Command Description
= Reboot the device.
 ! Configure the device via prompts.
C Sets or retrieves configuration parameters.
L Emulate virtual zone opens and closes.
E Dump error report and clear error history. Error report
V Dump the version, serial number and flags used in the firmware.
K Send message from specific partition or keypad address. Addressed Message
R Host Acknowledge the CRC message was valid.
\x01\x01\x01 Send Special Key #1
\x02\x02\x02 Send Special Key #2
\x03\x03\x03 Send Special Key #3
\x04\x04\x04 Send Special Key #4
\x05\x05\x05 Send Special Key #5
\x06\x06\x06 Send Special Key #6
\x07\x07\x07 Send Special Key #7
\x08\x08\x08 Send Special Key #8
a DSC ONLY(deprecated use Special Keys): Arm Away
s DSC ONLY(deprecated use Special Keys): Arm Stay
c DSC ONLY(deprecated use Special Keys): Toggle Chime
0123456789*#<> Send key to panel


The standard keypad keys when received by the AD2 will be treated as keypad press commands and sent to the alarm panel from the current address. If using the K command the keys will continue to be sent from the specified address until the AD2 receives a \r or \n at that point the AD2 will revert back to the configured address.


Rebooting the device is as simple as sending = to it.

During the boot process you can trigger a firmware upload by sending a second = to the device after the !boot message is received. At this point you'll receive a !load and can begin uploading.

Zone Emulation

Zone Expander Emulation allows the AlarmDecoder to act in place of a physical expander board and make use of virtual zones with your panel. After enabling it on both the panel and the AlarmDecoder you can begin opening and closing zones, which will be relayed back to the panel.

The L command can be used to open or close zones. There are two parameters: the zone and the state. The zone is a zero-padded two-digit number and the state is either 0 or 1.

Example - open zone 12:

  • L121\r

Example - close zone 12:

  • L120\r

Addressed Message

  • It is possible to send a message from a specific keypad on Ademco/Vista or to a specific partition on DSC.

The K command can be used to send a message to the panel from a specific keypad address or keypad partition for DSC. There are two parameters: The address or partition a zero padded 2 digit address or partition and the message to send. The AD2* will stay fixed on this new address until a new K message is received or the AD2* is reset or a \r or \n character is received.

Example - Send keypad string 1234 to DSC partition 01:

  • K011234\r

Example - Send keypad string 12343 from keypad address 19:

  • K1912343\r

Special Keys

The specialty keys are identified by ASCII character codes 1 through 8. In order to prevent false positives these must be sent three times in a row.

Special Key Codes
Code Description Ademco DSC
\x01\x01\x01 Special Key #1 Fire/Prog. Fire
\x02\x02\x02 Special Key #2 Police/Prog. Police
\x03\x03\x03 Special Key #3 Medical/AUX/Prog. Medical/AUX
\x04\x04\x04 Special Key #4 Programmable Stay
\x05\x05\x05 Special Key #5 N/A Away
\x06\x06\x06 Special Key #6 N/A Chime
\x07\x07\x07 Special Key #7 N/A Reset
\x08\x08\x08 Special Key #8 N/A Exit

Device Configuration

The AlarmDecoder configuration can be viewed or modified in one of two ways: prompted or programmatically.


If you send ! followed by a carriage return you will be prompted to configure each field. This prompt also includes a basic description of the setting as well as it's current value.

You may hit enter to keep the current value or provide a new one.


!>Ademco/DSC  Mode A/D  (A) :>
!>Keypad Address       (18) :>
!WARNING. Do not enable a module if the physical module exists on the system.
!Zone Expanders Y/N Max allowed: 02
!>expander module #01 ZN 09-16 (N) :>
!>expander module #02 ZN 17-24 (N) :>
!>expander module #03 ZN 25-32 (N) :>
!>expander module #04 ZN 33-40 (N) :>
!>expander module #05 ZN 41-48 (Y) :>
!Relay Modules Y/N Max allowed: 04
!>relay module #01 (Y) :>
!>relay module #02 (N) :>
!>relay module #03 (N) :>
!>relay module #04 (N) :>
!>Emulate Long Range Radio Y/N: (Y) :>
!>Address Filter Mask  (ffffffff) :>
!>Deduplicate          (N) :>
!>Config Bits        (ff04) :>


You may retrieve all of the current device settings by sending C to the panel followed by a carriage return (\r).

Retrieving settings:

  • Send: C\r

It can also be used to set values:

  • Send: CADDRESS=20\r
  • Response: !>ADDRESS=20

The same command may be used to set multiple values:

  • Response: !>ADDRESS=20&DEDUPLICATE=Y

Configuration Parameters

Name Default Value Valid Values (Regex) Description
MODE A [A,D]{1} Decoder panel mode Ademco or DSC.
ADDRESS 18 [0-9]{2} Keypad address assigned to the AlarmDecoder for Ademco and Partition# for DSC.
CONFIGBITS FF04 [0-9a-f]{4} Special settings for the device. See CONFIGBITS for more information.
MASK FFFFFFFF [0-9a-f]{8} Address mask used to filter for keypad alphanumeric messages.
EXP NNNNN [YN]{5} Emulation of zone expanders 1-5
REL NNNN [YN]{4} Emulation of relay expanders 1-4
LRR N [YN] Emulation of Long Range Radio expander
DEDUPLICATE N [YN] If enabled, removes duplicate alphanumeric keypad messages.
RESET Y [YN] Factory reset settings.


CONFIGBITS is a setting that's used to enable special functionality on the AlarmDecoder. You can enable these by masking the correct bits.

Mask Description
0x0001 Enable reporting of AUI messages.
0x0002 Enable reporting of keypress events.
0x0004 Disable prompts for L and | commands.
0x0008 Enable the prefixing of panel messages with !KPM.
0x0010 Disable DSC locking (experimental).
0x0080 enable CRC Delivery confirmation for LRR,EXP,REL etc.
0x0100 Enable reporting of RFX messages.

Message Types

There are several types of messages produced by the AlarmDecoder. These include: Keypad, Relay Expander, Zone Expander, RFX, LRR, and AUI.

  • All lines starting with ! are informational.
  • Lines that start with !> are prompts.
  • All other lines are panel data in the form of a Keypad message.


Keypad messages are by far the most common message type produced by the AlarmDecoder. These messages also have an optional header that can be enabled in the CONFIGBITS. This setting prefixes all keypad messages with !KPM:.


Keypad Format
[00110011000000003A--],010,[f70700000010808c18020000000000],"ARMED ***STAY** ZONE BYPASSED "
Bit field Numeric code Raw data Alphanumeric Keypad Message
[00110011000000003A--] 010 [f70700000010808c18020000000000] "ARMED ***STAY** ZONE BYPASSED "

Bit field

The bit field present on the keypad messages is where you're going to get most of the information on your alarm system's current state. These are all represented by a zero or one aside from the one exception. (beep)

Position Description
1 Indicates if the panel is READY
2 Indicates if the panel is ARMED AWAY
3 Indicates if the panel is ARMED HOME
4 Indicates if the keypad backlight is on
5 Indicates if the keypad is in programming mode
6 Number (1-7) indicating how many beeps are associated with the message
7 Indicates that a zone has been bypassed
8 Indicates if the panel is on AC power
9 Indicates if the chime is enabled
10 Indicates that an alarm has occurred. This is sticky and will be cleared after a second disarm.
11 Indicates that an alarm is currently sounding. This is cleared after the first disarm.
12 Indicates that the battery is low
13 Indicates that entry delay is off (ARMED INSTANT/MAX)
14 Indicates that there is a fire
15 Indicates a system issue
16 Indicates that the panel is only watching the perimeter (ARMED STAY/NIGHT)
17 System specific bits. 4 bits packed into a HEX Nibble [0-9,A-F]
18 Ademco or DSC Mode A or D
19 Unused
20 Unused

Numeric Code

This number specifies which zone is affected by the message. For example, if this message is for CHECK ZONE 22 then the numeric code would be 022. Most of the time this is zero-padded base10, but there are rare occurrences where this may be base16, such as ECP bus failures.

Raw data

This is the binary data associated with the message. It includes all of the bit field entries that were separated out for you in the first field, as well as the rest of the message for debugging and exploratory purposes.

There is one important piece of data included only in this field: the keypad address mask. The four bytes starting at position 2 (zero-indexed) indicate which keypads this message is intended for.

Inside this mask each bit represents a specific keypad. Each byte represents a group of eight keypad addresses, which the least-significant-bit being the start of the range.

Byte Addresses
1 0-7
2 8-15
3 16-23
4 24-31

For example:

  • f70700060010808c08020000 - our keypad address mask is 07000600.

Using the above mask example of 07000600 we find that this message was destined for keypads 0, 1, 2, 17 and 18.

There is one special case: system messages will have no address mask bits set and are intended for common keypads or monitoring multiple zones.

For the most part the address mask details only become really important when you're working with a setup that has multiple partitions since the AlarmDecoder will see all messages by default.

Alphanumeric Keypad Message

This section is the data that would be displayed on your keypad's screen.

Zone Expander

If you have one or more zone expanders connected to the alarm panel you will be able to see messages from the expanders as zones are faulted and restored. On DSC panels all zones are expressed as EXP messages.


Example of zone expander at address 7, channel 1 faulting and then restoring:



 !EXP Format
Header Zone Expander Address Expander Channel Data
 !EXP 07 01 01

Zone Expander Address

This is the address that the zone expander occupies.

Expander Channel

This is the channel generating the message.


00 and 01 indicate that the zone is restored and faulted, respectively.

Relay Expander

If you have one or more relay expanders connected to your alarm panel you will be able to see messages when the relays are opened or closed.


Examples of a relay expander at address 12, relay #1 closing and then opening:



 !REL Format
Header Relay Expander Address Expander Channel Data
 !REL 12 01 01

Relay Expander Address

This is the address that the relay expander occupies.

Expander Channel

This is the channel generating the message.


00 and 01 indicate that the relay is opened and closed, respectively.


If you have an RF receiver attached to your panel you will see messages from any 5800 RF device in range of the receiver, regardless of whether or not the panel was configured to listen to it.

This also functions when the system is ARMED STAY. Normally you won't see fault messages for interior zones when armed this way so you lose visibility of interior motion sensors. One option is to put the interior sensors on a separate partition so you still see the inside zones and the outside sensors are on their own. The other option is to listen to the !RFX messages directly which could then be used to tell your home automation system that the zones are faulted.


Example of a 5800Micra sensor faulting and restoring:


Example of a 5804 keyfob pressing the loop #2 button and having a low battery:



 !RFX Format
Header Serial Number Data
 !RFX 0180036 80

Serial Number

This is the 7-digit serial number of the device the message originated from.


The data is an 8-bit hex message with several indicators. Please refer to the 5800 SERIES TRANSMITTER INPUT LOOP IDENTIFICATION section of your programming manual for what the loops relate to for your specific device.

RFX Data Format
Bit Description
1 Unknown - Seems that the loop indicators should be ignored if set.
2 Low battery indication
3 Supervision required indication
4 Unknown
5 Loop #3 indication
6 Loop #2 indication
7 Loop #4 indication
8 Loop #1 indication


If you have a Long Range Radio device attached or have emulation enabled the AlarmDecoder will report LRR messages from the panel to the radio. The format of the data encapsulates the SIA DC-05-1999.09 standard for Contact ID reporting.


  • ARM STAY USER 002 partition 1
    •  !LRR:002,1,CID_3441,ff
  • DAY/NIGHT ALARM ZONE 9 partition 1
    •  !LRR:009,1,CID_1135,ff
  • ALARM CANCEL USER 002 partition 1
    •  !LRR:002,1,CID_1406,ff
  • ARM STAY OPENING user 002 partition 1
    •  !LRR:002,1,CID_1441,ff


 !LRR Format
Header Event Data Partition CID MESSAGE Report CODE
 !LRR 012 1 CID_1441 ff

Event Data

This is either the user number of the person performing the action or the zone that was bypassed.


The panel partition the event applies to. Partition 0 indicates that it's destined for all partitions.

CID Message

This is CID message for the event. See below for a description and what (if any) programming fields are required for activation. It is prefixed with "CID_" and then 4 digits that are described in section of the SIA DC-05-1999.09 standard.

Report Code Format
Header Event qualifier Event code
CID_ 1 441


Static string "CID_"

Event qualifier

1 = New Event or Opening 
3 = New Restore or Closing 
6 = Previously reported condition still present (Status report)

Event code

(3 Hex digits 0-9,B-F) Event codes are 3 hex digits and are broken down in classes by the first digit.

100 Alarms
200 Supervisory
300 Troubles
400 Open/Close REMOTE ACCESS
500 Bypass/Disables

For more detail on specific report codes see the list see Appendix C in the SIA DC-05-1999.09 standard.


AUI messages are generated for "Advanced User Interface" keypads. These include a lot of extra data than what's destined for regular keypads.


 !AUI Format
Header AUI Data
 !AUI 126600000000656c02456cf5ec01017f0002

AUI Data

This is a large binary blob that's destined for a graphical panel. This data has not been fully decoded. Please see the AUI page for information on what has been discovered so far.

Keypress Events

Keypress events are generated when keys are pressed on a keypad and can be enabled inside CONFIGBITS.


 !KPE Format
Header Keypad Address
 !KPE 18

Error message report

Error message reports will be sent to the host when the command 'E' is sent to the AD2*. The list will contain 0 if no errors are recorded and a list of errors separated by commas if errors are recorded. Once an error is reported it will be cleared from the history. The errors from left to right are in order of occurrence. As many as 10 errors can be stored before the oldest is removed from the list.


 !ERR Format
Header Error list
 !ERR 4,4,4

Error Codes

Error Codes
Error number Description
0 No issues to report
4 Keypress send failure


The CRC Message container is a wrapper around all of the standard !XXX event messages above with the checksum value at the end. The checksum is a CRC-CCITT-16 with a polynomial of 0x1021 of all of the Event Data bytes. Enable via CONFIGBITS


 !CRC Format
Header Event Data CRC
 !CRC  !LRR:000,1,CID_1121,ff 282d

Version Message

This message indicates the serial number of the unit, version, and the firmware capabilities.


 !VER Format
Header Serial number Firmware version Firmware capabilities
 !VER ffffffff V2.2a.8.2 TX;RX;SM;VZ;RF;ZX;RE;AU;3X;CG;DD;MF;LR;KE;MK;CB;DS;ER

Serial Number

This is the serial number of the device. If unset this defaults to ffffffff.

Firmware Version

This is the revision of the firmware that is currently loaded on the device.

Firmware Capabilities

This field indicates which capabilities are built in to the firmware. See the below table for reference.

 !VER Format
Firmware Capabilities
Flag Description
TX Ability to transmit to the panel
RX Ability to receive from the panel
SM Supports sending multiple keypresses
VZ Virtual zone expanders
RF Supports receiving of RF messages from the 5800 series wireless devices (!RFX)
ZX Supports receiving of messages from zone expanders (!EXP)
RE Supports receiving of messages from relay (!REL)
AU AUI support (!AUI)
3X Special Keys (S1-S4) must be sent 3 times to trigger
CG Serialized configuration string
DD Message deduplication
MF Address mask filter
LR Long range radio messages (!LRR) deprecated see L2
L2 Long range radio messages (!LRR) with CID reporting format
KE Keypad event messages (!KPM)
MK Multiple keypad emulation (See 'K' command for more information)
CB Config bits
DS DSC support
ER Error tracking
CR CRC Wrapper around EXP,LRR and other event type messages

Device Feedback LED

  • Boot flash mode
    • During boot the AD2* will rapid flash during the boot loader.
  • Operating mode
    • The normal operating mode is a steady of approx 2.5 flashes per second.
    • Sending to panel mode 3 flashes.
  • Error mode
    • If an error is recorded the AD2* will flash the error message as steady slow flashes to be counted with a long period of the LED off between flashes. after a few minutes the led will return to normal idle flash mode if no further errors happen.