GS500Z with Balboa-VL260-PN-55081 control panel

[surfmk]

Hi all,

This is a great project! I have a Cove Spa Delux that came with my house and I'm getting into home automation.

Before I jump into this and get my soldering iron out, could anyone comment on:

1. Code compatibility with GS500Z and my 4 button VL260?
   I understand how you are using the J1 socket
   Shame nobody got the J2 to work with it but I guess you would need to
   sniff the actual wireless device it was designed to work with...
   I'm happy to do some code editing and have a hobbie background in C++

2. I have a LAN connection available I would like to use in preference to Wemos D1 mini
   (powerline LAN allows extra distance into garden - out of wireless range)
   would the usb connector on the wemos be of any value to output anything to LAN?
   as you can tell, I am not that familiar with wemos :/

I attach some photos of my actual hardware...
I'm using Home Assistant and

Many thanks in advance,

Paul

[MagnusPer]

Hi @surfmk
Nice you visit this GitHub project! I can not answer the question on compatibility for your GS500Z control system since I reversed engineered GS510SZ. Either you need to do the same approach I did to measure the link between control system and display using oscilloscope or just give it a try and hope for the best!

[surfmk]

Hi - thank you for replying. I suppose it would be unlikely they would develop a different protocol for such a similar device... I'm keen to try it. Do you know how I could use LAN instead of WiFi? I need some LAN data capture board that I could interface with in Home Assistant... any ideas?

[Jacktheripper125]

Hi, I can confirm it doesnt work sadly. It stops the pump button from working and no useful data is gained.
Looking online i can see the topsides are not compatable so i guess they must communicate in different ways. Maybe on purpose to sell more top sides :).
Im now getting out of my depth as i dont have an ocilscope but i might see if i can buy one and carry on down the rabbit hole @MagnusPer any tips/newbie ideas you can give oh wise one :) I read your docs and photos but i feel like im missing the link between the screen and the ones and zeros.

[surfmk]

Hi Jack, That's interesting you are following this up... I haven't started yet but am happy to see what protocols are being used when I do (need to borrow a scope as well!). I'd quite to find a remote panel (chances are remote!) and see if we can replicate the signals that this sends...
All good fun.
Paul

[netmindz]

You might find a logic analyser is more helpful than a scope

[Jacktheripper125]

Thank you netminds.

One thing i would say is dont try the software and card on a gs500. After usung it my hot tub went to 40c and stayed there even though i selected 34c it just kept heating to 40c after haveing the card plugged in. I tried re powering and re setting. Even tried a new temp sensor. I have now had the tub un plugged a few days and the memory wipe jumper on and touch wood today it is back to normal.
I will maybe wait until i get brave again. I will get a logic board as it looks interesting. I will find something cheaper to break first

[surfmk]

Hi Jack, just wondering if any more progress? A logic analyser seems to be the way forward as netmindz suggested. I'll try to learn a bit more about how these work as I've only ever used an oscilloscope. If we can work out the protocol, we should be able to see where it diverges from the GS510*Z.

[surfmk]

Hi Jack, just looking around at logic analysers and this video / links seems to offer an excellent low cost way to decode the GS500 output.

https://www.youtube.com/watch?v=3IA_6MwInVg
https://www.amazon.co.uk/Logic-Analyzer-Binghe-Compatible-Arduino/dp/B0D868ST5C/ref=sr_1_1
https://github.com/sigrokproject/pulseview

Amazing you can buy such a powerful piece of kit for so little!

I'll get back when I have experimented with it...

Regards,
Paul

[GevaudanBeast]

Subject : Findings on GS501Z R2B – confirmed non-RS-485 bus & partial RS-485 output (J18)

Hi everyone 👋
I’ve been working for the past weeks on a Balboa GS501Z R2B (paired with a VL403 panel), trying to integrate it into Home Assistant through an Elfin EW11A Wi-Fi → RS-485 bridge.
After many captures and hardware tests, here’s a clear summary of what we’ve confirmed on this board revision — it might help others working on GS501Z/GS510SZ units.

---

🧩 Hardware revision

• Mainboard marking: GS501Z R2B

• Firmware label on ROM: GS501Z R2B v43

• Same hardware family as GS510SZ, very likely identical bus design.

---

🔍 Observed behaviour

Port | Physical Layer | Observations | Notes -- | -- | -- | -- J1 (VL-series keypad) | ⚠️ Not RS-485 | Bus has 0-5 V signals, one line clock (~38 kHz) + one line data. Captures look SPI-like. | Matches the description in this issue: synchronous, proprietary protocol. J2 | Same story | No measurable differential signal. Probably diagnostic or TTL RX only. |   J18 | ✅ RS-485 TX only | Emits clean [64 3F 2B…] frames at ~1 Hz (same as BWA MLD protocol). But the line is transmit-only: we can read but not inject commands. | Likely the internal telemetry/debug output from the MCU.

---

⚙️ What this means

• The GS501Z R2B no longer exposes a bidirectional RS-485 bus.

• The clavier/panel bus (J1) is proprietary TTL synchronous (SPI-like), not asynchronous UART.

• The only readable RS-485 output is on J18, but it’s TX only — perfect for passive reading, useless for control.

• This explains why the BWA Wi-Fi v1 module (RS-485 based) doesn’t work, while the BWA Wi-Fi v2 (with its own MCU) does.

---

🧠 Current working state

• Using EW11A on J18, we can reliably read:

  • Water temperature

  • Setpoint temperature

  • Mode (ST/ECO/SL)

  • Heater state

• All from the 27-byte [64 3F 2B…] frames — read-only telemetry confirmed.

• Injection tests on J18 produce no effect (no RX path to MCU).

• J1/J2 carry proprietary traffic (not UART/RS-485).

---

🔧 What we still need

1. Identify on the board where the real RS-485 transceiver sits (likely U22/U34), to see if bidirectional pads are still exposed.

2. Confirm if GS501Z/GS510SZ share the exact same SPI-like “BL-bus” between MCU ↔ panel.

3. Determine whether the BWA v2 module bridges this bus to MLD over TCP 4257 (would make reverse-engineering feasible).

---

💡 Next steps / ideas

• Probe the J1 bus with a 5 V logic analyzer in SPI mode (CLK, MOSI, MISO).

• Compare captures with those from GS510SZ units.

• Try to locate any test pads labeled RS+, RS-, A, B, U22, RO/DI on the PCB — they might expose the internal RS-485 lines.

---

If anyone here has a working BWA v2 on a GS501Z R2B / GS510SZ, it would be great to sniff its lines and confirm whether it’s doing a protocol conversion internally.

Thanks to the previous work here (MagnusPer, Jonas M., etc.), we now have solid confirmation that:

GS501Z R2B ≠ RS-485 Balboa MLD — it’s a synchronous 5 V bus.
Only J18 still mirrors MLD frames (TX-only).

Happy to share scope traces or the EW11A setup if it helps the investigation.

[kgstorm]

@surfmk Were using the same topside controller, so my project should work for you to.

Have a look if interested:

https://github.com/kgstorm/Balboa-GS100-with-VL260-topside

[ETE-Design]

@surfmk Have you got the J2 working? Have the exact mainboard and would like to have ESPHome to work with it :-)

[ETE-Design]

@kgstorm Would this work with VL401 also? Got the GS500Z board

[ETE-Design]

@kgstorm Think you did not notice that mine topside is a VL401? Or do you say that it should be equal with the VL260?
My mainboard is the GS500Z

Another thing: I have SeedStudio ESP32-C6 Any chance that you can merge it to my board? I’m really not any kind of programmer that’s why I ask :-)

[kgstorm]

@kgstorm Think you did not notice that mine topside is a VL401? Or do you say that it should be equal with the VL260?
My mainboard is the GS500Z

Yeah sorry. I scrolled up to the top of the post and just saw the images and thought it was a VL260 without fully absorbing the entire conversation.

I just googled the VL401 and sure looks likely that it would at least use extremely similar logic.
I would be very scared to just make it and plug it in, though, as if they swap the power and ground or use a different voltage that would be quite bad.

I would recommend doing a little bit of research first with a logic analyzer or at a minimum just split off each of the wires and check all the voltages between each wire and see if it looks like a match with my project.

If you split off each of the wires, check

• if measure 5V between the ground and VCC wires
• if all four of the button wires measured against ground reads about 2 1/2 V
• if the data and clock wire are reading just slightly positive
  If all that matches then you can be pretty confident that each wire is set up the same as the VL260 and my project as written would have a solid chance of working out of the box

[kgstorm]

@ETE-Design come to think of it looking at this thread again someone earlier on in this thread says they have a GS 500Z with the VL 260. If that's true and you're using the exact same board, it sounds like the board accepts the VL260 or the VL 401. So then it makes me think that maybe they are actually the exact same top side controllers with respect to functionality at least.
If that's true, then my project should work perfectly for the VL 401 as well. If you get it working or find anything out, please let me know.