I made a number of captures today with the system in different states, hoping to identify messages.

I had assumed that the remote would request particular data, and that the heat pump would reply. This, however, appears not to be the case.

Much of the time, the heatpump sends:

07 00 01 08 00 00 EF

And the remote acknowledges:

05 01 00 09 F0

and then immediately sends one of:

0E 01 00 97 08 0E 10 05 01 00 32 7B FE 82
12 01 00 A1 00 16 00 00 00 00 00 00 00 00 00 33 26 DC
0B 01 00 A3 A4 00 00 00 A4 47 C1

 (with small changes in places)

which is acknowledged by the heatpump with:

05 00 04 08 EE

(the above were collected while the pump was on standby, with no DHW or CH demand, and an outdoor air temp of 9.5 Celsius)

The first byte of each packet is the packet length in number of bytes.

The second appears to be an address (of the transmitting or receiving unit?)

The last byte is the checksum - sum complement.

Now for the rest...