Balboa-GS510SZ icon indicating copy to clipboard operation
Balboa-GS510SZ copied to clipboard
verified publisher icon MagnusPer

GS500Z with Balboa-VL260-PN-55081 control panel

Open surfmk opened this issue 9 months ago • 9 comments

Hi all,

This is a great project! I have a Cove Spa Delux that came with my house and I'm getting into home automation.

Before I jump into this and get my soldering iron out, could anyone comment on:

  1. Code compatibility with GS500Z and my 4 button VL260? I understand how you are using the J1 socket Shame nobody got the J2 to work with it but I guess you would need to sniff the actual wireless device it was designed to work with... I'm happy to do some code editing and have a hobbie background in C++

  2. I have a LAN connection available I would like to use in preference to Wemos D1 mini (powerline LAN allows extra distance into garden - out of wireless range) would the usb connector on the wemos be of any value to output anything to LAN? as you can tell, I am not that familiar with wemos :/

I attach some photos of my actual hardware... I'm using Home Assistant and

Many thanks in advance,

Paul

Image

Image

Image

Image

surfmk avatar Jun 06 '25 17:06 surfmk

Hi @surfmk Nice you visit this GitHub project! I can not answer the question on compatibility for your GS500Z control system since I reversed engineered GS510SZ. Either you need to do the same approach I did to measure the link between control system and display using oscilloscope or just give it a try and hope for the best!

MagnusPer avatar Jun 07 '25 13:06 MagnusPer

Hi - thank you for replying. I suppose it would be unlikely they would develop a different protocol for such a similar device... I'm keen to try it. Do you know how I could use LAN instead of WiFi? I need some LAN data capture board that I could interface with in Home Assistant... any ideas?

surfmk avatar Jun 07 '25 13:06 surfmk

Hi, I can confirm it doesnt work sadly. It stops the pump button from working and no useful data is gained. Looking online i can see the topsides are not compatable so i guess they must communicate in different ways. Maybe on purpose to sell more top sides :). Im now getting out of my depth as i dont have an ocilscope but i might see if i can buy one and carry on down the rabbit hole @MagnusPer any tips/newbie ideas you can give oh wise one :) I read your docs and photos but i feel like im missing the link between the screen and the ones and zeros.

Jacktheripper125 avatar Jun 26 '25 13:06 Jacktheripper125

Hi Jack, That's interesting you are following this up... I haven't started yet but am happy to see what protocols are being used when I do (need to borrow a scope as well!). I'd quite to find a remote panel (chances are remote!) and see if we can replicate the signals that this sends... All good fun. Paul

surfmk avatar Jun 26 '25 19:06 surfmk

You might find a logic analyser is more helpful than a scope

netmindz avatar Jul 03 '25 19:07 netmindz

Thank you netminds.

One thing i would say is dont try the software and card on a gs500. After usung it my hot tub went to 40c and stayed there even though i selected 34c it just kept heating to 40c after haveing the card plugged in. I tried re powering and re setting. Even tried a new temp sensor. I have now had the tub un plugged a few days and the memory wipe jumper on and touch wood today it is back to normal. I will maybe wait until i get brave again. I will get a logic board as it looks interesting. I will find something cheaper to break first

Jacktheripper125 avatar Jul 03 '25 22:07 Jacktheripper125

Hi Jack, just wondering if any more progress? A logic analyser seems to be the way forward as netmindz suggested. I'll try to learn a bit more about how these work as I've only ever used an oscilloscope. If we can work out the protocol, we should be able to see where it diverges from the GS510*Z.

surfmk avatar Jul 21 '25 08:07 surfmk

Hi Jack, just looking around at logic analysers and this video / links seems to offer an excellent low cost way to decode the GS500 output.

https://www.youtube.com/watch?v=3IA_6MwInVg https://www.amazon.co.uk/Logic-Analyzer-Binghe-Compatible-Arduino/dp/B0D868ST5C/ref=sr_1_1 https://github.com/sigrokproject/pulseview

Amazing you can buy such a powerful piece of kit for so little!

I'll get back when I have experimented with it...

Regards, Paul

surfmk avatar Jul 21 '25 09:07 surfmk

Subject : Findings on GS501Z R2B – confirmed non-RS-485 bus & partial RS-485 output (J18)

Hi everyone 👋
I’ve been working for the past weeks on a Balboa GS501Z R2B (paired with a VL403 panel), trying to integrate it into Home Assistant through an Elfin EW11A Wi-Fi → RS-485 bridge.
After many captures and hardware tests, here’s a clear summary of what we’ve confirmed on this board revision — it might help others working on GS501Z/GS510SZ units.

🧩 Hardware revision

  • Mainboard marking: GS501Z R2B

  • Firmware label on ROM: GS501Z R2B v43

  • Same hardware family as GS510SZ, very likely identical bus design.

🔍 Observed behaviour

Port | Physical Layer | Observations | Notes -- | -- | -- | -- J1 (VL-series keypad) | ⚠️ Not RS-485 | Bus has 0-5 V signals, one line clock (~38 kHz) + one line data. Captures look SPI-like. | Matches the description in this issue: synchronous, proprietary protocol. J2 | Same story | No measurable differential signal. Probably diagnostic or TTL RX only. |   J18 | ✅ RS-485 TX only | Emits clean [64 3F 2B…] frames at ~1 Hz (same as BWA MLD protocol). But the line is transmit-only: we can read but not inject commands. | Likely the internal telemetry/debug output from the MCU.

⚙️ What this means

  • The GS501Z R2B no longer exposes a bidirectional RS-485 bus.

  • The clavier/panel bus (J1) is proprietary TTL synchronous (SPI-like), not asynchronous UART.

  • The only readable RS-485 output is on J18, but it’s TX only — perfect for passive reading, useless for control.

  • This explains why the BWA Wi-Fi v1 module (RS-485 based) doesn’t work, while the BWA Wi-Fi v2 (with its own MCU) does.

🧠 Current working state

  • Using EW11A on J18, we can reliably read:

    • Water temperature

    • Setpoint temperature

    • Mode (ST/ECO/SL)

    • Heater state

  • All from the 27-byte [64 3F 2B…] frames — read-only telemetry confirmed.

  • Injection tests on J18 produce no effect (no RX path to MCU).

  • J1/J2 carry proprietary traffic (not UART/RS-485).

🔧 What we still need

  1. Identify on the board where the real RS-485 transceiver sits (likely U22/U34), to see if bidirectional pads are still exposed.

  2. Confirm if GS501Z/GS510SZ share the exact same SPI-like “BL-bus” between MCU ↔ panel.

  3. Determine whether the BWA v2 module bridges this bus to MLD over TCP 4257 (would make reverse-engineering feasible).

💡 Next steps / ideas

  • Probe the J1 bus with a 5 V logic analyzer in SPI mode (CLK, MOSI, MISO).

  • Compare captures with those from GS510SZ units.

  • Try to locate any test pads labeled RS+, RS-, A, B, U22, RO/DI on the PCB — they might expose the internal RS-485 lines.

If anyone here has a working BWA v2 on a GS501Z R2B / GS510SZ, it would be great to sniff its lines and confirm whether it’s doing a protocol conversion internally.

Thanks to the previous work here (MagnusPer, Jonas M., etc.), we now have solid confirmation that:

GS501Z R2B ≠ RS-485 Balboa MLD — it’s a synchronous 5 V bus.
Only J18 still mirrors MLD frames (TX-only).

Happy to share scope traces or the EW11A setup if it helps the investigation.

GevaudanBeast avatar Oct 09 '25 12:10 GevaudanBeast