can you add the layout of the pins as well ? My spa is still in installation phase (hasn’t even been unpacked yet) but I can start designing the pcb already.
I was thinking to make it possible to connect it in read mode and man-in-the-middle mode. We just need to know the number of pins that carry data of interest and if they would be RO or RW
JST-XH 6P
1 2 3 4 5 6
GND VCC RO1 RO2 RO3 RO4
but add more TXS0108E depending on the number of ports that would need RW and RO and offcourse replace the esp8266 with an esp32. That way we have more IO ports, so we could read the ports and eventually also write data back to the bus in passtrough mode if the device is inserted in between.
KEY = JST-XH 8P (pin 1)
1=VCC, 2=VSS, 3=K0, 4=K1, 5=K2, 6=P6, 7=P7, 8=P8.
VCC/VSS: Do not power the module from this connector. Any current draw on these pins will freeze the keypad/panel. Use only for high-impedance measurement (sniffing), without a load.
P7/P8: Unconfirmed, retained as an option for sniffing.
LCD = JST-XH 6P (pin 2)
1=F-OP, 2=VDD, 3=VSS, 4=DIO, 5=WR, 6=CS.
F-OP not used. Sniff reading only: DIO + WR (and CS recommended for framing). No writing to this bus.
Modes:
Read: LCD (DIO/WR/CS), KEY (K0/K1/K2/P6 + P7/P8 option).
Injection: K0 and K1 only via 74HC4066 (temporary grounding, passthrough maintained).
Levels:
SPA bus = 5V, ESP32 = 3.3V.
DIO/WR/CS and P7/P8 via dividers to 3.3V.
K0/K1/K2/P6 via 74HC125 at 3.3V + 1k series resistors.
TXS0108E not selected: unnecessary for reading (dividers + buffers are more stable), and not suitable for injection (the bus is not driven, it is temporarily forced to 0 via the 4066).
Appendix: V2 vs V1 corrections (4066 pinout validation + GPIO12 pull-down). Please route strictly according to these pins; this is the point that already caused an error in V1.
I was referring to input impedance (not “altitude voltage”).
On the VCC/VSS of the KEY connector: target = 0 mA (I don’t even connect the +5V KEY to the module anymore, otherwise the keyboard freezes).
On the signal lines: only high-impedance inputs (order of magnitude ≥ 1 MΩ, ideally 10 MΩ, leakage currents in µA).
With CMOS buffers (74HC125 powered by 3.3V) + dividers, it remains transparent and the panel no longer freezes.
There was some confusion: we’re using 1× 4066 + 2× 74HC125.
Power supply levels:
The 74HC125s are powered by 5V (5V on the SPA side).
The Y outputs of the 74HC125s to the ESP32 must be stepped down to 3.3V using a 10k/20k voltage divider (Y = 10k = node = GPIO; node = 20k = GND).
A inputs of the 74HC125s: direct from the SPA lines (no divider).
Injection (keypress):
Ideal: 74HCT4066 at 5V (TTL threshold OK with 3.3V GPIO).
I only have an HCF4066BE (CMOS), so I’m going to add a translation to the E inputs:
NPN + 10k pull-up resistor to 5V: collector to E, emitter to GND, base via 10k from GPIO.
For your information, I’m developing my own single-sided circuit in parallel, while you’re working on a double-sided version.
I’m using an HCF4066BE (VCC=5V). Since its thresholds aren’t TTL, I added a switch to the E inputs: 2× 2N2222 (NPN) + 10k pull-up resistor to 5V (controlled from GPIO18/GPIO19). Inverted logic (GPIO=0 → switch ON).
I removed the AMS1117: the ESP32 DevKit is powered by 5V from VIN (3.3V regulator already integrated).
The 74HC125s are powered by 5V. The outputs to the ESP32 are stepped down via 10k/20k dividers to obtain ~3.3V on the GPIO pins.
My single-sided PCB has several shunts (routing constraints). Your double-sided version will be much cleaner (ground planes, fewer jumpers).
Latest modification: adding pins to the LCD and KEY to allow insertion of a logic analyzer, and adding 330-ohm resistors to G21, G4, and G5.
Also added: removable jumpers to G19 and G18 for testing without injection (sniff mode).
edit : I just corrected an error: the 74HC125 was powered by 5V, so I switched to 3.3V from the ESP32.
