Unknown Messages / Partial Communication #58
Comments
|
Kudos for getting as far as you have. My guess is that these new message types may be new "Status Update" messages, but because their field values are so different between messages that may not be the case. You may need to post a timestamped dump/log of a message stream to make more sense of these. It would be even better if the log was notated to say when "obvious" telemetry like temperatures change on the display/control panel. FYI, you may want to switch to a RS-485 to USB adapter, as any IP-based system may introduce delays and/or drop packets. The Ethernet converter is probably fine, but switching to a lower-level serial device may help with troubleshooting. I think investigating the issue about not being able to detect control panel messages is critical. Does it use the same kind of connector? Are the control panel connector signal "bussed" with the RS-485<>Ethernet connector signals (does pin 1 connect to pin 1, etc.)? Maybe post some pictures. What kind of traffic is there if the control panel is unplugged? Also try logging the bus during power-on, both the the control panel plugged in and disconnected. |
|
Ordered usb 485 converter. 3 of same connector outiled with a silkscren box on the board. Diagram on box indicates smarttub module can plug into same connector area. Moved panel cable over to the connector i had been using and panel continued to work as expected so it doesnt seem to care where its attached at least. Will buzz it out and confrim board really has the connectors bussed and switch to a y cable if nessary. Agreed not seening panel messages is a problem for decoding. I see cts messages for other channels but no info from them. Will add photos. Is there a perfered log format? Hex dump with timestamps? |
|
Hex dump with timestamps is good, with manual notations of known events. See the wiki for some similar examples. I wonder if the new panels use wireless comm, and just get power via the wires? Can you tell if the control panel uses all 4 wires? Are there metal contacts in all four connector positions of the cable? Is there an FCC ID anywhere on the panel or main board? This would indicate wireless comm. |
|
Below is the startup log recording using a USB>485 Converter. Didn't have time to test commands with USB unfortunately. I think that possibly:
Possible next steps:
HARDWARESpa: Sundance 780 Kingston 2021 INFORMATIONSSID: UKNOWN 11:11:37.812 ECReq : 7E 05 0A BF 04 77 7E |
|
Summary/Notes:
I think the next step is to only log Message Types |
|
Very interesting observation there about the nibbles... |
|
While unsupported, certainly looks like the messages are more similar than the older GL/EL Balboa series |
|
Still can't make sense of the data. You need to capture the data just before and after a change (current temperature or button press). Try to limit the time surrounding the change event to a minimum (a few seconds). The idea is to compare the data before and after the change to try and detect what byte(s) is/are affected. Example:
Repeat this procedure for other button pushes, like decreasing set temperature, turning on/off lights and pumps, naming the file appropriately. Also, is this what your control panel looks like? If not, can you post a picture of or link to it? |
Thats an interesting theory, how so? |
That is my control panel! |
|
Alright, here's the captures, still not making sense of it :(. Order was: I started the log about one send before pressing, then stopped log a second or so after the change registered or pump had turned on/off. TempSetTo101.txt |
|
Performing bitwise xor to compare consecutive bytes in the C4 messages produces a result which is identical for all C4 messages sent while the hotub is in a steady state. Further I was able to find a pattern in changes to the result of this function which tracks with changes in pump state. IE given the latest C4 message I can determine what the bitwise xor results will change to in response to changes in any given pump state. Or in otherwords I think I'm reading pump share reliably. The odd thig is that multiple bytes of the result change. So I don't quite see the next level of what this means in terms of decrypting the message, I'm hoping that this is indicating a standard Cypher of some sort that can be generalized. Still working it. |
|
The bitwise xor of consecutive bytes also is identical for all CA messages in steady state. |
|
I'm able now to decode from the 0xC4 message the hot tubs currently set Hours, Minutes, Set Setpoint seemingly reliably from startup with no prior knowledge of sate, and Temperature when pumps are not on or if the pump state is known (not sure why yet), Python Source. Example Output while pressing the temp down to 65 then back up again with a current temp of 99. (H= hours, M = Minute, ST = Set point, T= Temperature) 16:24:58.447 H16 M24 ST70 T99 x[23, 1, 36, 142, 4, 96, 37, 69, 71, 22, 1, 25, 116, 46, 99, 1] |
|
Narrowing in further, got more of the status decoded but a few aren't fields reliable yet. Made a break thur on the CC message - its just corresponds to Key pressed! 225 - Nothing Pressed Next i need to try sending these to see if I can induce a response.. |
|
I now have 'the basics' working - Reading and writing Temperatures, pumps and lights. No more advanced features like filter configuring filter cycles. |
Hello,
I need some help decoding w messages from my 2021 Sundance 780 series spa. I recognize this is not a supported main board by the balboa worldwide app but I'm not sure where else to ask this.
I successfully connected a RS485<>Ethernet converter as described here: https://github.com/jshank/bwalink. I first attempted to use the this app as well as pybalboa unmodified with out success. I turned to manually adapting pybalboa to print raw data to try to identify the issue
I demonstrated I think I have my hardware working as expected by succeeding at implementing the channel assignment sequence:
With some confidence I then tired to send the following settings request messages (Type 0x22) after a CTS message in-place of a Nothing To Send message, with either codes 0, or 4 (Configuration, Information). However I observed no response to these messages. I also tried hard coding channel 0x0A (Wifi) without success.
Further, I am not receiving the known Status Update (0x13) message, nor was I able to capture the control panel sending any known message types by pressing controls. Instead I only receive a 3 different types of message at > 1hz rates.
Channel : Message Type: Number of Fields
0x10 : 0xCC : 2
0xFF : 0xCA : 29
0xFF : 0xC4 : 33
Example messages:
Ch: 0x10 Type: 0xCC Len 7 - Data ['B1', '51']
Ch: 0xFF Type: 0xC4 Len 38 - Data ['35', '21', '31', '30', '3F', '3F', 'A6', 'C6', '3E', '3A', '5C', '3A', '07', '26', 'C5', '26', '47', '22', '20', '36', '2F', '2E', '01', '2C', 'B0', '2A', '29', '7C', '72', '16', '15', '14', '13']
Ch: 0x10 Type: 0xCC Len 7 - Data ['A4', '44']
Ch: 0xFF Type: 0xC4 Len 38 - Data ['C7', 'D3', 'C3', 'C2', 'CD', 'CD', '54', '34', 'CC', 'C8', 'AE', 'C8', 'F5', 'D4', '37', 'D4', 'B5', 'D0', 'D2', 'C4', 'DD', 'DC', 'F3', 'DE', '42', 'D8', 'DB', '8E', '80', 'E4', 'E7', 'E6', 'E1']
Ch: 0xFF Type: 0xCA Len 34 - Data ['C3', '7F', '83', '82', '8D', '8C', '8F', 'B2', '89', '88', '8B', '75', '95', '94', '97', '96', '91', '90', '93', '92', '9D', '9C', '9F', '9E', '99', '98', '9B', '9A', 'A5']
Ch: 0x10 Type: 0xCC Len 7 - Data ['B2', '52']
Ch: 0xFF Type: 0xC4 Len 38 - Data ['9F', '8B', '9B', '9A', '95', '95', '0C', '6C', '94', '90', 'F6', '90', 'AD', '8C', '6F', '8C', 'ED', '88', '8A', '9C', '85', '84', 'AB', '86', '1A', '80', '83', 'D6', 'D8', 'BC', 'BF', 'BE', 'B9']
Ch: 0xFF Type: 0xC4 Len 38 - Data ['39', '2D', '3D', '3C', '33', '33', 'AA', 'CA', '32', '36', '50', '36', '0B', '2A', 'C9', '2A', '4B', '2E', '2C', '3A', '23', '22', '0D', '20', 'BC', '26', '25', '70', '7E', '1A', '19', '18', '1F']
Ch: 0x10 Type: 0xCC Len 7 - Data ['1E', 'FE']
Ch: 0xFF Type: 0xC4 Len 38 - Data ['03', '17', '07', '06', '09', '09', '90', 'F0', '08', '0C', '6A', '0C', '31', '10', 'F3', '10', '71', '14', '16', '00', '19', '18', '37', '1A', '86', '1C', '1F', '4A', '44', '20', '23', '22', '25']
Ch: 0x10 Type: 0xCC Len 7 - Data ['DF', '3F']
My observations are:
So,
I’m hoping someone might be able to point me in the right direction to try to narrow in further. Any ideas?
The text was updated successfully, but these errors were encountered: