sh file with the above command on my raspberry Pi shop system and use JSON on my Windows system to run an event on the Rpi which invokes the .sh file which controls the bed. Whew...

I have the below code started but the conversion of the Hex command is not right and when I look at Wireshark I do not see the UDP command issued on the network. Also the routine says that it sends 26 bytes of data and it should send 9. Any help would be appreciated. The code I have is below:

'***********************************************************************************
'*** This Routine should send a 9 byte binary representation of a Hex code via UDP
'*** The bytCommand is sent to a Tempurpedic Adjustable Bed on port 50007
'*** The Commands are as follows:
'***    Memory Position 1       Hex 33053203945C0000C8
'***    Memory Position 2       Hex 33053203945c0100c9
'***    Flat Position           Hex 3305320A945C0400CC
'***    Vibration 1             Hex 33053203948D007861
'***    Vibration Off           Hex 3305320A9486000012
    
Imports System.Net
Imports System.Net.Sockets
Imports System.Text

 Sub Main(ByVal parms as Object)
    Dim udpClient As New UdpClient
    Dim GLOIP As IPAddress 
    Dim GLOINTPORT As Integer 
    Dim bytCommand As Byte() = New    Byte() {}
    Dim pRet As Integer

    GLOIP = IPAddress.Parse("192.168.1.XX")
    GLOINTPORT = 50007
    udpClient.Connect(GLOIP, GLOINTPORT)
    bytCommand = Encoding.ASCII.GetBytes("33053203945C0000C8")
    pRet = udpClient.Send(bytCommand, bytCommand.Length)
    hs.writelog("No of bytes send " & pRet)
 End Sub

[sparkman]

Your conversion treats the hex string as ascii characters, not hex values. Let me check what the method should be.

[Bob_Linux_User]

Your conversion treats the hex string as ascii characters, not hex values. Let me check what the method should be.

Thanks Sparkman. I just "wing-it" with .vb and use examples from others to try to get the job done.

Bob

[sparkman]

I haven't found a simple function that does that. There are some example here: http://stackoverflow.com/questions/3...-binary-string that shows how you need to loop through your hex string to create a binary one.

Cheers
Al

[Bob_Linux_User]

After some more research I found a solution for the Hex string to byte array. I have posted the working code below.

Bob

'***********************************************************************************
'*** This Routine should send a 9 byte binary representation of a Hex code via UDP
'*** The bytCommand is sent to a Tempurpedic Adjustable Bed on port 50007
'*** The Commands are as follows:
'***    Memory Position 1       Hex 33-05-32-03-94-5C-00-00-C8
'***    Memory Position 2       Hex 33-05-32-03-94-5c-01-00-c9
'***    Flat Position           Hex 33-05-32-0A-94-5C-04-00-CC
'***    Vibration 1             Hex 33-05-32-03-94-8D-00-78-61
'***    Vibration Off           Hex 33-05-32-0A-94-86-00-00-12
    
Imports System.Net
Imports System.Net.Sockets
Imports System.Text

 Sub Main(ByVal parms as Object)
    Dim udpClient As New UdpClient
    Dim GLOIP As IPAddress 
    Dim GLOINTPORT As Integer
    Dim cmdlength As Integer = 9
    Dim pRet As Integer
    Dim binstring As String
    Dim input As String = "33-05-32-0A-94-5C-04-00-CC"
    Dim bin As New Text.StringBuilder
    Dim bytCommand As Byte() = input.Split("-"c).Select(Function(n) Convert.ToByte(Convert.ToInt32(n, 16))).ToArray()
    GLOIP = IPAddress.Parse("192.168.1.XX")
    GLOINTPORT = 50007
    udpClient.Connect(GLOIP, GLOINTPORT)
    pRet = udpClient.Send(bytCommand,cmdlength)
 End Sub

[DSteiNeuro]

Thanks, I will have to try this.

Unfortunately it seems that my Tempurpedic radio has died (I can't find the IP using the app). It was working but I never really used the app.


It is very hard to get under the bed to try to debug but now I have a reason to give it another try.

[Bob_Linux_User]

If anyone is interested, I updated my script to be more user friendly. Just enter the function to be performed in the "Parameters" field for calling the script (i.e. Memory 1, Flat, etc) and the script will parse the function. The only issue is that I have not been able to capture the proper Hex code for Memory 3 and Memory 4. The code follows:

Bob

'***********************************************************************************
'*** This Routine should send a 9 byte binary representation of a Hex code via UDP to
'*** port 50007. The String Paramenter "param" is sent to the script from the event
'*** which "Case" select which command to send to the Tempur-pedic Adjustable Bed 
'*** 
'*** The Commands are as follows:
'***    Memory Position 1       Hex 33-05-32-03-94-5C-00-00-C8       TV Position
'***    Memory Position 2       Hex 33-05-32-03-94-5C-01-00-C9       Sleep Position
'***    Memory Position 3       Hex 33-05-32-03-94-5C-01-00-C9       Not Assigned
'***    Memory Position 4       Hex 33-05-32-03-94-5C-01-00-C9       Sleep Position
'***    Flat Position           Hex 33-05-32-0A-94-5C-04-00-CC       Flat
'***    Vibration 1             Hex 33-05-32-03-94-8D-00-78-61       Head Vibration
'***    Vibration Off           Hex 33-05-32-0A-94-86-00-00-12       Vibration Off
    
Imports System.Net
Imports System.Net.Sockets
Imports System.Text
Imports System.IO

 Sub Main(ByVal parms As String)
    Dim udpClient As New UdpClient
    Dim GLOIP As IPAddress 
    Dim GLOINTPORT As Integer
    Dim cmdlength As Integer = 9
    Dim pRet As Integer
    Dim input As String
    Select Case parms
        Case "Memory 1"
		input = "33-05-32-03-94-5C-00-00-C8"
        Case "Memory 2"
		input = "33-05-32-03-94-5C-01-00-C9"
	Case "Memory 3"
		input = "33-05-32-0A-94-5C-04-00-CC"
	Case "Memory 4"
		input = "33-05-32-0A-94-5C-04-00-CC"
	Case "Flat"
		input = "33-05-32-0A-94-5C-04-00-CC"
	Case "Vibe 1"
		input = "33-05-32-03-94-8D-00-78-61"
	Case "Vibe off"
		input = "33-05-32-0A-94-86-00-00-12"
	Case Else
		input = "33-05-32-0A-94-5C-04-00-CC"
    End Select

    Dim bytCommand As Byte() = input.Split("-"c).Select(Function(n) Convert.ToByte(Convert.ToInt32(n, 16))).ToArray()
    GLOIP = IPAddress.Parse("192.168.1.50")
    GLOINTPORT = 50007
    udpClient.Connect(GLOIP, GLOINTPORT)
    pRet = udpClient.Send(bytCommand,cmdlength)
 End Sub

[Bob_Linux_User]

Unfortunately it seems that my Tempurpedic radio has died (I can't find the IP using the app). It was working but I never really used the app.

Just unplug the bed and wait a few seconds before plugging it back in. Sometimes the WiFi gets hung-up and doesn't respond.

Bob

[DSteiNeuro]

You probably need to do a reset of the Wifi Module.
Complete instructions are here.

[DSteiNeuro]

You probably need to do a reset of the Wifi Module.

Just realized that I answered my own question

In any case, the script is working great. I didn't really use the Tempurpedic app much, but this adds a lot of functionality (plus it is cool).

I always find it very interesting on how we hack this type of thing. I have done it myself and amazed that it is doable. This is nice proof of concept that a WiFi command can be snooped and issued from HS.

Nice work, Let us know if you snoop anymore Hex codes.

Thanks!

[WiDoAlEv]

If anyone is interested, I updated my script to be more user friendly. Just enter the function to be performed in the "Parameters" field for calling the script (i.e. Memory 1, Flat, etc) and the script will parse the function. The only issue is that I have not been able to capture the proper Hex code for Memory 3 and Memory 4. The code follows:

Bob

'***********************************************************************************
'*** This Routine should send a 9 byte binary representation of a Hex code via UDP to
'*** port 50007. The String Paramenter "param" is sent to the script from the event
'*** which "Case" select which command to send to the Tempur-pedic Adjustable Bed 
'*** 
'*** The Commands are as follows:
'***    Memory Position 1       Hex 33-05-32-03-94-5C-00-00-C8       TV Position
'***    Memory Position 2       Hex 33-05-32-03-94-5C-01-00-C9       Sleep Position
'***    Memory Position 3       Hex 33-05-32-03-94-5C-01-00-C9       Not Assigned
'***    Memory Position 4       Hex 33-05-32-03-94-5C-01-00-C9       Sleep Position
'***    Flat Position           Hex 33-05-32-0A-94-5C-04-00-CC       Flat
'***    Vibration 1             Hex 33-05-32-03-94-8D-00-78-61       Head Vibration
'***    Vibration Off           Hex 33-05-32-0A-94-86-00-00-12       Vibration Off
    
Imports System.Net
Imports System.Net.Sockets
Imports System.Text
Imports System.IO

 Sub Main(ByVal parms As String)
    Dim udpClient As New UdpClient
    Dim GLOIP As IPAddress 
    Dim GLOINTPORT As Integer
    Dim cmdlength As Integer = 9
    Dim pRet As Integer
    Dim input As String
    Select Case parms
        Case "Memory 1"
        input = "33-05-32-03-94-5C-00-00-C8"
        Case "Memory 2"
        input = "33-05-32-03-94-5C-01-00-C9"
    Case "Memory 3"
        input = "33-05-32-0A-94-5C-04-00-CC"
    Case "Memory 4"
        input = "33-05-32-0A-94-5C-04-00-CC"
    Case "Flat"
        input = "33-05-32-0A-94-5C-04-00-CC"
    Case "Vibe 1"
        input = "33-05-32-03-94-8D-00-78-61"
    Case "Vibe off"
        input = "33-05-32-0A-94-86-00-00-12"
    Case Else
        input = "33-05-32-0A-94-5C-04-00-CC"
    End Select

    Dim bytCommand As Byte() = input.Split("-"c).Select(Function(n) Convert.ToByte(Convert.ToInt32(n, 16))).ToArray()
    GLOIP = IPAddress.Parse("192.168.1.50")
    GLOINTPORT = 50007
    udpClient.Connect(GLOIP, GLOINTPORT)
    pRet = udpClient.Send(bytCommand,cmdlength)
 End Sub

Hey Bob!

I recently stumbled upon your post while attempting to reverse engineer the Tempur Ergo Android App so that I could build an Amazon Echo skill so that Alexa could control my bed. Thanks to you pointing me in the right direction, I am happy to say I was successful and its awesome! Cheers!

Additionally, in the reverse engineering, I was able to extract some of the HEX codes you were looking for. See below... If you want more, I am happy to extract them from the app; I can pretty much get all of them.

Happy Holidays!
Bill

'***    Memory Position 1       Hex 33-05-32-0A-94-5C-00-00-C8
'***    Memory Position 2       Hex 33-05-32-0A-94-5C-01-00-C9
'***    Memory Position 3       Hex 33-05-32-0A-94-5C-02-00-CA
'***    Memory Position 4       Hex 33-05-32-0A-94-5C-03-00-CB
'***    Flat Position           Hex 33-05-32-0A-94-5C-04-00-CC
'***    Vibration 1             Hex 33-05-32-03-94-8D-00-78-61
'***    Vibration 2             Hex 33-05-32-03-94-8D-01-78-60
'***    Vibration 3             Hex 33-05-32-03-94-8D-02-78-63
'***    Vibration 4             Hex 33-05-32-03-94-8D-03-78-62
'***    Vibration Off           Hex 33-05-32-0A-94-86-00-00-12

[jgary]

Better make sure your bed is NOT controlled by guest access, else someone may fold you up in the middle of the night !

[Bob_Linux_User]

Additionally, in the reverse engineering, I was able to extract some of the HEX codes you were looking for.

Bill,

Once I got the main positions working I diverted to working on Alexa projects. Thanks for the other codes. I will put them in the script.

Bob

[Bob_Linux_User]

Better make sure your bed is NOT controlled by guest access, else someone may fold you up in the middle of the night !

Funny that you should mention that. I have a "Good Night" routine that closes up the house, turns the bedroom TV on and puts the bed in the "TV" (Zero Gravity) position. My granddaughter recently moved in with us and was out late one night. I had not instructed her how to lock up the house and she used the "Good Night" routine. We got a real shock when the bed folded up on us while we were in a deep sleep.

Bob

[WiDoAlEv]

Funny that you should mention that. I have a "Good Night" routine that closes up the house, turns the bedroom TV on and puts the bed in the "TV" (Zero Gravity) position. My granddaughter recently moved in with us and was out late one night. I had not instructed her how to lock up the house and she used the "Good Night" routine. We got a real shock when the bed folded up on us while we were in a deep sleep.

Bob

That is quite funny! I have had some fun surprising my wife remotely, lol. Best of luck with your projects! If there is anything further I can do to help, feel free to reach out!

Bill