Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pinout #2

Closed
los93sol opened this issue Jun 22, 2017 · 82 comments
Closed

Pinout #2

los93sol opened this issue Jun 22, 2017 · 82 comments

Comments

@los93sol
Copy link

I'm actually looking to do similar with my tub and trying to figure out the pinout. Based on your findings I suspect the wifi module is nothing more than a dumb RS232 to Wifi module and that the protocol from the main to the topside is the same as what you're seeing from the Wifi module. I'm trying to find some documentation on the RJ45 port that Balboa uses on their VS series units. Does anyone have any info on it or can anyone confirm the wifi module isn't anything special?

@ccutrer
Copy link
Owner

ccutrer commented Jun 23, 2017

The protocol does feel very serial like, and it's infuriating that if one device is connected (or the tub thinks is still connected), another cannot connect, which would also point to masking a single serial port.

There are a few pieces of evidence that it's more than an off-the-shelf serial-to-wifi chipset, though:

  • Balboa has their own MAC address prefixes. This is fairly unusual among embedded devices, where they get MAC address assignments out of the pool of whatever wifi chip they happen to have in them.
  • setting the wifi parameters is done via the normal serial protocol. So either the adapter is watching for that particular sequence to recognize it, or the tub has enough smarts to echo the parameters back to the adapter in whatever the adapter's special protocol is.
  • cloud support. The tub makes an active connection out to balboa's servers to facilitate remote access. I haven't dove into this protocol much, besides recognizing that it's vastly different than the local protocol. And that multiple devices are allowed to connect "remotely" at the same time.

Assuming it is serial to the actual tub, though, none of these special add ons in their adapter should preclude the ability to insert your own serial device instead of the wifi adapter, and control the tub. It likely would preclude the ability to use the native app (which could be solved by setting up a proxy that pretends to be a tub-at least for local access). Given the flakiness of their wifi adapter, though, it may be a good route.

Unfortunately I'm not much of a low level hardware guy, so don't have the know-how to decipher the pin out. I could probably learn, but any time I get to work on this project would probably be taken up first by deciphering more of the protocol.

@los93sol
Copy link
Author

Great info, my buddy has a tub as well and picked up a TTL->USB converter. We're able to get data to spew from the tub to putty. In the process of slamming together a quick app to get the actual stream, but in the meantime, if you can check if there's any web interface exposed by your wifi module that might give a clue as to the proper settings for baud rate, etc. that would be very helpful. Might be easier to email me directly at los93sol@gmail.com

@ccutrer
Copy link
Owner

ccutrer commented Jun 23, 2017

I'd rather we keep the conversation in a public forum so that if it gets abandoned, at least someone else can see what work we've done.

That said, the following ports are open according to nmap:

  • 110 (normally POP3)
  • 143 (normally IMAP)

When I connect to either of those ports, I just get dead air, even attempting to speak the proper protocols for those ports.

As for actual app - are you comfortable with ruby? I could modify my gem here to work against a serial port pretty easily for you. Which pins are you connecting to which on your adapter?

@los93sol
Copy link
Author

I believe we are getting valid data out of it now using 115200, 8, N, 1....
Here's a sample of some of the messages we were able to dump....

7E-1C-FF-AF-00-00-61-0F-26-00-00-01-00-00-0C-00-00-02-00-00-00-00-00-00-61-00-00-3B-7E
7E-05-BF-06-37-7E
7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-1C-FF-AF-00-00-61-0F-26-00-00-01-00-00-0C-00-00-02-00-00-00-00-00-00-61-00-00-3B-7E

@los93sol
Copy link
Author

I'm working through it now, but so far the message start/message end seems correct, the message length also appears correct so I just need to decode a few of these manually against your documentation to see what all I can glean from it. I'm stoked that a simple $10 off the shelf adapter seems to be working

@ccutrer
Copy link
Owner

ccutrer commented Jun 23, 2017

Yup, those look super familiar, yet different than any actual messages I have documented so far.

@los93sol
Copy link
Author

We'll have values from another tub on Sunday if things go well, I have a Bullfrog X7 so expect output more similar to what you have with your A7. Different cable for mine since I don't have the TTL port on mine though so fingers crossed!

@los93sol
Copy link
Author

Is there a trick to being able to send control messages? We were able to validate out checksums are correct using the sample payload garbled1 posted in another thread here, but so far no luck with a simple toggle lights command.

@ccutrer
Copy link
Owner

ccutrer commented Jun 24, 2017

When using wifi, you can't use any control messages until you've sent one or two messages asking for the configuration. hopefully that's the trick

@garbled1
Copy link
Collaborator

I have a ton of code to do communication with one of these things in my gnhast repo here on github. The code is in C, but I have most of the routines commented with the protocol as far as I've been able to decode it.

The wifi one spams me like crazy when I connect to it. 4 messages per second. Does yours do the same over serial?

@ccutrer
Copy link
Owner

ccutrer commented Jun 28, 2017

@garbled1 nice, thanks for the tip! Now I can compare notes against yours. My personal favorites are "BMTR_PANEL_NOCLUE1" and "BMTR_PANEL_NOCLUE2" :). Other than that things are looking pretty familiar. I am curious what an AUX device is? Apparently my tub is fairly simple - I just have two pumps, a circ pump, and one light.

@los93sol
Copy link
Author

We are seeing the same thing, the raw bus is VERRRRRY chatty!

@los93sol
Copy link
Author

Still no luck sending commands, looks like there must be some initialization or translation that the wifi module is doing....or we don't have the connection parameters quite right. We are able to generate fully valid payloads that mimic what is documented as toggle commands and the commands sent from a real button press, but still no luck

@garbled1
Copy link
Collaborator

@ccutrer
My tub is pretty simple too. About a year ago, the controller died, so I bought a generic balboa replacement controller, so it has a ton of features that I don't actually use...

AUX is basically a separate VAC output circuit, 2 amps I think, that you can connect a load to. For example, lets say you have one of those music controllers, you can wire it into the aux out, and power it via that.

I found that one of them, will return my spa controller's model name, and serial number, encoded in ascii. I'd really like to see what yours says for that, to see if it's universally decodable.

@los93sol

So, the wifi connection is the same port type that the panel connects to. you can literally swap them around and nothing notices. Maybe you could somehow try to intercept data from the panel and see what it's saying to the spa?

@los93sol
Copy link
Author

@garbled1 We captured some logs early on with the device on a Y adapter and were able to see the panels messages. We actually have a full capture of the boot process as well and the main board seems to broadcast the results of its memory test on boot too. Currently we have it connected to a separate port and can still see the panel flooding the bus with 5-6 messages a second, it's crazy how chatty this thing is!

@los93sol
Copy link
Author

los93sol commented Jul 9, 2017

After playing with the settings I was using the raw serial bus protocol appears identical to the wifi module, the status messages are 100% identical down to the check byte. I still cannot get the tub to acknowledge any requests sent to it, and interestingly, where the wifi protocol message type is 0ABF11, they keypad itself sends 11BF11, not sure if this is an encoding issue or not though. When we were logging initially our status messages weren't 100% aligned to what you see but that turned out to be because we were using UTF8 encoding so some bytes were getting changed on us.

@smarty125
Copy link

Watching this topic...hoping for success

@stephb9959
Copy link

Also watching... I can say that the data is TTL level serial at 115200 8N1 as mentioned. I am using a Photon micro controller to replace the aweful Wifi module. Building a proxy and then will use the Particle cloud to manage the tub.

@stephb9959
Copy link

Quick update...

I have built a simple proxy that intercepts the iOS app and sends to the tub over serial. The goal is to replace the wifi module with something better and more IoT based.

I can read the codes sent by the tub. But just like @los93sol, I cannot get the tub to accept any of my commands over serial. And I am just relaying the commands from the iOS app.

If any of you could grab the command generated by the wifi module when you change the set point to 101, i could compare with what the app sends and see if the module does anything to the actual payload.

@stephb9959
Copy link

@garbled1 I am stuck like @los93sol ... All the commands match, CRCs check out. I am even using the commands coming out of the iOS app and they match what I computed. I monitor what I receive and what I send and the tub never reacts.

How are you sending your commands? What kind of hardware are you using? Is there some sort of setup before sending commands?

Thanks for the help

@sdelaye
Copy link

sdelaye commented Nov 11, 2017

Would be very interested by the response of @garbled1...

@los93sol
Copy link
Author

I actually got it talking, use an rs422 adapter instead

@stephb9959
Copy link

stephb9959 commented Nov 12, 2017 via email

@los93sol
Copy link
Author

Whoops, you are correct, I checked my notes and it was an RS-485 adapter that I ended up using

@los93sol
Copy link
Author

On another note, we never accomplished 100% reliability, about 10% of the time messages need to be resent

@stephb9959
Copy link

stephb9959 commented Nov 12, 2017 via email

@los93sol
Copy link
Author

Interesting, that explains quite actually, swapping my keypad back and forth between the ports resulted in it getting a new address and I would see phantom messages on the bus that just appeared to be messages from the main board going off into nowhere, I’m just guessing but I would assume that timing logic is implemented in the official WiFi module since you wouldn’t be able to reliably handle that through an app that can connect/disconnect at will

@los93sol
Copy link
Author

Btw, this is the adapter I am using https://www.amazon.com/USB-module-CP2102-Serial-Converter/dp/B01CNV45SG

@fabltd
Copy link

fabltd commented Dec 17, 2019

Did any one get this working?

@stephb9959
Copy link

stephb9959 commented Dec 17, 2019 via email

@techdoutdev
Copy link

I can confirm that building your own is not only possible it’s easy and stable. I’ve had a raspberry pi 3 shoved inside my tub for over a year in a northern climate with temps ranging from -10 to 100f without issue.

@los93sol Are you able to share how you have a raspberry pi interfacing with the tub? I have a 2017 Sundance 880 that I’m looking to integrate with home assistant but hoping to avoid paying $200-$300 for the WiFi module.

ccutrer added a commit that referenced this issue May 12, 2020
@ten300
Copy link

ten300 commented May 13, 2020

Hi, maybe i'm a confused noob but is there a benefit to going through the rs485 port as opposed to the rj45 as this person did? Or does it essentially end up being the same result and either will work? Do all Balboa controllers have rs485 and only some rj45? https://www.olivierhill.ca/archives/72-The-Internet-of-Spas.html

@stephb9959
Copy link

stephb9959 commented May 13, 2020 via email

@ten300
Copy link

ten300 commented May 14, 2020 via email

@bggardner
Copy link
Collaborator

bggardner commented May 25, 2020

The pinout is now fully documented in the wiki.

@cribskip
Copy link

@stephb9959 I'm very interested in your code as I'd like to create and publish a esp8266 MQTT bridge to the tub. Is your code available for use?

Thanks,
Sascha

@stephb9959
Copy link

stephb9959 commented Jun 17, 2020 via email

@markpw7
Copy link

markpw7 commented Jun 17, 2020

I have a Balboa GL2000 (as mentioned above, this board has no wifi). The "main panel" (J70, J71, J72) ports are 8 pins. Is it possible to wire up an RS485 to USB adapter to this?

@ccutrer
Copy link
Owner

ccutrer commented Jun 17, 2020

I've got a friend with a Balboa EL1500. At some point I'd like to answer the same question for him.

@ten300
Copy link

ten300 commented Jun 17, 2020 via email

@cribskip
Copy link

cribskip commented Jun 30, 2020

So I got my Spa wired up and state is published via MQTT from the RS485 to OpenHAB 👍

Sending toggle command (lights) results in no action.

I'm sending these bytes to toggle the lights. Are they correct?
0x7E 0x06 0x0A 0xBF 0x11 0x00 0xBA 0x7E

When using wifi, you can't use any control messages until you've sent one or two messages asking for the configuration. hopefully that's the trick

I'm not sending any request_configuration as the node is on the RS485. May be that's the problem? What telegram may I have to send beforehand?

Also, my telegrams look a little bit different to yours. My message type is not 0A BF xx but 10 BF xx in most cases:
7e 07 10 bf 11 00 00 3e 7e sent nearly all the time in sub-second intervals
7e 20 ff af 13 00 01 ff 12 31 01 26 3a 00 03 00 00 00 00 00 00 00 00 02 00 3a 00 00 00 00 00 00 b5 7e is my status update

Maybe there is a different configuration in my BP2100G0? 🤔

Thanks to all of you,
Sascha

@bggardner
Copy link
Collaborator

First of all, you're missing the second 0x11 byte: 0x7E 0x06 0x0A 0xBF 0x11 0x11 0x00 0xBA 0x7E, but that may just be a typo in your post.

Secondly, I've been working on fully documenting the protocol on the wiki (WIP). I believe you can use the channel of your top panel and/or wifi module to send commands, but you have to wait for the appropriate ClearToSend message.

@cribskip
Copy link

@bggardner Wow, kudos, thank you very much for your efforts! I'll be checking this out 👍

@cribskip
Copy link

cribskip commented Jul 1, 2020

So thank you all so much for your work.

Today, I've created my esp8266-mqtt-balboa-bridge and it's working very well.

Code is published in my repo: https://github.com/cribskip/esp8266_spa

@tmjo
Copy link

tmjo commented Aug 16, 2020

I have a Balboa GL2000 (as mentioned above, this board has no wifi). The "main panel" (J70, J71, J72) ports are 8 pins. Is it possible to wire up an RS485 to USB adapter to this?

Hi @markpw7; I have the same "issue" as you do. Did you figure it out? Thanks in advance. #14

@stephb9959
Copy link

stephb9959 commented Aug 16, 2020 via email

@tmjo
Copy link

tmjo commented Aug 16, 2020

Hi Stéphane and thanks for your reply!

It's Molex and not RJ45. Got a bit lost measuring since the combinations are so many, but I'll do some more testing and see. Will upload some pictures in separate threat to not spam this one. See #14 for details.

@ten300
Copy link

ten300 commented Mar 9, 2021 via email

@netmindz
Copy link
Contributor

Also watching... I can say that the data is TTL level serial at 115200 8N1 as mentioned. I am using a Photon micro controller to replace the aweful Wifi module. Building a proxy and then will use the Particle cloud to manage the tub.

Hi @stephb9959

Which control unit are you using? Which connector does it have? Interesting you are seeing TTL and not RS484, so must be using something different to the others. Hopefully hold the key to resolving #14

@stephb9959
Copy link

stephb9959 commented Jan 16, 2022 via email

@netmindz
Copy link
Contributor

If anyone finds this thread and has 8pin then check out
https://github.com/netmindz/balboa_GL_ML_spa_control

@ScanxTaz
Copy link

ScanxTaz commented Oct 25, 2023

Hey out there :)

Just recevied my hot tub, from Belgium :) I'm trying to connect with a RS485 USB connector on a raspberry pi 3.

I can just get garbage, regardless how I connect A and B, event if I try to connect the minus (B) on the ground. Bought it following this documentation : https://github.com/ccutrer/balboa_worldwide_app/

I think I missing something there, from the electronical side, can someone of you give me some tips how to progress there ? I already used with success RS-232 and RS-485 on other project (energymeter f.i.), but I cant get it to work :(

I'm seeing messages passing by on a regular basis, but of course, completely unreadable.

Please... SOS.... ... --- ... ... --- ...

@netmindz
Copy link
Contributor

What model of controller do you have @ScanxTaz ? Please confirm which pins you are using for the RS485

@cribskip
Copy link

cribskip commented Oct 26, 2023 via email

@ScanxTaz
Copy link

ScanxTaz commented Oct 26, 2023

Hey, thanks for your answer @netmindz & @cribskip .

The RS 485 first, I checked with a multimeter before plugging in. I've +- 15V on 2 wires, and then, only a few volts with the two others. I figured it out following this documentation : https://github.com/ccutrer/balboa_worldwide_app/wiki

The wires appear exactly the same as explained in : https://github.com/ccutrer/balboa_worldwide_app/wiki#physical-layer

I used the 15v to get a stable 5v for my raspberry (I initially tought under-voltage was a reason of issue, which is not).
I'm arriving at this level : https://ibb.co/6yhRvXP

The controller says BP21, with this written on the box : https://ibb.co/s6SWVGV

I've bought this RS485 interface to connect on my Raspberry pi 3 : https://www.amazon.fr/dp/B07B416CPK?psc=1&ref=ppx_yo2ov_dt_b_product_details

My raspberry recognizes the USB key, and I can connect, with this command, to the hot tub :

screen /dev/ttyUSB0 115200,cs8,parenb,-parodd

Meanwhile, I only see garbage, but at regular time, like if some messages where passing by, I'd say 4 to 6 updates per second, with some pauses in between of 1 or 2 seconds every 5 seconds. Here's what I see :

~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~���~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~ ��(>>x9~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~ ��(>>x9~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~ ��(>>x9~~�\~~�>~>~�>~~�\~~�>~~���~~�\~~�>~\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~ ��(>>x9~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~ ��(>>x9~~�\~~�>~~~�\~~�>~~�\~~�>~~�\~~�>~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~ ��(>>x9~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~>x9~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~~�\~~�>~~�\~~�>~~�\~~�>~~�>~~ ��(>>x9~�>~~�\~~�>~~�\~~�>~~���~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�>~~�>~\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~ ��(>>x9~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~~�\~~�>~>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�>~~�\~~�~�\~~

@cribskip
Copy link

cribskip commented Oct 26, 2023 via email

@ScanxTaz
Copy link

Can I then just ask a dumb question : How can I read (human reading) what's passing by the USB then ?
Could you share a command in CLI please ?

@ScanxTaz
Copy link

That's indeed working, I want to give it a tutorial, step by step, to make it to work, but I can't manage to find a correct command to verify the link with the spa works well.

On my side, the registration of the service was failing, I don't know why, most certainly access right on the gem that are not well set...

Thanks for your help, it works now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests