Background Information¶

Swimming Pool Wireless Sensors¶

Over the past decade, there has been an increasing diversity of connected swimming pool sensors on the market. These typically take the form of floating devices with a battery, some sensors and a radio communication interface.

Here are a few examples of connected pool sensors (all images are obtained directly from Google Images):

The point of these sensors is to monitor some key parameters of swimming pool water autonomously, sparing the pool owners the tedious test-strip based testing, both time-consuming and subject to interpretation errors. Typical monitored parameters are the pH, the Oxidation-Reduction Potential (ORP), and Temperature.

All of these solutions are very similar, but also differ in some aspects.

Connectivity: Some sensors are connected directly to the cloud using Low-Power Wide-Area Networks (LPWANs) like Sigfox. Others use short-range radio protocols only, like Bluetooth Low Energy or proprietary protocols in the 2.4GHz or 868/915MHz ISM bands, and offer optional connectivity to the cloud using a dedicated bridge (gateway).
Recommendations: While obtaining exact parameters of the water is the main purpose of the connected pool sensor, some manufacturers go one step further and provide recommendations on how to treat the pool water, based on the measurement history. This simplifies the water treatment for users that don’t have the background knowledge required to apply the correct treatment.
Chemicals: Companies who provide recommendations sometimes also sell their own pool chemicals.

About pHin¶

pHin has been one of the first wireless connected pool sensors on the market, and they provided both recommendations and chemical products along with the connected sensor. In December 2021, Hayward, the parent company of pHin, announced that the pHin serviced would be discontinued on December 20th 2021.

On the official website, phin.co, one can read the following:

Will I still be able to use my pHin?: “No, the service will no longer be available once it is shut down on December 20, 2021. Your pHin monitor will no longer be actively measuring your pool chemistry. The pHin app will no longer be active but will have information on the end of monitoring services.”
What about my subscription?: “If you are due a refund, we are offering pro-rated refunds for the remaining portion of your current subscription. Simply click on the link below to request your refund before March 31, 2022. https://www.phinrefund.com”
What should I do with my pHin?: “We recommend recycling your floating pHin monitor. Best Buy stores accept most electronic devices or you can search for a local drop off location at Recycle Nation. https://recyclenation.com/find/”

This is obviously very bad news for the pHin customers, as they are left stranded with a useless device and no alternative solution. A few days after the annoucenement, the founders of the original company behind pHin announced on https://www.generalgalactic.io/phinished that they were trying to help the community by releasing a viewer application that displays the current measurement of nearby pHin pool monitors. The landing page promises users to:

“Use the pHinished app on iOS or Android to view the pH, ORP, and Temperature from your pHin Smart Monitor and continue to care for your pool or hot tub.”

In the introductory text, the creators of pHin describe their motivations:

“Now that the pHin service is shut down, we’re not happy that so many pHin monitors will end up in the landfill before their time. We’ve created the pHinished app so you can still get some value out of your pHin Smart Monitor by being able to view the raw measurements, at least until the monitor battery eventually dies.”

For these same reasons, I had already decided to reverse-engineer the pHin prior to this announcement. I found a Facebook group called “pHin Customer Alumni” which is:

“A place for former pHin users to discuss how they are caring for their pools and hot tubs after pHin. Members can help each other with chemistry questions and other pool care topics.”

I posted my intention of attempting a reverse, documenting a very simple architecture based on sniffing BLE Advertisements.

Note

At that time I had to assume the device announced data in its BLE Advertisements and that the payload would be non-encrypted. This turned out to be true. Otherwise, the reverse would have been much more difficult.

I proposed to attempt a reverse and, if successful, to release:

My documentation (you’re reading it now)
A viewer application for iOS/Android. This would have been redundant with the phinished App which was later announced and released, so I didn’t pursue this track.
An ESP32 based firmware to implement a BLE/WiFi bridge, allowing to post data to a server

About this document¶

This is a write-up of the steps I took to reverse-engineer the pHin. The information presented here attempts to be as educational as possible and provides thus more than what is strictly required to understand the reverse. The writing was done as I progressed: the sections are presented mostly in a chronological order, reflecting the steps and detours I took.

Here is a summary of the steps.

Unboxing: I stared by acquiring two pHin units from a former user, and I describe the state in which the probes were while Unboxing.
Teardown: I proceded to opening the pHin in the Teardown, and made a quick inspection of the different parts of the PCB.
A naïve attempt at decoding the pHin BLE GAP Interface: I naïvely thought that I’d be able to cut corners and reverse the protocol by dipping the pHin in a few reference buffer solutions and staring at bytes scrolling up my screen like that so cliché forensic IT guy in practically all the police/detective TV shows that have ever been made since computers exist. Although I did progress on the decoding the A naïve attempt at decoding the pHin BLE GAP Interface section, I had yet to scratch the surface of the pool-related measurements.
A closer look at the Sensor Front-End: In A closer look at the Sensor Front-End, I go back to the PCB and have a closer look at what is actually going on the in frontend while a measurement is performed. This allows us to understand how one can emulate the probe and stimulate the pHin with controlled sensor values.
A controlled decoding of the pHin BLE GAP Interface: A controlled decoding of the pHin BLE GAP Interface is a second attempt at decoding the BLE Advertisements using a controlled emulation of the sensor values. This brings us much closer to a complete decoding of the BLE Advertisements.
The near-complete, decoded pHin BLE Interface: A complete description of the BLE Interface is summarized in The near-complete, decoded pHin BLE Interface.
Appendix: Tools: The Appendix: Tools describes some of the tools used during the reverse-engineering.

Disclaimer¶

All knowledge and methods used to produce the reverse engineering presented here are either publicly available on the internet, or are the private property of Dawans Egineering, SPRL. I obtained no prior information on what pHin is or how it works before I started this analysis, including anyone from Hayward, Connected Yard, General Galactic or from the pHin users community. I also did not use any private IP, software or tools developed by third parties to help me in this analysis beyond their intended purpose.