Visonic Powerlink RS232 Hack

[Digit]

I wrote some extra code for myself to make it all a bit more human readable, now all those bytes get a meaning

Code: Select all

<0D A5 00 02 BD 06 00 00 00 00 00 00 43 51 0A
 Keep Alive, Open Zones: 1 3 4 5 6 8 10 11

<0D A5 00 04 00 20 01 03 00 00 2C 00 43 C2 0A
 Status: Disarm, Flags : Zone event, , Zone 01 Open

<0D A5 00 02 BC 06 00 00 00 00 00 00 43 52 0A
 Keep Alive, Open Zones: 3 4 5 6 8 10 11

<0D A5 00 04 00 20 01 04 00 00 2C 00 43 C1 0A
 Status: Disarm, Flags : Zone event, , Zone 01 Closed

<0D A5 00 02 AC 06 00 00 00 00 00 00 43 62 0A
 Keep Alive, Open Zones: 3 4 6 8 10 11

<0D A5 00 04 00 20 05 04 00 00 2C 00 43 BD 0A
 Status: Disarm, Flags : Zone event, , Zone 05 Closed

<0D A5 00 02 BC 06 00 00 00 00 00 00 43 52 0A
 Keep Alive, Open Zones: 3 4 5 6 8 10 11

<0D A5 00 04 00 20 05 03 00 00 2C 00 43 BE 0A
 Status: Disarm, Flags : Zone event, , Zone 05 Open

<0D A5 00 02 BD 06 00 00 00 00 00 00 43 51 0A
 Keep Alive, Open Zones: 1 3 4 5 6 8 10 11

<0D A5 00 04 00 20 01 03 00 00 2C 00 43 C2 0A
 Status: Disarm, Flags : Zone event, , Zone 01 Open

<0D A5 00 02 BC 06 00 00 00 00 00 00 43 52 0A
 Keep Alive, Open Zones: 3 4 5 6 8 10 11

<0D A5 00 04 00 20 01 04 00 00 2C 00 43 C1 0A
 Status: Disarm, Flags : Zone event, , Zone 01 Closed

[Digit]

Here's a the traffic I saw while I Armed my PowerMax.
I saw messages not mentioned before here, starting with A7
(the times displayed are minutes and seconds)

Code: Select all

00:17 > :0D A1 00 00 04 <pin> <pin> 00 00 00 00 00 43 <cs> 0A 
00:17 < 0D 02 43 BA 0A 
00:17 < 0D A5 00 01 00 00 00 00 00 00 00 00 43 16 0A 
00:17 < 0D A5 00 04 01 40 00 00 00 00 2C 00 43 A5 0A 
00:18 < 0D A5 00 04 01 00 00 00 00 00 2C 00 43 E5 0A 
00:18   Status: Exit Delay Flags : 
01:07 < 0D A5 00 04 01 10 00 00 00 00 2C 00 43 D5 0A 
01:07   Status: Exit Delay Flags : Last 10sec. delay, 
01:16 < 0D A5 00 04 04 48 00 00 00 00 2C 00 43 9A 0A 
01:16   Status: Armed Home Flags : Bypass On, (dis)Arm or Alarm event, 
01:16 < 0D A7 01 00 2B 51 00 00 00 00 2C 00 43 6B 0A 
01:17 < 0D A7 01 00 2B 59 00 00 00 00 2C 00 43 63 0A 
01:17 < 0D A7 01 00 0B 5C 00 00 00 00 2C 00 43 80 0A 
01:17 < 0D A5 00 04 04 08 00 00 00 00 2C 00 43 DA 0A 
01:18   Status: Armed Home Flags : Bypass On, 
01:18 < 0D A7 01 00 08 5C 00 00 00 00 2C 00 43 83 0A 
01:18 < 0D A7 01 00 06 5C 00 00 00 00 2C 00 43 85 0A 
01:18 < 0D A7 01 00 05 5C 00 00 00 00 2C 00 43 86 0A 
01:18 < 0D A7 01 00 03 5C 00 00 00 00 2C 00 43 88 0A 

[Rene]

Those messages indicate a status change of the panel and are already described partly, see http://www.domoticaforum.eu/viewtopic.php?f=68&t=6581

01:16 < 0D A7 01 00 2B 51 00 00 00 00 2C 00 43 6B 0A
Armed Home

01:17 < 0D A7 01 00 2B 59 00 00 00 00 2C 00 43 63 0A
Forced Arm

01:17 < 0D A7 01 00 0B 5C 00 00 00 00 2C 00 43 80 0A
Bypass, could 0x0B be zone 11?

01:18 < 0D A7 01 00 08 5C 00 00 00 00 2C 00 43 83 0A
Bypass, could 0x08 be zone 8?

01:18 < 0D A7 01 00 06 5C 00 00 00 00 2C 00 43 85 0A
Bypass, could 0x06 be zone 6?

01:18 < 0D A7 01 00 05 5C 00 00 00 00 2C 00 43 86 0A
Bypass, could 0x05 be zone 5?

01:18 < 0D A7 01 00 03 5C 00 00 00 00 2C 00 43 88 0A
Bypass, could 0x03 be zone 3?

[Digit]

Hmmm, must have been much too late last night
And I didn't recheck again today...

Zones are right, those were open last night
Zone 6 is questionable..

[Odin]

OK my RS232 interface kit has arrived. My panel is a Complete panel and I don't have the option of 'activating' powerlink (it seems to know it is there without activation!) so will have to somehow trigger it.

[Bwired]

follow the flow in the first post
on my powermax plus i did not need to activate it with a powerlink

[Odin]

thanks you Bwired - I will give it a try (sorry for this - I am new to serial stuff)

Do you use Putty or some other software tool to 'talk' to the powermax via RS232?

[Willem4ever]

Do you use Putty or some other software tool to 'talk' to the powermax via RS232?

Most of us wrote their own little tool in python/C or VB ...

[Odin]

Do you use Putty or some other software tool to 'talk' to the powermax via RS232?

Most of us wrote their own little tool in python/C or VB ...

OK last night I was fiddling around in Perl as I have this on my NSLU2

[Willem4ever]

perl runs on a pc well ....

[Odin]

perl runs on a pc well ....

indeed it does run well. However I thought I'd run this on my NSLU2 as it only consumes 5W of power and is a full linux server where I have my email server/php/apache/mysql etc.

[Odin]

and my code is started..

here is a trace from my perl job when pressing the 'arm home' button on the keyfob for a Powermax complete panel

Code: Select all

[Fri Aug 12 17:57:45 2011] - Received From Alarm Subsystem: 0da5000100000000000000004316
[Fri Aug 12 17:57:45 2011] - Received From Alarm Subsystem: 0da50004014100000002000043ce
[Fri Aug 12 17:57:45 2011] - Received From Alarm Subsystem: 0da500070000000000030000430d
[Fri Aug 12 17:57:45 2011] - Received From Alarm Subsystem: 0da500
[Fri Aug 12 17:57:45 2011] - Received From Alarm Subsystem: 0da5000b0000000000000000430c
[Fri Aug 12 17:57:45 2011] - Received From Alarm Subsystem: 0da5000c0000000000000000430b
[Fri Aug 12 17:57:46 2011] - Received From Alarm Subsystem: 0da5000d000000000000000043

and then pressing the disarm button:

Code: Select all

[Fri Aug 12 17:57:48 2011] - Received From Alarm Subsystem: 0da50004004100000002000043cf

[Odin]

Hi - does anyone know of a way of getting the info on which keyfob armed/disarmed the alarm when activated/deactivated?

When I press the arm home button, I get the following but there is no keyfob info on that:

0da50004014100000006000043ca

[Willem4ever]

See message 0xA7 ....

[Odin]

See message 0xA7 ....

Thanks - however I don't get an A7 message from my panel - only A5 and A2 msgs.

I am logging in with 0DAB0A00010000000000000043060A - is this correct?