The protocol elements that I figured out so far are:
Code: Select all
Messages To Panel:
AB Message (15Byte): 0D AB 0A 00 01 00 00 00 00 00 00 00 43 06 0A
Sent to start panel reporting
02 Message (4Byte): 0D 02 FD 0A
Must be sent to panel to acknowledge messages
Messages From Panel:
02 Message (5Byte): 0D 02 43 BA 0A
Acknowledge AB message sent to panel
A5 Message (15 Byte): 0D A5 XX <TYPE> <ARM> <DEVICE> <ZONE> <EVENT> XX XX XX XX XX XX 0A
General event indication
TYPE, byte 4:
0x04 - event (for type see byte 6)
ARM, byte 5:
0x00 - disarmed
0x01 - arming home
0x02 - arming away
0x03 - follow mode
0x04 - alarm activated home
0x05 - alarm activated away
DEVICE, byte 6:
0x0X - alarm event (alarm activated)
0x2X - sensor event (evaluate byte 8 to determine type of event)
the lower 4 bit of byte 6 indicate
bit 1 - 0:not ready to arm
1:ready to arm
bit 2 - 0:no alarm in memory
1:alarm in memory
bit 3 - 0:no tamper
1:system tamper
0x4X - arming event (evaluate byte 5 to determine type of arming)
the lower 4 bit of byte 6 indicate
bit 1 - 0:not ready to arm
1:ready to arm
bit 2 - 0:no alarm in memory
1:alarm in memory
0x6x - same as 0x2X but while arming (exit delay)
ZONE, byte 7
the zone id
EVENT, byte 8
0x01 - tamper open
0x02 - tamper close
0x03 - open
0x04 - close
0x05 - movement
(I expect others will be: flood, fire, ...)
A7 Message (15 Byte): 0D A5 XX XX XX <TYPE> XX XX XX XX XX XX XX XX 0A
General panel status indication
TYPE, byte 6:
0x0X - alarm
0x06 tamper alarm on (sensor)
0x07 tamper alarm on (panel)
0x1X - alarm off
0x13 low battery alarm of
0x16 tamper alarm off (sensor)
0x17 tamper alarm off (panel)
0x21 - low battery alarm
0x51 - armed home
0x52 - armed away
0x55 - disarmed
0x60 - admin login on panel
0x61 - admin logout on panel
Code: Select all
Window Zone 07 open
0D A5 00 04 00 20 07 03 00 03 AF 0F 43 27 0A
Window Zone 07 close
0D A5 00 04 00 21 07 04 00 03 AF 0F 43 25 0A
Movement Zone 11
0D A5 00 04 00 21 0B 05 00 03 AF 0F 43 20 0A
Movement in Zone 11 with tamper alarm in memory
0D A5 00 04 00 23 0B 05 00 03 AF 0F 43 1E 0A
Door Open in Zone 01 while arming away (exit delay)
0D A5 00 04 02 60 01 03 00 03 00 00 43 A9 0A
Door Close in Zone 01 while arming away (exit delay)
0D A5 00 04 02 61 01 04 00 03 00 00 43 A7 0A
Arming Away
0D A5 00 04 02 41 00 00 00 03 AF 0F 43 0E 0A
Arming Home
0D A5 00 04 01 41 00 00 00 03 AF 0F 43 0F 0A
Disarming
0D A5 00 04 00 41 00 00 00 03 AF 0F 43 10 0A
Not ready to arm
0D A5 00 04 00 40 00 00 00 03 AF 0F 43 11 0A
Example A7 Messages
Disarmed
0D A7 01 00 20 55 00 00 00 03 AF 0F 43 DC 0A
Armed Home
0D A7 01 00 20 51 00 00 00 03 AF 0F 43 E0 0A
Armed Away
0D A7 01 00 21 52 00 00 00 03 00 00 43 9D 0A
Tamper With Panel
0D A7 01 00 00 07 00 00 40 03 AF 0F 43 0B 0A
Tamper Restore On Panel
0D A7 01 00 00 17 00 00 00 03 AF 0F 43 3B 0A
Tamper With Sensor
0D A7 01 00 0F 06 0F 01 00 03 AF 0F 43 2D 0A
Tamper Restore With Sensor
0D A7 01 00 0F 16 0F 02 00 03 AF 0F 43 1C 0A