Friday, 27 April 2018

Lay-Z-Spa hottub controller modifications (arduino controller)

This is a work-in-progress project, one that I've been planning to do for a while and finally done a bit of preparation for it.
Last year we bought the bestway Lay-Z-Spa semi-rigid/inflatible hot tub for the back garden, the kids love it but it does chew electricity up quite quickly (Approximately £5 extra per day it's switched on/at temperature).



So my thoughts then turned to how to minimise this and control it a little better. As you can see there is a rugby-ball shaped pump/filter control unit to the side of the hottub. This handles everything, so it has two water pipes, one inlet from the hottub and one return that it pumps and uses a 2Kw heating element in there. There is also a larger diameter pipe used to blow air through it to produce the spa/bubbles effect.
The problem is the unit uses capacitive touch to control it, and if you simply power the unit on and off at the supply it defaults to a powered off state (for safety I'd assume), so being able to control it remotely wasn't an easy starter.



What I wanted was to use an Arduino or Raspberry PI to talk to it, attach that to my wifi similar to my other smart-home kit and I can then send temperature/control settings to it to vary when it was on or off and hopefully set temperatures remotely ideally, as what my goal is to be able to set it to a lower temperature when it won't get used (overnight, daytime, etc) and then boost enough in time for when it is wanted (evenings or weekends) therefore reducing the overall electrical supply drain it uses.

So first is to disassemble it and see what's inside. It's constructed fairly simply, a set of 6 screws around the very top for the control panel, then the same again about half way down for the main body.


So after removing the top screws you can see inside the main body, the control panel lifts off on a ribbon cable (4 wires) and has a connector to disconnect it.


The above photo shows (from top left to right) the reset plunger, power transformer, water flow detector and outlet from heater.
Great box to the left is the output high power controller (switching the heater, pumps, etc) then the silver canister is the 2Kw heater (2x1Kw heaters side by side) and finally the black circle assembly is the air pump for bubbles/spa effect.


Here is a closer photo of the 2Kw heating element casing. The blue connector and black wire is the thermal one-shot fuse to protect overheating.

Here is the 4 way connector between the grey output controller and the top panel.

Here is the underneath of the top panel, the controls are screwed inside this waterproof casing.



This is inside the control panel, the whole board is encased in a resin/gel to protect it against moisture. The spring/metal contacts push against the plastic casing and act as the capacitive sensors. On the main board you can see a 10-pin connector at the top left which is marked programming.
Bottom left is the piezo sounder for warning/button tones. Middle is the 3 digit bar array.
And interestingly there are two chips, one to the lower left of the bar segment (along with a timing crystal can) and another one almost dead centre.





I've not yet managed to identify the chips, however they DO have their product codes on them, it's just very difficult to read as they're tiny and also under the resin. I'm going to try and retrieve these as they might hold the key.
The main square chip is definitely an Atmel chip which suggests an ARM like processor I'd guess.

My goal now is to work out the communications protocol going between the control board and the output board. At a guess this is going to be a form of serial communication (2 wires, TX and RX and then 2 for power) and so potentially tapping into this I can simulate one or the other units talking to each other.
My guess is that the output control board sends information about current relay states, safety cut outs, temperature sensors, etc, and feeds it over a serial data stream to the top control board so it can display error codes, etc and feedback status. The top board then sends signals to the bottom board to handle when to turn on pump, heater, etc.

That's as far as I've got so far, I now want to identify the chips and then try to sniff the data going through these pins. I'm so far trying to salvage an old 'damaged' unit that I can do testing on to discover this protocol as there is little to no information out in the wild about them!

If you know anything, please do get in touch.


----Update----
I've taken apart the lower unit this time:

And something jumped out at me, the 4 pin connector has labels on it!
GND-TXD-RXD-5v
Which is what I was suspecting. There is also the same chips, so looking as closely as I can, this looks like an Atmel ATmega168 chip. Looking the datasheets up (http://ww1.microchip.com/downloads/en/DeviceDoc/Atmel-2545-8-bit-AVR-Microcontroller-ATmega48-88-168_Summary.pdf)
This Atmel chip looks a good candidate, it's got serial onboard, has a capacitive touch library built in, Counters, PWM channels, 8-channel ADC for temperature sensing, and various I/O lines which sounds ideal for this circuit. It requires an external clock (Hence the clock chip can below the chip) and so this looks likely!
Next steps I think are to branch this connection and connect it up to a serial port and try to sniff the data. Hopefully it'll be at a standard baud rate and not encrypted so we can see the simple data flow.

No comments:

Post a Comment