Visonic Powermax Integration

Other Devices & Integrations Door Locks & Sensors
1

I have a Visonic Powermax+ alarm system which I connected to vera. It required to build some hardware and the interaction with vera is limited but it works reasonably well.

The powermax has an output which is normally connected to an X-10 PLC interface device (for example, XM10 Two-way PLC Interface). The powermax can be programmed to report events via X-10. For example, if a particular motion sensor connected to the powermax is tripped an X-10 command (e.g. A 10 ON) can be sent via X-10. Also, for events such as Arm or Disarm it is possible to send X-10 commands. The powermax also has two inputs for wired sensors (two additional sones Z29 and Z30). These are normally used to connect things like a wired open/close sensor.

I constructed a little board with a PIC microcontroller (I call it powermaxuart) which connects to the X-10 PLC interface and the Z29/Z30 interfaces at the powermax and at the other side to the vera via usb/serial. The board translates events from the powermax (transmitted as X-10 signals before power line modulation) into ASCII text that can be read by vera. In the other direction vera can send ASCII commands to the board which translates that into inputs for the Z29/Z30 input.

For vera UI4 I created a powermax device which shows the status of the powermax (Armed, Disarmed, …). The alarm panel has a number of child devices which represent two switches (Z29/Z30), motion sensors present in the powermax system, door sensors of the powermax and as well the AUX button on the powermax remote.

For example, now the powermax can use z-wave motion sensors connected to vera via the Z29/Z30 inputs. It is also possible to use the sensors attached to the powermax within vera.

I will make the board design and code for vera public available as soon as I have cleaned it up a bit more and I find the time (In case anyone would like to try it out).

There are some things that do not work and I would like to have as well. The powermax can only report via the X-10 interface but cannot receive commands. So, it is not possible to arm/disarm the powermax from vera (you can only see the status). Visonic sells an additional device called powerlink which talks via rs232 to the powermax. Essentially, the powerlink does similar things as vera, it provides a web frontend to control the powermax. The problem is that the powerlink device is pricey, has security issues and has an ugly not programmable interface (I hate it). So the correct way would be to use the serial interface of the powermax and use vera instead of the powerlink to control it. The problem is that visonic does not provide a spec of the protocol running on the rs232 link. The only way forward I see is to buy a powerlink, then analyse the rs232 protocol running between powermax and powerlink and then to reverse engineer the protocol spec. This is doable but very time consuming and a bit pricey (as I have to get a powerlink which I will throw in the bin when done).

Is there anyone out there that has a notion of the powermax/powerlink rs232 protocol. Any help is welcome.

2

@utz,
Not the answer, but there was an integration option discussed before in this thread that might provide some clues:

http://forum.micasaverde.com/index.php?topic=1637.msg5543#msg5543
3

There are a number of integration options/attemps out there. However, nothing is as complete as a proper rs232 interface with vera would be (But for that I need to get a spec of the protocol visonic is guarding like Coca-Cola the secret of their brew).

  • The Alphatronics solution: a receiver only that cuts out the powermax alarm panel and you can receive the signals from the sensors directly at the vera. Thus, vera could become the central controller for the alarm and you can then throw the powermax central unit in the bin. However, I would like to have a system where vera is the central control system but other sub systems of the house can work independently (such as alarm; heating; electricity; pets; …). Thus, when I mess up one subsystem with my tinkering the others still work (everything going through vera would create a single point of failure).

  • The rfxcomm solution: similar to the Alphatronics solution but with send and receive capability. This would potentially work as the transmit function could mimic the keyfob arming and disarming the system. Thus you could receive sensor data and interact with the powermax. What would be missing is proper interrogation of the system regarding faults, messages in memory, …

  • The hacked powerlink: someone managed to hack the powerlink box and it is possible to add code. Thus, it might be possible to integrate closely the powerlink box with vera. But again you would need to analyse the code binaries living on the powerlink and it might be easier to then go directly and look at the protocol on the rs232.

Finally, hardware for all above solutions cost well over 100€ while my solution at the moment was less then 10€ (I assume, i had the pieces anyway).

4

I send some mails to visonic about the protocol on the rs232 interface.

The response was that they do not consider “DIY users” as important enough to give them the protocol spec. However, it seems that system integrators get the spec (so I guess its out there but probably with NDA).

Well, I have to see if I can get a powerlink for cheap (seems not to be sold in the UK) and then I have to figure out the protocol myself.

5

I started to reverse engineer the powermax+ serial protocol. I could use some help. In particular it would be nice if someone that is the owner of a PowerLink module could run a sequence of arming/disarming/… via the powerlink and then send me the logfile on the powerlink (apparently the serial communication will be logged).

I bought a Visonic RS-232 Adaptor Kit which can be attached to the powermax+ and provides an RS232 interface to the alarm panel. It would be possible to make your own cable/connector but for the price of £30 I decided its not worth it (Essentially its a max232 with a cable). The adaptor kit comes as well with the Powermax Programmer Software which allows you to upload and download alarm panel configuration. The software does not allow you to do more; for example arm the system or receive events from sensors (the interesting bit you would like to mimic with vera).

The Powermax Programmer Software has a logfile which records messages sent between Powermax+ (called Panel) and Powermax Programmer Software (called PC). From this I could figure out some protocol basics. Then I looked at the procedures for remote programming. Finally I configured the powermax+ to have a powerlink module attached and tried to pretend my pc is a powerlink. As I do not have a powerlink device it is guesswork (I do not know what a powerlink would normally send).

In summary, it is possible to get the panel to talk over the serial port. I can get sensor events and arm/disarm events. With a powerlink module at hand it would be possible to figure out how to arm/disarm/… the panel via serial port as well. Thus, in general it is possible to integrate visonic alarm panels with vera. I will keep deciphering this protocol and when I have enough information together I will put together a plugin for vera.

– BASICS –

Message format: 0D XX XX XX … 0A

  • All messages start with 0D and end with 0A. Messages have variable length. Messages can contain 0A as well within the message (does not help for parsing)
  • The first byte seems to be the message type field

ACK message: 0D 02 FD 0A

  • All messages need to be acked. If you do not send an ACK the message is repeated and after several repeats the communication link drops an has to be established again.

– PROGRAMMING MODE –

Establish communication for remote programming (PC->Panel): 0D 24 00 00 AA AA 00 00 00 00 00 00 86 0A

  • This message sets the panel in programming mode (it will indicate this on the display)
  • The sequence AA AA is a programmer password. If your panel has set the password different you need to change this.
  • after sending this command upload/download of configuration and the event list is possible

Panel Identification (Panel->PC): 0D 3C FD 0A 00 00 24 01 00 00 02 07 8D 0A

  • Sent by the panel after the previous message
  • Might contain version number of the powermax panel

Ready (Panel->PC): 0D 06 F9 0A

  • Sent periodically
  • needs an ack or communication link closes

Close communication for remote programming: 0D 0F F0 0A

  • This closes programming mode and resets the panel.

Variable Upload Request ask panel to send VUL data (PC->Panel): 0D 3E 18 01 01 00 B0 C9 A2 44 00 00 46 0A

  • This message is used to request a chunk of configuration data from the panel

Variable UpLoad (receive data) (Panel->PC): 0D 3F 18 01 01 00 A6 0A

  • This message contains a chunk of data and is sent as response to the previous message

– POWERLINK –

Establish communication (Panel->PC): 0D AB 0A 00 01 00 00 00 00 00 00 00 43 06 0A

  • After configuring in the panel that a powerlink is present this message is sent out on the serial interface
  • As all messages this one needs to be acked
  • After the ACK, the panel believes a powerlink is present and starts sending message about events on the serial port

Keep Alive (Panel->PC): 0D A5 00 02 00 00 00 00 00 00 00 00 43 15 0A

  • If there are no events to report, the panel sends out this message
  • I believe it is a keep-alive; an ack needs to be sent

Establish communication (PC->Panel): 0D AB 0A 00 01 00 00 00 00 00 00 00 43 06 0A

  • If the PC does not respond with an ACK to messages from the panel the panel repeats the message
  • after a number of unsuccessful transmission, the communication link drops
  • Sending this message opens the communication again (I copied the same message used by the panel to initialise communication)
  • It seems to work but it might be that the powerlink would send a slight modification normally

Movement Event (Panel->PC): 0D A5 00 04 00 21 0F 05 00 03 01 04 43 D5 0A

  • A5 messages seem to be indications
  • The 21 is in my opinion a “close” event (20 would be open but movement detectors only generate close)
  • The 0F is Zone 15

Open Event (Panel->PC): 0D A5 00 04 00 20 02 03 00 03 01 0C 43 DD 0A

  • 20 indicates open
  • Zone 02

Close Event (Panel->PC): 0D A5 00 04 00 21 02 04 00 03 81 0C 43 5B 0A

  • 21 indicates close
  • Zone 02

Arming Home (Panel->PC): 0D A7 01 00 21 51 00 00 00 03 81 0C 43 11 0A

  • A7 messages seem panel state (arm/disarm/…)
  • 51 armed home?

Disarm (Panel->PC): 0D A7 01 00 21 55 00 00 00 03 8D 0C 43 75 0A

  • 55 disarmed ?
6

This is a messy protocol, I wonder who came up with this. Anyway, I managed to write a plugin that patches all sensors the powermax has through to vera. Here is what I think it is so far (I will update this when learning more). What would be needed now is some idea of what messages need to be sent to the panel to arm/disarm that thing (Anyone with a powerlink that can sniff some messages?)

Messages To Panel:

AB Message (15Byte): 0D AB 0A 00 01 00 00 00 00 00 00 00 43 06 0A
Sent to start panel reporting

02 Message (4Byte): 0D 02 FD 0A
Must be sent to panel to acknowledge messages

Messages From Panel:

02 Message (5Byte): 0D 02 43 BA 0A
Acknowledge AB message sent to panel

A5 Message (15 Byte): 0D A5 XX <TYPE> <ARM> <DEVICE> <ZONE> <EVENT> XX XX XX XX XX XX 0A
General event indication
TYPE, byte 4: 
	0x04 - event (for type see byte 6)
ARM, byte 5: 
	0x00 - disarmed  
	0x01 - armed home
	0x02 - armed away
	0x03 - follow mode
	0x04 - alarm home
	0x05 - alarm away
DEVICE, byte 6:
	0x0X - alarm event (alarm activated)
	0x2X - sensor event (evaluate byte 8 to determine type of event)
		the lower 4 bit of byte 6 indicate
		bit 1 - 0:not ready to arm 
			1:ready to arm
		bit 2 - 0:no alarm in memory
			1:alarm in memory
		bit 3 - 0:no tamper
			1:system tamper
	0x4X - arming event (evaluate byte 5 to determine type of arming)
		the lower 4 bit of byte 6 indicate
		bit 1 - 0:not ready to arm
			1:ready to arm
		bit 2 - 0:no alarm in memory
			1:alarm in memory
	0x6x - same as 0x2X but while arming (exit delay) 
ZONE, byte 7
	the zone id
EVENT, byte 8
	0x01 - tamper open
	0x02 - tamper close
	0x03 - open
	0x04 - close
	0x05 - movement
	(I expect others will be: flood, fire, ...) 

A7 Message (15 Byte): 0D A5 XX XX XX <TYPE> XX XX XX XX XX XX XX XX 0A
General panel status indication
TYPE, byte 6:
	0x0X - alarm
		0x06 tamper alarm on (sensor)
		0x07 tamper alarm on (panel)
	0x1X - alarm off
		0x16 tamper alarm off (sensor)
		0x17 tamper alarm off (panel)	
	0x51 - armed home
	0x52 - armed away
	0x55 - disarmed
	0x60 - admin login on panel
	0x61 - admin logout on panel

Example A5 messages:

Window Zone 07 open
0D A5 00 04 00 20 07 03 00 03 AF 0F 43 27 0A
Window Zone 07 close
0D A5 00 04 00 21 07 04 00 03 AF 0F 43 25 0A
Movement Zone 11
0D A5 00 04 00 21 0B 05 00 03 AF 0F 43 20 0A
Movement in Zone 11 with tamper alarm in memory
0D A5 00 04 00 23 0B 05 00 03 AF 0F 43 1E 0A
Door Open in Zone 01 while arming away (exit delay)
0D A5 00 04 02 60 01 03 00 03 00 00 43 A9 0A
Door Close in Zone 01 while arming away (exit delay)
0D A5 00 04 02 61 01 04 00 03 00 00 43 A7 0A
Arming Away
0D A5 00 04 02 41 00 00 00 03 AF 0F 43 0E 0A
Arming Home
0D A5 00 04 01 41 00 00 00 03 AF 0F 43 0F 0A
Disarming
0D A5 00 04 00 41 00 00 00 03 AF 0F 43 10 0A
Not ready to arm
0D A5 00 04 00 40 00 00 00 03 AF 0F 43 11 0A

Example A7 Messages

Disarmed
0D A7 01 00 20 55 00 00 00 03 AF 0F 43 DC 0A
Armed Home
0D A7 01 00 20 51 00 00 00 03 AF 0F 43 E0 0A
Armed Away
0D A7 01 00 21 52 00 00 00 03 00 00 43 9D 0A
Tamper With Panel
0D A7 01 00 00 07 00 00 40 03 AF 0F 43 0B 0A 
Tamper Restore On Panel
0D A7 01 00 00 17 00 00 00 03 AF 0F 43 3B 0A
Tamper With Sensor 
0D A7 01 00 0F 06 0F 01 00 03 AF 0F 43 2D 0A
Tamper Restore With Sensor 
0D A7 01 00 0F 16 0F 02 00 03 AF 0F 43 1C 0A
7

Someone as well tried to decode these messages but by using the powerlink and looking there at the logfile:
http://www.domoticaforum.eu/viewtopic.php?f=22&t=6088&start=15#p47407

8

The discussions on the Plugin, and it’s development/integration with MiOS, is now continued here:
http://forum.micasaverde.com/index.php?topic=7597.0