Pinout

[los93sol]

I'm actually looking to do similar with my tub and trying to figure out the pinout. Based on your findings I suspect the wifi module is nothing more than a dumb RS232 to Wifi module and that the protocol from the main to the topside is the same as what you're seeing from the Wifi module. I'm trying to find some documentation on the RJ45 port that Balboa uses on their VS series units. Does anyone have any info on it or can anyone confirm the wifi module isn't anything special?

[ccutrer]

The protocol does feel very serial like, and it's infuriating that if one device is connected (or the tub thinks is still connected), another cannot connect, which would also point to masking a single serial port.

There are a few pieces of evidence that it's more than an off-the-shelf serial-to-wifi chipset, though:

• Balboa has their own MAC address prefixes. This is fairly unusual among embedded devices, where they get MAC address assignments out of the pool of whatever wifi chip they happen to have in them.
• setting the wifi parameters is done via the normal serial protocol. So either the adapter is watching for that particular sequence to recognize it, or the tub has enough smarts to echo the parameters back to the adapter in whatever the adapter's special protocol is.
• cloud support. The tub makes an active connection out to balboa's servers to facilitate remote access. I haven't dove into this protocol much, besides recognizing that it's vastly different than the local protocol. And that multiple devices are allowed to connect "remotely" at the same time.

Assuming it is serial to the actual tub, though, none of these special add ons in their adapter should preclude the ability to insert your own serial device instead of the wifi adapter, and control the tub. It likely would preclude the ability to use the native app (which could be solved by setting up a proxy that pretends to be a tub-at least for local access). Given the flakiness of their wifi adapter, though, it may be a good route.

Unfortunately I'm not much of a low level hardware guy, so don't have the know-how to decipher the pin out. I could probably learn, but any time I get to work on this project would probably be taken up first by deciphering more of the protocol.

[los93sol]

Great info, my buddy has a tub as well and picked up a TTL->USB converter. We're able to get data to spew from the tub to putty. In the process of slamming together a quick app to get the actual stream, but in the meantime, if you can check if there's any web interface exposed by your wifi module that might give a clue as to the proper settings for baud rate, etc. that would be very helpful. Might be easier to email me directly at los93sol@gmail.com

[ccutrer]

I'd rather we keep the conversation in a public forum so that if it gets abandoned, at least someone else can see what work we've done.

That said, the following ports are open according to nmap:

• 110 (normally POP3)
• 143 (normally IMAP)

When I connect to either of those ports, I just get dead air, even attempting to speak the proper protocols for those ports.

As for actual app - are you comfortable with ruby? I could modify my gem here to work against a serial port pretty easily for you. Which pins are you connecting to which on your adapter?

[los93sol]

I believe we are getting valid data out of it now using 115200, 8, N, 1....
Here's a sample of some of the messages we were able to dump....

7E-1C-FF-AF-00-00-61-0F-26-00-00-01-00-00-0C-00-00-02-00-00-00-00-00-00-61-00-00-3B-7E
7E-05-BF-06-37-7E
7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-05-10-BF-06-5C-7E
7E-05-BF-06-37-7E-7E-05-BF-07-30-7E
7E-1C-FF-AF-00-00-61-0F-26-00-00-01-00-00-0C-00-00-02-00-00-00-00-00-00-61-00-00-3B-7E

[los93sol]

I'm working through it now, but so far the message start/message end seems correct, the message length also appears correct so I just need to decode a few of these manually against your documentation to see what all I can glean from it. I'm stoked that a simple $10 off the shelf adapter seems to be working

[ccutrer]

Yup, those look super familiar, yet different than any actual messages I have documented so far.

[los93sol]

We'll have values from another tub on Sunday if things go well, I have a Bullfrog X7 so expect output more similar to what you have with your A7. Different cable for mine since I don't have the TTL port on mine though so fingers crossed!

[los93sol]

Is there a trick to being able to send control messages? We were able to validate out checksums are correct using the sample payload garbled1 posted in another thread here, but so far no luck with a simple toggle lights command.

[ccutrer]

When using wifi, you can't use any control messages until you've sent one or two messages asking for the configuration. hopefully that's the trick

[garbled1]

I have a ton of code to do communication with one of these things in my gnhast repo here on github. The code is in C, but I have most of the routines commented with the protocol as far as I've been able to decode it.

The wifi one spams me like crazy when I connect to it. 4 messages per second. Does yours do the same over serial?

[ccutrer]

@garbled1 nice, thanks for the tip! Now I can compare notes against yours. My personal favorites are "BMTR_PANEL_NOCLUE1" and "BMTR_PANEL_NOCLUE2" :). Other than that things are looking pretty familiar. I am curious what an AUX device is? Apparently my tub is fairly simple - I just have two pumps, a circ pump, and one light.

[los93sol]

We are seeing the same thing, the raw bus is VERRRRRY chatty!

[los93sol]

Still no luck sending commands, looks like there must be some initialization or translation that the wifi module is doing....or we don't have the connection parameters quite right. We are able to generate fully valid payloads that mimic what is documented as toggle commands and the commands sent from a real button press, but still no luck

[garbled1]

@ccutrer
My tub is pretty simple too. About a year ago, the controller died, so I bought a generic balboa replacement controller, so it has a ton of features that I don't actually use...

AUX is basically a separate VAC output circuit, 2 amps I think, that you can connect a load to. For example, lets say you have one of those music controllers, you can wire it into the aux out, and power it via that.

I found that one of them, will return my spa controller's model name, and serial number, encoded in ascii. I'd really like to see what yours says for that, to see if it's universally decodable.

@los93sol

So, the wifi connection is the same port type that the panel connects to. you can literally swap them around and nothing notices. Maybe you could somehow try to intercept data from the panel and see what it's saying to the spa?

[los93sol]

@garbled1 We captured some logs early on with the device on a Y adapter and were able to see the panels messages. We actually have a full capture of the boot process as well and the main board seems to broadcast the results of its memory test on boot too. Currently we have it connected to a separate port and can still see the panel flooding the bus with 5-6 messages a second, it's crazy how chatty this thing is!