JoyOnWay Spa Control

christopheknap · May 4, 2026, 4:54pm

Hi,

I also have a Joyonway P23B32 (spa Miami) with resistive heater only (no heat pump).
I am currently setting up a USR-W610 bridge on the RS485 bus to use your HACS integration.

@Neuro — very interested in your work on the P23B32 at 9600 baud.
Did you get consistent results? Would love to compare notes.

@Gaet78 — I will send you a 30-second raw frame capture once the W610
is wired and connected. Should I start testing at 9600 or 115200 baud
for a P23B32 with resistive heater?

Thanks for the great work on this integration.
Christophe (France)

c0mpleX · May 6, 2026, 5:52am

I also recorded some frames on my P25B37 controller via an ESP32 + MAX485.
My settings are:
baud_rate: 9600
data_bits: 8
parity: NONE
stop_bits: 1

RS485 frame 17 bytes: 67 8F 06 03 22 2F 01 02 24 26 02 02 82 67 51 42 FB
RS485 frame 9 bytes:  64 0D 02 22 F7 35 09 BF FE
RS485 frame 5 bytes:  65 0D 02 4E FF
RS485 frame 5 bytes:  64 0D 02 0A F6
RS485 frame 5 bytes:  65 0D 02 66 FE
RS485 frame 5 bytes:  66 0D 02 8E F7
RS485 frame 5 bytes:  66 20 02 CB FE
RS485 frame 5 bytes:  67 20 02 83 FF
RS485 frame 5 bytes:  66 20 02 C1 FE
RS485 frame 5 bytes:  67 20 02 83 FE
RS485 frame 5 bytes:  66 20 02 03 FE
RS485 frame 5 bytes:  64 20 02 27 FE
RS485 frame 17 bytes: 67 8F 06 03 22 2F 01 02 24 26 02 02 82 67 41 22 E5
RS485 frame 9 bytes:  64 0D 02 22 F7 35 09 BF FE

christopheknap · May 8, 2026, 2:36pm

Hi @Neuro,

I also have a Joyonway P23B32 (spa Miami, resistive heater, no heat pump).
I am currently setting up a USR-W610 bridge on the RS485 bus.

Have you made any progress since March 31st?
Did you manage to decode more frames at 9600 baud?

I will be able to share my own P23B32 frame captures soon.
Would be great to compare and work together on this.

Christophe (France)

KDy · May 8, 2026, 3:31pm

Hey everyone,
I found the following information on websites selling genuine Joyonway Wi-Fi modules:

"Compatible Joyonway spa control boxes (but only if a PB553, PB554 or PB555 colour screen touchpad is fitted):
P20B29
P23B32
P25B37
P25B85"

This may mean that these control boxes use a different transmission protocol.

I spent the whole evening yesterday capturing data at a baudrate 9600, at various temperatures, with the light on, the filter pump running, the heater on, the jets active, and so on.
My data is very similar to that presented by c0mpleX.

I’ve been analysing this data for a long time and I’m 99% certain that the 9600 baudrate is incorrect.
At this speed, the data obtained from the capture makes no sense at all.
Unless the programmer came up with something very strange when defining the low and high states of the bits.

There's no point in messing about like this. We could do with someone with an oscilloscope to determine the actual transmission speed.

c0mpleX · May 8, 2026, 5:53pm

That could very well be the case.
I also tried to analyze some of the frames especially light modes but did not make much progress.
I thought that i mapped the frames correctly to the modes but one day later they seemingly changed.

christopheknap · May 8, 2026, 7:07pm

@KDy @c0mpleX @Neuro

I have a P23B32 with a PB555 color touchpad —
confirmed WF01 compatible configuration.

USR-W610 is ready to connect on the RS485 bus.
I can test all baudrates systematically and share
raw captures for each speed:
9600 / 19200 / 38400 / 57600 / 115200

Will share results as soon as W610 is physically
connected (within the next few days).

Christophe (France)

KDy · May 8, 2026, 7:18pm

OK
I don’t have an oscilloscope, but I’ve bought the cheapest digital signal analyser I could find. Unfortunately, it’s so cheap that the transmission freezes after a few moments. Fortunately, it’s possible to save those first few dozen bytes.

From the graphs, you can see that the duration of a single bit is 26us, so the baud rate is 38400; after setting 8N1, it reads the frames correctly.

Sorry, I'm new here and I can only post one image

Each frame starts with 0x1A and ends with 0x1D
The master (0x01) transmits a frame to individual addresses approximately every 50 ms. In my case, I have only one slave – the panel (0x20) – and it seems to be responding, but I don’t know what it’s saying. There are 12 frames transmitted.
In addition, the master transmits something to the broadcast address 0xFF, and there is some interesting data there.
I can’t see the number of bytes transmitted in the frame anywhere.

At a glance, I can read the temperature, the target temperature and the lighting status. The statuses of the pumps, heaters and ozone are also visible, but these are a bit more complicated and depend on the spa’s configuration.

The rest of the tests tomorrow

KDy · May 8, 2026, 7:23pm

Here's another picture from which I read the speed

KDy · May 9, 2026, 7:44am

As I mentioned yesterday, the master sends 12 frames. Ten of them look similar to the one in the image.

The second byte is the recipient’s address, the third byte is the sender’s address – in this case, the master’s. The frames are sent to the addresses 0x21, 0x22, 0x23, 0x30, 0x10, 0x11, 0x12, 0x13, 0x50, 0x40. There is no response to the frames.

christopheknap · May 9, 2026, 10:49am

Hello, @KDy What is your Joyonway controller model?
P20B29, P23B32, P25B37 or P25B85?

KDy · May 9, 2026, 11:22am

I'll tell you all about my spa bath in a moment
The eleventh frame is sent to address 0x20; from the documentation for another protocol, I gather that this is the panel’s address. The frame looks like this.

There is a response to the frame. The problem is that both the request and the response are always identical. However, I am currently testing this statically, which means I am not capturing packets whilst making changes to the panel. I will test that another time.

KDy · May 9, 2026, 11:30am

The most interesting part is the twelfth frame. It is sent to the broadcast address. The image shows a section of it.

Byte 10 contains the temperature in Fahrenheit. Byte 17 contains the target temperature in Fahrenheit. The conversion to degrees Celsius is likely carried out in the control panel, as the frame does not contain this information. Bytes 54–60 likely contain the date and time, but this requires further testing. I am not describing the remaining bytes that I am aware of, so as not to cause confusion.

KDy · May 9, 2026, 12:04pm

I have a small three-person spa bath. The bath is fitted with a P25B85 controller and a PB554 control panel.
The spa has one two-speed pump. The first speed is for filtration, the second for massage. In addition, the tub has one LED light and a UV lamp which is connected to the controller instead of an ozone generator. The controller is entirely European; it can be connected to a single-phase 230V supply. 2kW heater. The heater can operate at the same time as the hydromassage, but my circuit breaker is too small, so I have it set to either heating or hydromassage.
The broadcast frame looks like this; sometimes it’s a bit shorter, sometimes a bit longer.
1A FF 01 3C D2 B4 FF 08 03 5E 04 06 04 F5 40 00 68 01 00 12 21 12 3B 14 00 16 00 04 00 43 00 04 3B 12 00 14 00 00 00 06 4D 00 00 00 00 00 00 00 00 00 00 00 00 10 05 08 13 1B 11 12 00 00 4E 28 33 11 1D
When the light is switched on without the pumps running, byte 18 changes to 0x01
When filtration is switched on, bytes 13 and 28 change to 0x02
When the massage is switched on, bytes 13 and 28 change to 0x04
UV/ozone lamp: byte 15 – 0xC1, byte 18 – 0x80, byte 29 – 0x20
UV/ozone lamp + LED: byte 15 – 0xC1, byte 18 – 0x81, byte 29 – 0x20

Heating
There are three heating stages:
The first lasts several tens of seconds and only the circulation pump is switched on; byte 15 takes the value 0x50, byte 18 – 0x80, byte 29 – 0x20,
In the second stage, the heater switches on; byte 15 changes to 0x54, byte 18 to 0x80, and byte 29 to 0x20
Third – heater cooling, byte 15 – 0x40, byte 18 – 0x80, byte 29 – 0x20

That’s all I know for now