Page 1 of 13

Visonic Powermax Powerlink protocol description

Posted: Mon Aug 08, 2011 11:20 pm
by Rene
Because the Wiki we previously used to describe the protocol is publically accessable and everyone is able to modify it, I moved the protocol description to this topic. Here we can control who can edit the description. Whenever you have an edition just reply to this topic. I will add it to the main description and then delete your post.


General Message Format
Messages are a sequence of bytes. Messages can have arbitrary length. Messages start with a preamble (0x0D) and end with postamble (0x0A). The last byte before the postamble is a checksum.

Code: Select all

<Preamble> <Payload> <Checksum> <Postamble>
Because the payload can contain the preamble as well as the postamble as data, you should calculate the checksum whenever you receive the postamble (0x0A). If the checksum is correct you know it was the postamble, if it is not this byte is just part of the data.

Calculation of the checksum
The checksum is calculated as follows:
1. Sum all bytes except for the preamble, postamble and the checksum itself.
2. Divide this sum by 255.
3. Take the one complement of the remainder, but only if the remainder is bigger than 0.

Example of calculating the checksum in Python:

Code: Select all

checksum = 0
for char in msg[1:len(msg) - 2]:
   checksum += ord(char)
checksum = checksum % 255
if checksum % 0xFF != 0:
   checksum = checksum ^ 0xFF
Other way to calculate the checksum:
1. Sum all the payload bytes in a word;
2. Subtract both high and low byte from FFFF;
3. Low byte contains the checksum.

Why: the "if" seems rather odd to me in a checksum calculation; this one always does the same calculation.
A few examples:

Code: Select all

Payload  : A5 00 07 00 00 00 00 00 10 00 00 43
Checksum : 00 (from Visonic)
Sum      : A5+07+10+43 = 00FF
Checksum : FFFF-00-FF = FF00, low byte = 00

Payload  : A5 00 02 94 06 00 00 00 00 00 00 43 
Checksum : 7A
Sum      : A5+02+94+06+43 = 0184
Checksum : FFFF-01-84 = FF7A, low byte = 7A

Payload  : A5 00 01 00 00 00 00 00 00 00 00 43 
Checksum : 16
Sum      : A5+01+43 = 00E9
Checksum : FFFF-00-E9 = FF16, low byte = 16

Payload  : A5 00 02 B4 06 00 00 00 00 00 00 43 
Checksum : 5A         
Sum      : A5+02+B4+06+43=01A4
Checksum : FFFF-01-A4 = FF5A, low byte = 5A
Communication parameters
The parameters of the RS232 interface are:

Code: Select all

9600 Baud; Data Bits 8; Stop Bits 1; Parity None
The enrollment process
The (emulated) Powerlink needs a pin code in order to:
- Get some information from the Powermax
- Use the bypass command
- Use the disarm and arm commands
During the enrollment process the Powerlink will create a pin and register this pin at the Powermax. The advantage is that none of the already pins is required.
On the Powermax+ and Powermax Pro the (emulated) Powerlink can be enrolled via the installer menu, on the Powermax Complete the Powerlink will be registered automatically (what does this dialog look like?)

When the (emulated) Powerlink is connected and the 'Install Powerlink' option is selected from the installer menu the Powermax sends the following message:

Code: Select all

0xAB 0x0A 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x43
The (emulated) Powerlink should respond with the following message:

Code: Select all

0xAB 0x0A 0x00 0x00 <pin1> <pin2> 0x00 0x00 0x00 0x00 0x00 0x43
where <pin1> and <pin2> are the digits of the pin code that needs to be registered in order to be used by the Powerlink. When the enrollment process is completed successfully, a beep will be sounded.

Note: When a new Powerlink module needs to be registered while there is already a Powerlink registered, the previous registered one needs to be uninstalled. You can do so by selecting 'Install Powerlink' from the installer menu en then press the disarm button.

Establishing connection
Communication can be established by sending an AB message (see messages below) to the Powermax. The Powermax will respond with a Panel ACK message. All messages sent by the Powermax must be responded to with an ACK message. If messages are not acknowledged the communication drops and has to be re-initialised sending an AB message.

Message types
Note: The all messages must be prefixed by the preamble and postfixed by the checksum and postamble.

0x02 - Acknowledgement
Length: 2 bytes

Code: Select all

0x02 0x43
This acknowledgement must be sent in reply to all messages from the panel in order to keep the communication alive.

0x08 - Access denied
Length: 2 bytes

Code: Select all

0x08 0x43
This message is sent by the Powermax when a command has been sent which requires a pin code and none or an incorrect pin is specified.

0x46 - Set date and time
Length: 11 bytes

Note: This seems to work only on the Powermax Pro and not on the Powermax Plus.

Code: Select all

0x46 0xF8 0x00 0x00 <Minutes> <Hours> <Day> <Month> <Year> 0xFF 0xFF
Where:
hours must be specified in 24 hour format
day must be the day of the month (1-31)
month must be between 1-12
year must be specified as the years since 2000.

Example: To set the time to 21:56, August 3 2011, send the following message:

Code: Select all

0x46 0xF8 0x00 0x00 0x38 0x15 0x03 0x08 0x0B 0xFF 0xFF
0xA0 - Get event log
Length: 12 bytes

Code: Select all

0xA0 0x00 0x00 0x00 <Byte 4> <Byte 5> 0x00 0x00 0x00 0x00 0x00 0x43
Where:
Byte 4 contains the first 2 digits of the pin code to be used
Byte 5 contains the third and fourth digit of the pin code to be used

Note: If your pin is 1357, you should replace <Byte 4> <Byte 5> with 0x13 0x57, do not translate your pin to hex directly!

The response is a large number of messages, each indicating a log entry. The responses are also starting with 0xA0.
The format of these messages is:

Code: Select all

0xA0  <Byte1> <Byte2> <Byte 3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte 9> <Byte10> 0x43
Where:
Byte 1 indicates the total number of messages returned
Byte 2 indicates the current message number
Byte 3 indicates the seconds of the timestamp
Byte 4 indicates the minutes of the timestamp
Byte 5 indicates the hours of the timestamp specified in 24 hour format
Byte 6 indicates the day of the month
Byte 7 indicates the month
Byte 8 indicates the number of years since 2000
Byte 9 Zone/User, see appendix E
Byte 10 indicates the event occurred. A list of all log events can be found in appendix C

Example:

Code: Select all

0xA0 0xFB 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0x00 0x43
0xA0 0xFB 0x02 0x07 0x38 0x16 0x06 0x08 0x0B 0x4D 0x33 0x43
.
.
0xA0 0xFB 0xFB ...
The reply consists out of 251 (0xFB) messages.The second message is the latest log entry, in this case a telephone line failure on August 6, 2011 at 16:38.

0xA1 - Arm or disarm the Powermax
Length: 12 bytes

Code: Select all

0xA1 0x00 0x00 <Byte3> <Byte4> <Byte5> 0x00 0x00 0x00 0x00 0x00 0x43
Where:
Byte 3 must be one of the following commands:
0x00 Disarm
0x04 Arm home
0x05 Arm away
0x14 Arm home instantly
Byte 4 must be the first 2 digits of the pin code to be used
Byte 5 must be the third and fourth digit of the pin code to be used

Note: If your pin is 1357, you should replace <Byte4> <Byte5> with 0x13 0x57. Do not translate your pin to hex directly!

0xA2 - Request status update
Length: 12 bytes

Code: Select all

0xA2 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x43
The reponse consists of multiple rows/messages (9 (0x09) for the Powermax+ and Powermax Pro and 14 (0x0D) for the Powermax Complete) of the following format:

Code: Select all

0xA5 <Number of rows> <Row> ...... <0x43>
Till now only the second, third, fourth and sixth message have been decoded partly.

The second row indicates the status of the zones:

Code: Select all

0xA5 <Numberof rows> 0x02 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
The description is the same as for the 0xA5 0x00 0x02 message, see later on.

The third row indicates which zones are tampered or inactive:

Code: Select all

0xA5 <Numberof rows> 0x03 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
The description is the same as for the 0xA5 0x00 0x03 message, see later on.

The fourth row indicates the status of the system panel:

Code: Select all

0xA5 <Numberof rows> 0x04 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
See for a detailed description the 0xA5 0x00 0x04 message later on.

The sixth row also indicates whether a zone is enrolled and bypassed:

Code: Select all

0xA5 <Numberof rows> 0x06 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
Byte 3 indicates which of zones 1 - 8 are enrolled
Byte 4 indicates which of zones 9 - 16 are enrolled
Byte 5 indicates which of zones 17 - 24 are enrolled
Byte 6 indicates which of zones 25 - 30 are enrolled
Byte 7 indicates which of zones 1 - 8 are bypassed
Byte 8 indicates which of zones 9 - 16 are bypassed
Byte 9 indicates which of zones 17 - 24 are bypassed
Byte 10 indicates which of zones 25 - 30 are bypassed
Each bit represents a zone, e.g. bit 0 of byte 7 (Zone 1-8) represents zone 1 and bit 7 represents zone 8. When a bit is set it indicates the corresponding zone is bypassed. Note: bits are numbered from right to left starting at 0.

0xA5 - General event description
Length: 12 bytes

Code: Select all

0xA5 0x00 <Byte2> <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
Byte 2 indicates the type of event:
0x01 Log event ?
0x02 Status message
0x03 Tamper event
0x04 Zone event

Keep Alive (Byte 2 = 0x02)
This message reports the status of each zone. It is send periodically and as part of a response to a status request. The message indicates per zone whether the zone is opened and the condition of the battery (low or not).

Code: Select all

    0xA5 0x00 0x02 <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
    
Byte 3 indicates the status of zone 1 - 8 - when a bit is set it indicates the corresponding zone is open
Byte 4 indicates the status of zone 9 - 16
Byte 5 indicates the status of zone 17 - 24
Byte 6 indicates the status of zone 25 - 30
Byte 7 indicates the battery condition of zone 1 - 8 - when a bit is set it indicates the corresponding zone has a low battery
Byte 8 indicates the battery condition of zone 9 - 16
Byte 9 indicates the battery condition of zone 17 - 24
Byte 10 indicates the battery condition of zone 25 - 30

Each bit represents a zone, e.g. bit 0 of byte 3 (Zone 1-8) represents zone 1 and bit 7 represents zone 8. When a bit is set it indicates the corresponding zone is opened or a low battery.
Note: bits are numbered from right to left starting at 0.

Tamper (Byte 2 = 0x03)
This message is send as part of a status report or when a zone is tampered. The message indicates per zone if the zone is active and if the zone is tampered.

Code: Select all

    0xA5 0x00 0x03 <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
    
Byte 3 indicates the status of zone 1 - 8
Byte 4 indicates the status of zone 9 - 16
Byte 5 indicates the status of zone 17 - 24
Byte 6 indicates the status of zone 25 - 30
Byte 7 indicates the tamper status of zone 1 - 8
Byte 8 indicates the tamper status of zone 9 - 16
Byte 9 indicates the tamper status of zone 17 - 24
Byte 10 indicates the tamper status of zone 25 - 30

Each bit represents a zone, e.g. bit 0 of byte 3 (Zone 1-8) represents zone 1 and bit 7 represents zone 8. When a bit is set it indicates the corresponding zone is tampered or inactive.
Note: bits are numbered from right to left starting at 0.

Event (BYTE 2 = 0x04)

Code: Select all

    0xA5 0x00 0x04 <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
    
Byte 3 indicates the system status (See appendix A)
Byte 4 contains the system state flags (See appendix B)
Byte 5 indicates the zone triggering the event (only when bit 5 of Byte 4 is set)
Byte 6 indicates the type of zone event (only when bit 5 of Byte 4 is set). A complete list can be found in appendix D.
Byte 8: ? (reported values: 0x01, 0x05)
Byte 9: ? (reported values: 0x22, 0x30, 0x32, 0x34, 0x36)

0xA7 - Panel status change
Length: 12 bytes

Code: Select all

0xA7 0x00 <Byte2> <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
Byte 1:
0x01 ?
0x02 ?

Byte 2:
Byte 3: Zone/User (See appendix E for a complete list of all log events)
Byte 4: Log event (See appendix C for a complete list of all log events)

0xAA - Enable and disabe bypass
Length : 12 bytes

Bypass enable

Code: Select all

0xAA <Byte 1> <Byte 2> <Byte 3> <Byte 4> <Byte 5> <Byte 6> 0x00 0x00 0x00 0x00 0x43
Where:
Byte 1 contains the first 2 digits of the pin code to be used
Byte 2 contains the third and fourth digit of the pin code to be used
Byte 3 indicates the mode for zones 1 - 8. When a bit is set it indicates bypass of the corresponding zone will be enabled
Byte 4 indicates the mode for zones 9 - 16
Byte 5 indicates the mode for zones 17 - 24
Byte 6 indicates the mode for zones 25 - 30

Bypass disable

Code: Select all

0xAA <Byte 1> <Byte 2> 0x00 0x00 <0x00> <0x00> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
Where:
Byte 1 contains the first 2 digits of the pin code to be used
Byte 2 contains the third and fourth digit of the pin code to be used
Byte 7 indicates the mode for zones 1 - 8. When a bit is set it indicates bypass of the corresponding zone will disabled
Byte 8 indicates the mode for zones 9 - 16
Byte 9 indicates the mode for zones 17 - 24
Byte 10 indicates the mode for zones 25 - 30

General Remarks
* Sensors (pirs) are only reported when motion is detected (05)
* Sometimes the keep alive (hartbeat) packet is not received any more.
You have registered as a power link, i noticed the same we have to do some more sniffing on that. Do not reply with 0xAB 0x0A 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x43 during the PL "inleren". To reset the PM back (disconnet mains an battery) and have it start sending xA5 x00 x02 messages again you have to startup the remote programmer once (that is what fixed it for me) do not start the "inleren" and reply with a x02 ACK message when you receive a message from the PL.

Appendix A - System Status

0x00 Disarm
0x01 Exit Delay
0x02 Exit Delay
0x03 Entry Delay
0x04 Armed Home
0x05 Armed Away
0x06 User Test
0x07 Downloading
0x08 Programming
0x09 Installer
0x0A Home Bypass
0x0B Away Bypass
0x0C Ready
0x0D Not Ready

Appendix B - System state flags

bit 0: Ready if set
bit 1: Alert in Memory if set
bit 2: Trouble if set
bit 3: Bypass On if set
bit 4: Last 10 seconds of entry or exit delay if set
bit 5: Zone event if set
bit 6: Arm, disarm event if set
bit 7: Alarm event if set

Note: bits are numbered from right to left starting at 0

Appendix C - Log events

0x00 None
0x01 Interior Alarm
0x02 Perimeter Alarm
0x03 Delay Alarm
0x04 24h Silent Alarm
0x05 24h Audible Alarm
0x06 Tamper
0x07 Control Panel Tamper
0x08 Tamper Alarm
0x09 Tamper Alarm
0x0A Communication Loss
0x0B Panic From Keyfob
0x0C Panic From Control Panel
0x0D Duress
0x0E Confirm Alarm
0x0F General Trouble
0x10 General Trouble Restore
0x11 Interior Restore
0x12 Perimeter Restore
0x13 Delay Restore
0x14 24h Silent Restore
0x15 24h Audible Restore
0x16 Tamper Restore
0x17 Control Panel Tamper Restore
0x18 Tamper Restore
0x19 Tamper Restore
0x1A Communication Restore
0x1B Cancel Alarm
0x1C General Restore
0x1D Trouble Restore
0x1E Not used
0x1F Recent Close
0x20 Fire
0x21 Fire Restore
0x22 No Active
0x23 Emergency
0x24 No used
0x25 Disarm Latchkey
0x26 Panic Restore
0x27 Supervision (Inactive)
0x28 Supervision Restore (Active)
0x29 Low Battery
0x2A Low Battery Restore
0x2B AC Fail
0x2C AC Restore
0x2D Control Panel Low Battery
0x2E Control Panel Low Battery Restore
0x2F RF Jamming
0x30 RF Jamming Restore
0x31 Communications Failure
0x32 Communications Restore
0x33 Telephone Line Failure
0x34 Telephone Line Restore
0x35 Auto Test
0x36 Fuse Failure
0x37 Fuse Restore
0x38 Keyfob Low Battery
0x39 Keyfob Low Battery Restore
0x3A Engineer Reset
0x3B Battery Disconnect
0x3C 1-Way Keypad Low Battery
0x3D 1-Way Keypad Low Battery Restore
0x3E 1-Way Keypad Inactive
0x3F 1-Way Keypad Restore Active
0x40 Low Battery
0x41 Clean Me
0x42 Fire Trouble
0x43 Low Battery
0x44 Battery Restore
0x45 AC Fail
0x46 AC Restore
0x47 Supervision (Inactive)
0x48 Supervision Restore (Active)
0x49 Gas Alert
0x4A Gas Alert Restore
0x4B Gas Trouble
0x4C Gas Trouble Restore
0x4D Flood Alert
0x4E Flood Alert Restore
0x4F X-10 Trouble
0x50 X-10 Trouble Restore
0x51 Arm Home
0x52 Arm Away
0x53 Quick Arm Home
0x54 Quick Arm Away
0x55 Disarm
0x56 Fail To Auto-Arm
0x57 Enter To Test Mode
0x58 Exit From Test Mode
0x59 Force Arm
0x5A Auto Arm
0x5B Instant Arm
0x5C Bypass
0x5D Fail To Arm
0x5E Door Open
0x5F Communication Established By Control Panel
0x60 System Reset
0x61 Installer Programming
0x62 Wrong Password
0x63 Not Sys Event
0x64 Not Sys Event
0x65 Extreme Hot Alert
0x66 Extreme Hot Alert Restore
0x67 Freeze Alert
0x68 Freeze Alert Restore
0x69 Human Cold Alert
0x6A Human Cold Alert Restore
0x6B Human Hot Alert
0x6C Human Hot Alert Restore
0x6D Temperature Sensor Trouble
0x6E Temperature Sensor Trouble Restore

Appendix D - Zone event types
0x00 None
0x01 Tamper Alarm
0x02 Tamper Restore
0x03 Open
0x04 Closed
0x05 Violated (Motion)
0x06 Panic Alarm
0x07 RF Jamming
0x08 Tamper Open
0x09 Communication Failure
0x0A Line Failure
0x0B Fuse
0x0C Not Active
0x0D Low Battery
0x0E AC Failure
0x0F Fire Alarm
0x10 Emergency
0x11 Siren Tamper
0x12 Siren Tamper Restore
0x13 Siren Low Battery
0x14 Siren AC Fail

Appendix E - Zone/User
0X00 System
0x01 Zone 1
0x02 Zone 2
0x03 Zone 3
0x04 Zone 4
0x05 Zone 5
0x06 Zone 6
0x07 Zone 7
0x08 Zone 8
0x09 Zone 9
0x0A Zone 10
0x0B Zone 11
0x0C Zone 12
0x0D Zone 13
0x0E Zone 14
0x0F Zone 15
0X10 Zone 16
0x11 Zone 17
0x12 Zone 18
0x13 Zone 19
0x14 Zone 20
0x15 Zone 21
0x16 Zone 22
0x17 Zone 23
0x18 Zone 24
0x19 Zone 25
0x1A Zone 26
0x1B Zone 27
0x1C Zone 28
0x1D Zone 29
0x1E Zone 30
0X1F Keyfob1
0X20 Keyfob2
0X21 Keyfob3
0X22 Keyfob4
0X23 Keyfob5
0X24 Keyfob6
0X25 Keyfob7
0X26 Keyfob8
0X27 User1
0X28 User2
0X29 User3
0X2A User4
0X2B User5
0X2C User6
0X2D User7
0X2E User8
0X2F Wireless Commander1
0X30 Wireless Commander2
0X31 Wireless Commander3
0X32 Wireless Commander4
0X33 Wireless Commander5
0X34 Wireless Commander6
0X35 Wireless Commander7
0X36 Wireless Commander8
0x37 Wireless Siren1
0x38 Wireless Siren2
0x39 2Way Wireless Keypad1
0x3A 2Way Wireless Keypad2
0x3B 2Way Wireless Keypad3
0x3C 2Way Wireless Keypad4
0x3D X10-1
0x3E X10-2
0x3F X10-3
0x40 X10-4
0x41 X10-5
0x42 X10-6
0x43 X10-7
0x44 X10-8
0x45 X10-9
0x46 X10-10
0x47 X10-11
0x48 X10-12
0x49 X10-13
0x4A X10-14
0x4B X10-15
0x4C PGM
0x4D GSM
0x4E Powerlink
0x4F Proxy Tag1
0x50 Proxy Tag2
0x51 Proxy Tag3
0x52 Proxy Tag4
0x53 Proxy Tag5
0x54 Proxy Tag6
0x55 Proxy Tag7
0x56 Proxy Tag8

Examples
Window Zone 07 open

Code: Select all

0x0D 0xA5 0x00 0x04 0x00 0x20 0x07 0x03 0x00 0x03 0xAF 0x0F 0x43 0x27 0x0A
Window Zone 07 close

Code: Select all

0x0D 0xA5 0x00 0x04 0x00 0x21 0x07 0x04 0x00 0x03 0xAF 0x0F 0x43 0x25 0x0A
Movement Zone 11

Code: Select all

0x0D 0xA5 0x00 0x04 0x00 0x21 0x0B 0x05 0x00 0x03 0xAF 0x0F 0x43 0x20 0x0A
Movement in Zone 11 with tamper alarm in memory

Code: Select all

0x0D 0xA5 0x00 0x04 0x00 0x23 0x0B 0x05 0x00 0x03 0xAF 0x0F 0x43 0x1E 0x0A
Door Open in Zone 01 while arming away (exit delay)

Code: Select all

0x0D 0xA5 0x00 0x04 0x02 0x60 0x01 0x03 0x00 0x03 0x00 0x00 0x43 0xA9 0x0A
Door Close in Zone 01 while arming away (exit delay)

Code: Select all

0x0D 0xA5 0x00 0x04 0x02 0x61 0x01 0x04 0x00 0x03 0x00 0x00 0x43 0xA7 0x0A
WORK IN PROGRESS............

Re: Powerlink protocol description

Posted: Thu Aug 11, 2011 3:40 pm
by Bwired
Update log for above protocol:

11-08-2011 0xA0 - Get event: updated with new translations for bytes 9 and 10 (Bwired)
11-08-2011 0xA0 - Get event: Byte 3, only logical explanation is that it depicts seconds from the timestamp (willem4ever)
11-08-2011 0xA0 - Get event: updated Appendix E with confirmed zones (Bwired)
12-08-2011 0xA5 0x09 - Status message - row 6 - added description for byte 3, byte 4, byte 5 and byte 6 (willem4ever)
13-08-2011 0xA7 - Panel status change: Translation for Byte 3 Appendix E (Bwired)
13-08-2011 Appendix B System State flags: Modified bit 6, added description bit 7 (willem4ever)
14-08-2011 General Remarks section added: added that only motion (05) is detected for sensors within visonics. No motion is not reported (Bwired)
21-08-2011 General Remarks section added: added reboot for receiving A5 00 02 hartbeat, which can be not received in certain cases (Bwired)
26-08-2011 Other way to calculate the Visonic Powermax checksum with samples (Digit)
30-08-2011 0xA5 0x00 0x03 Tamper packet partly decoded (Bwired/Willem4ever)
01-09-2011 0xA5 0x00 0x02 added description for bytes 7-10 - battery status (Bwired/Willem4ever)
08-09-2011 Added RemoteCommanders to Appendix E (utz)
14-09-2011 Corrected byte 11 of 0xA2 command (utz)
02-10-2011 Completed appendix E (Rene, taken from the .tdf files that come with the programmer software)
02-10-2011 Added description of the enrollment process (Rene)
02-10-2011 Added indication whether a zone is active or inactive (0xA5 <byte 2> 03) (Rene)

Re: Powerlink protocol description

Posted: Sun Nov 13, 2011 11:23 pm
by utz
0x46 - Set date and time

This command is not working for me. Can someone please check if it is correctly documented (Also, I would have assumed that a PIN would need to be submitted with it).

Re: Powerlink protocol description

Posted: Fri Nov 18, 2011 11:53 pm
by utz
When pressing the test button on a smoke detector (MCT-425) I see the following message:
0D A5 00 04 00 A2 10 03 00 03 01 00 43 59 0A

Byte 5 is 0x10 which indicates Zone 16 which is correct. However, Byte 6 is "0x03 Open" and I would have expected "0x0F Fire Alarm". Did anyone else observe this? Is it maybe because I pressed the test button and putting some real smoke to the sensor would create a different result?

Re: Powerlink protocol description

Posted: Sat Nov 19, 2011 12:41 am
by Rene
It should not be to hard to try this out. I have several smoke detectors but did not have a look at them yet. Triggering the alarm is not something the rest of the family is very keen of ;-) It provides a lot of noise.

Re: Powerlink protocol description

Posted: Mon Nov 21, 2011 2:05 pm
by utz
@Rene

Did you have a chance to try that with real smoke?
Did you ever try the set time and date? Does that work for you?

Posted: Mon Nov 21, 2011 3:13 pm
by Rene
It's a no to both questions. I am very busy at work lately.

Re: Powerlink protocol description

Posted: Wed Nov 23, 2011 9:54 pm
by Willem4ever
utz wrote: Did you ever try the set time and date? Does that work for you?
Yes time and date did work for me ...

Re: Powerlink protocol description

Posted: Thu Nov 24, 2011 2:14 am
by utz
@Willem4ever

I use a powermax+. What panel type did you use to try it? powermaxpro maybe?

Re: Powerlink protocol description

Posted: Thu Nov 24, 2011 8:23 am
by Willem4ever
i have a powermaxpro

Re: Powerlink protocol description

Posted: Thu Nov 24, 2011 3:29 pm
by utz
Ok, that might be the problem here. When I send the set time command my panel ignores the message (no ack). It might be that this command is only possible on a powermaxpro (and not the powermax+). There is as well the possiblility that my code is rubbish. I will try to get some users that use my software with a powermaxpro to see if the set time works.

Re: Powerlink protocol description

Posted: Fri Nov 25, 2011 12:53 am
by utz
A5 Event Message (BYTE 2 = 0x04)

Byte9: On/Off status of attached X-10 (Unit 1 to 7 and PGM output). LSB is PGM; MSB is Unit 7.
Byte10: On/Off status of attached X-10 (Unit 8 to 15). LSB is Unit 8; MSB is Unit 15.

The AUX button of the keyfob can be defined to switch an X10 unit or the PGM output. When this is done (even with, for example on the PGM, nothing attached) an A5 message with status in Byte9/Byte10 is sent. Thus, the keyfob can be used as a remote in a home automation scenario.

Re: Powerlink protocol description

Posted: Fri Nov 25, 2011 1:47 pm
by utz
I can confirm now that the time set message is only working on a powermaxpro but not on a powermax+.

X10 processing

Posted: Mon Feb 13, 2012 1:06 pm
by utz

Code: Select all

0d a4 00 00 00 00 00 01 00 80 00 00 43 96 0a
this should be sent to the powermax to switch on X15. Byte8 means on; Byte10 is X15

Code: Select all

0d a4 00 00 00 00 00 00 02 00 00 00 43 96 0a
this should be sent to powermax to switch off X01. Byte8 means on; Byte9 is X01

Code: Select all

0d a5 00 04 00 01 00 00 00 00 12 80 43 7f 0a
this is sent from powermax to indicate X10 status. Byte11 means X01 and X04 are on; Byte12 means X15 is on.

Re: Powerlink protocol description

Posted: Mon Feb 13, 2012 1:57 pm
by Rene
@utz:
I will update the description.

I saw your message of setting the time on the Powermax Plus just today. Are you able to determine what command is sent to the Powermax Plus when you update the time from within the Remote Programmer software?