This document outlines the AUI protocol used on Ademco Vista series alarm panels. The AUI protocol is the more advanced communication from the panel to touch screen keypads such as the 6270

Messages Received

System Response Packet

 LL 0 A 00000000 T S M..M

There are two basic packet types received from the system: A response to a previous request, and asynchronous broadcast packet. Most message data (M..M) typically begin with one or more “fe” bytes. The presence of “fd” or “fc” indicates an error return, sometimes followed by a hex encoded ASCII error number. Spaces above are inserted for ease of reading.

Field	Description
LL	Inclusive packet length.
0	Unknown.
A	Destination address bitmask. x21x 1 graphic console address 1 2 graphic console address 2 One or both bits may be set (for a broadcast message). AlarmDecoder may not filter out messages sent to other addresses, which is only a concern in environments with multiple AUI’s. The examples used herein specify address 1.
00000000	Unknown.
T	Message type (binary data). 5 single destination packet 6 broadcast packet
S	Message sequence ID based either on the message sent, or a sequence number used by the controller (binary data).

System Asynchronous Response Packet

The asynchronous messages are sent on various events, such as a zone fault, arming, disarming, etc. The two known types of asynchronous packets do not appear to contain any zone-specific information, nor are there differences between messages received from faulting or restoring a zone. Typical messages received on a zone fault, again with spacing inserted:

 120600000000 60 6c0245              6c f5ec0101010000
 160600000000 60 630245 43f531fb45   6c f5ec01010101

The messages are likely partition-specific. That is, broadcast to all keypads set to a specific partition. The second message contains bits below that indicate a state change. The bits are for the most part only set for a specific instance of a message. Each non-zero nibble after the “ec” is represented below:

Notify Type	State
0001 0001 0001 0001	disarmed
0011 0001 0001 0001	chime mode on
0010 0001 0001 0010	armed stay, counting down
0010 0010 0001 0010	armed away, counting down
0010 0001 0010 0010	armed instant, counting down
0010 0001 0001 0001	armed stay/away
0010 0001 0010 0001	armed instant
0010 0001 0001 0100	armed, alarming
0101	in programming mode

Messages Sent

Single byte messages representing key presses on the keypad are accepted by the controller. These use the same values as the alpha keypad: 00 - 09 for the numbers, 0a = *, 0b = #, and F1 - F4 = 1c - 1f.

Request header

Messages otherwise follow the basic format:

006 S TT tt M..M

Field	Description
006	Unknown.
S	Optional sequence count which generates a related return sequence count in the response message. The AUI keypads rotate through the sequence 8 - f. Setting this to zero returns a zero in the corresponding response, and seems to have no other effect.
TT	The type of packet, of which there are typically multiple sub-types.
tt	The sub-type of packet, of which there are at times multiple parameters that differentiate sub-types.
M..M	The message parameters. These parameters are typically separated by very similar-looking bytes, and almost always terminated by one of two bytes. The exact purpose and meaning of these different separators is not currently known. A 43 starts many parameters, and a 45 terminates many of those same parameters. 63 / 6c Two common message terminating bytes. 436c Another method of terminating a message. 4543 / 4549 Typically used before a hex encoded ASCII number. The number itself is typically enclosed in an initial f5 byte and terminating fb byte. 456c Typically used before an initial f5 byte followed by an ec byte with binary flag data, though sometimes a hex encoded ASCII number. The flags also may have an optional byte representing a countdown in seconds in the case of an ARMING notification. 4343 / 4361 Typically used when no additional parameters are sent.

Information, Arm/Disarm, Chime

Various known and unknown message sub-types all using the 62 message group:

006 S 62 tt M..M

Field	Description
02	Unknown Queried many times while in programming mode by an AUI. Example: 0060 620245 43f531fb 43 6c Returns data very similar to the asynchronous notification: 0e020000000050 fefe ec 01010101 Asynchronous comparison: 160600000000 60 630245 43f531fb 45 6c f5ec01010101 The ASCII 1 parameter has no known purpose and does not appear to be related to the partition. When sent during Programming Mode the message returns a different status: 0b040000000050 fefe ec 05
03	Secure commands This sub-type requires a password. These commands do not function outside of an AUI scenario. There is likely some initialization sequence which is not being correctly followed (single character messages can be substituted). The first parameter contains a hex encoded ASCII password (1234), and the second parameter specifies the operation, in this example ARM STAY. Example: 00606203 88 ec 31323334 fb 456c f5 ec 010201010101 Returns an apparent status: 0d020000000050 fefe ec 010001 Arm Message Format: 00606203 88 ec P..P fb 456c f5 ec 010A0W010I01 Field Description P..P Password A Arming flag set to 2 in all cases. W Arm Away flag set to 2. I Arm Instant flag set to 2. Disarm Message Format: 00606203 88 ec P..P fb 456c f5 ec 010101 Field Description P..P Password Chime Mode Message: 00606203 88 ec p..p fb 456c f5 ec 010C0F01 Field Description P..P Password C Set chime mode flag set to 4 F Chime setting on = 1, off = 0

Information, Enumeration

Various known and unknown message sub-types all using the 6b message group:

006 S 6b tt M..M

Field	Description
02	Various Unknown Unknown messages sent by an AUI. Unknown 1 Sent periodically, even during Programming Mode. The first message sent by an AUI during startup. Example: 00606b02 4343 Returns: 0e020000000050 fe ec 0201010000 (Programming Mode) 0e020000000050 fe ec 0101010000 (Immediately after booting) 0e020000000050 fe ec 01017f0000 (Normal return)
09	Logs Used to query log entries. Query Log Entry Count Query the count of log entries using parameters. Example: 00606b09 4549 f5 A..A fb454a f5 B..B fb 4361 Field Description A..A Unknown hex encoded ASCII parameter set to zero (30). B..B Unknown hex encoded ASCII parameter set to 14 (3134). Returns: 0d020000000050 fefefe 313030 Returns the number of entries in the log as a hex encoded ASCII value, in this example 100. Other parameters return different numbers. Using 1 or 2 for the first value appear to be valid, and using up to 14 - 24 appear to be valid for the second value. Reading logs does not function outside of an AUI device, likely due to incorrect initialization. Using the ASCII keypad method to retrieve entries after querying the total count does function. Query Log Entry Query a specific log entry using parameters. Example: 00606b09 4549 f5 A..A fb 454a f5 B..B fb 4543f5 N..N fb 436c Field Description A..A Unknown hex encoded ASCII parameter set to zero (30). B..B Unknown hex encoded ASCII parameter set to 14 (3134). N..N One-based hex encoded ASCII parameter containing the log entry to retrieve. Returns: 26020000000050 fefefefe ec 50302030312f30312030323a3330414d2045333032205a303030 Returns the hex encoded ASCII log entry, “P0 01/01 02:30AM E302 Z000” in this example. Note that querying log entries does not currently work.
0a	Password, Various Unknown A collection of password-oriented message types (T) all using the 0a message sub-type: 006 S 6b 0a T M..M User Information (80) Query access information of a user based on a given password. Example: 00600a 80 ec P..P f5ec U..U Field Description P..P Password of partition master. U..U Password of a user whose access is to be returned. Returns: 0f020000000050 feec X..X 00 U..U 00 Field Description X..X Hex encoded ASCII digits representing access flags for each partition. The digits are terminated by a zero byte. In the case of a Vista 20P this would be partitions 1, 2, 3. Field Description 0 Installer 1 Master 3 User 4 Guest 6 Duress 7 Arm-only 9 No access U..U Hex encoded ASCII digits containing the associated User ID, where Installer = 1, Master = 2, etc. The digits are terminated by a zero byte. Example: 0f040000000050 feec 30303000 3100 This example shows the Installer User ID one with Installer access (zero) to each partition. An unknown password returns “???” for the partition access with no User ID field. Installer Code (81) Query the installer code. Example: 00606b 0a 81 Returns: 0d040000000050 feec P..P Field Description P..P Contains the hex encoded ASCII password digits. Unknown 1 (8e) Unknown query sent by an AUI near the end of initialization. Appears to return a hex encoded ASCII zero. Example: 00606b 0a 8e Returns: 09040000000050 fe 30 Unknown 2 (8f) Unknown query sent by an AUI near the end of initialization. Appears to return a hex encoded ASCII one. Example: 00606b 0a 8f Returns: 09040000000050 fe 31
0b	System Information, Various Unknown A collection of system information message types (T) all using the 0b message sub-type: 006 S 6b 0b T M..M Unknown 1 Sent during AUI startup. Appears to be sent in error, as it returns an error. It used to be sent three times on older 128BP units returning fe with no content, and possibly one of the occurrences may have been missed. Example: 00606b0b 456c 32 Returns: 09020000000050 fd 32 Appears to be complaining about the extraneous trailing 32. System Description (31) Returns a hex encoded ASCII system description. Example: 00606b0b 4543 f5 31 fb 436c Returns: 13020000000050 fefeec 56495354412d323050 Returns “Vista-20P” in this example. Firmware Version (32) Returns a hex encoded ASCII system firmware version. Example: 00606b0b 4543 f5 32 fb 436c Returns: 15020000000050 fefeec 30372e30302030342e3031 Returns “07.00 04.01” in this example. Unknown 2 (33) Sent occasionally by an AUI, returning variously one or two as a hex encoded ASCII digit. Example: 00606b0b 4543 f5 33 fb 436c Returns: 0a020000000050 fefe 31 Unknown 3 (34) Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns 1f Example: 00606b0b 4543 f5 34 fb 436c Returns: 0b020000000050 fefeec 1f Unknown 4 (35) Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns the same two zero terminated hex encoded ASCII digit parameters. Example: 00606b0b 4543 f5 35 fb 436c Returns: 0d020000000050 fefeec 300031 Unknown 5 (36) Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns the same two zero terminated hex encoded ASCII digit parameters. Example: 00606b0b 4543 f5 36 fb 436c Returns: 0e020000000050 fefeec 33003439 Unknown 6 (37) Sent near the end of AUI initialization as part of a set of unknown queries (34 - 37). Always returns the same two zero terminated hex encoded ASCII digit parameters. Example: 00606b0b 4543 f5 37 fb 436c Returns: 0e020000000050 fefeec 39003634
0c	Partition Information A collection of partition information messages, distinguished by parameters, all using the 0c message sub-type: 006 S 6b 0c M..M Partition Count Query the number of partitions. Returns the entry count as a hex encoded ASCII digit, typically returning three. Example: 00606b0c 4361 Returns: 09020000000050 fe C..C Field Description C..C Hex encoded ASCII partition count. Partition Identifier Query the identifier used for a partition. The number of partitions would previously be queried using Partition Count. Example: 00606b0c 4543 f5 E..E fb 436c Field Description E..E The hex encoded ASCII partition entry, typically 1 - 3 (31 - 33). Returns: 0b020000000050 fefeec P..P P..P Hex encoded ASCII numeric partition identifier. Partition Entries Query the entries present for a specified partition identifier. Entries include zones and other zone-like items. The partition identifier would previously be queried using Partition Identifier. Example: 00606b0c 4549 f5 P..P fb 4361 Field Description LL Inclusive packet length, value depending on digits returned. P..P The hex encoded ASCII partition identifier. Returns: LL020000000050 fefe C..C C..C Hex encoded ASCII numeric partition entry count. Partition Entry Queries information on a specific entry in a partition. This returns zero terminated hex encoded ASCII fields. The last field is not zero-terminated. Note undocumented Device Types: Onboard zones 1 - 8 is one; Zone number 99 is six; Hardware is zero. Example: 00606b0c 4549 f5 P..P fb 4543 f5 E..E fb 436c Field Description P..P The hex encoded ASCII partition identifier. E..E The one-based hex encoded ASCII entry to enumerate. Returns: LL020000000050 fefefeec Z..Z 00 T..T 00 D..D 00 N..N Field Description LL Inclusive packet length, value depending on digits returned. Z..Z Zone number of the entry being enumerated. T..T Zone Type. D..D Zone Device Type. N..N Optional zone name.
0d	Unknown Sent as the sixth message during AUI boot. Always returns hex encoded ASCII one. Example: 0060 6b0d4343 Returns: 09020000000050 fe 31
0e	Set Current Partition Sent as the seventh message during AUI boot defaulting a keypad to the first partition entry. Used to set the AUI keypad to a particular partition entry (as opposed to partition ID, as the message is sent before the partition IDs are enumerated). Example: 0060 6b0e4543f5 P..P Field Description P..P The hex encoded ASCII partition entry to which the AUI is to be assigned. Returns: 08020000000050 fe
0f	Device Enumeration A collection of what appear to be device enumeration messages, distinguished by parameters, all using the 0f message sub-type: 006 S 6b 0f M..M Device Count Query the count of consoles and expansion cards. Sent during AUI boot after enumerating the partitions. Example: 00606b0f 4361 Returns: LL020000000050 fe D..D Field Description LL Inclusive packet length, value depending on digits returned. D..D Hex encoded ASCII count of devices. Device Entry Query the specified device entry. Sent during AUI boot after sending a Device Count. Appears to return entries for graphic consoles, expansion boards, and text consoles. Returned fields are zero-terminated hex encoded ASCII numbers, excluding the last entry which is not zero-terminated. Example: 006d6b0f 4543 f5 E..E fb 436c Field Description E..E The one-based hex encoded ASCII entry to enumerate. Returns: LL020000000055 fefeec A..A 00 U..U 00 X..X 00 Y..Y 00 Z..Z Field Description LL Inclusive packet length, value depending on digits returned. A..A Likely represents the address of the device. For instance, two items enumerated at listed as 17 and 18, the text console addresses. U..U Unknown. Set to 4 for likely text consoles, otherwise set to 1. X..X Unknown. Set to 5. Y..Y Unknown. Set to 0. Z..Z Unknown. Set to 0.