Any headway on AUI packets?

[digiblur]

I was noticing in the telnet display the AUI packets going across when a zone was triggered and cleared even when the system was in armed status. I tried to reverse engineer what was shown but quickly figured out that part of the packet is missing. Is there a way to see more of the AUI data? Some secret firmware or firmware setting?

This has to be how the actual ADT Pulse hub is seeing the zones triggered when the alarm is in armed status. I'd like to do the same as this was the original intent of the box. Trying to do this rather quickly as the WAF is quickly dwindling on my product decision as this was supposed to replace the motion trigger while armed to turn on the lights when we walked in the room.

This must be how the system is communicating with the cellular module as well as I don't see an LRR packets in the display at all when arming or disarming things. Not sure which module I have on the Vista 20p system but I know they replaced it before the GSM sunset.

[kevin]

AUI is fully decoded and in the latest firmware you should not see partial packets. We use AUI in the web application to auto-enroll (find installer code, enable keypad address, set alarmdecoder to keypad address) as well as poll zones to auto-populate zones and panel logs in diagnostics to see the last panel events.

[digiblur]

AUI is fully decoded and in the latest firmware you should not see partial packets. We use AUI in the web application to auto-enroll (find installer code, enable keypad address, set alarmdecoder to keypad address) as well as poll zones to auto-populate zones and panel logs in diagnostics to see the last panel events.

Hmm.. Maybe I am not seeing this and according to the web app it is on the latest updates and I did check the firmware and it is on the latest update as well. There was some beta firmware listed as available but it looked behind the current stable release.

Had to find my installer code manually, enable 18, etc. Would be cool to see this happen automatically including set up the relay stuff that it looks like I have to do since I wasn't able to see all the packets for zones coming across like the pulse box does.

[digiblur]

AUI is fully decoded and in the latest firmware you should not see partial packets. We use AUI in the web application to auto-enroll (find installer code, enable keypad address, set alarmdecoder to keypad address) as well as poll zones to auto-populate zones and panel logs in diagnostics to see the last panel events.

So I did a bit more digging on this and also have more time to write out my thoughts. The ADT iHub Pulse box is hooked up to a HSPIM module that connects to the keypad bus, this module takes up addresses 5 and 6 and then speaks out to the hub via RS422.

I can arm the Vista 20P panel and walk around and trigger the motion and see AUI packets that are sent each time the motion is triggered and cleared, and this is during a STAY arm. If you disarm the panel you'll see these same 2 packets for closed then open on the switches. The problem is no matter what zone the packets seem to be the same. There is obviously some packet in the middle that is missing. As I can watch the Pulse app trigger the zones and it reads the zones regardless if they are bypassed or not. It would seem to me that we could pick up this packet and reverse engineer it by comparing it to the zones triggered.

[kevin]

From what I remember when I decoded it there was a preamble then the data in the middle in a hex format where you can convert to ascii to get the right numbers... check the code for the 'zones' templates in the webapp

[digiblur]

From what I remember when I decoded it there was a preamble then the data in the middle in a hex format where you can convert to ascii to get the right numbers... check the code for the 'zones' templates in the webapp

I think we are talking about two different things. Not sure how things can be decoded when the 4 packets received for a zone trigger and clear are the same data no matter the zone. Definitely some data missing from the console. The only thing I can see that is different seems to be a cycle byte that increments and goes with what seems like another packet to match. I thought this was the zone at first but it seems this byte will change even with the same zone triggered over and over. Maybe something else is enabled on the panel with this iHub installed that the firmware isn't passing through yet.

[kevin]

If you could post examples that might clear things up - but a typical AUI message has everything you're looking for ...

[digiblur]

If you could post examples that might clear things up - but a typical AUI message has everything you're looking for ...

Sure. See below. I've also included a screenshot of the pulse history (monitored on the same keypad bus). I left the !REL messages in as well to help show the open close activity of zone 2. Is there a debug mode to just dump whatever is coming over the bus?

[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
!REL:12,01,01
!AUI:126600000000666c02456cf5ec0101010000
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
!AUI:1666000000006763024543f531fb456cf5ec02010106
!REL:12,01,00
!AUI:126600000000606c02456cf5ec0101010000
!AUI:1666000000006163024543f531fb456cf5ec02010101
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
!REL:12,01,01
!AUI:126600000000626c02456cf5ec0101010000
!AUI:1666000000006363024543f531fb456cf5ec02010106
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
!REL:12,01,00
!AUI:126600000000646c02456cf5ec0101010000
!AUI:1666000000006563024543f531fb456cf5ec02010101
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
!REL:12,01,01
!AUI:126600000000666c02456cf5ec0101010000
!AUI:1666000000006763024543f531fb456cf5ec02010106
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "
!REL:12,01,00
!AUI:126600000000606c02456cf5ec0101010000
!AUI:1666000000006163024543f531fb456cf5ec02010101
[00100001000000003A--],008,[f72200071008008c08020000000000],"ARMED ***STAY*** "

[kevin]

Yep those aren't a typical zone info AUI packet ... maybe you can parse zone number and status out of there but I'm not seeing it.

@48 will debug the bus if you have debug firmware
@00 will turn off debug

[digiblur]

Yep those aren't a typical zone info AUI packet ... maybe you can parse zone number and status out of there but I'm not seeing it.

@48 will debug the bus if you have debug firmware
@00 will turn off debug

Guess I need to email support for this firmware? All I see are the betas and stables listed.