Madimack InverFLOW Plus F300i — Smart Pool Pump Local Control Attempts

> A detailed log of attempts to make a Madimack (Fairland OEM) inverter pool pump locally controllable, written for the Home Assistant community.

TL;DR

The Madimack InverFLOW Plus F300i (Fairland OEM, SKU 20101) uses Fairland IOT cloud — not Tuya. The WiFi module is an Espressif ESP32 with zero open TCP/UDP ports. Cloud commands are lowest priority in the pump's control chain. The "RS485 Perfect Pairing" cable is a dry-contact DI3 trigger, not Modbus. No existing local control solution exists for Fairland cloud pump motor controllers.

Bottom line: The pump is effectively un-local-controllable with current knowledge. Treat the Fairland integration as read-only for monitoring.

---

Equipment

Component	Model	Integration
Pump	Madimack InverFLOW Plus F300i (1 HP, SKU 20101)	Fairland IOT (siedi/ha-fairland)
Heat pump	Madimack Elite V4-230 (23 kW)	tuya_local
Salt chlorinator	Evochlor A25TS (25g/hr)	Zigbee smart plug
"RS485 Perfect Pairing" cable	MADMAC00520 clone	Dry-contact DI3 trigger (not Modbus)

Important: There are two InverFLOW variants:

• InverFLOW Plus (this pump) — Fairland cloud only. No Tuya. ~$1,500 AUD
• InverFLOW Pro — Uses Tuya. Factory reset can switch to Tuya IoT app. ~$2,227 AUD

The Pro is $727 more and the Plus has better efficiency (6-star vs 5-star). If you want local control, buy the Pro.

---

Network Discovery

Pump WiFi Module

• IP: 192.168.86.27
• Hostname: espressif.lan
• MAC: 8c:bf:ea:44:b1:ec
• Manufacturer: Espressif Inc. (ESP32)

Full Port Scan (nmap)

TCP 1-65535: ALL FILTERED
UDP top 200: ALL FILTERED
No HTTP response on any port

The module is a pure outbound cloud client. It initiates HTTPS connections to api-eu.fairlandiot.com (AWS Europe) and never listens for inbound connections. No local API of any kind was discovered. The ESP32 likely validates TLS certificates, ruling out simple MITM with a self-signed cert.

Heat Pump WiFi Module

• IP: 192.168.86.30
• Integration: tuya_local
• Config: host: 192.168.86.30, local_key: .p1$9FRQsv7Pa<1b, protocol_version: 3.5
• Note: Goes offline when the heat pump is powered off (no battery/supercap)

---

Cloud Protocol: Fairland IOT

Integration

ha-fairland by siedi — a custom component that talks to the Fairland REST API.

API Details

• Base URL: https://api-eu.fairlandiot.com (AWS Europe)
• Auth: loginByPassword endpoint with email/password
• Device discovery: deviceAllGroupInfo
• State polling: deviceDataPointInfo
• Control: set endpoint

Fairland Data Points (from HA config dump)

DP	Field	Values
5	Power (W)	Instantaneous wattage
102	Running rate (%)	Current actual speed
103	Mode	0 = manual inverter, 1 = backwash
104	Backwash duration (min)	Setup value
105	Power switch	On/off
108	Backwash countdown (min)	Remaining time
109	Energy consumption (kWh)	Scale factor: 2 (divide by 100)
111	Speed setpoint (%)	Range 30-100, step 5

Device Credentials (from config dump)

• Device ID: 2060582836410437634
• MAC: 8c:bf:ea:44:b1:ec
• Product code: cj0p0sf6ax7sseec (category: waterPump)
• Serial: 311100182512R60036
• Account: email/password registered with Fairland cloud

---

Control Priority Chain

From the pump manual:

> DI3 (Digital Input) > RS485 Modbus > Panel > Cloud/App

We confirmed this empirically:

1. DI3 (80%): When the heat pump runs, the dry-contact closes and forces the pump to 80%. This overrides everything.
2. Panel (60%): Our pump panel is set to 60%. This is the default speed when DI3 is inactive.
3. Cloud/App (lowest): Sending number.pool_pump_speed_setpoint to 65% via HA was accepted by the API, but the pump immediately reported back 80% (DI3 active). When DI3 was inactive, the cloud command at 80% was overridden by the panel's 60%.

Conclusion: The Fairland cloud integration can read status, but cannot reliably control the pump if the panel has a different setting.

---

The "RS485 Perfect Pairing" Cable Revealed

The Madimack "RS485 Perfect Pairing" cable (also sold as "Quick Connect Comms Cable," SKU MADMAC00520, ~$120 AUD) is not a Modbus data cable.

What We Found

• Heat pump side: Connects to the BAG+12V port (external 2-pin weatherproof connector), which uses the RS485 D+/D- pins internally
• Pump side: Connects to the pump's DI3 input pin, not the pump's RS485/Modbus header (pins 6/7/5)
• Internally: Contains a relay or optocoupler — when the heat pump is active, the contact closes
• Behaviour: Heat pump runs → DI3 closes → pump forces preset DI3 speed (default 80%) → heat pump stops → DI3 opens → pump reverts to panel speed

DI3 Configuration

• Default DI3 speed is 80%
• User attempted to change to 35% via pump panel but setting did not persist
• Panel save procedure may require a hold-to-save or power-cycle — undocumented

What This Means

• The cable is a hardware interlock, not a data link
• It ensures minimum flow during heating — independent of HA, WiFi, or cloud
• It does not provide bidirectional communication, speed negotiation, or graceful ramping
• The heat pump's RS485 port (BAG+12V) is functional, but the cable doesn't use it for Modbus

---

RS485 / Modbus Feasibility

Pump (InverFLOW Plus)

The pump has a 7-pin RS485 connector with:

• Pin 6 (Green): RS485 A
• Pin 7 (Brown): RS485 B
• Pin 5 (Yellow): Ground

However, on Madimack-branded units, the RS485 transceiver components are missing from the PCB. The header is physically present but the circuit is incomplete. This was confirmed by visual inspection and is a known cost-saving measure on rebadged Fairland units.

To restore RS485 on the pump: source and solder the missing transceiver components, then reverse-engineer the Modbus register map (no published maps exist for the waterPump category — only for Fairland heat pumps).

Heat Pump (Elite V4-230)

The heat pump's internal RS485 header IS functional. Multiple GitHub projects demonstrate local Modbus control:

• spdr870/fairland_iphcr45_modbus — ESPHome
• rstcologne/ESP-Home-Fairland-Heatpump — ESPHome
• Elwell/pool-heatpump — ESP32 standalone
• enboer/DomoticzFairlandModbus — Python, with error code maps

Heat pump Modbus address is typically 0xAA.

Why This Matters

If you only need heat pump control, RS485 works and you can use tuya_local or ESPHome. If you need pump control, you're stuck with either:

1. The Fairland cloud (limited)
2. Restoring the pump's RS645 circuit + reverse engineering (advanced)
3. Using the DI3 interlock (80% fixed speed only)
4. Replacing the pump with a Pro variant (Tuya compatible)

---

What We Tried (And What Happened)

Attempt	Result
Cloud speed setpoint via HA (siedi/ha-fairland)	API accepted, pump overrode with panel value
Cloud power on/off via HA	Switch bounced back immediately
Port scan pump WiFi module	Zero open ports — no local API possible
UDP scan (top 200)	Zero open ports
HTTP probe on pump IP	No response on any port
ESP32 firmware reverse engineering research	No published firmware dumps or exploits found
MITM consideration	ESP32 likely validates TLS cert — not attempted
DNS redirect (Thomas Witt approach)	Not attempted — HF-LPB130 module, not this pump
Factory reset to Tuya (Pro trick)	Plus variant does not support this — only Pro
DI3 dry-contact trigger confirmation	Works as documented — forces 80% via hardware
RS485 header inspection	Transceiver components missing on Madimack-branded unit
Heat pump Modbus research	Confirmed working — multiple published implementations

---

What Actually Works

Hardware (No HA Required)

• DI3 interlock: Heat pump on → pump forced to 80%. Always works.
• Salt cell interlock: Original wiring detects salt cell → starts pump. Always works.
• Pump panel: Set it and forget it. Panel setting is the baseline.

Home Assistant (tuya_local)

• Heat pump control: HVAC mode, preset mode, temp reading, power monitoring
• Rate-based heating optimization: Bump presets based on observed temp rise rate
• tuya_local works locally — no cloud dependency for heat pump

Home Assistant (Zigbee)

• Salt cell schedule: Zigbee smart plug controls Evochlor runtime
• Hardware interlock provides safety: Pump is running whenever cell is on

Fairland Integration (Read-Only)

• Power monitoring: View pump wattage, energy consumption
• Speed monitoring: See current running rate (though it's panel/DI3 controlled)
• Not useful for control — cloud commands are overridden

---

Final Architecture

Wall GPO → Original hardware interlock wiring → Pump GPO
            ↕                                    ↕ DI3 (forces 80% when HP runs)
        Heat pump (BAG+12V) ←──┬── Heat pump (tuya_local, HA controlled)
                               │
Zigbee plug → Evochlor ───────┘

• Pump is hardware-governed. HA never touches it.
• Heat pump controlled via HA/tuya_local (local WiFi, no cloud needed)
• Salt cell scheduled via HA/Zigbee (local)
• All three are independent of internet connectivity

---

Lessons for the HA Community

1. Check your variant. InverFLOW Plus ≠ InverFLOW Pro. The Pro has Tuya. The Plus does not. They're ~$700 apart in price for a reason.

2. RS485 cable ≠ Modbus. The "Perfect Pairing" / "Quick Connect Comms" cable is a dry-contact interlock. If you want Modbus, you need to wire the RS485 header pins directly — and on Madimack-branded pumps, you'll need to populate missing components first.

3. Port scan your devices. A pump WiFi module with zero open ports is a dead end for local API access.

4. Fairland cloud commands are guest status. You can read, but you can't write (not reliably). The panel always wins.

5. DI3 is useful but limited. It forces a fixed speed (default 80%) when the heat pump runs. Good for safety, not for fine control. The DI3 speed setpoint may not persist through power cycles.

6. Heat pump Modbus is viable. If you only need heat pump control, ESPHome + MAX485 on the BAG+12V port or internal header works. Published register maps exist.

7. No one has solved Fairland cloud pump local control. Not via firmware dumping, not via ESP32 flashing, not via cloud emulation. If you find a path, the community needs to know.

---