From captures shared I've identified some tenative pieces @skymuster can you see if this makes any sense to you.
These are the request messages - but I don't have a device that answers to these messages:
02 00 F0 FF FF 80 00 39 0E B7 E9 0B F4 03 - response seems like a countdown - possibly until chlorinator finishes dosing02 00 F0 FF FF 80 00 39 0E B7 EA 0B F5 03 - Returns a level 4500 or 9000 in observed captures
0xE9/slot 0x0B — tentative ⚠️: a 2-byte little-endian value followed by 2 bytes that have only ever read 00 00. Answered by the Viron Chlorinator (0x0084) rather than the Touchscreen, in response to the Internet Gateway's 0x39 poll. The value is a linear countdown in units of 1/5 second — 300 units = 1 minute. Measured across 13 consecutive reads in one capture: 12700 → 5500 over 24 minutes, a rate of 298 units/minute with a residual spread of only 275 units (55 s), which is the one-minute quantisation expected from a value the chlorinator refreshes once a minute. Extrapolating the zero-crossing and cross-referencing the Touchscreen clock (0xFD) shows the countdown targeting a fixed wall-clock time (~10:45 in that capture). What it counts down to is unknown — that install's only configured timer runs 09:00–13:00 daily, so it is not the timer's stop time. A separate capture from the same install reads 00 00 00 00 at 15:36–15:40, outside the timer window, consistent with the counter only running while the equipment does. On the other install the Gateway polls this register every cycle but the chlorinator never answers it.0xEA/slot 0x0B — tentative ⚠️: same payload shape and source as 0xE9/slot 0x0B above — a 2-byte little-endian value followed by 2 bytes that have only ever read 00 00, answered by the Viron Chlorinator (0x0084) in response to the Gateway's 0x39 poll (02 00 F0 FF FF 80 00 39 0E B7 EA 0B F5 03). Two installs report different but entirely static values: 94 11 00 00 = 4500 (141 responses over ~18.5 hours) and 28 23 00 00 = 9000 (18 responses across three captures). It reads as a stored setting rather than a live measurement — 4500 would be a plausible salt level in ppm, but 9000 is high for the same units, so the meaning is unconfirmed. The Gateway polls it back-to-back with 0xE9 (~1.5 s apart, every cycle), but the two are not related as total and remaining: 0xEA held at 9000 while 0xE9 swept 12700 → 0, including passing straight through 9000 with no effect.
From captures shared I've identified some tenative pieces @skymuster can you see if this makes any sense to you.
These are the request messages - but I don't have a device that answers to these messages:
02 00 F0 FF FF 80 00 39 0E B7 E9 0B F4 03- response seems like a countdown - possibly until chlorinator finishes dosing02 00 F0 FF FF 80 00 39 0E B7 EA 0B F5 03- Returns a level 4500 or 9000 in observed captures0xE9/slot0x0B— tentative00 00. Answered by the Viron Chlorinator (0x0084) rather than the Touchscreen, in response to the Internet Gateway's 0x39 poll. The value is a linear countdown in units of 1/5 second — 300 units = 1 minute. Measured across 13 consecutive reads in one capture: 12700 → 5500 over 24 minutes, a rate of 298 units/minute with a residual spread of only 275 units (55 s), which is the one-minute quantisation expected from a value the chlorinator refreshes once a minute. Extrapolating the zero-crossing and cross-referencing the Touchscreen clock (0xFD) shows the countdown targeting a fixed wall-clock time (~10:45 in that capture). What it counts down to is unknown — that install's only configured timer runs 09:00–13:00 daily, so it is not the timer's stop time. A separate capture from the same install reads00 00 00 00at 15:36–15:40, outside the timer window, consistent with the counter only running while the equipment does. On the other install the Gateway polls this register every cycle but the chlorinator never answers it.0xEA/slot0x0B— tentative0xE9/slot0x0Babove — a 2-byte little-endian value followed by 2 bytes that have only ever read00 00, answered by the Viron Chlorinator (0x0084) in response to the Gateway's 0x39 poll (02 00 F0 FF FF 80 00 39 0E B7 EA 0B F5 03). Two installs report different but entirely static values:94 11 00 00= 4500 (141 responses over ~18.5 hours) and28 23 00 00= 9000 (18 responses across three captures). It reads as a stored setting rather than a live measurement — 4500 would be a plausible salt level in ppm, but 9000 is high for the same units, so the meaning is unconfirmed. The Gateway polls it back-to-back with0xE9(~1.5 s apart, every cycle), but the two are not related as total and remaining:0xEAheld at 9000 while0xE9swept 12700 → 0, including passing straight through 9000 with no effect.