Office: 503-443-2000 | Fax: 503-968-1877 | Email:
Nu Tech Software Solutions is an Information Technology Services and Software Development company.
We focus on highly available applications for both the Internet and Enterprise. Expertise in both the Microsoft and Linux/LAMP environments.
If you need a Content Management System (CMS) we can do it! We are experienced with both Joomla! and Drupal!
Contact us at: Phone: (503) 443-2000, Email:

Home
AlarmDecoder/AD2USB
Contact Us
AlarmDecoder Forum
FAQ
Online Store
 Home
Welcome, Guest
Please Login or Register.    Lost Password?
Firmware Support (1 viewing) (1) Guest
Discuss our ADEMCO Emulator hardware.
Go to bottom Favoured: 15
TOPIC: Firmware Support
#5
Firmware Support 10 Years, 2 Months ago Karma: 7  
The latest firmware for the AD2USB can be found at the top of the AD2USBGUI forum here

Please post any firmware issues you see or features you would like added here.

Firmware documentation V2

Output Format
All lines that start with ! are information
A line that starts with !> is a prompt for input
All other lines are real panel data

Each line ends with a CR LF also known as rn or chr(10),chr(13)

In a normal panel output message the data has 4 sections.

If the config bit 0x0008 is set on firmware version V2.2a.8+ then the panel message line will begin with !KPM:

Section #1 the bit fields easy to parse interpretations of the
raw panel code. Each bit can be one of three states.
0 = Off 1 = On - = Unknown or float or in the case of BEEP
a single digit number.


Example: [1000000100000000----]
Position #1 = READY
Position #2 = ARMED AWAY
Position #3 = ARMED HOME
Position #4 = BACK LIGHT
Position #5 = Programming Mode
Position #6 = Beep 1-7 ( 3 = beep 3 times )
Position #7 = A ZONE OR ZONES ARE BYPASSED
Position #8 = AC Power
Position #9 = CHIME MODE
Position #10 = ALARM OCCURRED STICKY BIT (cleared 2nd disarm)
Position #11 = ALARM BELL (cleared 1st disarm)
Position #12 = BATTERY LOW
Position #13 = ENTRY DELAY OFF (ARMED INSTANT/MAX)
Position #14 = FIRE ALARM
Position #15 = CHECK ZONE
Position #16 = PERIMETER ONLY (ARMED STAY/NIGHT)
Position #17 - #20 unused

Section #2 Numeric indicator if message is zone 3 fault this will be 003

Section #3 Raw panel binary message data
Example: [f70700060010801c08020000000000]
This is the raw panel binary message data. Each
byte is represent as a 2 char hex bytes.

Byte 2-5 is the 32 bit keypad address mask in the above example the
mask is 07000600. This mask defines if the message should be listened
to based upon the devices address. The addresses for every bit in the
32 bit word are as follows from the MSB to LSB
07,06,05,04,03,02,01,00
15,14,13,12,11,10,09,08
23,22,21,20,19.18,17,16
31,30,29,28,27,26,25,24

If you have multiple partitions setup a keypad is assigned to a given
partition and may show "READY" where another keypad on the other
partition may show "ARMED" so be aware if the issues of being able to
see all messages from the alarm panel and only use the ones are intend
to listen to. You may also want to ignore System messages that have no
address mask bits set and are intended for common keypads or monitoring
multiple zones.



Section #4 Alpha Keypad Message
Example: "****DISARMED**** ZONES FAULTED "
This is in quotes and is the message that is displayed on an alpha keypad.

Here is a full message from a vista 50p


[01000001000---------],0e5,[f707000600e5800c0c020000],"ARMED ***AWAY***** ALL SECURE **"


With firmware 2.2a.8+ and config bit 0x0008 set.

!KPM:[001000010000--------],010,[f70700060010808c08020000],"ARMED ***STAY** ZONE BYPASSED "


The alarm panel does not sent out CLEARED messages when a zone is restored. To determine if a zone is clear you have to watch all faulted zones and if one stops reporting as faulted consider it restored. So you have to track the state of the zone messages. To get a list of faulted zones send a * to the panel when you see a message that contains "Hit * for faults". You will then get a list of faulted zones. Each zone is sent out in numeric order from lowest to highest. If a zone faults in the middle of sending out a faulted zone list it will display the latest fault then continue sending out faults that are for zones that are larger then the newest fault.


Keyboard Commands
= reboot
C Configure device string #2
! Configure device via prompts
L Virtual Zone expander message input

To send keypad characters to the panel the following
characters are valid.
0123456789*#
F1 = chr(1)+chr(1)+chr(1)
F2 = chr(2)+chr(2)+chr(2)
F3 = chr(3)+chr(3)+chr(3)
F4 = chr(4)+chr(4)+chr(4)
** older firmware you would send chr(1) one time in the
newer firmware you must send it 3 times. This was done to
prevent false alarms.

#2 To configure the device send a C followed by
the name/value pairs of any options you want to change
For example to change the address of the device you
would send CADDRESS=18 To change multiple items simple
separate each pair with an & so to change the address and
enable the first zone expander and set the mask you would
send CADDRESS=18&EXP=YNNNN&CONFIGBITS=0000&MASK=ffffffff Sending a C by
itself will report back the current configuration values
as a NAME/VALUE pairs.

Configuration Definitions
All names are as follows with the number of characters and the data type mask. Every setting can also be changed via the Menu configuration prompt using the ! command.


ADDRESS XX (0-9)
  • Default address assigned the AD2USB when sending messages to the panel

CONFIGBITS XXXX (0-9a-f) default FF00
  • 0x0001: REPORT AUI MESSAGES

  • 0x0002: REPORT KEYPAD PRESS EVENTS

  • 0x0004: NO Prompts using 'L' and '|' commands better for uP control(note #2)

  • 0x0008: prefix panel messages with !KMP(note #2)

  • 0x0100: REPORT RFX MESSAGES



MASK XXXXXXXX (0-9a-f)
  • Address mask filter for alpha messages

EXP XXXXX (Y/N)
  • Enable emulation of zone expanders 1-5

REL XXXX (Y/N)

LRR X (Y/N)
  • Enable emulation of a Long Range Radio expander

DEDUPLICATE X (Y/N)
  • Remove duplicate ALPHA messages


Diagnostic LED
A heartbeat for the USB command and control thread. Not active in boot loader.

!EXP Messages

If you have one or more zone expanders connected to the alarm panel you will be able to see raw messages from the zone expander as zones are faulted.

The EXP messages has the following format It starts with the following "!EXP:" with no quotes the next section is the zone expander address followed by a comma then the channel on the expander 1-8 followed by a comma and finally the raw data for that channel.

Example of zone expander at address 7 input #1 faulting and then restored.
!EXP:07,01,01
!EXP:07,01,00

!REL Messages

If you have one or more relay expanders connected to the alarm panel you will be able to see raw messages from relay as it is opened and closed.

The REL messages has the following format It starts with the following "!REL:" with no quotes the next section is the relay expander address followed by a comma then the channel on the relay 1-4 followed by a comma and finally the raw data for that channel.

Example of relay expander at address 12 relay #1 closing and then opening.
!REL:12,01,01
!REL:12,01,00

Note) See this thread for more details on how to program your panel to use this feature.





!RFX Messages

If you have a RF receiver attached to your alarm you will see messages from any 5800 RF device in the range of the receiver regardless if the alarm panel was configured to listen to the 5800 device.

When the alarm is armed stay you wont see any "FAULT" messages for interior zones so if you have motion sensors in your building and you arm stay you loose visibility of these faults. One option is to put the interior sensors on a separate partition so you still see these zones and the outside sensors on a separate zone. This would allow you to see faults inside of the building while the outside is armed. Another option is to listen directly to the RF sensors messages and use these to control your home automation needs.

The RFX messages has the following format It starts with the following "!RFX:" with no quotes the next section is the 7 digit Serial Number of the RF device followed by a comma and the 8 bit hex message from the device.

This is a 5800Micra sensor faulting
!RFX:0180036,80

This is a 5800Micra sensor restoring
!RFX:0180036,00

This is a 5804 keyfob pressing the loop 2 button and
it has a low battery.
!RFX:0307854,22


Each bit of the 8 bit message has a meaning as follows.

bit Meaning
============
1 UNKNOWN at this time
2 battery
3 supervision
4 UNKNOWN at this time
5 loop 3
6 loop 2
7 loop 4
8 loop 1

Refer to the "5800 SERIES TRANSMITTER INPUT LOOP IDENTIFICATION"
section of your alarms programming manual for what loop each device sends.



Zone Expander Emulator
If you have a zone expander emulation enabled you can send faults and clear for a zone by sending an L followed by the two digit zone number padded with zeros followed by a 0 1 or 2

So to fault zone 09 and you are emulating the first zone expander you would send L091 to open the zone and to clear that zone you would send L090. To fault a zone and simulate a wire problem short etc you would send L092

The following features are currently only available for v2.2 hardware with v2.2a.3 or later firmware

Long Range Radio Emulator !LRR Messages

If you have a Long Range Radio device attached or have the Long Range Radio Emulator enabled the AD2USB will report LRR messages from the panel to the radio.

You can emulate a LRR with the AD2USB by enabling it in the AD2USB configuration. If you already have a IP/GSM or similar device which uses the LRR interface then do not enable the emulation on the AD2USB.

To be able to see the LRR messages, LRR communication module must be enabled in programing mode. These are the fields, and suggested entries:
  • *29 - 1, to enable the LRR or IP/GSM device

  • *49 - 5, receive all signals on Primary and Secondary destinations (Check with your alarm company before changing)

  • *54 - 0, send signals to the Primary and Secondary destinations (see sec. 55)

  • *55 - 0, if using the ad2usb virtual LRR. Otherwise, consult with your alarm company.

  • *60 - *76 - enable all by entering 1's for each field.

The LRR message has the following format. Each message starts with !LRR:. The next section is the EVENT DATA followed by a comma ,then the PARTITION followed by a comma and finally the EVENT TYPE.

EVENT DATA - Either the User Number who preformed the action or the zone that was bypassed.

PARTITION - The panel partition the event applies to. 0 indicates all partitions such as ACLOSS event.

EVENT TYPES - One of the following events. Note: the programming mode for enabling each type is also provided.
  • ALARM_EXIT_ERROR - *59
    TROUBLE - *60
    BYPASS - *61
    ACLOSS - *62
    LOWBAT - *63
    TEST_CALL - *64
    OPEN - *65 Note requires *66 Enabled also
    ARM_AWAY,ARM_STAY - *66
    RFLOWBAT - *67
    CANCEL - *68
    RESTORE - *70
    TROUBLE_RESTORE - *71
    BYPASS_RESTORE - *72
    AC_RESTORE - *73
    LOWBAT_RESTORE - *74
    RFLOWBAT_RESTORE - *75
    TEST_RESTORE - *76
    ALARM_PANIC - N/A always on
    ALARM_FIRE - N/A always on
    ALARM_ENTRY - N/A always on
    ALARM_AUX - N/A always on
    ALARM_AUDIBLE - N/A always on
    ALARM_SILENT - N/A always on
    ALARM_PERIMETER - N/A always on

Example LRR Messages showing User 12 arming/disarming
!LRR:012,1,ARM_STAY
!LRR:012,1,ARM_AWAY
!LRR:012,1,OPEN
!LRR:003,1,BYPASS


Notes:
#2. Available on V2.2a.8+ firmware
mathewss (Admin)
Admin
Posts: 512
graph
User Offline Click here to see the profile of this user
Gender: Male
Logged Logged  
 
Last Edit: 2013/12/02 14:17 By mathewss.
 
struct SoftwareProfessional {
double salary;
long lunches;
float jobs;
char unstable;
void work;
short tempers;
};
 
The administrator has disabled public write access.  
#93
Re:Firmware Support 8 Years, 11 Months ago Karma: 8  
Section #2 Numeric indicator if message is zone 3 fault this will be 03
Is there more information on section 2 of the message? It is clear, from the example, that if the message is a FAULT section 2 contains the faulted zone. But, what does it mean with other message types. For example, what does the 08 mean in the following message:
Code:

[100000011000--------],08,[f700001b1008001c28020000]," DISARMED [ CHIME   Ready to Arm  "
berkinet (Moderator)
Moderator
Posts: 159
graphgraph
User Offline Click here to see the profile of this user
Location: SF Bay Area
Logged Logged  
 
The administrator has disabled public write access.  
#94
Re:Firmware Support 8 Years, 10 Months ago Karma: 7  
AFAIK that field can contain some other data but it is 99% the zone.

In the case when the panel is "ready" i think it will just show the last zone that was restored or faulted.

Could you do a few tests to confirm this? Just fault / restore zones and see what that field ends up with.

If this is true we can update the docs on the forums to make a note of this for others.

Thanks
Sean M


berkinet wrote:
Section #2 Numeric indicator if message is zone 3 fault this will be 03
Is there more information on section 2 of the message? It is clear, from the example, that if the message is a FAULT section 2 contains the faulted zone. But, what does it mean with other message types. For example, what does the 08 mean in the following message:
Code:

[100000011000--------],08,[f700001b1008001c28020000]," DISARMED [ CHIME   Ready to Arm  "
mathewss (Admin)
Admin
Posts: 512
graph
User Offline Click here to see the profile of this user
Gender: Male
Logged Logged  
 
struct SoftwareProfessional {
double salary;
long lunches;
float jobs;
char unstable;
void work;
short tempers;
};
 
The administrator has disabled public write access.  
#95
Re:Firmware Support 8 Years, 10 Months ago Karma: 8  
mathewss wrote: Could you do a few tests to confirm this? Just fault / restore zones and see what that field ends up with.

If this is true we can update the docs on the forums to make a note of this for others.]

Well, we can update the docs I faulted a couple of zones and then armed (STAY) and dis-armed the system. Here is what I captured from the ad2usb
Code:

[100000011000--------],08,[f700001b1008001c28020000]," DISARMED CHIME   Ready to Arm  "
[000003011000--------],35,[f700001b1035030028020000],"FAULT 35 LIBRARYSOUTH DOOR      "
[100000011000--------],08,[f700001b1008001c28020000]," DISARMED CHIME   Ready to Arm  "
[100100011000--------],08,[f700001b1008001c28020000]," DISARMED CHIME   Ready to Arm  "
[000100011000--------],03,[f700001b1003000028020000],"FAULT 03 ENTRY  HALL MOTION     "
[100100011000--------],08,[f700001b1008001c28020000]," DISARMED CHIME   Ready to Arm  "
[001103011000--------],60,[f700001b1060038028020000],"ARMED ***STAY***May Exit Now  60"
[001100011000--------],59,[f700001b1059008028020000],"ARMED ***STAY***May Exit Now  59"
[001100011000--------],58,[f700001b1058008028020000],"ARMED ***STAY***May Exit Now  58"
[001100011000--------],57,[f700001b1057008028020000],"ARMED ***STAY***May Exit Now  57"
[001100011000--------],56,[f700001b1056008028020000],"ARMED ***STAY***May Exit Now  56"
[100101011000--------],08,[f700001b1008011c28020000]," DISARMED CHIME   Ready to Arm  "
[100100011000--------],08,[f700001b1008001c28020000]," DISARMED CHIME   Ready to Arm  "
[100101010000--------],08,[f700001b1008011c08020000],"****DISARMED****  Ready to Arm  "
[000100010000--------],03,[f700001b1003000008020000],"FAULT 03 ENTRY  HALL MOTION     "
[100100010000--------],08,[f700001b1008001c08020000],"****DISARMED****  Ready to Arm  "

The second field reliably shows "08" on the DISARMED messages, regardless of the zone that was faulted. But, notice that it also displays the seconds during the arm countdown. and, as you noted, the faulted zone.

I also noticed a few things in the third (binary data) field. The first 5 bytes seem to stay at "f7 00 00 1b 10," at least for the simple tests I have done. Byte 6 seems to echo the second section (discussed above). Byte 7 seems to contain the chime count (also shown in bit 6 of section 1). Byte 8 seems to show the Armed status: 00=Faulted; 1c=Ready; oc=Armed (Away) & 80 Armed (Stay). Byte 9 also changes, but I haven't figured out what it indicates. Finally, bytes 10-12 seem to remain at "02 00 00."

Also, I have observed that the first 3 bits of section one can be taken as a binary number (lsd on the right) with the following decode (in base 10) of:
0 = Faulted
1 = Armed Home (Stay)
2 = Armed Away
4 = Ready

I am not sure if there are other legal combinations, but there could be: 0 - 8.

Clearly more testing required.
berkinet (Moderator)
Moderator
Posts: 159
graphgraph
User Offline Click here to see the profile of this user
Location: SF Bay Area
Logged Logged  
 
The administrator has disabled public write access.  
#96
Re:Firmware Support 8 Years, 10 Months ago Karma: 7  
I should probably better describe what section #1 is.

Section #1 is my decoding of data in section #3. The idea is that it would be easier to just read the characters in section #1 as apposed to doing any parsing of section #3.

Section #3 is raw data from the panel section #1 is my "interpretation" of data I have identified as having specific functions. Such as ARMED etc. The data in section #1 should not be considered binary data but as flags.

In general section #2 is a "Numeric" indicator for keypads that are not Alpha. This would be displayed on a non alpha display. This comes from hex byte #6 in section #3 again just parsed out for ease of use by your own interface.

So why is it 8... Hmm. not sure should
Re
Sean M
mathewss (Admin)
Admin
Posts: 512
graph
User Offline Click here to see the profile of this user
Gender: Male
Logged Logged  
 
struct SoftwareProfessional {
double salary;
long lunches;
float jobs;
char unstable;
void work;
short tempers;
};
 
The administrator has disabled public write access.  
#174
Re:Firmware Support V2 8 Years, 8 Months ago Karma: 8  
I am now running the new V2 firmware and have noticed a new message type in the raw data. I am seeing occasional data that looks like:
!RFX:0569847,20

Any ideas what this is?

EDIT: Duh. Just figured it out, it is the raw event from a wireless device.
berkinet (Moderator)
Moderator
Posts: 159
graphgraph
User Offline Click here to see the profile of this user
Location: SF Bay Area
Logged Logged  
 
Last Edit: 2010/05/14 17:27 By berkinet.
 
The administrator has disabled public write access.  
Go to top





Lost Password?
©2019 Nu Tech Software Solutions, Inc. | Terms and Conditions | Service Level Agreement | Acceptable Use Policies | Contact Us