Jump to content

I hacked my 2018 Hot Springs hot tub so I could control the temperature over the internet


Recommended Posts

Hardware

20And0CgLYYwpuqIywW66f5E3vMnDn155A06-3SnXcUYGbsgbIoFvqhz3YEWv_5IhZsrMIOypAyGzUdhHKzyrOc1ROmY0NvdkF8QGNFjEn7KfbdV7zeEUozbNH-KRSBsNbMn17wu

In the above setup, for each COM port, the Pi can wait for a packet (see below) and then forward that packet on to the other device’s RX. This results in a man in the middle sort of setup. 

 

Nf19m_GHomH35eMlGG2HhJRIbyuQTcvZxMzHXbG7Xm-30KCKDP1n6X0cGIeN7CRWq3GNpiaopXneUSRyTjB8oI4qgj3DfarPf27RpS1G-FmsOGjqDTGXbL0CHl2k4z3vbgg9jkGl

Example parts

Description

Mfg

Part number

Plugs into IQ2020 Control Head Port (8 Pin)

TE

3-644540-8

Receives from Touch Panel (8 Pin)

TE

3-647000-8

USB to RS422 adapter

DTECH

 

12 to 5V supply for Raspberry Pi

Weewooday

 

 

Pinout

 

Pin

Color

Touch Panel

IQ2020

1

Blue

Rx -

Tx-

2

Green

12V In

12V Out

3

Yellow

Tx +

Rx+

4

Red

Ground

Ground

5

Brown

Tx -

Rx-

6

White

Rx +

Rx+

7

NC

   

8

NC

   

 

Packet

 

Everything is Big Endian (Network order)

 

Message

Bytes

Notes

Start

3

Can be XMS (from touch panel) or XSM (from IQ2020)

Message Length

2

Doesn’t include start, length, or checksum bytes

Message

N

 

Checksum

2

Simple sum of all prior bytes.

 

Example full message (Main Screen Acknowledged): 58534D 0002 0800 0102

Important Messages

From touch panel

States

The touch panel sends these commands many times per second 

Touch Panel Mode

Hex

Screen Off

6B 0000 0000 0100 0000 0000 

Main Screen

6B 0000 0000 0100 0100 0000

Temperature Adjust Screen

6B 0300 0000 0100 0103 0000

Temp. Down Button Pressed

6B 0300 0008 0100 0103 0000

Temp. Up Button Pressed

6B 0300 0004 0100 0103 0000

 

Commands

 

Command

Msg Hex

Description

More

4B 

When you enter a new mode, the IQ2020 will give the touch panel info that it needs to show its next screen. The IQ2020 spreads this info over a few packets. The touch panel asks for “more” until the IQ2020 sends a “I don’t have more info” packet” and then should resume sending one of the state packets above


 

From IQ2020

The green hex below is the temperature setpoint. The temperature is encoded as ASCII (eg 0x3831 => 81 F)

 

Message

Message Hex 

Main Screen Acknowledged

08 00

Temperature Screen Acknowledged

08 03

Setpoint (going into temp)

00 0000 0A00 4005 040A 1502 0003 3831 3A00

Setpoint (after setpoint adjust)

01 0005 1503 3832 3A00 


 

Communication Capture

The doc below is a capture of the communication during normal operation through the touch screen. In this capture, the touch screen starts off, then we go into the main screen, then we go to the temperature adjust screen, then we lower the temperature one degree, then we exit the temperature screen. I stop recording for a few minutes so the logs won’t be too long. The touch screen then goes back off. 

 

https://docs.google.com/spreadsheets/d/1FPIu6mpBpGdMX-Mh76JIv4aA3WfhkPuU5-MZ9X7wuec/edit?usp=sharing

 

Full sequence to adjust temperature setpoint

  • Verify we are in “Screen Off” mode

  • Replace all “Screen Off” commands from touch screen with “Main Screen” commands

  • Wait until IQ2020 acknowledges that we’ve entered “Main Screen”

  • Replace all “Screen Off” commands with “Temperature Screen” commands

  • Grab setpoint from IQ2020

  • Wait for IQ2020 to acknowledge that we’re in “Temperature Screen” mode

  • Replace all “Screen Off” commands with “Temp. Up/Down” commands

  • Wait for setpoint to reach your new target setpoint

  • Go to main screen

  • Go to “screen off” (stop replacing “screen off” commands)

iPhone interface

 

Option 1: https://www.npmjs.com/package/homebridge-web-thermostat

Option 2: https://www.npmjs.com/package/homebridge-thermostat

 

Temperature Measurement

Watkins uses a 10kOhm thermistor to bring in the temperature. I connected to that thermistor (top right port) with a MAX31865. I used the calibration curves posted on the web (example) to convert from resistance to temperature

 

  • Like 1
  • Thanks 2
Link to comment
Share on other sites

  • 1 month later...

Hi,

After learning some C programming my 1st version of Hawk Control.
When the program has started, the data traffic between the keyboard and the controller is output on the console.
The set button can be locked by means of a switch.
Since the keyboard and control are constantly exchanging the same data, there is also a switch that suppresses duplicate data.
What is still missing is a web interface to call up and control the data on the mobile device.

You can find the c program here.

https://github.com/SvenPausH/Hotspring-Hawk


Remember I have never programmed with c before.
The program code can certainly be made more beautiful.

If anyone feels like it, they are welcome to work on the project.

 

  • Like 1
Link to comment
Share on other sites

  • 3 months later...

Hello @infinitenothing

it took a while but I have now found a solution that I like.
I implemented the project with an ESP8266.
The ESP send out a website and use Websocket.
So I can see the data in real time on the website without reloading the page.
The website is also suitable for mobile devices.

WebUI.jpg.ebaa4bdf2887dac2b6f9c2322ade4072.jpg

If you're interested.
I have the project uploaded here https://github.com/SvenPausH/Hawk-ESP8266
 

I will now solder everything to a circuit board and install it in the pool when the opportunity arises.
The circuit has now been running on my desk for over 3 days without dropping out.

Thanks again for your help.

Link to comment
Share on other sites

  • 2 months later...

If you want to do it with an ESP chip you need
1* or 2*  https://www.futurlec.com/Mini_RS422.shtml to read Data from Keybord and Mainboard.

RS422-Duplex.jpg.0c5f8108a7b0f3905ded72900b383f18.jpg
The ESP Chip has only 2 Hardware Serial und you need one Duplex chip.

The second you need to write Data
this is a little bit cheaper
https://protosupplies.com/product/max485-ttl-to-rs-485-interface-module/

MAX485-RS-485-Interface-Module.jpg.8c2f9515d7762f7ced170f8fb2e5abc6.jpg


I found on Ali this
https://de.aliexpress.com/item/1005001621705950.html?gatewayAdapt=glo2deu&spm=a2g0o.order_list.0.0.21ef5c5fT011zZ

335708718_ESPupto24v.thumb.jpg.29a08eaa7f7b8671631cd6695f193aa3.jpg
The board can handle an input voltage of up to 24V.
The HAWK board has 12V. I think the IQ2020 has 12V too?
So you don't need a power supply.

So I used something like this.
https://de.aliexpress.com/item/1005002197995752.html?_randl_currency=EUR&_randl_shipto=DE&src=google&aff_fcid=28d1d0a712d3475fb761a6fdb3ad317e-1649138399021-04942-UneMJZVf&aff_fsk=UneMJZVf&aff_platform=aaf&sk=UneMJZVf&aff_trace_key=28d1d0a712d3475fb761a6fdb3ad317e-1649138399021-04942-UneMJZVf&terminal_id=8578f8c28a3a4e539777f6867c822083&afSmartRedirect=y

power.thumb.jpg.b22da6ce04d2557f3dea71fb6d333da5.jpg
You have to use the ESP Chip Hardware Serial otherwise you will have data drops.
But my sketch is for the Hawk mainboard and you would have to adapt it for the IQ2020.

If infinitenothing is still reading here, he might give you his program for the IQ2020
I just see my ESP chip in the pool has a uptime of 32 days and it works :)

Link to comment
Share on other sites

  • 1 month later...
  • 1 month later...

I didn't want to spend a great deal of unpaid hours to support this project. I was more hoping to support enough people that could then help people who were less experienced with hardware. If you had questions of how any of the pieces work, I can help with that. My IDE (LabVIEW) is super obscure so I doubt my source code would be useful.

Link to comment
Share on other sites

  • 2 months later...

Thanks a lot to @infinitenothingand others for providing your information here. Fantastic work!

Some information is still missing in this thread, that I want to add here - e.g. the RS422 baud rate which is 115200.
Also I feel that from the pictures above it's maybe not 100% clear which connection to intercept. It's the one on right of the main IQ2020 board, not the one(s) on the "hub" that Hotspring adds on top of their IQ2020 board. The correct one is the white plug in a white socket on the right side and that plug has the lower six of the eight pins of the socket connected to its cables.

Actually it really seems to be impossible to do this in any other way except by intercepting messages. Really sad as in the beginning I was hoping to find an easier, less intrusive, solution but didn't get lucky. The IQ2020 really seems to isolate the "hmi" part of the system (touchpad, wireless touchpad, etc.) from the "utility" part of the system (ace/freshwater, ozone, music, etc.).
Regarding the HW interface, I'm using an ESP32 board with two cheap RS422/TTL converters for less than 4€ each. The TE connector was luckily available for order at the Conrad webshop.

I noticed that once I stop forwarding messages for more than a second or two, I sometimes need to "restart" the wireless touchpad communication by disconnecting + reconnecting. I plan to add a relay to one of the ESP32 pins so that this can be done automatically whenever the ESP32 starts up, making sure that the touchpad-base and the IQ2020 can re-sync.

So far I was able to log the data, but the "protocol" (the data inside) looks really, well - "interesting" to say the least.
I want to be able to monitor and control the whirlpool from my mobile. The ESP32 can directly connect to the outside world via MQTTs which would be perfect for what I want, with instant reaction from all over the world.

The tricky part for me is to get more information on how to make the IQ2020 actually change settings, take actions, etc. Also it's not really clear to me how the data content inside the messages are to be read.
So if you have any more information than the above, I ask you to please let me know! Thanks in advance! 😃

Link to comment
Share on other sites

Well, I thought about the "seems to be impossible to do this in any other way" I stated above. Actually there must be a better/easier way to do this, looking at the Spa Network Adapter (SNA) in the image:connextion.jpg.753b348876342860e5c34ca9c8ff2638.jpg

The "Connextion" app then offered all the fancy information and settings that you'd expect to be able to monitor and control.

Same with the FreePad that basically was a RF remote:

FreePad.thumb.png.28aace682880ebaf8ade8eb9ab01efa5.png

My point is that both of those do not have to intercept the IQ2020<->touchpad communication so there must be a simpler way to communicate with the IQ2020.

 

I want to find out if anybody does actually successfully intercept and modify the messages between IQ2020 and the touchpad. If not, maybe we need to focus on analyzing the pairing between the IQ2020 and the Freepad or the SNA.

 

Quote

FreePad/IQ2020 Synchronization
The Freepad comes pre-synchronized to the Interface Module. Since the IQ2020 will communicate with up to eight (8) FreePad controllers, any additional controllers will need to be manually synchronized. The following is required
to synchronize a FreePad controller with the Interface Module:
HotSpring models
1. Press and hold both the Light Plus and the Light Minus buttons on the spa’s Main control panel simultaneously for two (2) seconds to initiate synchronization.
2. Press any FreePad button to wake the FreePad. When the display illuminates, press the Plus button on the FreePad to complete the process.

 

Link to comment
Share on other sites

Hi, yes you are right, the control immediately goes into error when the data is interrupted.
With the Hawk controller I found out that you can send a reset and the connection will be resumed after a fault.
With the Hawk, the reset code is sent directly the first time a connection is established.
You can take a look to see if it's the same with the IQ2020 controller.

The Reset HEX Code from Keyboard from HAWK is

\x58\x4d\x53\x00\x01\x4b\x01\x44

and Mainboard Reset is:

\x58\x53\x4d\x00\x03\x1b\x27\x10\x01\x4d

 

I looked at the data exchange for many hours and learned little by little.

 

Link to comment
Share on other sites

That's quite interesting - it's definitely not the same here.
I start to suspect that something isn't perfectly smooth on my electronics setup.
I just had to disconnect both the IQ2020 and the touchpad at the same time to get any communication - it had stopped completely after I had caused too much of a timeout.

Link to comment
Share on other sites

As far as I know, the sensors you want don't exist. My plan is to use cheap peristaltic pumps to draw a sample and mix in the titrants (maybe OTO) and then use a color sensor to measure chlorine. I don't think I'm brave enough to have it pump bleach back in. So many projects, so many adult responsibilities, so little time.

Link to comment
Share on other sites

Hi, I have my hot tub outside and the cottage is for rent all year round.
Therefore it is also important that I can monitor the whirlpool. That's why I built the Wifi control so that the guests don't constantly adjust the temperature.
I have an isolated system for dosing. Here, however, the manufacturer has already created a way for the system to be controllable and monitorable via the network.2022-10-03_12-28.png.d4b4bac9ca8a4cebc893c652ac18ea23.png

2022-10-03_12-36.png.8d1841984ce84b6ec9a62a25398fbe80.png

You can see on the screenshot how often the up and down buttons and the SET button are pressed within just 31 days.

2022-10-03_12-34.thumb.png.5976a0f90f1cbb31e068ee5d5b8e3476.png

Link to comment
Share on other sites

  • 1 month later...
  • 1 year later...
On 10/2/2022 at 12:34 PM, the0ne said:

That's quite interesting - it's definitely not the same here.
I start to suspect that something isn't perfectly smooth on my electronics setup.
I just had to disconnect both the IQ2020 and the touchpad at the same time to get any communication - it had stopped completely after I had caused too much of a timeout.

@the0ne or anyone else with an IQ2020,

Were you able to get the spa controlled remotely? Any instructions you can provide beyond what's in this thread would be greatly appreciated.

 

Link to comment
Share on other sites

  • 3 months later...

Hi everyone. After some work, I got the RS485 bus of the IQ2020 connected to a ESP32 device using ESP-Home and so, connected to Home Assistant. Pins attached. It's not a complete project since I don't know the binary protocol to talk to the tub, however the physical connection work.

Attached in the expansion port pin information as I could figure it out. Some of the data provided above helped. If anyone has more data on this topic, please open an issue on GitHub or let me know here. Thanks.

IQ2020-ESP1.png

Link to comment
Share on other sites

To follow up on my previous post. Here is an image of the ESP32 I am using and how it looks within the controller's enclosure. The RS485 protocol is 38400 bauds N,8,1 and the Checksum is the sum of all previous bytes except the first one XOR 0xFF. The ESP32 device is very good at reading the data, you can see it over WIFI within Home Assistant in near real time.

IQ2020-ESP3.png

 

 

IQ2020-ESP2.png

IQ2020-ESP4.png

IQ2020-ESP3.png

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...