Difference between revisions of "AUI"

Page|Discussion|View source|History|
Line 1: Line 1:
 
[[Category:Documentation]]
 
[[Category:Documentation]]
 
[[Category:Specifications]]
 
[[Category:Specifications]]
 +
{{PageHeading|
 +
This document outlines the AUI protocol used on Ademco Vista series alarm panels. The AUI protocol is the more advanced communication from the panel to touch screen keypads such as the 6270
 +
}}
 +
[[File:6270_pr.jpg]]
  
 
=Messages Received=
 
=Messages Received=

Revision as of 23:13, 21 December 2013

This document outlines the AUI protocol used on Ademco Vista series alarm panels. The AUI protocol is the more advanced communication from the panel to touch screen keypads such as the 6270

6270 pr.jpg

Contents

Messages Received

System Response Packet


 LL 0 A 00000000 T S M..M


There are two basic packet types received from the system: A response to a previous request, and asynchronous broadcast packet. Most message data (M..M) typically begin with one or more “fe” bytes. The presence of “fd” or “fc” indicates an error return, sometimes followed by a hex encoded ASCII error number. Spaces above are inserted for ease of reading.

Field Description
LL Inclusive packet length.
0 Unknown.
A Destination address bitmask.
x21x
1 graphic console address 1
2 graphic console address 2

One or both bits may be set (for a broadcast message). AlarmDecoder may not filter out messages sent to other addresses, which is only a concern in environments with multiple AUI’s. The examples used herein specify address 1.

00000000 Unknown.
T Message type (binary data).
5 single destination packet
6 broadcast packet
S Message sequence ID based either on the message sent, or a sequence number

used by the controller (binary data).

System Asynchronous Response Packet

The asynchronous messages are sent on various events, such as a zone fault, arming, disarming, etc. The two known types of asynchronous packets do not appear to contain any zone-specific information, nor are there differences between messages received from faulting or restoring a zone. Typical messages received on a zone fault, again with spacing inserted: 

 120600000000 60 6c0245              6c f5ec0101010000
 160600000000 60 630245 43f531fb45   6c f5ec01010101


The messages are likely partition-specific. That is, broadcast to all keypads set to a specific partition. The second message contains bits below that indicate a state change. The bits are for the most part only set for a specific instance of a message. Each non-zero nibble after the “ec” is represented below:

Notify Type State
0001 0001 0001 0001 disarmed
0011 0001 0001 0001 chime mode on
0010 0001 0001 0010 armed stay, counting down
0010 0010 0001 0010 armed away, counting down
0010 0001 0010 0010 armed instant, counting down
0010 0001 0001 0001 armed stay/away
0010 0001 0010 0001 armed instant
0010 0001 0001 0100 armed, alarming
0101 in programming mode

Messages Sent

Single byte messages representing key presses on the keypad are accepted by the controller. These use the same values as the alpha keypad: 00 - 09 for the numbers, 0a = *, 0b = #, and F1 - F4 = 1c - 1f.

Request header

Messages otherwise follow the basic format: 

006 S TT tt M..M
Field Description
006 Unknown.
S Optional sequence count which generates a related return sequence count in the response message. The AUI keypads rotate through the sequence 8 - f. Setting this to zero returns a zero in the corresponding response, and seems to have no other effect.
TT The type of packet, of which there are typically multiple sub-types.
tt The sub-type of packet, of which there are at times multiple parameters that differentiate sub-types.
M..M The message parameters. These parameters are typically separated by very similar-looking bytes, and almost always terminated by one of two bytes. The exact purpose and meaning of these different separators is not currently known. A 43 starts many parameters, and a 45 terminates many of those same parameters.
63 / 6c Two common message terminating bytes.
436c Another method of terminating a message.
4543 / 4549 Typically used before a hex encoded ASCII number. The number itself is typically enclosed in an initial f5 byte and terminating fb byte.
456c Typically used before an initial f5 byte followed by an ec byte with binary flag data, though sometimes a hex encoded ASCII number. The flags also may have an optional byte representing a countdown in seconds in the case of an ARMING notification.
4343 / 4361 Typically used when no additional parameters are sent.

Information, Arm/Disarm, Chime

Various known and unknown message sub-types all using the 62 message group: 

006 S 62 tt M..M
Field Description
02 Unknown

Queried many times while in programming mode by an AUI. Example: 

 0060 620245 43f531fb 43 6c


Returns data very similar to the asynchronous notification: 

 0e020000000050 fefe ec 01010101


Asynchronous comparison: 

 160600000000 60 630245 43f531fb 45 6c f5ec01010101


The ASCII 1 parameter has no known purpose and does not appear to be related to the partition. When sent during Programming Mode the message returns a different status: 

 0b040000000050 fefe ec 05
03 Secure commands

This sub-type requires a password. These commands do not function outside of an AUI scenario. There is likely some initialization sequence which is not being correctly followed (single character messages can be substituted). The first parameter contains a hex encoded ASCII password (1234), and the second parameter specifies the operation, in this example ARM STAY.

Example: 

 00606203 88 ec 31323334 fb 456c f5 ec 010201010101


Returns an apparent status: 

 0d020000000050 fefe ec 010001


Arm Message Format: 

 00606203 88 ec P..P fb 456c f5 ec 010A0W010I01
Field Description
P..P Password
A Arming flag set to 2 in all cases.
W Arm Away flag set to 2.
I Arm Instant flag set to 2.

Disarm Message Format: 

 00606203 88 ec P..P fb 456c f5 ec 010101
Field Description
P..P Password

Chime Mode Message: 

 00606203 88 ec p..p fb 456c f5 ec 010C0F01
Field Description
P..P Password
C Set chime mode flag set to 4
F Chime setting on = 1, off = 0

Information, Enumeration

Various known and unknown message sub-types all using the 6b message group: 

006 S 6b tt M..M
Field Description
02 Various Unknown

Unknown messages sent by an AUI.

Unknown 1
Sent periodically, even during Programming Mode. The first message sent by an AUI during startup.

Example: 

 00606b02 4343


Returns: 

 0e020000000050 fe ec 0201010000 (Programming Mode)
 0e020000000050 fe ec 0101010000 (Immediately after booting)
 0e020000000050 fe ec 01017f0000 (Normal return)
09 Logs

Used to query log entries.

Query Log Entry Count
Query the count of log entries using parameters.

Example: 

 00606b09 4549 f5 A..A fb454a f5 B..B fb 4361
Field Description
A..A Unknown hex encoded ASCII parameter set to zero (30).
B..B Unknown hex encoded ASCII parameter set to 14 (3134).

Returns: 

 0d020000000050 fefefe 313030


Returns the number of entries in the log as a hex encoded ASCII value, in this example 100. Other parameters return different numbers. Using 1 or 2 for the first value appear to be valid, and using up to 14 - 24 appear to be valid for the second value. Reading logs does not function outside of an AUI device, likely due to incorrect initialization. Using the ASCII keypad method to retrieve entries after querying the total count does function.

Query Log Entry
Query a specific log entry using parameters.

Example: 

 00606b09 4549 f5 A..A fb 454a f5 B..B fb 4543f5 N..N fb 436c
Field Description
A..A Unknown hex encoded ASCII parameter set to zero (30).
B..B Unknown hex encoded ASCII parameter set to 14 (3134).
N..N One-based hex encoded ASCII parameter containing the log entry to retrieve.

Returns: 

 26020000000050 fefefefe ec 50302030312f30312030323a3330414d2045333032205a303030


Returns the hex encoded ASCII log entry, “P0 01/01 02:30AM E302 Z000” in this example. Note that querying log entries does not currently work.

0a Password, Various Unknown

A collection of password-oriented message types (T) all using the 0a message sub-type: 

 006 S 6b 0a T M..M


User Information (80)
Query access information of a user based on a given password.

Example: 

 00600a 80 ec P..P f5ec U..U
Field Description
P..P Password of partition master.
U..U Password of a user whose access is to be returned. Returns: 
0f020000000050 feec X..X 00 U..U 00
Field Description
X..X Hex encoded ASCII digits representing access flags for each partition. The digits are terminated by a zero byte. In the case of a Vista 20P this would be partitions 1, 2, 3.
Field Description
0 Installer
1 Master
3 User
4 Guest
6 Duress
7 Arm-only
9 No access
U..U Hex encoded ASCII digits containing the associated User ID, where Installer = 1, Master = 2, etc. The digits are terminated by a zero byte. Example: 
0f040000000050 feec 30303000 3100

This example shows the Installer User ID one with Installer access (zero) to each partition. An unknown password returns “???” for the partition access with no User ID field.

Installer Code (81)
Query the installer code.

Example: 

 00606b 0a 81

Returns: 

 0d040000000050 feec P..P
Field Description
P..P Contains the hex encoded ASCII password digits.

Unknown 1 (8e)
Unknown query sent by an AUI near the end of initialization. Appears to return a hex encoded ASCII zero.

Example: 

 00606b 0a 8e

Returns: 

 09040000000050 fe 30


Unknown 2 (8f)
Unknown query sent by an AUI near the end of initialization. Appears to return a hex encoded ASCII one.

Example: 

 00606b 0a 8f

Returns: 

 09040000000050 fe 31
0b System Information, Various Unknown

A collection of system information message types (T) all using the 0b message sub-type: 

 006 S 6b 0b T M..M

Unknown 1
Sent during AUI startup. Appears to be sent in error, as it returns an error. It used to be sent three times on older 128BP units returning fe with no content, and possibly one of the occurrences may have been missed.

Example: 

 00606b0b 456c 32

Returns: 

 09020000000050 fd 32


Appears to be complaining about the extraneous trailing 32.

System Description (31)
Returns a hex encoded ASCII system description.

Example: 

 00606b0b 4543 f5 31 fb 436c

Returns: 

 13020000000050 fefeec 56495354412d323050


Returns “Vista-20P” in this example.

Firmware Version (32)
Returns a hex encoded ASCII system firmware version.

Example: 

 00606b0b 4543 f5 32 fb 436c

Returns: 

 15020000000050 fefeec 30372e30302030342e3031


Returns “07.00 04.01” in this example.

Unknown 2 (33)
Sent occasionally by an AUI, returning variously one or two as a hex encoded ASCII digit.

Example: 

 00606b0b 4543 f5 33 fb 436c

Returns: 

 0a020000000050 fefe 31


Unknown 3 (34)
Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns 1f

Example: 

 00606b0b 4543 f5 34 fb 436c

Returns: 

 0b020000000050 fefeec 1f


Unknown 4 (35)
Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns the same two zero terminated hex encoded ASCII digit parameters.

Example: 

 00606b0b 4543 f5 35 fb 436c

Returns: 

 0d020000000050 fefeec 300031


Unknown 5 (36)
Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns the same two zero terminated hex encoded ASCII digit parameters.

Example: 

 00606b0b 4543 f5 36 fb 436c

Returns: 

 0e020000000050 fefeec 33003439


Unknown 6 (37)
Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns the same two zero terminated hex encoded ASCII digit parameters.

Example: 

 00606b0b 4543 f5 37 fb 436c

Returns: 

 0e020000000050 fefeec 39003634
0c Partition Information

A collection of partition information messages, distinguished by parameters, all using the 0c message sub-type: 

 006 S 6b 0c M..M

Partition Count
Query the number of partitions. Returns the entry count as a hex encoded ASCII digit, typically returning three.

Example: 

 00606b0c 4361

Returns: 

 09020000000050 fe C..C
Field Description
C..C Hex encoded ASCII partition count.

Partition Identifier
Query the identifier used for a partition. The number of partitions would previously be queried using Partition Count.

Example: 

 00606b0c 4543 f5 E..E fb 436c
Field Description
E..E The hex encoded ASCII partition entry, typically 1 - 3 (31 - 33).

Returns: 

 0b020000000050 fefeec P..P
P..P Hex encoded ASCII numeric partition identifier.

Partition Entries
Query the entries present for a specified partition identifier. Entries include zones and other zone-like items. The partition identifier would previously be queried using Partition Identifier.

Example: 

 00606b0c 4549 f5 P..P fb 4361
Field Description
LL Inclusive packet length, value depending on digits returned.
P..P The hex encoded ASCII partition identifier.

Returns: 

 LL020000000050 fefe C..C
C..C Hex encoded ASCII numeric partition entry count.

Partition Entry
Queries information on a specific entry in a partition. This returns zero terminated hex encoded ASCII fields. The last field is not zero-terminated. Note undocumented Device Types: Onboard zones 1 - 8 is one; Zone number 99 is six; Hardware is zero.

Example: 

 00606b0c 4549 f5 P..P fb 4543 f5 E..E fb 436c
Field Description
P..P The hex encoded ASCII partition identifier.
E..E The one-based hex encoded ASCII entry to enumerate.

Returns: 

 LL020000000050 fefefeec Z..Z 00 T..T 00 D..D 00 N..N
Field Description
LL Inclusive packet length, value depending on digits returned.
Z..Z Zone number of the entry being enumerated.
T..T Zone Type.
D..D Zone Device Type.
N..N Optional zone name.
0d Unknown

Sent as the sixth message during AUI boot. Always returns hex encoded ASCII one.

Example: 

 0060 6b0d4343

Returns: 

 09020000000050 fe 31
0e Set Current Partition

Sent as the seventh message during AUI boot defaulting a keypad to the first partition entry. Used to set the AUI keypad to a particular partition entry (as opposed to partition ID, as the message is sent before the partition IDs are enumerated).

Example: 

 0060 6b0e4543f5 P..P
Field Description
P..P The hex encoded ASCII partition entry to which the AUI is to be assigned. Returns: 
08020000000050 fe
0f Device Enumeration

A collection of what appear to be device enumeration messages, distinguished by parameters, all using the 0f message sub-type: 

 006 S 6b 0f M..M

Device Count
Query the count of consoles and expansion cards. Sent during AUI boot after enumerating the partitions.

Example: 

 00606b0f 4361

Returns: 

 LL020000000050 fe D..D
Field Description
LL Inclusive packet length, value depending on digits returned.
D..D Hex encoded ASCII count of devices.

Device Entry
Query the specified device entry. Sent during AUI boot after sending a Device Count. Appears to return entries for graphic consoles, expansion boards, and text consoles. Returned fields are zero-terminated hex encoded ASCII numbers, excluding the last entry which is not zero-terminated.

Example: 

 006d6b0f 4543 f5 E..E fb 436c
Field Description
E..E The one-based hex encoded ASCII entry to enumerate.

Returns: 

 LL020000000055 fefeec A..A 00 U..U 00 X..X 00 Y..Y 00 Z..Z
Field Description
LL Inclusive packet length, value depending on digits returned.
A..A Likely represents the address of the device. For instance, two items enumerated at listed as 17 and 18, the text console addresses.
U..U Unknown. Set to 4 for likely text consoles, otherwise set to 1.
X..X Unknown. Set to 5.
Y..Y Unknown. Set to 0.
Z..Z Unknown. Set to 0.
Retrieved from "http://www.alarmdecoder.com/wiki/index.php?title=AUI&oldid=265"