Visonic Powermax Powerlink protocol description

[nlrb]

Hope someone can give me a working example of the message to be sent to retrieve the zone names (which is the most important to me now)?

Zone names can best be requested with a A3 message. That works on all panel versions. For the 3E Variable UpLoad (VUL) request you need to know the layout of the settings.

[wwolkers]

Just a small bit of information about the B0 packets:

B0 has a dynamic length, the length is on position 4, also add 8 for the full length

I have looked at what I now think are packet type 03, subtypes 04 and 07:

The 04 packet contains some kind of information about the zones (marked in red in the packet below), in this case from a powermaster 30 with 64 zones:

0D B0 03 04 45 FF 08 03 40 04 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 43 D6 0A
0D B0 03 07 45 FF 08 03 40 03 03 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8F 43 D8 0A

In this case only zones 1 2 and 3 are used.

Now to see if I or someone else can find out what these values mean

[dad]

Hi,

My B003 messages appear to have a different format (also a Powermaster 30):

0D B0 03 39 07 FF 08 FF 02 18 24 9B 43 E6

0D B0 03 39 06 FF 08 FF 01 09 97 43 20

I have found that the last position before the checksum ( 9B & 97 ) is a counter which loops through 01 to FF increasing with each B0 03 message.

The 06 and 07 seem to be the number of bytes following before the checksum

[wwolkers]

Hi,

My B003 messages appear to have a different format (also a Powermaster 30):

0D B0 03 39 07 FF 08 FF 02 18 24 9B 43 E6

0D B0 03 39 06 FF 08 FF 01 09 97 43 20

I have found that the last position before the checksum ( 9B & 97 ) is a counter which loops through 01 to FF increasing with each B0 03 message.

The 06 and 07 seem to be the number of bytes following before the checksum

I have those also, yes. You are correct about the counter before the checksum, and the number of bytes, for the B0 03 39 packet.

The number after the FF is the zone this packet contains info about:

0D B0 03 39 07 FF 08 FF 02 18 24 9B 43 E6
0D B0 03 39 06 FF 08 FF 01 09 97 43 20

[uAlex73]

@dad: which type of sensors do you have in zone 1 and 2?

I got 2 PIRs connected to zone 1 and 2, but i only get "FF 01", never the "FF 02" message.

[wwolkers]

* Removed, was wrong info *

[uAlex73]

The PowerMaster30 B0 messages are interesting. To detect motion with a PIR, only the following approach seem to work:

- Change your PIR to report always
- Then it will send "B0 03 39" messages like "< 0D B0 03 39 06 FF 08 FF 01 18 0B 43 9D 0A"
- Report to it with a "B0 01 04" message like "> 0D B0 01 04 06 02 FF 08 03 00 00 43 F3 0A"
- Now you get a response with the zones (64 zones - everything after the "0D B0 03 04 45 FF 08 03 40" is zone information):
< 0D B0 03 04 45 FF 08 03 40 08 15 04 00 00 00 00 00 00 00 15 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 43 21 0A
- This information does NOT give you information about which zone is tripped
- Normally you will get in next 1-10 seconds again the "B0 03 39" messages, respond to them with "B0 01 04"
- Detect the delta in the zone message, the following example shows a different:
< 0D B0 03 04 45 FF 08 03 40 15 15 04 00 00 00 00 00 00 00 15 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0E 43 12 0A
- It was "08 15 04" and now it is "15 15 04". This means the PIR in zone 1 has detected movement.
- Ignore any change after the first change detection. I use a detection window of 5-6 seconds after the first "B0 03 39" message.
- I wait 30 seconds after the last B0 03 39 before accepting any further zone motion detection

I hope this is usefull for anybody using a PowerMaster30

[ilyaext]

I have PM 30 and can get A0 messages, but at least time of log seems as wrong. Do you know if the described format of A0 messages was changed in PM 30?
I'm looking for notification about alarm and it's zone. The alarm I think I could get from A5 00 04... message. But how to get the alarm's zone? Have I use B0 messages for it or could get from A0?
Thank you

[uAlex73]

@ilyaext:

Most of the A5 messages are the same as the previous PowerMax messages, so the A5 00 04 for the status of the panel. The A5's also work for the magnet contacts, only the PIRs aren't useable with these messages. This is why you need the B0 messages for it.

[jimmi]

Today I tried connecting to my Powermax.
Sorry if this is a stupid question, but my Powermax seems to always send the same numbers: "0000 5800 0000 0000 0058 0000 5800 0000". Even if I don't send anything to the interface, I always receive this.
Am I doing anything wrong?
I tried using minicom (then I receive just "XXXXXX...." which is the ASCII code for 0x58), linux command cu ("XXXX..." again) and od (here I receive the 0x58).

Would be very happy if someone could give me a hint.
Thanks.

[uAlex73]

The 0000 5800 looks to be weird packet(s), no pre and post characters are in there ... Can you capture the full hex data?

Also, if you connect the (windows) remote programmer, does it work?

[nlrb]

This is an invalid state. Just remove all power (mains & battery) and try again.

[jimmi]

Thanks for your replies.

The "0000 5800 0000 0000 0058 0000 5800 0000" is repeating all the time there is no beginning or end.
I already tried unplugging mains and battery. As soon as I plug it in, the "0000 5800 0000 0000 0058 0000 5800 0000" start coming again.

Unfortunately I don't have the remote programmer software to test if this would work.

[uAlex73]

The software and password can be download via the link:
http://powermax-alarm.co.uk/cms.php?id_cms=8

See "Q How do I access the Visonic Remote Programming Software?"

BTW: you can try to send an init to the panel?

[jimmi]

Hi, thanks for your replies. And sorry for my delay. I was busy with some other stuff and couldn't do further tests with my PowerMax.
I was able to connect using the Remote Programming Software without problems.
When I dump the serial port, I meanwhile found some more information when exiting installer mode:

0000 0000 0058 0000 5800 0000 0000 0058 0000 5800 0000 0000 a50d 0100 0000 0000 0000 0000 1743 580a 0000 0060 0058 0000 5800 0000 0000 0058 0000 5800 0000 0000 0058 0000 5800 0000 0000 0058 0000 5800 0000 0000 0058 0000 5800 0000 0000 0058

As you can see I still receive these damn 0x58. Even unplugging all power (battery + mains) didn't solve this.
But I also received "0d 0100 0000 0000 0000 0000 1743 580a". But shouldn't the checksum be "A4"? Why 58?
What does this message mean? This is not an enrollment message, is it?

To make sure I didn't miss anything else: I connected a 3.3V compatible serial interface cable to the PC/IP connector. I don't have a PowerLink. I would like to emulate one.