Thanks to a broken heat pump, I’m now the “proud” owner of a new AO Smith HPTS-50. I’m aware of the existing, cloud based integration, but my unit also has Bluetooth. And I’d much rather keep things local. It doesn’t hurt that my unit refuses WiFi anyway
I’ve been capturing BLE traffic from the Android app and have made solid progress reverse engineering the protocol - it’s unencrypted, and I have mode/temperature control working at the protocol level. At least, I believe so, based on the captures; the data was pretty clear. The main obstacle right now is connection sequencing: the device is very picky about the order of operations, and it terminates immediately if anything is out of place. Bleak is a non-starter because of how it handles service discovery, I believe. The device booted it immediately.
I’d love to have this as an ESPHome external component, but I could use some help - either from someone who has looked at AO Smith BLE before, or someone with deep ESP-IDF / Bluetooth experience who wants to collaborate.
Anyone done any work in this space, or interested in contributing?
Hey, I’m working on a similar project with my AO-Smith HPS10. additionally complicating the picture is I cant actually get my app to connect the water heater via bluetooth either. I pulled a HCI snoop log that I can pass along, but id love to know how you pulled temperature readings. I’ve spent a couple hours working with Claude today to try and work through some of the issues I have ran into.
Any progress here? I've spent some time with claude probing the cloud api to see if it can be emulated locally but no luck, bluetooth would be a great alternative for local control @stumpylog
It’s taken a much longer time than I would have liked (somewhat due to the fact life is busy), but I have made progress. It’s actually better than I had thought at first, I have been able to connect using Bleak, which means this could be possible through HA directly, without needing a custom ESPHome component.
The key was the handshake. I didn’t think one existed, so I spent a lot of time trying to determine why the device always disconnected me, assuming it was some sort of BLE problem. I even bought a sniffer for this project. But there is a handshake, just a simple one fortunately.
I’m hoping to publish a library and HACS integration at some point soon. I’d love help testing that out and helping expand the models and firmwares we can get some data out of. I’m trying to take a really conservative, safe approach here, given a HWH is expensive to replace and I frankly don’t trust the AO Smith programmers to properly sanitize and handle bad inputs without bricking the unit. Obviously a bad, bad thing.
I’ll post more soon I hope!
@funnyman06 - If you’d like to collaborate or provide that sniff log and more information, I’m on matrix as “@stumpylog:matrix.org”. If you do want to share the log, it does include an identifier, though I think I would need to be next to the unit to even use it.
Great news! If there’s anyway I can help please let me know, I have an HPS10-80H45DV, all my attempts to connect over Bluetooth/spoof the cloud connection have failed so I put it on the back burner.
$100 in Codex credits later and I have a working version for testing, this is 100% vibe coded and in testing but all functions appear to work perfectly fine in my testing. The only thing that I couldn’t get working was completely offline utility tariff setting because the water heater only gets the local time when connected to the internet, there’s no way to push the time via Bluetooth so if you want that functionality you have to set it in the official app.
If you want to give it a try you can add my repository in HACs and install it, once you hold the Bluetooth button on the water heater to put it in pairing mode it should be found/allow you to pair with it.
Testing on my HPS10, although should work on other units as all functions are based on the decompiled code straight from the iCOMM APK.