AO Smith Water Heater Monitor Lowes IRIS

by jrsprouls1

1.6K314

Intro: AO Smith Water Heater Monitor Lowes IRIS

Shortly after buying a new water heater that is capable of being "Smart" or remotely controlled. Lowes discontinued their IRIS platform, making all the IRIS products useless. Although they did release source code for their hub but my water heater smart add on connected to the IRIS servers directly though WIFI meaning I had no way to remotely control or monitor the water heater.

This project uses a energy smart water heater controller modified with an Wemos Mini development board running Arduino code and sending data over MQTT to homeassistant. The energy smart water heater controller connects and communicates with your water heater so no modification is needed to the actual water heater only the smart controller is modified. The smart controller is easily removed and installed to the water heater in a minute or less. This tutorial only reads data and does not send data to the water heater preventing any malfunction of the water heater.

My main purpose was to monitor the estimated hot water volume. I know it is possible to control the water heater, change setpoints and modes of operation but this has not be pursued at this point.

**disclaimer** as always with projects you read online I am not responsible for any damage you might cause to your property or to yourself. Read and follow these directions at your own risk. I have not measured any high voltages on the circuit board or the water heater connector I used. Although it is possible your water heater is different then mine or I just missed something and was lucky that I didn't kill myself.... Use common sense and treat every wire as its high voltage or confirm with a voltmeter that its safe.

*** This is my first instructable post so I hope it doesn't completely suck ***

STEP 1: Soldering

  1. Remove the circuit board from the smart energy controller by removing the screw and releasing the 4 locking tabs
  2. Connect wires to the circuit board. Only 3 wires need to be attached TX, 5V and Ground. For these connections, I attached header pins but you can always just solder wires directly to the board. The TX pin has a though hole connecter near the WIFI module that I used to solder the header to, for 5v and Ground I used the main board connector and soldered header pins floating on the back side.
  3. Solder header pins on your Wemos board if not already installed

STEP 2: Code

You will need to have setup esp8266 board in your Arduino IDE and installed EspMQTTClient library before compiling and uploading your code. If you have not setup the esp8266 in Arduino or the EspMQTTClient library there are plenty of forums out there.

You will also need to download and install a modified version of software serial, I call SoftwareSerial512, this is included in the link below along with the project code. To install the library extract the zip file into your Arduino library folder. This library is needed since the normal version of SoftwareSerial has a buffer size of 64 characters and the water heater will send over a hundred characters at a time. This library should be good for 512 characters but at a cost of additional memory usage. So use your normal SoftwareSerial library on other projects unless you need to read a long string over serial.

https://drive.google.com/drive/folders/10Oa0dhez-m...

Modify the sketch with your WIFI and MQTT setting, and if you want/need modify the MQTT topics.

The code is relatively simple, since the water heater already sends all the data needed, periodically to the WIFI module on the circuit board. The data is sent over serial communication at 115200bps baud rate. All we are doing is reading this data and parsing it out into variables. We then publish those variables to the MQTT client. There is more data then what I am parsing but most of it was useless, feel free to read the data string and add any thing you think is relevant.

Upload the code!

STEP 3: Testing

Before installing the Smart controller board back into the case you will want to make sure your 5V and GND connections are correct. Carefully install the board onto the water heater and measure the voltage on the two header pins you installed on the Left hand side of the board. You want to ensure you are getting 5v and also make sure the polarity is correct(if you see -5v you need to switch +5 and GND). Your connections should look like mine, the Red wire is obviously +5v and the black wire next to it is GND, the other black wire on the Right is TX.

Next you want to test your serial connection to the water heater, Connect the TX pin on the smart controller to the Software serial RX pin GPIO14 or D5 (not the pin labeled RX) on the wemos board. Connect the 5V and GND wires to the Wemos board as well, connect your PC and open the serial monitor. You should see data coming in after a few minutes with "DeviceText" in it. The water heater only sends these strings every few minutes so just go grab a beer and comeback. If you don't see any data in your serial monitor after 5-10 minutes check all your connections. If all is well you can install the board back into the case.

You will then want to setup you MQTT topics in your MQTT Client, for my setup I am monitoring the water heater from my home assistant. If you don't have any MQTT Clients or a MQTT server you will have to set those up... again many forums out there!

7 Comments

jos33 2 years ago

Hey, this is a great article and thanks for sharing it. I wanted to share with yall some other findings I'm been digging into. I have a rebranded AO smith heatpump water pump that is sold by Kenmore Elite. Its the same machine though. The rebranded Kenmore IOT module still works with the Kenmore Smart app, but not very well. I wanted to add that the J2 connector has a direct connection to the wifi modules Tx and Rx pins so you can interface them from there a bit easier. It also has a 3.3 v and ground pin. Also the waterheater uses RS-485 to communicate using the A-B data wires. You can read the binary stream with any RS-485 to usb converter. I am still working on translating the stream. The baud is 19200 ,8N1 and the termination string is 820082. This will save you huge amounts of time. There are multiple binary strings sent. The protocol is AO smiths own proprietary network called AOSmith AINP. The payload that is sent every second or so is 208 bytes. The SetPoint and tank temperatures are about 140 bytes into the stream. and look like this, in the bigended format which means the leading two zeros go after the 52 to make a 16 bit number(word): 0052004A004C004A
translates to Setpoint: 0x5200 Temp1:0x4A00, Temp2:0x4C00 Total Temp: 0x4A00.
so for example: 0x5200 is 20992 in 10 base(decimal), then divide by 512 and get 41 degrees Celcius.
Thats 100F degree set point on my heater. The other measurements are tank temperatures and are done the same way.



jrsprouls1 2 years ago

Glad this past had been useful or interesting to some. I haven't had time to mess around with anything else, I know l now have a 1 year old, so my time is limited....

martin38347 2 years ago

Thanks for posting these instructions.
I wonder if you have any data on what the typical serial i/o looks like from the Iris unit?
I'm modifying your code a bit and I will share it via github when done.

kiwimonk 2 years ago

Here's a list of the data that is sent out from the iris. Reformatted from the original single line output with & separating each key/value pair. I found it only works if it can talk to the remote energysmartwaterheater.com domain with a proper yet expired cert.

DeviceText=XXXXXXXXXXXX
Password=XXXXXXXXXX
ModuleApi=1.5
ModFwVer=3.1
MasterFwVer=02.06
MasterModelId=B2.00
DisplayFwVer=00.00
WifiFwVer=C2.4.0.3.AO7
UpdateRate=300
Mode=Efficiency
SetPoint=122
Units=F
LeakDetect=NotDetected
MaxSetPoint=122
Grid=Disabled
AvailableModes=Efficiency,Hybrid,Electric,Vacation
SystemInHeating=False
HotWaterVol=High
Leak=None
DryFire=None
ElementFail=None
TankSensorFail=None
EcoError=False
MasterDispFail=None
CompSensorFail=None
SysSensorFail=None
SystemFail=None
CondensePumpFail=False
AirFilterStatus=OK
UpperTemp=120
LowerTemp=118
FaultCodes=0
UnConnectNumber=0
AddrData=05FD|00E6
SignalStrength=-58

martin38347 2 years ago

Interesting, thanks.
So I purchased an Iris box and I've been trying to spy on the RS232 data. It is trying to contact a main server but fails, unsurprisingly. It would be great if there was a way to fool it into giving up data without a remote connection. There's a CANbus type interface I think, unfortunately that's probably too difficult to reverse engineer. Let me know if you have any other thoughts. Thanks

kiwimonk 2 years ago

IRIS attempts to contact two urls. I've tried to spoof replies and certs but didn't get anywhere. I think one way to do it would be to cut traces to rx, tx and have an arduino in the middle getting info from the Microcontroller and sending alternate info out to the WiFi Module.. as well as altered info back to the Microcontroller. The WiFi module actually supports MQTT natively I believe (might depend on firmware version), so you could basically just have one device on your network instead of two.

The true end goal with the IRIS is to watch the RS485 side to reverse engineer things and completely do away with the IRIS board. I fried my serial adapters trying. The water heater should support CTA2045 which would allow for control of the actual heating times I did at one point get my model number and serial straight from the water heater along with Garbage Characters, but I got nowhere playing with the CTA2045 simulator, Modbus, or any other method to extract more data straight from the unit. I'll let you know if I get anywhere.. Waiting on parts in the mail.

Chips involved:
NXP MC9S08QE32 (Main Microcontroller)
TI SNx5176B (RS485 Chip)
Inventek eS-WiFi Module

D0=devices.irissmarthome.com
CS
P1=3
P3=50.57.193.83
P4=443
P9=2
PB=0
CR
P6=1
D0=energysmartwaterheater.com
JP1=3
P3=198.20.234.69
P4=443
P9=0
PB=0
CR
P6=1
S1=780
S0
POST /~branecky/postAll.php HTTP/1.1
Host: energysmartwaterheater.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 634