I work for a company that repairs electronics. We work on things like laptops, GPS, cellphones etc. which we repair to the component level -- I spend much of my day soldering under a microscope.

One of our larger customers has, apparently, "a warehouse full" of HVAC control hardware that is known bad or used/untested. Our boss has been working up a Plan to repair these controls and my role in this project is to come up with test fixtures and so on to make it all happen. I have the general electronic chops to put this together, but I'm looking for a source of low-level information on Alerton control modules to save the trouble of having to reverse-engineer everything from scratch.

I'm hoping you folks can get me pointed in the right direction.

So far all the stuff I've been shown is Alerton; Ibex and BACtalk. I had early success with a TX-653P. On one of the forums here I found a piece of software called "TDS" which allowed me to connect to the RS232 header on the 653 and control it. I could read all the inputs and set all the outputs. The only info I had on the module was a tag that said, "analog?" and sure enough, the analog outputs were all dead. I quickly narrowed it down to an opamp that cost a quarter, changed that out and all was well. The customer put that module into one of his HVAC systems and verified that it worked.

So of course the boss now thinks I'm a genius, and the next thing I get is a bunch of BACtalk modules that don't have RS232 ports and wouldn't work with TDS (I think?) even if they did. And a box of Microset wall modules.

I did get a BCM-PWS and BCM-ETH, and I hooked them up to a router and can talk to the ETH but it doesn't see any of the BACtalk modules I've hooked up to it. This could be because all the modules I've tried are dead, or it could be because I'm not doing something important.

Now all of these things (except the Microsets) have RS485 and I've done a lot of work with RS485 in previous lives. But I need to know what to say to the 485 port to make each module do its thing.

Ultimately, here's what I'd like to be able to do: For any arbitrary Alerton Ibex or BACtalk module, communicate with the module. Read the value of all inputs, set arbitrary values to all outputs. Clear any stored program in the onboard memory ("DDC"?). Talk to a Microset without any other Alerton hardware involved to read all the buttons and sensors. The Microsets I've seen so far all seem to be input-only widgets, but if there are Microsets with display elements, LEDs, etc. I want to be able to write arbitrary stuff to those outputs.

I work with microcontrollers extensively, and have no qualms about building and programming a microcontroller-based gizmo that lies through its little digital teeth to the module being tested. I just need to know what language to lie in :-)

What I'm NOT looking to do is to build an HVAC system, whether live or as a test bed. I don't even really care that these modules are used in HVAC -- they could be for automotive engines, oil refineries, or Mars landers; outputs are outputs and inputs are inputs regardless.

All I'm looking for are pointers to sources of information on things like comm protocols and device enumeration so that I can get access to those tasty IO ports. The googling I've done seems to basically point me either to people selling modules, or right here to the hvac-talk.com forums. Can someone here help me out with a couple of URLs?