-
Notifications
You must be signed in to change notification settings - Fork 27
Home
- C++: https://github.com/MHotchin/BalboaSpaComms
- C++/ESP8266: https://github.com/cribskip/esp8266_spa
- NodeJS: https://github.com/rsrawley/spaControl
- NodeRed/HomeKit: https://github.com/ntableman/Balboa-Spa-HomeKit
- Python: https://github.com/garbled1/pybalboa
- Python/HomeAssistant: https://github.com/plmilord/Hass.io-custom-component-spaclient
- TypeScript/HomeKit: https://github.com/vincedarley/homebridge-plugin-bwaspa
This section of the wiki is a sounding board for decoding of the serial protocol, and the verified/agreed upon results posted to protocol.md. Text between question marks indicate unknown, uncertain, or unverified items. Please help determine the purpose of each message, and each byte in each message by posting byte streams and their context in the Examples section.
The internal serial bus is RS-485 at 115200 baud, 8 bits per byte, no parity, 1 stop bit (115200/8-N-1). The plug connector is a Molex 430250400 (or equivalent, see here or here), with the pinout shown below. Wire colors may vary. Connections may be added by connecting to open receptacles on the Main Board, or using Y-splitters. Be sure to keep the wires twisted and/or wrapped to reduce noise injection. It is also recommended to attach pin 3 to the return of the connecting device to reduce common-mode voltage.
| Pin | Signal |
|---|---|
| 1 | RS-485 B (TX+/RX+/D+) |
| 2 | Supply (+12 to 15VDC) |
| 3 | Return (0VDC) |
| 4 | RS-485 A (TX-/RX-/D-) |
| Byte | Name | Description/Values |
|---|---|---|
| 0 | Delimiter | 0x7E |
| 1 | Length | N - 2 (minimum of 5) |
| 2 | Channel | (see Channels) |
| 3 | ?? | 0xAF when Byte 2 is 0xFF, otherwise 0xBF |
| 4 | Type Code | (see Message Types) |
| 5 to N - 2 | Arguments | Optional, usually the same for each message type |
| N - 1 | Checksum | CRC-8 of bytes 1 through N-2, polynomial=0x07, initial=0x02, final XOR=0x02 |
| N | Delimiter | 0x7E |
The protocol uses an addressing scheme to provide direct traffic between devices. Some messages use multicast (broadcast) channels, while others use unicast (point-to-point) channels. Clients should only listen to multicast channels and their own channel, which is assigned my the Main Board. New channel assignments are incremented by one from the previous assignment, except when the assignment reaches 0x3F, the next assignment is 0x30. In addition, the Main Board does not send CTS messages to channels 0x30-0x3F, so these channels are probably not meant to be used. The only known way to "reset" channel assignment is to perform a power cycle.
| Channel(s) | Type | Description |
|---|---|---|
| 0x0A | Unicast | ?Assigned to the Wifi Module? |
| 0x0C | Unicast | ?? |
| 0x10-0x2F | Unicast | Assigned to clients, Main Board provides CTS |
| 0x30-0x3F | ?Unicast? | Assigned to clients, Main Board does not provide CTS |
| 0xFE | Multicast | Used by Main Board and clients for channel assignment |
| 0xFF | Multicast | Used by Main Board for broadcasting to all clients |
Clients are essentially devices on the RS-485 bus other than the Main Board, such as Top Side Panels, WiFi Modules, or the App.
| Type Code | Name | Sender | Length |
|---|---|---|---|
| 0x00 | ?Settings 0x10 Response? | Main Board | 26 |
| 0x00 | New Client Clear to Send | Main Board @ 10 Hz or 1 Hz | 5 |
| 0x01 | Channel Assignment Request | Client | 8 |
| 0x02 | Channel Assignment Response | Main Board | 8 |
| 0x03 | ?Channel Assignment Acknowledgement? | Client | 5 |
| 0x04 | ?Existing Client Request? | Main Board | 5 |
| 0x05 | ?Existing Client Response? | Client | 8 |
| 0x06 | Clear to Send | Main Board @ 60 Hz | 5 |
| 0x07 | ?Nothing to Send? | Client | 5 |
| 0x11 | Toggle Item Request | Client | 7 |
| 0x12 | ?? | Main Board | 22 |
| 0x13 | Status Update | Main Board @ 3.3 Hz | 27, 28, or 32 |
| 0x14 | ?? | Main Board | 22 |
| 0x20 | Set Temperature Request | Client | 6 |
| 0x21 | Set Clock Request | Client | 7 |
| 0x22 | Settings Request | Client | 8 |
| 0x23 | Filter Cycles Message | Client (write)/Main Board (read) | 12 |
| 0x24 | Information Response | Main Board | 25 |
| 0x25 | ?Settings 0x04 Response? | Main Board | 14 |
| 0x26 | Preferences Response | Main Board | 23 |
| 0x27 | Set Preferences Request | Client | 7 |
| 0x28 | Fault Log Response | Main Board | 15 |
| 0x29 | ?Settings 0x40 Response? | Main Board | 9 |
| 0x2B | GFCI Test Response | Main Board | 6 |
| 0x2E | Configuration Response | Main Board | 11 |
| 0x92 | Set WiFi Settings Request | App | 106 |
| 0x94 | ?? | ?? | 29 |
| 0xE0 | Toggle Sensor A/B Temperatures Request | Client | 6 |
| 0xE1 | ?Error? | ?? | 12 |
| 0xF0 | ?Error? | ?? | 11 |
A New Client Clear to Send message is sent by the Main Board at 10 Hz during start up and 1 Hz otherwise. This message is for flow control (prevents collisions on the RS-485 bus), as it indicates it is safe for a client to send a Channel Assignment Request. It is unclear how multiple clients avoid collisions.
Type Code: 0x00
Length: 5
A Channel Assignment Request is sent by a (new) client that has not been assigned a channel, immediately after a New Client Clear to Send message is received.
Type Code: 0x01
Length: 8
Arguments:
| Byte | Values/Description |
|---|---|
| 0 | ?Device Type? 0x02=?Top Side Panel? |
| 1 | ?? |
| 2 | ?? |
Examples:
08 FE BF 01 02 76 57 (SpaTouch1 connected before power-on)
08 FE BF 01 02 F2 47 (TP900 connected before power-on)
08 FE BF 01 02 F1 73 (TP900 connected after power-on)
A Channel Assignment Response is sent by the Main Board after a Channel Assignment Request. Depending on the arguments of the request, the response may include a new channel, or re-use an existing channel, though the details of this are unclear.
Type Code: 0x02
Length: 8
Arguments:
| Byte | Values/Description |
|---|---|
| 0 | Channel |
| 1 | ?? |
| 2 | ?? |
Examples:
08 FE BF 10 76 57 (Request arguments are 0x02, 0x76, 0x57)
08 FE BF 10 F2 47 (Request arguments are 0x02, 0xF2, 0x47)
08 FE BF 11 F1 93 (Request arguments are 0x02, 0xF1, 0x73)
A Clear to Send message is sent by the Main Board at 60 Hz, unless it is sending another message. This message is for flow control (prevents collisions on the RS-485 bus), as indicates it is safe for a client to send a message. Therefore, a client should only send messages immediately after detecting a Clear to Send message with its assigned channel.
Type Code: 0x06
Length: 5
A Toggle Item Request is sent by a client to toggle a device or setting. There is no response from the Main Board.
Type Code: 0x11
Length: 7
Arguments: Item Code, 0x00
| Item Code | Item |
|---|---|
| 0x01 | Priming Mode |
| 0x04 | Pump 1 |
| 0x05 | Pump 2 |
| 0x06 | Pump 3 |
| 0x07 | Pump 4 |
| 0x08 | Pump 5 |
| 0x09 | Pump 6 |
| 0x0C | Blower |
| 0x0E | Mister |
| 0x11 | Light 1 |
| 0x12 | Light 2 |
| 0x16 | Aux 1 |
| 0x17 | Aux 2 |
| 0x3C | Hold Mode |
| 0x50 | Temperature Range (Low/High) |
| 0x51 | Heat Mode (Ready/Rest) |
The Status Update message is sent by the Main Board three times a second. The length varies based on the SSID version, as additional features have been added in later versions.
Type Code: 0x13
Length:
| SSID | Length |
|---|---|
| M100_210 V6.0 | 28 |
| M100_220 V20.0 | 29 |
| M100_201 V44.0 | 32 |
Arguments:
| Byte | Name | Description/Values |
|---|---|---|
| 0 | Flags Byte 0 | 0x00=None, 0x01=Initializing, 0x05=Hold Mode, ?0x14=A/B Temps ON?, 0x17=?? |
| 1 | ?Initialization Mode? | 0x00=Idle, 0x01=Priming Mode, 0x04=?Stage 1?, 0x05=?Stage 3?, 0x42=?Stage 2? |
| 2 | Current Temperature | Temperature (scaled by Temperature Scale), 0xFF if unknown |
| 3 | Clock: Hour | 0-23 |
| 4 | Clock: Minute | 0-59 |
| 5 | Heating Mode | 0=Ready, 1=Rest, 3=Ready-in-Rest |
| 6 | ?? | 0 |
| 7 | Sensor A Temperature / Hold Timer | Minutes if Hold Mode else Temperature (scaled by Temperature Scale) if A/B Temps else 0x00 |
| 8 | Sensor B Temperature | 0x00 if A/B Temps if OFF else Temperature (scaled by Temperature Scale) |
| 9 | Flags Byte 9 | Temperature Scale, Clock Mode, Filter Mode (see below) |
| 10 | Flags Byte 10 | Heating, Temperature Range (see below) |
| 11 | Flags Byte 11 | Pumps 1-4 Status (see below) |
| 12 | Flags Byte 12 | Pumps 5-6 Status (see below) |
| 13 | Flags Byte 13 | Circulation Pump Status, Blower Status (see below) |
| 14 | Flags Byte 14 | Lights 1-2 Status (see below) |
| 15 | Mister | 0=OFF, 1=ON |
| 16 | ?? | 0 |
| 17 | ?? | 0 |
| 18 | ?? | 0 |
| 19 | ?Clean-up Cycle? | ?0x00=N/A, 0x04=OFF, 0x0C=ON? |
| 20 | Set Temperature | Temperature (scaled by Temperature Scale) |
| 21 | A/B Temps | 0=OFF, 1=ON |
| 22-23 | ?? | 0 |
| 24 | M8 Cycle Time | 0=OFF, 30, 60, 90, or 120 (in minutes) |
| 25-26 | ?? | 0 |
| Bits | Flag | Values |
|---|---|---|
| 0 | Temperature Scale | 0=1°F, 1=0.5°C |
| 1 | Clock Mode | 0=12-hour, 1=24-hour |
| 3-4 | Filter Mode | 0=OFF, 1=Cycle 1, 2=Cycle 2, 3=Cycle 1 and 2 |
| 5-8 | ?? | 0 |
| Bits | Flag | Values |
|---|---|---|
| 0-1 | ?? | 0 |
| 2 | Temperature Range | 0=Low, 1=High |
| 4-5 | Heating State | ?0-2? |
| 6-7 | ?? | 0 |
| Bits | Flag | Values |
|---|---|---|
| 0-1 | Pump 1 Status | 0=OFF, 1=Low, 2=High |
| 2-3 | Pump 2 Status | 0=OFF, 1=Low, 2=High |
| 4-5 | Pump 3 Status | 0=OFF, 1=Low, 2=High |
| 6-7 | Pump 4 Status | 0=OFF, 1=Low, 2=High |
| Bits | Flag | Values |
|---|---|---|
| 0-1 | Pump 5 Status | 0=OFF, 1=Low, 2=High |
| 2-3 | Pump 6 Status | 0=OFF, 1=Low, 2=High |
| 4-8 | ?? | 0 |
| Bits | Flag | Values |
|---|---|---|
| 0 | ?? | 0 |
| 1 | Circulation Pump Status | 0=OFF, 1=ON |
| 2-3 | Blower Status | 0=OFF, 3=ON |
| 4-7 | ?? | 0 |
| Bits | Flag | Values |
|---|---|---|
| 0-1 | Light 1 Status | 0=OFF, 3=ON |
| 2-3 | Light 2 Status | 0=OFF, 3=ON |
| 4-8 | ?? | 0 |
A Settings Request is sent by a client and the Main Board responds with the corresponding message.
Type Code: 0x22
Length: 8
Arguments:
| Settings Code | Name | Subsequent Arguments | Response |
|---|---|---|---|
| 0x00 | Configuration | 0x00, 0x01 | Configuration Response |
| 0x01 | Filter Cycles | 0x00, 0x00 | Filter Cycles Message |
| 0x02 | Information | 0x00, 0x00 | Information Response |
| 0x04 | ?? | 0x00, 0x00 | Settings 0x04 Response |
| 0x08 | Preferences | 0x00, 0x00 | Preferences Response |
| 0x10 | ?? | 0x00,0x00 | (None) |
| 0x20 | Fault Log | Entry Number (0-23, 0xFF is last fault), 0x00 | Fault Log Response |
| 0x40 | ?? | 0x00, 0x00 | Settings 0x40 Response |
| 0x80 | GFCI Test | 0x00, 0x00 | GFCI Test Response |
The Main Board sends a Filter Cycles Message when a client sends the appropriate Settings Request. The client sends a Filter Cycles Message to save/write filter cycle settings to the Main Board, which does not send a response.
Type Code: 0x23
Length: 12
Arguments:
| Byte | Name | Values |
|---|---|---|
| 0 | Filter 1 Start: Hour | 0-23 |
| 1 | Filter 1 Start: Minute | 0-59 |
| 2 | Filter 1 Duration: Hours | 0-23 |
| 3 | Filter 1 Duration: Minutes | 0-59 |
| 4 | Filter 2 Enable/Start: Hour | Bits 0-6: Hour (0-23), Bit 7: Enable (0=OFF, 1=ON) |
| 5 | Filter 2 Start: Minute | 0-59 |
| 6 | Filter 2 Duration: Hours | 0-23 |
| 7 | Filter 2 Duration: Minutes | 0-59 |
The Main Board sends a Filter Cycles Message when a client sends the appropriate Settings Request.
Type Code: 0x24
Length: 25
Arguments:
| Byte(s) | Name | Description/Values |
|---|---|---|
| 0-3 | Software ID (SSID) | Displayed (in decimal) as "M<byte 0>_<byte 1> V<byte 2>[.<byte 3>]" |
| 4-11 | System Model Number | ASCII-encoded string |
| 12 | Current Configuration Setup Number | Refer to controller Tech Sheets |
| 13-16 | Configuration Signature | Checksum of the system configuration file |
| 17 | ?Heater Voltage? | ?0x01=240? |
| 18 | ?Heater Type? | ?0x06,0x0A=Standard? |
| 19-20 | DIP Switch Settings | LSB-first (bit 0 of Byte 19 is position 1) |
Examples:
25 10 BF 24 64 D2 06 00 43 53 54 42 50 33 55 4C 02 57 07 21 08 01 0A 02 00 (M100_210 V6, CSTBP3UL, 2, 57072108, 240V, Standard, 0100000000)
25 10 BF 24 64 C9 2C 00 4D 42 50 35 30 31 55 58 03 A8 2F 63 83 01 06 05 00 (M100_201 V44, MBP501UX, 3, A82F6383, 240V, Standard, 101000)
A Preferences Response is sent by the Main Board after a client sends the appropriate Settings Request (using the same Channel as the request) or when a client sends a Set Preferences Request (using the broadcast Channel).
Type Code: 0x26
Length: 23
Arguments:
| Byte(s) | Name | Description/Values |
|---|---|---|
| 0 | ?? | 0 |
| 1 | Reminders | 0=OFF, 1=OFF |
| 2 | ?? | 0 |
| 3 | Temperature Scale | 0=1°F, 1=0.5°C |
| 4 | Clock Mode | 0=12-hour, 1=24-hour |
| 5 | Clean-up Cycle | 0=OFF, 1-8 (30 minute increments) |
| 6 | Dolphin Address | 0=none, 1-7=address |
| 7 | ?? | 0 |
| 8 | M8 Artificial Intelligence | 0=OFF, 1=ON |
| 9-17 | ?? | 0 |
A Set Preferences Request is sent by a client and the Main Board responds with a Preferences Response.
Type Code: 0x27
Length: 7
Arguments:
| Preference Code | Name | Preference Values |
|---|---|---|
| 0x00 | Reminders | 0=OFF, 1=ON |
| 0x01 | Temperature Scale | 0=1°F, 1=0.5°C |
| 0x02 | Clock Mode | 0=12-hour, 1=24-hour |
| 0x03 | Clean-up Cycle | 0=OFF, 1-8 (30 minute increments) |
| 0x04 | Dolphin Address | 0=none, 1-7=address |
| 0x05 | ?? | ?? |
| 0x06 | M8 Artificial Intelligence | 0=OFF, 1=ON |
A Fault Log Response is sent by the Main Board after a client sends the appropriate Settings Request.
Type Code: 0x28
Length: 15
Arguments:
| Byte | Name | Values |
|---|---|---|
| 0 | Total Entries | 0-24 |
| 1 | Entry Number | 0-23 (0=Entry #1) |
| 2 | Message Code | (see below) |
| 3 | Days Ago | ?0-255? |
| 4 | Time: Hour | 0-23 |
| 5 | Time: Minute | 0-59 |
| 6 | Flags | TODO |
| 7 | Set Temperature | Temperature (scaled by Temperature Scale) |
| 8 | Sensor A Temperature | Temperature (scaled by Temperature Scale) |
| 9 | Sensor B Temperature | Temperature (scaled by Temperature Scale) |
| Code | Message |
|---|---|
| 15 | Sensors are out of sync |
| 16 | The water flow is low |
| 17 | The water flow has failed |
| 19 | Priming Mode |
| 20 | The clock has failed |
| 21 | The settings have been reset |
| 22 | Program memory failure |
| 26 | Sensors are out of sync -- Call for service |
| 27 | The heater is dry |
| 28 | The heater may be dry |
| 29 | The water is too hot |
| 30 | The heater is too hot |
| 31 | Sensor A Fault |
| 32 | Sensor B Fault |
| 34 | A pump may be stuck on |
| 35 | Hot fault |
| 36 | The GFCI test failed |
| 37 | Standby Mode (Hold Mode) |
A GFCI Test Response is sent by the Main Board during initialization and after a client sends the appropriate Settings Request.
Type Code: 0x2B
Length: 6
Arguments:
| Byte 0 | Description |
|---|---|
| 0x00 | N/A ? or FAIL? |
| 0x01 | PASS |
A Configuration Response is sent by the Main Board after a client sends the appropriate Settings Request.
Type Code: 0x2E
Length: 11
Arguments
| Byte | Name | Values |
|---|---|---|
| 0 | Pumps 1-4 | Bits N to N+1: Pump N/2+1 (0=None, 1=1-speed, 2=2-speed) |
| 1 | Pumps 5-6 | Bits 0-1: Pump 5, Bits 6-7: Pump 6 (0=None, 1=1-speed, 2=2-speed) |
| 2 | Lights | Bits 0-1: Light 1, Bits 6-7: Light 2 (0=None, 1=Present) |
| 3 | Flags Byte 3 | ?Bits 0-1: Blower, Bit 7: Circulation Pump? |
| 4 | Flags Byte 4 | ?Bit 0: Aux 1, Bit 1: Aux 2, Bits 4-5: Mister? |
| 5 | ?? | 0x00 |
The section defines the order of messages.
TODO
Please use this section to post examples with the context in which they were collected. It is easier to decode with more data! Please try following the same format, with the delimiters and checksums removed for clarity.
HARDWARE
========
Spa Pack: CSTBP1C3 (56117-04)
Main Board: CSTBP1C (56118-03)
Expansion Board: 2RELAYS (55865)
Tech Sheet: 55963-02
Top Side Panel: TP900
Connection: Raspberry Pi with JBtek RS-485 USB Adapter
INFORMATION
===========
SSID: M100_210 V6
System Model: CSTBP3UL
Current Setup: 2
Configuration Signature: 57072108
Heater Voltage: 240
Heater Type: Standard
DIP Switches (1-10): 0100000000
Panel Version: BWG 4.8
25 10 BF 24 64 D2 06 00 43 53 54 42 50 33 55 4C 02 57 07 21 08 01 0A 02 00
MESSAGES
========
1C FF AF 13 00 00 49 09 25 00 00 00 00 01 00 01 00 00 00 00 00 00 00 00 49 00 00 (27-byte Status Message)
08 10 BF 05 04 08 00 (Existing Client Response from TP900)
0E 10 BF 25 02 02 32 63 50 68 20 07 01 (Settings 0x04 Response)
09 10 BF 29 15 00 00 0F (Settings 0x40 Response)
0B 10 BF 2E 2A 00 01 50 00 00 (Configuration Response: 3 2-speed pumps, 1 light, no circ/blower)
Seen @ 60Hz:
05 10 BF 06 (Thought to be the Main Board's "your turn to send")
05 10 BF 07 (~2ms later, or 40 degrees phase shift)
Seen @ 1Hz:
05 FE BF 00
Main Board power-on with TP900:
05 0A BF 04
05 0C BF 04 (~3 ms later)
05 10 BF 04 (~3 ms later)
05 11 BF 04 (~3 ms later)
... (channel increments by one) ...
05 3E BF 04 (~3 ms later)
05 3F BF 04 (~3 ms later)
06 FF AF 2B 00 (~7 ms later)
16 FF AF 12 02 00 04 05 06 11 1B 00 00 00 00 00 00 04 05 11 06 (~50 ms later)
16 FF AF 14 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (~15 ms later)
16 FF AF 12 01 04 05 06 01 91 02 00 00 00 00 00 00 00 00 00 00 (~217 ms later)
16 FF AF 14 01 04 05 11 28 00 00 00 00 00 00 00 00 00 00 00 00 (~15 ms later)
05 FE BF 00 (~716 ms later)
08 FE BF 01 02 F2 47 (~1 ms later)
08 FE BF 02 10 F2 47 (~15 ms later)
05 10 BF 03 (~1 ms later)
05 10 BF 06 (~15 ms later)
05 10 BF 07 (~1 ms later)
... (Clear to Send/Nothing to Send messages at 30 Hz) ...
1C FF AF 13 01 04 00 00 00 00 00 64 4D 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~120 ms later, first Status Update)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
16 10 BF 12 02 00 04 05 06 11 1B 00 00 00 00 00 00 04 05 11 06 (~235 ms later)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
08 10 BF 22 04 00 00 (~365 ms later)
0E 10 BF 25 02 02 32 63 50 68 20 07 01 (~5 ms later)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
1C FF AF 13 01 00 00 00 00 00 00 64 4D 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~1.736 s later, argument byte 1 changed)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
1C FF AF 13 01 04 00 00 00 00 00 D2 5F 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~600 ms later, argument bytes 1, 7, and 8 changed)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
1C FF AF 13 01 00 00 00 00 00 00 D2 5F 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~2.4 s later, argument byte 1 changed)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
1C FF AF 13 01 42 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~300 ms later, argument bytes 1, 7, and 8 changed)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
1C FF AF 13 01 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~2.7 s later, argument byte 1 changed)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
1C FF AF 13 01 05 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~900 ms later, argument bytes 1 and 7 changed)
... (New Client CTS @ 10 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
... (New Client CTS @ 1 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ... (~2.5 s later, New Client CTS changes from 10 Hz to 1 Hz)
1C FF AF 13 00 01 FF 10 0B 00 13 01 00 00 06 00 00 00 00 00 00 00 00 00 62 00 00 (~200 ms later, many argument bytes changed)
... (New Client CTS @ 1 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
1C FF AF 13 00 01 FF 10 0C 00 13 01 00 00 06 00 00 00 00 00 00 00 00 00 62 00 00 (~26 s later, argument byte 4 changes)29.058
... (New Client CTS @ 1 Hz, CTS/Nothing to Send at 30 Hz, Status Updates at 3 Hz) ...
... (I expect Priming Mode will timeout) ...
Main Board power-on without TP900:
05 0A BF 04
05 0C BF 04 (~3 ms later)
05 10 BF 04 (~3 ms later)
05 11 BF 04 (~3 ms later)
... (channel increments by one) ...
05 3E BF 04 (~3 ms later)
05 3F BF 04 (~3 ms later)
06 FF AF 2B 00 (~8 ms later)
16 FF AF 12 02 00 04 05 06 11 1B 00 00 00 00 00 00 04 05 11 06 (~54 ms later)
16 FF AF 14 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (~15 ms later)
16 FF AF 12 01 04 05 06 01 91 02 00 00 00 00 00 00 00 00 00 00 (~218 ms later)
16 FF AF 14 01 04 05 11 28 00 00 00 00 00 00 00 00 00 00 00 00 (~15 ms later)
05 FE BF 00 (~715 ms later)
1C FF AF 13 01 04 00 00 00 00 00 64 4D 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~103 ms later, first Status Update)
... (New Client Clear to Send @ 10 Hz and Status Updates @ 3 Hz continue) ...
1C FF AF 13 01 00 00 00 00 00 00 64 4D 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~2.4 s later, argument byte 1 changed)
... (New Client Clear to Send @ 10 Hz and Status Updates @ 3 Hz continue) ...
1C FF AF 13 01 04 00 00 00 00 00 D2 5F 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~600 ms later, argument bytes 1, 7, and 8 changed)
... (New Client Clear to Send @ 10 Hz and Status Updates @ 3 Hz continue) ...
1C FF AF 13 01 00 00 00 00 00 00 D2 5F 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~2.4 s later, argument byte 1 changed)
... (New Client Clear to Send @ 10 Hz and Status Updates @ 3 Hz continue) ...
1C FF AF 13 01 42 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~900 ms later, argument bytes 1 and 7 changed)
... (New Client Clear to Send @ 10 Hz and Status Updates @ 3 Hz continue) ...
1C FF AF 13 01 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~2.4 s later, argument byte 1 changed)
... (New Client Clear to Send @ 10 Hz and Status Updates @ 3 Hz continue) ...
1C FF AF 13 01 05 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 00 00 00 62 00 00 (~900 ms later, argument bytes 1 and 7 changed)
... (New Client Clear to Send @ 10 Hz and Status Updates @ 3 Hz continue) ...
1C FF AF 13 00 01 FF 0F 00 00 13 01 00 00 06 00 00 00 00 00 00 00 00 00 62 00 00 (~2.7 s later, many argument bytes changed)
... (New Client Clear to Send @ 1 Hz and Status Updates @ 3 Hz continue) ... (New Client Clear to Send changes from 10 Hz to 1 Hz)
When TP900 plugged in after Main Board already on: (normal traffic interleaved, but now shown)
05 FE BF 00 (Main Board: "any new clients?")
08 FE BF 01 02 F1 73 (~8 ms later, TP900: "I'm new")
08 FE BF 02 11 F1 93 (~50 ms later, new channel is 11)
05 11 BF 03 (~1 ms later)
16 11 BF 12 02 00 04 05 06 11 1B 00 00 00 00 00 00 04 05 11 06 (~33 ms later)
05 11 BF 07 (~1 ms later, and ~1ms after every Clear To Send on channel 11)
HARDWARE
========
Spa Pack: MBP501UX (56931-03)
Top Side Panel: SpaTouch1 (50586-03)
Connection: Raspberry Pi with BOB-10124 RS-485 Transceiver Breakout
INFORMATION
===========
Panel Version: BWG 3.55
Image File: 14
Panel Type ST1i
SSID: M100_201 V44
System Model: MBP501UX
Configuration Signature: A82F6383
Current Setup: 3
DIP Switch Settings 101000
Heater Voltage: 240V
Heater Type: Standard
25 10 BF 24 64 C9 2C 00 4D 42 50 35 30 31 55 58 03 A8 2F 63 83 01 06 05 00
MESSAGES
========
0E 10 BF 25 09 03 32 63 50 68 49 03 41 02
Main Board power-on:
06 FF AF 2B 01
16 FF AF 12 04 00 04 05 11 1B 3D 00 00 00 00 00 00 04 05 00 11
16 FF AF 14 04 04 05 00 11 00 00 00 00 00 00 00 00 00 00 00 00
16 FF AF 12 01 04 05 1B 01 91 02 00 00 00 00 00 00 00 00 00 00
16 FF AF 14 01 04 05 11 28 00 00 00 00 00 00 00 00 00 00 00 00
05 FE BF 00
08 FE BF 01 02 76 57
08 FE BF 02 10 76 57
05 10 BF 03
05 10 BF 06
05 10 BF 07