Controlling the Hayward Ecostar Pump

Quite some time ago I got fed up with the huge amount of power a pool pump uses and got one of those cool permanent magnet, variable speed pumps.  It's really is cool, it can run from a few RPM up to way over 3000.  All of the speeds use less power than a conventional motor and you can actually circulate water with 200 watts of power usage.  This is what they look like:

There's three pieces to these things, the controller, the actual motor and the filter-impeller.  Hayward calls the controller the 'drive'; I don't have any idea why except maybe because they make pool controllers and they don't want customers to get confused.  The drive is this part here:

Yes, I stole the image off the web.  It was too hot to go out and take my own picture.  The drive can be separated from the motor and remotely set up.  This makes it convenient for ease of use, and nice if you have the rest of the stuff inside an enclosure.

The drive has its own controls, but it can also be controlled by my Goldline P4 controller.  The problem is that the darn controller only supports two speeds: low and high.  Sure, I can set the speed for each of them to anything I want, but I only have two speeds for my variable speed motor.  That has always ticked me off.  Hayward decided that I only get two speeds for the motor that are easily done.  To do anything else I have to futz around with settings each time.  Really ??

A few weeks ago one of my readers asked if I had ever pursued breaking the protocol between my controller and the drive.  I hadn't, but it sounded like a cool project to take on.  So, armed with my motor, his motor, his skills, my lack of skills, we embarked upon a project to get control of this motor.  Naturally, there is zero documentation on the protocol, but we had some hints.

It's RS485 half duplex because it works on the same line as the other controls for the P4.  It's 19.2Kbaud for the same reason.  That meant that we could set up monitors and code to listen to the conversations between the devices as we changed things and might stand a chance to get a hint on how to control it.

Guess what?  After a few false starts, we beat it.  We can now control the motor and change the speed to anything we want to.  It turns out the protocol is relatively simple; you send a command to the motor periodically telling it the speed you want it to run.  If you stop sending, the motor stops.  If you send a speed of zero, the motor stops.  If you send a specific speed, the motor runs at that speed.

The motor protocol works in percentage.  If you send 100%, it will run at the top speed.  If you send 0%, it stops.  You can choose any percentage in between and the motor will go to that speed.  You can't send 1000 RPM, you have to send a percentage instead.  Still, it works quite nicely.  The protocol looks like this:

Off     0x10, 0x02, 0x0C, 0x01, 0x00, 0x00, 0x00, 0x1F, 0x10, 0x03

100% 0x10, 0x02, 0x0C, 0x01, 0x00, 0x64, 0x00, 0x83, 0x10, 0x03

45%   0x10, 0x02, 0x0C, 0x01, 0x00, 0x2D, 0x00, 0x4C, 0x10, 0x03

The 0x10, 0x02 is the start of packet indicator.  The 0x0C, 0x01 means from device 1 to device 12.  The 0x00 is just a zero, never saw it become anything else.  the 0x00 or 0x64 or 0x2D is the percentage in hex (0, 100, 45) the next two bytes are the checksum and the 0x10, 0x03 is the end of packet indicator.  So, to change the speed, change the percentage, recalculate the checksum and send it.  The motor will change speed.  You have to send this at half second intervals to keep the motor running.  Actually, I've gone up to a second and a half and still had the motor run, but better safe than sorry.

The checksum is a matter of adding the byte values and sticking them in place.  In the first packet above, 10 + 2 + C + 1 + zeros = 1F.  Remember, it's hexadecimal and the checksum is two bytes long, so it's 0x00, 0x1F.  Similarly, the 100% packet is 10 + 2 + C + 1 + 0 + 64 = 0x00, 0x83.  The last two bytes, 0x10, 0x03 are not used in the checksum.

Each of these control packets is responded to immediately by the drive unit with something like:

0x10 0x02 0x00 0x0C 0x00 0x00 0x2D 0x02 0x36 0x00 0x83 0x10 0x03

It starts off with the begin packet bytes of 0x01, 0x02.  Then 0x00 , 0x0c which would mean, from device 12 to device 0.  Strange that it would reply to device zero when device 1 sent the command, but ??  Byte 6 of the packet is the speed, in the packet above it is byte 6 counting from the first byte being index [0].  Bytes 7 & 8 are the power and they threw me for a loop. They’re in nibble form of the actual speed if you read it out loud. For example:

0x10 0x02 0x00 0x0C 0x00 0x00 0x62 0x17 0x81 0x01 0x18 0x10 0x03

Byte 6 is 0x62, for 98 percent and bytes 7 & 8 are 0x17 0x81, this reads as one, seven, eight, one or a power reading of 1,781 watts. Is that weird or what?   I tried big endian, little endian, hex, some obscure rotations I’ve seen in the past and other stuff until I just happened to read it out loud and then look at the motor. Shocked is probably the correct term for my reaction.

Edit: I had a face-slap moment on this a couple of months after I posted here. The number is simple binary coded decimal; the reason I missed it is because I haven't seen BCD used since the late '70s of last century. I gues it's still used somewhat, but I completely missed it.

So, to calculate the speed: Serial.print(((long)3450 * buffer[6]) / 100); seems to work just fine. It’s a tiny bit off from the actual motor reading on its LCD sometimes, but I think that’s because of the calculations on the two devices being a little different. The power is right on for every instance I have tried.

The code for something like this was relatively simple to put together, but it gets really complex when you add in whatever method you use to control it.  I have an XBee network that I send commands through, but most folk out there want wireless ethernet or wires.  It can be controlled from a board as simple as an Arduino (like me and my colleague), or any other device that can either provide RS485 or handle an adapter to convert TTL serial.  My setup is described here <link>, I just added code to it to handle the motor separately and turned off control of the motor in the Goldline P4 I have.

The physical connection is with two wires from your RS485 device to the motor drive unit on the communications port.  You may have to use shielded cable and connect the ground up as well; these motors are extremely noisy on both the power line and RF near the unit.  So, grab some of that shielded CAT5 cable and go for it.

I cut this right out of the installation manual for the Ecostar motor.  Pin 7 is the plus (+) side of the RS485 link and they clearly label the comm connection.  This image also shows how the connection is made to a pool controller like my P4.

If you do this to control your motor, there is something that will help you.  When you send something to the motor that it can't understand, it locks up the drive unit.  I sent many a packet that was constructed incorrectly and the drive would go nuts and not respond after that.  You have to actually power down the motor and then turn it back on to continue.  Not the most robust software in the world.

There is another protocol here that I will research in more depth later.  Not only is the 'drive' controlled by the pool controller, the motor itself is controlled by the 'drive'.  Yes, the motor itself has a protocol all it's own that the drive supplies.  That's why you can separate the drive from the motor and mount it somewhere else with some wires running between.  This is also RS485 and it runs at 1200 baud.  It has a different checksum scheme and there are bits in there that have to be figured out.  We haven't made much progress on this protocol, but we can make the motor turn on without the drive unit even being there.  This may come in handy at some point in the future when the drive dies and the warranty has expired.  Those drives cost almost as much as the entire assembly ... jerks.

There you go folk, you now have control of that expensive motor Hayward has been keeping secret. Plus, for people like me, you can monitor the power usage real time to keep energy costs down.  You won't be limited by some arrangement of relays or the two speeds Hayward saw fit to allow.

That's two of their secret protocols I've put on the web now <link>; maybe I should think about hiding for a while...

Arduino, XBee, and a Freezer Defroster

I have an upright freezer.  Living a ways from town and the climate make this necessary.  I load a cooler in the car, go to the store get my frozen goods and some ice, pack the food in the cooler with the ice and come home.  When it's over 114F outside, you have to take some special precautions to keep the food from becoming a puddle in the back of the car.

A while back I discusssed how my freezer uses power; it's relatively efficient except for one item, the defroster <link>.  A freezer's defroster is a combination of a timer, a heater, and a thermostat to monitor the temperature of the evaporator.  What bothered me was the timing of the defrost cycle.  Every 11 hours or so, it would defrost, and this meant that the heater would be on during peak usage period.  Since I pay a lot for peak usage it would be nice to have better control of the timing of the defrost cycle.  So, an examination of the defrost circuitry showed a clear opportunity for an accurate timer and a simple SPDT relay as a replacement for the conventional method.

So, since I had a couple of arduinos that weren't doing anything, I got one of these:

This shield has both the relays and the XBee socket I wanted to use, perfect.  I have a few XBees that I picked up, so I configured one and plugged it in.  A little code later I was reading my house clock transmissions and setting off a timer every 12 hours.  I chose 08:15 and 20:15, times that are outside the peak period, now all I had to do was wire it in and test it.  Here's an image of the schematic of the circuitry:

I circled the defrost timer to make it obvious.  Notice that it simply switches between the compressor circuitry and the defrost heating assembly.  This makes it simple to wire into the circuitry, so I took out the timer and used the plug that went to it to wire into the relay of the arduino shield.  It was ready to test, and I hooked up a wall wart power supply and plugged the arduino into the same power monitor that I use on the freezer.  It worked like a charm.  Now my freezer goes into a defrost cycle at the programmed times and runs for 30 minutes.  I checked the evaporator pretty often to make sure it was running the heater long enough and everything seems fine.

While I was programming the device I threw in some code to allow me to set off the defrost cycle any time I want to as well as having it report through the XBee the status of the defroster.  This leaves a clear opportunity for installing a temperature sensor, compressor sensor, door sensor, etc.  Over time I may well do some of these things.  I could go nuts and use the arduino to control the entire freezer; these appliances are relatively simple devices and a little arduino and some relays could take over the entire operation.  I'm not sure there's any real point to that since it works well already, but I may get bored some hot summer day.

A temperature sensor would be pretty nice though.  I could send the temp to my house controller <link> and set up a piece of code to check for the temperature getting too high.  A too-high situation could easily send me mail or light up an LED somewhere to alert me to a problem.  Or both.   

Here's a chart of my freezer power usage over a 24 hour period:

The freezer is the black line.  Notice the two humps, one at 08:15 and the other at 20:15?  That's the increased power usage from the heating units (one on the evaporator and the other on the drain tube).  Now I have this power using mode scheduled for the lower rate periods.  With the new LED lights I installed in the freezer to replace the incandescent ones, this device is getting cheaper to run all the time.

Before you tell me that the wall wart and arduino probably use 5 watts continuously, remember my goal was to move the higher usage away from peak billing periods.  I'd rather have 5 watts continuous than 400 watts for thirty minutes during peak.  Peak usage is really expensive in my area.

No, it's not a major savings, but every little bit helps.  Heck, I'll probably get back the money I spent on the shield and arduino in ... what ... 10 years or so.

OpenWrt on the HLK-RM04, Reality Check

There's a ton of pixels out there about OpenWrt.  It's open source router software that can do an excellent job of expanding the capabilities of some routers way beyond what the manufacturers provide.  I had an OpenWrt router for a while, it eventually went up in smoke and I've been using what the DSL provider recommends ever since.  However, I ran into the HLK-RM04 <link> through the suggestion of a reader and decided to look into expanding the capabilities of this little device and OpenWrt seemed like a good choice to use as software for it.

There's a few threads on the OpenWrt forum and a couple of interesting repositories on github that relate to the device and they look reasonably promising,  So, I read the threads, and all of them suggested either picking up a binary they created or building my own.  There were involved instructions on the build, so I thought, "Why not?"  Thus began my misadventures with building OpenWrt for the HLK-RM04.

First, I tried the binary that was created by one of the guys that frequents the OpenWrt forum.  This binary seemed to have great possibilities since, once you have a version of OpenWrt running, you can add to it and update it pretty easily.  So I followed the instruction to install the uboot boot loader and then installed the image that the guy put in github.  This process went pretty well, but very little worked on the router.  I could get an ethernet connection, but wireless and any outside access wouldn't work.  When I tried to enable wireless, the rm04 ran out of memory.  Fine, I'll build my own and learn about the configuration of the software while going through the process.

So, I thought to myself, I really should make sure I could restore the rm04 to factory settings.  Oops, too late.  Once you install uboot on the device, the factory software is gone and can't be recovered.  Even though it's in a different part of the device, there just isn't any way to get to it.  Sure, I could have spent about a month learning the ins and outs of the JTAG interface and bit banged myself a backup, but that didn't seem like a valuable skill to pursue.  There were two reasons I was tardy in looking at a way to back it up.  The first was because there really aren't any useful instructions out there on how to backup.  Sure there's a OpenWrt <link> wiki page on it, but I couldn't get enough information out of it to even attempt anything.  The 'How To' was full of 'could', 'maybe', and 'beware', with no real examples.  Like I said, I'd have to learn the intricacies of JTAG to have a chance.  The second was because there isn't a serial interface to control the chip.  There's a serial line, but you can't log into it and do anything.  I really don't understand why manufacturers do this, do they want to sell these things?

I guess I better make OpenWrt work.

I downloaded OpenWrt, configured it the way the instructions said and started make.  Six hours later, it failed.  Following the instructions, I used the V=s option to see what was failing.  It turns out that OpenWrt installation only installs part of the code, the makefile goes to various servers and their mirrors and downloads more.  The file it failed on was a little over two meg, so I tried it again.  Of course, it failed again.  I set up a little script to restart the make if it died and went to bed.

The next morning, it was still trying to load files.  Yes, I got the two meg and several others, but the files were getting enormous.  I watched it fail five times on an eight meg file and decide this wasn't working, so I hunted down the retry count and timeout amount in the scripts and changed them to 25 retries and a full minute timeout.  Ran it again and it seemed to stumble through some of the downloads.  However, when I watched the log, it was failing quite often with a 404 error on a file that it had been previously reading; what?  So, I changed the retry to 50 to allow for server errors and let it go again.

It chugged along for many hours and then I noticed that the file size was getting larger and larger.  There were files over 90Mb that were trying to be loaded.  The internet, my little machine, and bad luck were really conspiring because at one time I noticed the load speed was two bytes (yes bytes) a second.  Obviously, this wasn't going to work, at least in the time I have left on the planet.

Time to try another tactic.  I saw three possibilities 1) Configure various things out of the binary version I had previously tried until I got the bare minimum and see what I could get running.  2) Download and install a version I ran across that said that they had already stripped it to almost nothing.  3) Try to get the original software from somewhere and put it back, then start off with some other tactic.

I did all three.  I went to the OpenWrt image I had running, but ran out of memory, and started cutting things out.  Problem with this was that when I cut something out that I shouldn't, the little board died and I had to start over cutting things out.  This got tiring, but I got really good at loading software on the board and backing up the OpenWrt config files such that it was only tedious to restore it, not a real pain.  However, I never did get enough out of the distribution of OpenWrt to allow wireless to run without it failing from running out of memory.

So I went to step 2 above and loaded a bare minimum system on the board.  This one held some promise, but I couldn't get past the configuration changes necessary to make the board do something useful.

Step three was now the remaining option.  I dropped a note to the manufacturer asking for the very latest version of the boards software.  I hoped they would send it then I could try loading it on the board with uboot to see if that would get me back to the starting point.  I also dropped a note to a person that had posted that he had the manufacturer's files and had used them.  I fully expected to get no response from either of them, ... but:

The other customer that had the files posted them to github so folk could pick them up there.  So, the last two versions of the board's OS are out there to be tried.  The manufacturer actually answered me and sent a lot of documentation that appears to be correct.  They said they would send me the files as well, but I haven't received them yet.

This was totally unexpected.  Two total strangers responded extremely rapidly and there are possible solutions that I can try.  Gathering up enough cables and wires to make a huge mess, I tried loading the factory files to the board with uboot.  No luck there, I got the horrible message, "Bad Magic Number," and the boot failed.  I tried to look into the magic number, thinking that I could change it and get the file to execute.  No such luck.  One (get this only one) person had fought the battle against this message and posted about his trials <link>.  Turns out that it wasn't just a magic number, it's a 60 byte header that includes compression type, CRC checksum, and a bunch of other stuff I didn't know and couldn't think of a way to find out.

I'm out of options.

It's not as bad as it sounds though.  Remember, I bought this board as a tool that I could use to monitor devices and possibly make changes with.  It was truly compelling because it's relatively small and cheaper than most solutions out there.  Wait, cheap?  I ordered another chip for the board.  Since the board is just interfaces and mounts, a new chip will give me a second chance to try and get everything I need working, and I have loads of experience with it now to keep from making some of the mistakes that got me into this mess.

Back when I started experimenting with the board I managed to make a reasonable 802.11 b/g/n gateway with it.  That was a nice bonus because it meant that I definitely could get some use out of it as a wifi device.  If I can get the serial port to send data over wireless, that would just be icing on the cake.  That's worth another 10-12 bucks investment.  If I'm lucky, the newer software, better documentation, and experience could lead to a nice versatile addition to my network.

The problem with OpenWrt is that it is too versatile.  Over the years many people have contributed to the project and it has grown to the point where one needs a quad processsor running at light speed to build it the first time.  Of course that also means a quantum link to the ethernet or access to the buss of the server.  If you can get it loaded and built, you've actually got something that you can do something with because the ability to update it is really nice.  It's that first time that will test your patience.  When I finally gave up, it was over 2G and still growing; allow for this in your plans.

Now I'm waiting for the new chip and holding on to the updated manufacturer's software.  I have notes on how to do things that shouldn't kill the board and understand a whole lot more about the device.

C'mon mail.

Playing with the HLK-RM04 Serial to Ethernet Convertor

I went on ebay and got me one of these:

This is a HLK-RM04 serial to ethernet device.  When I got it, I thought, why does it have two ethernet plugs?  Why does it have a wireless antenna plug there too?  Does it work with TTL serial like the Arduino, Raspberry Pi, and XBee do?  So, I started playing with it to see what it could do.

I found out that it is probably an incredible little device.  I couldn't get it to sign on to my wireless network using the built in web server, the darn thing would try, but it just wouldn't connect.  So, I looked around the web and noticed that it had a 'secret' web page I could play with.  A lot more messing around and I found out that the software that comes with it is incredibly buggy.  No, I'm not surprised, just disappointed.  Why do folk that come out with devices like this hate doing reasonable documentation?  Why do the leave out significant features that could sky rocket their sales to the Makers out there?  Do they need these things as something to lower their reputation?

Silly.

I managed to turn this little device into a wireless ethernet bridge that supports 802.11 b/g/n at full speed, which is a blessing to me because my old house DSL modem is much slower and starting to get a bit flaky.  Did you catch that?  I have a nice wireless interface to my network at 'n' speeds without spending a fortune.  Also, I can put one of these anywhere I have an ethernet plug and extend my wireless for a small fraction of what Linksys or Belkin would like me to pay.  It cost me less than $25 complete with wall wart and 2db antenna included. Free shipping too.

All I had to do was overcome the crappy software and disgustingly incomplete documentation.  There's even an article on how to load openwrt on the device, but I kind of want to avoid that if possible (enough eggs on the fire right now ... thank you).

First though, my device isn't exactly like the one pictured above; mine's a little different:

Notice that there's an RF shield over the components that handle the RF?  That's probably to maintain the various certifications.  It has a LAN plug as well as a WAN plug besides the two serial ports and wireless.  Talk about stuffing ten pounds in a five pound sock!  What I will eventually be able to do with this series of boards should be a lot of fun.

One of my readers suggested I use this board.  My original intent was to use the serial input to monitor my pool controller for more protocol decoding that I haven't gotten to.  He and I embarked on a project that I'll write up later, and I got really tired of wandering from the house outside with a laptop and a bunch of tools to hook up and gather some data.  The idea was that I'd put this board out there and just watch it from inside where the temperature isn't approaching 115F in the full sun.  I can't do that yet, I didn't conquer the serial input before I discovered some of it's other capabilities.

Just so you folk don't think I'm just teasing you, the 'secret' web page for the settings that the manufacturer wants to keep us from playing with is http://192.168.15.254/home.asp  See, this configurable router is complete.  It can do all the encryptions, routing, tunneling, UPNP, etc that the expensive devices can do.  Sure, it's not a gigabit device, but neither is my house wiring.  You could put this behind the DSL modem at your house and totally stop the phone company from looking around your network.  I know, that sounds paranoid, but it is the 21st century and they ARE out to get me.

So, go to the 'secret' web page on one of these devices and experiment away.  You could have a cheap working Wifi access point in about 45 minutes.  You'd have a second one in about 2 minutes; there's a little learning curve to it.  Setting it up as a bridge is really simple.  The hardest part was finding the place where I could change the SSID.  There's a couple of different places for this depending on what you configure the device to be.

Now I can replace the old DSL modem I'm using in the garage to extend my wireless as well as the flaky wireless on my connected DSL up in the attic.

I have a letter to the vendor complaining about how the serial configuration failed; maybe he can get me some better documentation or something.  Meanwhile, I may just hunt for a couple more of these little things.  The darn ethernet plugs and antenna would cost me as much as the entire assembly did.