The Internet of Spas
Somewhere in my yard, there is an appliance which is not connected to the Internet... yet. Last summer, after a power outage, I realized the pumps were not working. The heater was running, but without water circulating the spa went quickly in Overheat mode, throwing errors on the top display. As it was summer and being a lot outside, I had plenty of time to notice the issue and not worry about freezing conditions.
Being out of warranty, I decided to cut the power to the spa and open the control box. This is where I discovered a Cal Spa CS6200DV branded Balboa circuit board, with SSID 100 66 45. Going through standard components, I noticed a blown out 30A fuse that was feeding the pumps. Replaced the fuse, powered back the spa, everything worked for a total of 2,95$.
Wondering how I could have remotely caught this issue, I started searching the web for a WiFi remote or RF option to the spa. While I noticed a WiFi Balboa bridge, it didn't seem to fit my need or even be compatible. It also needed a paid cloud membership and was well overpriced.
However, searching the issue made me realize all of these extra components were connected to a free RJ45 port.
Going through patents and LinkedIn profiles of past and current employees, I was convinced the port was communicating using SPI. I even coded a small program on the Arduino to read the port output, which worked fine, until I realized the data was shifting from bytes to bytes by a bit.
This is when I decided I needed a logic analyzer. I could see with my multimeter all pins where below 5V but couldn't figure out the data transmitted. Being cheap, I decided to turn the Arduino into a logic analyzer instead of buying a standalone unit.
At last, some data. On a standard Ethernet cable, the clock is on pin 6 and the data on pin 5. This is was you see in the image. Some rapid observations:
Monitoring the values as the water was heating, I could read
While the other pins are still a mystery (and are probably to issue commands to the spa and not read data), I can now build a small controller that would read the top display. Add an ESP8266 to the mix and you get a remote WiFi connection for about 5$.
Another proof why IoT is so disruptive. Many appliances are not connected and were not meant to be interfaced with. Add some commodity M2M hardware to the mix and for a very low price you can turn anything into a smart device you can interact with using an API.
And while I'm a purist and tend to use low level coding (read C here), I can imagine how low the barrier is now that you can use NodeMCU and prototype smart devices using a scripting language such as Lua.
Being out of warranty, I decided to cut the power to the spa and open the control box. This is where I discovered a Cal Spa CS6200DV branded Balboa circuit board, with SSID 100 66 45. Going through standard components, I noticed a blown out 30A fuse that was feeding the pumps. Replaced the fuse, powered back the spa, everything worked for a total of 2,95$.
Wondering how I could have remotely caught this issue, I started searching the web for a WiFi remote or RF option to the spa. While I noticed a WiFi Balboa bridge, it didn't seem to fit my need or even be compatible. It also needed a paid cloud membership and was well overpriced.
However, searching the issue made me realize all of these extra components were connected to a free RJ45 port.
Going through patents and LinkedIn profiles of past and current employees, I was convinced the port was communicating using SPI. I even coded a small program on the Arduino to read the port output, which worked fine, until I realized the data was shifting from bytes to bytes by a bit.
This is when I decided I needed a logic analyzer. I could see with my multimeter all pins where below 5V but couldn't figure out the data transmitted. Being cheap, I decided to turn the Arduino into a logic analyzer instead of buying a standalone unit.
At last, some data. On a standard Ethernet cable, the clock is on pin 6 and the data on pin 5. This is was you see in the image. Some rapid observations:
- The clock is pulsing 7 times for each byte, pulsing for 3 bytes. This explains why my SPI test was always shifting by a bit as most protocols don't expect 7 bits (what is this, 1975?)
- First byte seems to be some status. I was seeing 0x04 while heater was on.
- The two other bytes seem to be what is displayed on the top display
Monitoring the values as the water was heating, I could read
0x73 0x70 for 97F, 0x73 0x7F for 98F and 0x73 0x73 for 99F. For some reason, these values didn't seem to be random. Googling for BCD to 7 segment shift registers, I could find in the product sheet this table.| Q7 | Q6 | Q5 | Q4 | Q3 | Q2 | Q1 | Hex | Dec |
|---|---|---|---|---|---|---|---|---|
| H | H | H | L | L | L | L | 0x70 | 7 |
| H | H | H | H | H | H | H | 0x7f | 8 |
| H | H | H | L | L | H | H | 0x73 | 9 |
While the other pins are still a mystery (and are probably to issue commands to the spa and not read data), I can now build a small controller that would read the top display. Add an ESP8266 to the mix and you get a remote WiFi connection for about 5$.
Another proof why IoT is so disruptive. Many appliances are not connected and were not meant to be interfaced with. Add some commodity M2M hardware to the mix and for a very low price you can turn anything into a smart device you can interact with using an API.
And while I'm a purist and tend to use low level coding (read C here), I can imagine how low the barrier is now that you can use NodeMCU and prototype smart devices using a scripting language such as Lua.
Trackbacks
Olivier's Blog on : Cal Spa Connector
Show preview
In The Internet of Spas, I briefly explained how commodity IoT hardware could be used to connect a (dumb) spa to the Internet, using the empty RJ-45 port found on most Balboa spa controllers. At that time, I only had the opportunity to connect the port
Comments
Display comments as Linear | Threaded
jason rogers on :
M on :
M on :
Will T on :