Visonic Powermax Powerlink protocol description

[nlrb]

I have been looking a bit more into the way the communication between PM & PL works.

What confused me was the remark in the enrollment process description.

During the enrollment process the Powerlink will create a pin and register this pin at the Powermax. The advantage is that none of the already pins is required.

The pin code that is generated is a download code, not a user or installer pin code. I.e. you can get all settings with this code, but not arm the PM. So the PL uses this code to read the user1 pin code from the settings and uses the user1 code to arm/disarm the panel. BTW: you need to go into programming mode for this by 24 00 00 pin1 pin2 00 00 00 00 00 00. Note that in programming mode the messages don't have the 0x43 - these only occur in normal running mode (so an ack will be 0D 02 FD 02, a nack will be 0D 08 F7 0D (e.g. wrong download code) and a timeout will be 0D 06 F9 0A).

Furthermore, what Rene already noted on Aug 06, 2011, once enrolled the PM will send a message every 30 secs. to check whether the PL is still responding/alive.

Code: Select all

0xAB 0x03 0x00 0x1E 0x00 0x34 0x36 0x30 0x36 0x00 0x00 0x43

If this message is not acknowledged (you can afford not the acknowledge a couple) then the PM enters the error state (PL communication error). The alive message (0xAB 0x03) will not be sent any longer.

To restore communication and clear the PM error, you need to send the following message.

Code: Select all

0xAB  0x06  0x00  0x00  0x00  0x00  0x00  0x00  0x00  0x00  0x00  0x43

I.e. if you have not received the 0xAB 0x03 in the last minute, you will have to send a 0xAB 0x06.

[nlrb]

The "0x34 0x36 0x30 0x36" in the Alive message (0xAB 0x03) is most likely the Powermax firmware version, in this case v4.6.06. So other numbers could appear also.

[viknet]

OK nlrb, you deserve a big THANK YOU !!!!!

if you come close to marseille (France) I'll buy you a beer, otherwise PM your paypal account and you will have one on me

So I had issue because the openwrt router was hanging sometime (once a week, an issue with the serial driver that I cannnot resolve myself) because of this the alarm was beeping and I had to go into user mode to aknowledge and remove the beep: Booooooring.

Now I send your string (0xAB 0x06 ...... 0x43) at program's beginning and because the router is self rebooting I will no longuer have this f....ing beep.

So once again a big THANK YOU

rene, please include both string into the protocol, (the version one is very interesting alos, it seems to be the only way of getting the pmax soft version)

nlrb, your information about the PIN are also very valuable thank you

Viknet

[Rene]

Another way to request version information is as follows

Request:

Code: Select all

3E 00 04 36 00 B0 30 30 33 35 35

Response:

Code: Select all

3F 00 04 36 4A 2D 37 30 30 33 35 35 20 76 34 2E 36 2E 30 36 4A 53 37 30 31 31 39 32 
            J  -  7  0  0  3  5  5     v  4  .  6  .  0  6  J  S  7  0  1  1  9  2

20 76 34 2E 36 2E 30 36 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 0B 0A 09 00 A1 FF
   v  4  .  6  .  0  6                                                  0B 0A 09 00 A1

Which means:
EPROM: J-700355 V4.6.06
SOFTWARE: JS701192 V4.6.06
PRODUCT: 0BA09.00A1 (SERIAL)

[nlrb]

@viknet: just happy I could help

@Rene: thanks, I was indeed looking into the different settings. BTW: the last 4 bytes can just be 0.

The 3E command works as follows.

Code: Select all

0x3E index page len 0x00 0xB0 0x00 0x00 0x00 0x00 0x00

page: the settings page nr
index: the index in the page
len: the number of bytes to read

As examples

Code: Select all

Info              Page   Index  Len
Force pin code    0x01   0x11   0x02
User pin codes    0x01   0xFA   0x10
Serial            0x04   0x30   0x06
Panel type        0x04   0x36   0x02
Zone info         0x09   0x00   0x78
Keyfobs           0x09   0x78   0x40
Zone names        0x0B   0x40   0x1E

For panel type, the 2nd byte indicates:

Code: Select all

pmPanelType_t = { [0] = "PowerMax", [1] = "PowerMax+", [2] = "PowerMax Pro", [3] = "PowerMax Complete", [4] = "PowerMax Pro Part", [5] = "PowerMax Complete Part", [6] = "PowerMax Express }

The zone names are:

Code: Select all

pmZoneName_t = { "Attic", "Back door", "Basement", "Bathroom", "Bedroom", "Child room", "Closet", "Den", "Dining room", "Downstairs", "Emergency", "Fire", "Front door", "Garage", "Garage door", "Guest room", "Hall", "Kitchen", "Laundry room", "Living room", "Master bathroom", "Master bedroom", "Office", "Upstairs", "Utility room", "Yard", "Custom1", "Custom2", "Custom3", "Custom4", "Custom5", "Not Installed" }

The zone info consists of 4 bytes per zone. This looks to be:
Byte 1&2: PowerCode
Byte 3: Sensor type
Byte 4: 0xCT, where C = chime and T = zone type

Code: Select all

pmZoneType_t = { "Non-Alarm", "Emergency", "Flood", "Gas", "Delay 1", "Delay 2", "Interior-Follow", "Perimeter", "Perimeter-Follow", "24 Hours Silent", "24 Hours Audible", "Fire", "Interior" }

pmZoneChime_t = { "Chime Off", "Melody Chime", "Zone Name Chime" }

I would be very interested to see what people get back for byte 3 (& whether this is the sensor type)!
So far I believe I see the following:
95 = MCT-302
96 = MCT-302T
E4 = NEXT 9-85 MCW
6A/9A = MCT-425

Could be that only the lower 4 bits are relevant.

[nlrb]

To be more precise on the 0x3E command:

Code: Select all

0x3E index page len_l len_h max 0x00 0x00 0x00 0x00 0x00

page: the settings page nr
index: the index in the page
len_l + 256 * len_h = the number of bytes to read
max: the maximum size of a returned message (max: 0xB0)

This will return 0x3F messages of maximum size <max> until <len_l + 256 * len_h> bytes have been returned.

Another way to read the settings is to use the 0x5A message. The 0x5A message will return the settings a fixed-size return message 0x33.

Code: Select all

0x5A index page lines 0x00 0x00 0x00 0x00 0x00 0x00 0x00

page: the settings page nr
index: the index in the page
lines: number of return messages (with 8 bytes)

The 3rd way to read settings (which the PowerLink uses) is the 0x0A (start) message.

• Send 0D 08 F7 0A
• PowerMax will return a number of 0x33 messages
• The stop message (0D 0B F4 0A) marks the end

[Rene]

The sensor type info was just the information I was missing. I had a quick look and found the following:
C3/E4: Next 9-85 MCW
9A: MCT-425L
6A: MCT-425
85: MCT-302T
75: MCT-302T

I still have found more about the protocol that I have to document. I am still puzzling about the following messages:
0xA5 0x00 0x05 ...... (part of the status dump)
0xA5 0x00 0x07 ......
0xA5 0x00 0x08 ......
0xA5 0x00 0x09 ......
0xA5 0x00 0x0A ...... (0x0A - 0x0D are only returned by the Powermax Pro Part and Complete)
0xA5 0x00 0x0B ......
0xA5 0x00 0x0C ......
0xA5 0x00 0x0D ......


To determine the panel type more specific you can match the data from 0x36 0x04 with the following (grabbed from the .tdf files that come with the remote programmer software):
0x0000 PowerMax
0x0001 PowerMax LT
0x0004 PowerMax A
0x0005 PowerMax 108
0x0006 PowerMax LT 108
0x0009 PowerMax B
0x0009 PowerMax B SV
0x000a PowerMax A 112
0x000b PowerMax 112
0x000c PowerMax LT 112
0x000f PowerMax B 112
0x000f PowerMax B SV 112
0x0014 PowerMax A 113
0x0015 PowerMax 113-4
0x0016 PowerMax 113-6
0x0017 PowerArt 113
0x0018 PowerMax SC 113
0x0019 PowerMax SK 113
0x001a PowerMax 113-4-SV
0x001b PowerMax 113-4-T
0x001e PowerMax WSS
0x001f PowerMax SmithAndWesson
0x0100 PowerMax+
0x0103 PowerMax+ UK
0x0104 PowerMax+ JP
0x0106 PowerMax+ CTA
0x0106 PowerMax+ CTAM
0x0108 PowerMax+ GSM
0x010a PowerMax+ SH
0x010b PowerMax+ CF
0x010b PowerMax+ CFM
0x0112 PowerMax+ WSS
0x0112 PowerMax+ WSSM
0x0113 PowerMax+ 2INST
0x0113 PowerMax+ 2INSTM
0x0114 PowerMax+ HL
0x0115 PowerMax+ UK2
0x0116 PowerMax+ 2INST3
0x0116 PowerMax+ 2INSTM3
0x0118 PowerMax+ CF2
0x0118 PowerMax+ CFM2
0x0119 PowerMax+ 2INST2
0x0119 PowerMax+ 2INSTM2
0x011a PowerMax+ GSM2
0x011c PowerMax+ WSS33
0x011c PowerMax+ WSSM33
0x011d PowerMax+ UK3
0x0120 PowerMax+ 2INST33
0x0120 PowerMax+ 2INSTM33
0x0120 PowerMax+ ALPH
0x0121 PowerMax+ GSM3
0x0122 PowerMax+ CF3
0x0122 PowerMax+ CFM3
0x0124 PowerMax+ UK33
0x0127 PowerMax+ 2INSTM_MONITOR39
0x0127 PowerMax+ 2INST_MONITOR39
0x0128 PowerMax+ KeyOnOff
0x0128 PowerMax+ KeyOnOff_M
0x0129 PowerMax+ 2INSTM_MONITOR41
0x0129 PowerMax+ 2INST_MONITOR41
0x012a PowerMax+ 2INSTM_MONITOR42
0x012a PowerMax+ 2INST_MONITOR42
0x012b PowerMax+ 2INSTM_3_4_17
0x012b PowerMax+ 2INST_3_4_17
0x012c PowerMax+ 1_44_0
0x012d PowerMax+ CF3_1_45_0
0x012d PowerMax+ CFM_1_45_0
0x012e PowerMax+ SA(M)_1_46
0x012e PowerMax+ SA_1_46
0x012f PowerMax+ UK_1_47
0x012f PowerMax+ UK_3_4_17
0x0130 PowerMax+ SA UK_1_48
0x0132 PowerMax+ KeyOnOff_1_50
0x0132 PowerMax+ KeyOnOff_M_1_50
0x0201 PowerMax Pro
0x0201 PowerMax Pro M
0x0202 PowerMax Pro-Nuon
0x0202 PowerMax Pro-Nuon M
0x0204 PowerMax Pro-PortugalTelecom
0x0204 PowerMax Pro-PortugalTelecom M
0x020a PowerMax Pro-PortugalTelecom2
0x020a PowerMax Pro-PortugalTelecom2 M
0x020c PowerMax HW-V9 Pro
0x020c PowerMax HW-V9 Pro M
0x020d PowerMax ProSMS
0x020d PowerMax ProSMS M
0x0214 PowerMax Pro-PortugalTelecom_4_5_02
0x0214 PowerMax Pro-PortugalTelecom_4_5_02 M
0x0216 PowerMax HW-V9_4_5_02 Pro
0x0216 PowerMax HW-V9_4_5_02 Pro M
0x0217 PowerMax ProSMS_4_5_02
0x0217 PowerMax ProSMS_4_5_02 M
0x0218 PowerMax UK_DD243_4_5_02 Pro
0x021b PowerMax Pro-Part2 M 2_27
0x0223 PowerMax Pro Bell-Canada
0x0223 PowerMax Pro Bell-Canada M
0x0301 PowerMax LE
0x0301 PowerMax LE M
0x0302 PowerMax LE_NV
0x0302 PowerMax LE_NV M
0x0303 PowerMax LE_PortugalTelecom
0x0303 PowerMax LE_PortugalTelecom M
0x0307 PowerMax LE_1_0_07
0x0307 PowerMax LE_1_0_07 M
0x0308 PowerMax LE_NV_1_0_07
0x0308 PowerMax LE_NV_1_0_07 M
0x030a PowerMax LE_UK_DD243_1_1_03
0x030b PowerMax LE_COUNTERFORCE_1_0_06
0x030b PowerMax LE_COUNTERFORCE_1_0_06 M
0x0401 PowerMax Pro-Part
0x0401 PowerMax Pro-Part M
0x0402 PowerMax Pro-Part CellAdaptor
0x0402 PowerMax Pro-Part CellAdaptor M
0x0405 PowerMax Pro-Part_5_0_8
0x0405 PowerMax Pro-Part_5_0_8 M
0x0406 PowerMax Pro-Part CellAdaptor_5_2_04
0x0406 PowerMax Pro-Part CellAdaptor_5_2_04 M
0x0407 PowerMax KeyOnOff Pro-Part_5_0_8
0x0407 PowerMax KeyOnOff Pro-Part_5_0_8 M
0x0408 PowerMax UK Pro-Part_5_0_8
0x0408 PowerMax UK Pro-Part_5_0_8 M
0x0409 PowerMax UK-Sector Pro-Part_5_0_8
0x0409 PowerMax UK-Sector Pro-Part_5_0_8 M
0x040a PowerMax CP1 4_10
0x040a PowerMax CP1_M 4_10
0x040c PowerMax Pro-Part CellKey_4_12
0x040c PowerMax Pro-Part CellKey_4_12 M
0x040d PowerMax UK 4_13
0x040d PowerMax UK_M 4_13
0x040e PowerMax UK-Sector 4_14
0x040e PowerMax UK-Sector M 4_14
0x040f PowerMax UK 4_15
0x040f PowerMax UK_M 4_15
0x0410 PowerMax CP1 4_16
0x0410 PowerMax CP1_M 4_16
0x0411 PowerMax Pro-Part NUON Key 4_17
0x0411 PowerMax Pro-Part NUON Key 4_17 M
0x0433 PowerMax Pro-Part2 4_51
0x0433 PowerMax Pro-Part2 M 4_51
0x0434 PowerMax UK Pro-Part2 4_52
0x0434 PowerMax UK Pro-Part2 M 4_52
0x0436 PowerMax Pro-Part2 4_54
0x0436 PowerMax Pro-Part2 M 4_54
0x0437 PowerMax Pro-Part2 4_55
0x0437 PowerMax Pro-Part2 M 4_55
0x0438 PowerMax Pro-Part2 4_56
0x0438 PowerMax Pro-Part2 M 4_56
0x0439 PowerMax Pro-Part2 4_57
0x0439 PowerMax Pro-Part2 M 4_57
0x043a PowerMax 4_58
0x043a PowerMax M 4_58
0x043c PowerMax 4_60
0x043c PowerMax M 4_60
0x043e PowerMax Pro-Part2 4_62
0x043e PowerMax Pro-Part2 M 4_62
0x0440 PowerMax Pro-Part2 4_64
0x0440 PowerMax Pro-Part2 M 4_64
0x0442 PowerMax 4_66
0x0442 PowerMax M 4_66
0x0443 PowerMax 4_67
0x0443 PowerMax M 4_67
0x0444 PowerMax 4_68
0x0444 PowerMax M 4_68
0x0445 PowerMax 4_69
0x0445 PowerMax M 4_69
0x0446 PowerMax Pro-Part2 4_70
0x0446 PowerMax Pro-Part2 M 4_70
0x0447 PowerMax 4_71
0x0447 PowerMax M 4_71
0x0449 PowerMax 4_73
0x0449 PowerMax M 4_73
0x044b PowerMax 4_75
0x044b PowerMax M 4_75
0x0451 PowerMax 4_81
0x0451 PowerMax M 4_81
0x0452 PowerMax 4_82
0x0452 PowerMax M 4_82
0x0503 PowerMax UK LE-Part 1_5_00
0x0503 PowerMax UK LE-Part 1_5_00 M
0x050a PowerMax LE-Part GPRS
0x050a PowerMax LE-Part GPRS M
0x050b PowerMax LE-Part NV GPRS
0x050b PowerMax LE-Part NV GPRS M
0x050c PowerMax LE-Part GPRS-
0x050c PowerMax LE-Part GPRS- M
0x050d PowerMax LE-Part NV GPRS-
0x050d PowerMax LE-Part NV GPRS- M
0x050e PowerMax LE-Part GPRS- UK
0x050e PowerMax LE-Part GPRS- UK M
0x0511 PowerMax LE-Part GPRS 5_17
0x0511 PowerMax LE-Part GPRS M 5_17
0x0512 PowerMax LE-Part GPRS- UK M_5_18
0x0512 PowerMax LE-Part GPRS- UK_5_18
0x0533 PowerMax Complete 5_51
0x0533 PowerMax Complete M 5_51
0x0533 PowerMax LE-Part2 GPRS 5_51
0x0533 PowerMax LE-Part2 GPRS M 5_51
0x0534 PowerMax LE-Part2 5_52
0x0534 PowerMax LE-Part2 M 5_52
0x0536 PowerMax Complete 5_54
0x0536 PowerMax Complete M 5_54
0x0537 PowerMax LE-Part2 5_55
0x0537 PowerMax LE-Part2 M 5_55
0x053a PowerMax Complete 5_58
0x053a PowerMax Complete M 5_58
0x053b PowerMax Complete 5_59
0x053b PowerMax Complete M 5_59
0x053b PowerMax LE-Part2 5_59
0x053b PowerMax LE-Part2 M 5_59
0x053e PowerMax Complete 5_62
0x053e PowerMax Complete M 5_62
0x053e PowerMax LE-Part2 5_62
0x053e PowerMax LE-Part2 M 5_62
0x053f PowerMax LE-Part2 5_63_2
0x053f PowerMax LE-Part2 M 5_63_2
0x0540 PowerMax LE-Part2 5_64
0x0540 PowerMax LE-Part2 M 5_64
0x0543 PowerMax Complete 5_67
0x0543 PowerMax Complete M 5_67
0x0544 PowerMax LE-Part2 5_68
0x0544 PowerMax LE-Part2 M 5_68
0x0545 PowerMax LE-Part2 5_69
0x0545 PowerMax LE-Part2 M 5_69
0x0546 PowerMax Complete 5_70
0x0546 PowerMax Complete M 5_70
0x0547 PowerMax Complete 5_71
0x0547 PowerMax Complete M 5_71
0x0549 PowerMax Complete 5_73
0x0549 PowerMax Complete M 5_73
0x054b PowerMax Complete 5_75
0x054b PowerMax Complete M 5_75
0x0601 PowerMax Express
0x0601 PowerMax Express M
0x0603 PowerMax Express M_6_3
0x0603 PowerMax Express_6_3
0x0605 PowerMax Express M OEM_6_5
0x0605 PowerMax Express OEM_6_5
0x0607 PowerMax Express BBA_6_7
0x0607 PowerMax Express M BBA_6_7
0x0608 PowerMax Express 6_8
0x0608 PowerMax Express M_6_8
0x0609 PowerMax Express M OEM_6_9
0x0609 PowerMax Express OEM_6_9
0x060b PowerMax Express BBA_6_11
0x060b PowerMax Express M BBA_6_11
0x0633 PowerMax Express Part2 6_51
0x0633 PowerMax Express Part2 M 6_51
0x063b PowerMax Express Part2 6_59
0x063b PowerMax Express Part2 M 6_59
0x063e PowerMax Express Part2 6_62
0x063e PowerMax Express Part2 M 6_62
0x0645 PowerMax Express 6_69
0x0645 PowerMax Express M 6_69
0x0645 PowerMax Express Part2 6_69
0x0645 PowerMax Express Part2 M 6_69
0x0647 PowerMax Express Part2 6_71
0x0647 PowerMax Express Part2 M 6_71
0x0648 PowerMax Express Part2 6_72
0x0648 PowerMax Express Part2 M 6_72
0x0649 PowerMax Express Part2 6_73
0x0649 PowerMax Express Part2 M 6_73
0x064a PowerMax Secure Part2 6_74
0x064a PowerMax Secure Part2 M 6_74
0x064c PowerMax Express Part2 6_76
0x064c PowerMax Express Part2 M 6_76
0x064f PowerMax Express Part2 6_79
0x064f PowerMax Express Part2 M 6_79
0x064f PowerMax Secure Part2 6_79
0x064f PowerMax Secure Part2 M 6_79
0x0651 PowerMax Express Part2 6_81
0x0651 PowerMax Express Part2 M 6_81
0x0652 PowerMax Express Part2 6_82
0x0652 PowerMax Express Part2 M 6_82
0x0654 PowerMax Express 6_84
0x0654 PowerMax Express M 6_84
0x0654 PowerMax Express Part2 6_84
0x0655 PowerMax Express 6_85
0x0655 PowerMax Express M 6_85
0x0701 PowerMax PowerCodeG(M)_7_1
0x0701 PowerMax PowerCodeG_7_1
0x0702 PowerMax PowerCodeG(M)_7_2
0x0702 PowerMax PowerCodeG_7_2
0x0704 PowerMaster10 7_4
0x0704 PowerMaster10(M) 7_4
0x070c PowerMaster10 7_12
0x070c PowerMaster10(M) 7_12
0x070f PowerMaster10 7_15
0x070f PowerMaster10(M) 7_15
0x0710 PowerMaster10 7_16
0x0710 PowerMaster10(M) 7_16
0x0800 PowerMax Pro-Part2 2_27
0x0802 PowerMax PowerCodeG(M)_8_2
0x0802 PowerMax PowerCodeG_8_2
0x0803 PowerMaster30 8_3
0x0803 PowerMaster30(M) 8_3
0x080f PowerMaster30 8_15
0x080f PowerMaster30(M) 8_15
0x0810 PowerMaster30 8_16
0x0810 PowerMaster30(M) 8_16

[Bwired]

@Rene: Is it possible to update the main topic?, I lost track
Thanks.

[nlrb]

@Rene: thanks for the sensor type info!

So far it looks like:
x3/x4: PIR
x5/x6: Door sensor
xA: Smoke alarm

Regarding the A5 messages, I have also not been able to figure out the content >4. But the fact that the later models have more lines in the A5 message makes sense. This could be related to the partitions and that e.g. the PowerMaster-30 has 64 zones (so that wouldn't fit in the original A5 1-9).

BTW: I did the same with the .tdf files .

If you start updating the first post, then I also have the following additions.
A1 message
Byte 3 (arm code) can be:
0x00 disarm
0x04 arm
0x05 arm home
0x06 User test
0x10 Instant disarm
0x14 Instant arm
0x15 Instant arm home
These values are basically the same as Appendix A. BTW In appendix A: 0x01: Home Exit Delay, 0x02: Away Exit Delay

Short response messages
0x02: acknowledge
0x06: timeout
0x08: access denied
0x0A: start
0x0B: stop
0x0F: exit

A7 message
Byte 1: count of messages (1-4)
Byte 3, 5, 7, 9: Zone/User (See appendix E for a complete list of all log events)
Byte 4, 6, 8, 10: Log event (See appendix C for a complete list of all log events)

AB message (Powerlink messages)
Byte 2 = 0x03: check alive message
Byte 2 = 0x05: phone action

• Byte 4 = 0x01: calling user
  Byte 4 = 0x02: user acknowledged alarm by phone

Byte 2 = 0x0A: Powerlink enrollment

[nlrb]

The sensor type info was just the information I was missing. I had a quick look and found the following:
I still have found more about the protocol that I have to document. I am still puzzling about the following messages:
0xA5 0x00 0x05 ...... (part of the status dump)
0xA5 0x00 0x07 ......
0xA5 0x00 0x08 ......

What you probably already found is that the 0xA5 0x00 0x01 message shows the zones that have been violated during an alarm.

The 0xA5 0x00 0x07 message always appears when arming the system. I'm hoping this will contain the battery status of the wireless siren, but cannot confirm it.

[Rene]

Yeh, I already knew, in fact this is the complete decoding:

Code: Select all

A5 00 01 00 00 00 00 00 00 00 00 43
          |  |  |  |  |  |  |  |
          |  |  |  |  |  |  |  Sab. alarm zone 25-30 + BIT7: ?, BIT8: Panel
          |  |  |  |  |  |  Sab. alarm zone 17-24
          |  |  |  |  |  Sab. alarm zone 9-16
          |  |  |  |  Sab. alarm zone 1-8 (1=alarm)
          |  |  |  Alarm zone 25-30 + BIT7:, BIT8: Panel
          |  |  Alarm zone 17-24
          |  Alarm zone 9-16
          Alarm zone 1-8 (1=alarm)

I am thinking the 0xA5 0x00 0x07 also says something about the status of the GSM module (strength of the signal, ability to send etc.)

[nlrb]

Hi guys,

I need some help.

The newer PowerMax models with partition support also have auto-enrollment for the Powerlink. Now the following happens when trying to start download mode after an INIT.

Code: Select all

<-PM- 0D AB 0A 00 01 00 00 00 00 00 00 00 43 06 0A
----> 0D AB 0A 00 00 56 50 00 00 00 00 00 43 60 0A
<-PM- 0D 02 43 BA 0A 
<-PM- 0D AB 03 00 1E 00 35 32 36 37 00 00 43 1B 0A
----> 0D 02 43 BA 0A 
----> 0D AB 0A 00 01 00 00 00 00 00 00 00 43 06 0A 
<-PM- 0D 02 43 BA 0A 
----> 0D 24 00 00 56 50 00 00 00 00 00 00 35 0A 
<-PM- 0D 02 FD 0A 
<-PM- 0D 25 03 00 02 00 00 00 00 00 00 00 D5 0A 
----> 0D 02 FD 0A 

Normally on a 24 message the response would be a 3C message. In this case the response is a 25 message.

Any idea how a Powerlink(2) responds to a 25 message and why it occurs?

[uAlex73]

Just a quick question, is the communication the same for all PowerMax devices? I am thinking of getting a PowerMax Express, and it isn't mentioned in the correct threat as working

[nlrb]

Yeh, I already knew, in fact this is the complete decoding:
I am thinking the 0xA5 0x00 0x07 also says something about the status of the GSM module (strength of the signal, ability to send etc.)

This is what I have so far on the A5-07 message.

Code: Select all

Bytes: 15	Mode: Normal	
01	02	03	04	05	06	07	08	09	0A	0B	0C	0D	0E	0F
0D	A5	rows 07	D1	D2	D3	D4	D5	D6	D7	D8	crc  43	0A

Byte  Description	  Bits				   Comment
D1	 Tamper memory	See device list*	Bit set if device has been open
D2	 Tamper open	  See device list*	Bit set if device is currently open
D3	 Inactive		  See device list*	Bit set if device is inactive
D?	 AC failure		See device list*	Bit set if device has an AC failure
D?	 Low battery	  See device list*	Bit set if device has a low battery
D6	 Enrolled		  See device list*	Bit set if device has been enrolled

*Device list bits:
1 (x01)	2 (x02)	3 (x04)	4 (x08)	5 (x10)	6 (x20)	7 (x40)	8 (x80)
WLSiren 1 WLSiren 2 ??		  ??		  2w-Kpad 1 2w-Kpad 2 ??	     ??

As you can see not all bytes are clear yet - the D? are a guess.

If you have a GSM module then you should be able to figure out which bit is for the GSM.

I would not expect GSM signal strength to be in the status messages, but according to the Powerlink database the following information should be available:

• low_battery
• ac_failure
• tamper_open
• tamper_memory
• rssi_low
• net_trouble
• message_send_fail
• tamper_open
• tamper_memory
• gsm_pmax_communication_trouble

[nlrb]

Any idea how a Powerlink(2) responds to a 25 message and why it occurs?

I've think I've figured out why it occurs. If you send a message to the PM to soon after the last receive, you can get 'garbage' back. So my assumption is that the 25 message is not an actual message. If you make sure that there is ~500 ms delay between the last receive and a new send, then all communication goes OK.