ESPHome + KL8300 (KL8-3H-FACE3) — Sniffing UART to retrieve water temperature / spa data

ESPHome
1

Hi everyone,

I’m working on integrating the KL8300-HV83G controller with the KL8-3H-FACE3 panel (spa/pool management system) into Home Assistant using ESPHome and an ESP32.

Goal: Retrieve useful data, especially the water temperature.

What I’ve tested so far

1. Documentation research

  • No public technical documentation available (pinout, protocol, datasheet).
  • Researched across:
    • Forums (Home Assistant, Domoticz, Jeedom…)
    • GitHub (e.g., bbqkees/BalboaSpaWifi)
    • Chinese sites (1688, Alibaba – PCB photos, no docs)
    • Distributors (Poolstar, iPool…)
    • Wayback Machine

→ Conclusion: The 8-pin connector on the KL8300 is likely UART TTL 5V.

2. Hardware tests

  • Voltage measured on each pin:
    • GND and 5V lines clearly identified
    • Other pins are either 0V, floating, or fixed at ~5V
  • UART sniffing with ESP32:
    • Voltage reduction using resistor divider (2×1kΩ in series for R1, 1kΩ for R2 to GND)
    • UART RX pins tested: GPIO16, GPIO17, GPIO4
    • Baud rates tested: 9600, 19200, 38400, 57600, 115200
    • ESPHome YAML shows raw UART frames in hexadecimal
    • Built-in LED (GPIO2) toggles when data is received

Results

  • No UART data received
  • UART logs stay empty
  • LED never blinks (no bytes detected)

Hypotheses

  • Wrong TX pin on the KL8300
  • Data only sent under certain conditions (keypad activity, pump on, heating?)
  • Protocol may require master polling/init sequence
  • Possibly inspired by Balboa protocol (framing with 0x7E?)
  • Could be non-UART format (SPI? multiplexed data? something proprietary?)

Call for collaboration

If you:

  • Own a KL8300-based spa system
  • Have captured or decoded any UART or bus activity
  • Have internal photos, schematics, or frame dumps
  • Want to participate in open-source reverse engineering

Please reach out or contribute.

I can host a GitHub repository to centralize pinouts, logs, frame samples, and decoding efforts.

Hardware setup

  • ESP32 DevKit V1
  • ESPHome 2025.4.1
  • Voltage divider to protect RX input (5V → 3.3V)
  • Breadboard setup

Thanks in advance to anyone willing to test, share, or contribute. Even failed attempts are useful for the community.

2

That’s incorrect, you need to put them in parallel for R1.
R1 needs to be 500R, not 2k

4

Indeed it was a mistake on my part, thank you.

Attached are photos of the pinouts.
The ESP power is taken from connector 2.
The pin numbers in the image are the order in which I consider the pins.
The goal is to find the TX so that I can listen to the communication.

pin numbers
pin numbers590×1280 74 KB

5

Are you sure it can provide sufficient current for Esp?
Safer would be powering Esp from usb and connect only GND (and rx) to your device.

6

connectors
connectors480×640 482 KB

connectors

7

Yes the measured voltage is stable at 5V, I am sending a photo of the second connector to follow (being new to the forum I can only send one image at a time)

power
power1368×1824 441 KB

8

If your oscilloscope says so…
Esp32 can draw >300mA at peaks.

9

Unfortunately, I am not equipped with an oscilloscope.

below is the table of connector 1 measured by voltmeter:

Pin , Idle , voltage , Voltage when pressed Notes
1 , 5.09 V , 2.22 V , Sharp drop → possible TX line?
2, 5.09 V , Oscillates around 3.78 , V Fluctuations → suspected TX too
3 , 2.90 V , Rises to 5.09 V quickly , Transient behavior
4 , 5.09 V , Oscillates around 3.78 V , Identical to pin 2
5 , 0.07 V , Rises to 1.40 V , Could be a logic control line
6 , 0.03 V , 0.03 V , Inactive
7 , 0.00 V , 0.00 V , GND likely
8 , 0.00 V , 0.00 V , GND likely

10

Then you can’t write:

Because you don’t know it.

There’s written LCD on thar connector. What is it connected to?

11

So I’m going to start again by connecting directly via USB.

12

both connectors go to the control panel (KL8-3H-FACE3)

13

Hello — I would like to communicate directly with the KL8-3H-FACE3 from an ESP32.
My goal is to replace the PIC on the control board and command the power board directly while keeping the original keypad and display. Any information about the nature of the communications between the topside and the control module would be extremely helpful. thanks

1 Like