Reading the bus but no F7s

[jn3va]

Hi Alain

I connected my ESP to the alarm today and it seems to be decoding messages from the bus but I am not seeing any F7 messages (see attached). Mostly F8 and 9E. If I open a door the primary keypad shows a fault on that door, I don't see any F7 messages, just output below:

[20:21:02][I][CMD:347]: 9E 02 20 81 62 00 00 00 00 00 00 00 [20:21:02][I][CMD:347]: 9E 02 25 60 7E 00 00 00 00 00 00 00 [20:21:04][I][CMD:347]: F8 98 F8 66 1E 86 86 86 00 00 00 00 [20:21:04][I][CMD:347]: 9E 98 60 E6 66 00 00 00 00 00 00 00 [20:21:04][I][CMD:347]: F8 98 66 7E 00 78 00 FE 1E 00 00 00 [20:21:04][I][CMD:347]: 98 F8 66 00 00 FE 00 00 00 00 00 00 [20:21:05][I][CMD:347]: F8 F8 F8 F8 00 FE 1E F8 F8 00 00 00 [20:21:05][I][CMD:347]: F8 F8 00 FE 1E F8 F8 F8 F8 00 00 00 [20:21:12][I][CMD:347]: F8 F8 F8 F8 00 9E 02 20 F1 00 00 00 [20:21:12][I][CMD:347]: F2 00 00 00 00 00 00 00 00 00 00 00

[20:21:12][I][INFO:551]: Beeps: 0 [20:21:12][I][EXT:347]: 98 07 00 00 00 00 00 00 00 00 00 00

[20:21:12][I][INFO:551]: Beeps: 0

[20:21:13][I][CMD:347]: F8 F8 78 98 60 E6 00 F8 00 00 00 00 [20:21:13][I][CMD:347]: 98 66 7E 00 78 60 00 00 00 00 00 00 [20:21:13][I][CMD:347]: 9E 86 E6 E0 86 00 00 00 00 00 00 00 [20:21:14][I][CMD:347]: 9E 78 1E 7E F8 00 00 00 00 00 00 00 [20:21:14][I][CMD:347]: F8 00 FE 1E 66 00 F8 7E FE 00 00 00 [20:21:14][I][CMD:347]: F8 F8 80 7E 1E 00 00 FE 9E 00 00 00 [20:21:14][I][CMD:347]: F8 78 06 7E 00 FE 9E 7E E0 00 00 00 [20:21:16][I][CMD:347]: 9E 02 25 F1 ED 00 00 00 00 00 00 00 [20:21:16][I][EXT:347]: 9E 00 25 00 51 86 18 98 90 E9 00 00 [20:21:17][I][CMD:347]: F8 98 F8 66 1E 86 86 86 00 00 00 00 [20:21:17][I][CMD:347]: 9E 98 60 E6 66 00 00 00 00 00 00 00 [20:21:17][I][CMD:347]: F8 98 66 7E 00 78 00 FE 1E 00 00 00 [20:21:17][I][CMD:347]: 98 F8 66 00 00 FE 00 00 00 00 00 00 [20:21:18][I][CMD:347]: F8 F8 F8 F8 00 FE 1E F8 F8 00 00 00 [20:21:18][I][CMD:347]: F8 F8 00 FE 1E F8 F8 F8 F8 00 00 00 [20:21:26][I][CMD:347]: F8 F8 F8 F8 00 00 00 E0 E0 00 00 00 [20:21:27][I][CMD:347]: F8 98 F8 66 1E 86 86 86 00 00 00 00 [20:21:27][I][CMD:347]: 9E 98 60 E6 66 00 00 00 00 00 00 00 [20:21:27][I][CMD:347]: F8 98 66 7E 00 78 00 FE 1E 00 00 00 [20:21:28][I][CMD:347]: 98 F8 66 00 00 FE 00 00 00 00 00 00 [20:21:28][I][CMD:347]: F8 F8 F8 F8 00 FE 1E F8 F8 00 00 00 [20:21:28][I][CMD:347]: F8 F8 00 FE 1E F8 F8 F8 F8 00 00 00 [20:21:35][I][CMD:347]: F8 F8 F8 F8 00 9E 02 20 81 00 00 00 [20:21:35][I][EXT:347]: 98 07 00 00 01 00 00 00 00 00 00 00

All the sensors in my system are wireless and there is a 5881EN Wireless receiver attached to the keypad bus (that is using keypad ID 17). I set the ESP to be Keypad ID 19. I checked and MONITORTX was already uncommented. I'm assuming the wireless sensors are reporting differently.

I tried arming from the primary keypad (quick Arm #3) which results and no F7 messages

[20:29:52][I][CMD:347]: 9E 02 20 81 62 00 00 00 00 00 00 00 [20:30:59][I][EXT:347]: 9E 00 20 00 24 00 DC 00 00 00 00 00 [20:31:06][I][CMD:347]: F8 98 66 7E 00 78 00 FE 1E 00 00 00 [20:31:06][I][CMD:347]: 98 F8 66 00 00 FE 00 00 00 00 00 00 [20:31:06][I][CMD:347]: F8 F8 F8 F8 00 FE 1E F8 F8 00 00 00 [20:31:06][I][CMD:347]: F8 F8 00 FE 1E F8 F8 F8 F8 00 00 00

V20P_log.txt

[Dilbert66]

What panel and version are you using? The 9E are RF messages which contain the device serial number and a device status byte.. The 98's are expander cmds. The F8's are unkown to me at this time. It almost points to AUI data but I don't have that type of setup or RF modules so can't test it. Did you also enable the keypad 19 in the vista panel config (prgram *192 I believe) ? It needs to happen. What is your main keypad? Is it a touch model?

[Dilbert66]

Also I see that your monitortx is working fine as I see some EXT response messages in your logs.

[jn3va]

Its an old Ademco. Label inside the box says AM100 and the sticker on the circuit board is labeled says SAV20AMTE. I did enable the Keypad address 19 (*192 1 0 ). When I was checking for unused keypad IDs I was getting some strange results. e.g.

191 showed OPTIONS 08

192 showed TELCO MONITOR 00

193 showed RPT ARM 01

194 showed DOWNLOAD PHONE but no digits

195 showed RING COUNT 00

196 showed INIT CSID EE

Originally the alarm had a 4285 voice module hooked in so you could arm/disarm by phone. That's since been removed (by the new alarm monitoring company). I'm assuming TELCO MONITOR was originally connected to 19 and is the label the tech added for the voice module, but I have no idea why the other keypad IDs have the labels they do. I'll try again tomorrow with Keypad ID 22 (*195) and see if that makes any difference.

main keypad is a direct wire LCD display with the standard numeric keypad (non touch). I don't know the model number

[Dilbert66]

Set the address to 16. That's the default keypad address and usually used for the main keypad used to program a system. Your model looks to be a variant of the Vista20P. The SAV20AMTE from a quick google, points to a model sold by a company called SecurityLink.

[jn3va]

Do you mean in the ESPHome yaml? I thought the system could get confused when there were multiple things connected that used the same address?

yes SecurityLink (I think was also ADT at some point). Everything in the programming seems to be consistent with the 20P programming manual.

I will try reflashing with 16 and connect it back up tomorrow.

Thanks!

[Dilbert66]

You didnt indicate that there was anything on 16? It won't hurt to have it there, you will just have problems sending but you can test it to see if you get the F7's. Of course, set it to a different address when done testing. At this point I really don't get why you don't see the F7 but instead see a ton of F8 messages. Must be because of something in the proprietery programming of that vista20p variant. The odd part is that your lcd keypad is showing messages though and those come from the F7. This points to some program setting somewhere in the panel or keypad addressing but I'm at a loss as to what.

edit: Those messages you show when accessing the keypad programming menu are odd?? The LCD does not normally show that type of info? Then again I don't know that much about the various panels per say.

[Dilbert66]

Ok, I know why. I found the program manual for this system. It's not your typical vista20p. There is no program section above 99. So when you were entering 192, 193 etc, it was getting 92, 93,94, etc which matches this manual. Here's a link to the manual: http://www.alarmhow.net/manuals/Ademco/Control%20Panels/Vista-20AMT/Vista-20AMT3%20Program%20Sheet.pdf

http://www.alarmhow.net/manuals/Ademco/Control%20Panels/Vista-20AMT/

[Dilbert66]

Try address 31 as that seems to be one recommended for lcd's for this system.

[jn3va]

That AM100 manual find answers a lot of questions. Makes much more sense about the results I was seeing when using #192 #193 etc to review the programming fields. Unfortunately no luck with this yet. I reflashed using 31 as the keypad address, but all I'm seeing are the "9E" messages. I used the simultaneous 1&3 key press sequence on the keypad and confirmed it is set to address 31. Like you said above, I'm now wondering if this is old enough that there are no F7 messages, maybe that was introduced with the newer 20P systems. I saw an article that talked about the keypads coming default to 31 and that needing to be changed to 16, 17 etc. so while similar the older system definitely has some new code related to the keypads.

I also tried reflashing with address 16. Flashing with an address of 16 results in more data from the serial log. When I use address 31 I only see the 9E messages. When I use address 16 I see F8, 9E, and 98 as the first byte. When I open a door I see the 3 lines below but no F7

[19:13:26][I][INFO:551]: Beeps: 0

You mentioned that the 9E are wireless sensor state reports. Do you have any reference or info about those? e.g. Which bytes have the address, which the state etc? Maybe I can try and decode some and modify the code to look at the individual info; that way even if I can't arm/disarm etc., I can at least read the sensors.

[Dilbert66]

That system must be using a different command than an F7 for statuses and messages so I will modify the code to also display unknown messages and I'll get you to post the serial out debug logs so we can identify the cmds.

As to the 9E wireless commands, i have a code addition that will display the decoded info and extract the serial and data from it. A user posted a pull request so I will add it to the debug version and push it to the "dev" branch for you to test out.

I'll let you know when I have something for you to test. Will be tomorow.

[Dilbert66]

I made a quick change and added some debug code to try and capture unknown commands and also have prelimininary 9E decoding (untested so I don't know if it works). I've pushed it to the "dev" branch.

Load it up and post the logs you get.

[jn3va]

Awesome - thanks! I might not be able to get to this again until Thursday but if I can get out of a meeting tomorrow I'll run it and post the output. Have a great night.

[Dilbert66]

No problem! Just note that you might get some odd logs as it will only capture about 4 bytes of the initial unknown command sthe rest will show up as another command. It will skew the output a bit but thats ok. Lets see if we can identify this beast.

[Dilbert66]

You mentioned that the 9E are wireless sensor state reports. Do you have any reference or info about those? e.g. Which bytes have the address, which the state etc? Maybe I can try and decode some and modify the code to look at the individual info; that way even if I can't arm/disarm etc., I can at least read the sensors.

Just to clarify, the CMD: 9E's are sent from the panel. They are just requests for status for each device. The ones to look for are the EXT: 9E which are the responses from the sensors. Those are the ones with the sensor status

[jn3va]

Log attached after flashing with the DEF branch. Let me know if you need more detail or to try anything else.

Joe ESPVista_DEV_Capture_20210512.txt

[Dilbert66]

From the looks of the data, there are a few more unknown commands in there. Perhaps a 1E, FE (but hard to know for sure due to the fact that we are just capturing groups of bytes and without knowing the length of the commands, it's tough to pin down. I use an inexpensive logic analyzer such as this one: https://learn.sparkfun.com/tutorials/using-the-usb-logic-analyzer-with-sigrok-pulseview/all with pulse view to identify the protocol. It's invaluable for this type of stuff.

I was hoping to see some ascii characters in the decoded bytes such as sent in the F7 but I don't see anything like that so it's kinda tough to know for sure what's going on. With the latest LCD keypads, the panel sends the actual text messages to the keypads in the F7. I don't see how it's done with this particular panel though.

[jn3va]

I'm pretty sure this is a newer (within 4-5 years) keypad. Had to replace the original a few years ago. The original panel is pretty old. The keypad will display where the fault is by name that was programmed in by the original installer so I know the panel is sending that info, but I'm assuming it uses an older encoding that the newer keypads still understand. I'm actually considering upgrading the panel since the wireless sensors all still work and are compatible with the Vista 20 and 21 panels. Do you know if your interface works with the 21iP? or just the 20P? Once I swap it out I'll come back to this. Also ever used or heard anything about AlarmGrid? Seems like they have a much better rate for monitoring than I have today.

[Dilbert66]

That's odd though so there must be an f7 sent somehow since those keypads work with the regular vista 20p. I would really need to see the bus to know for sure. Anyhow, vista systems are pretty cheap any how especially if they work with the existing hardware you have. I've never tested or know of anyone using a 21p but looking at the specs, since it works with the same bus hardware as the vista20p, I'm sure it t would work fine with my code. I've never used AlarmGrid. I've been using ADT for many years and they have been ok. Not the cheapest though.

[Dilbert66]

I had a another look at the cmds shown in the logs and none really make sense. The 98's and 9E's are not correct. The chksums don't even add up so it would seem the protocol is very different on this panel. Interesting though that the lcd keypad can understand it so I suspect it's somethign else like polarity, baud rate, etc or the data is inverted? I can't imagine 2 different protocols. Can you double check your wiring... ?

[jn3va]

I was watching a video about hose keypads. They come factory set to address 31 - and mine is still set to address 31. When you add them to a Vista20 you have to change the address to 16, 17, etc. on the keypad and then enable in the panel. So I suspect there is something in the keypad code like If ID=31 then Decode the data the old way.... else Decode the data beginning with "F7" the new way...

I'll check the wiring tonight Thanks!

[jn3va]

The 98's and 9E's are not correct. The chksums don't even add up so it would seem the protocol is very different on this panel

I am getting a lot of disconnects when viewing the log to capture the output. I'm running an ESP32 so I figured it would be fast enough but maybe between ESPHome trying to connect and the board trying to listen things are getting dropped. I don't have a logic analyzer. Any other thoughts on how to capture the output besides the ESPHome web interface in HaaS?

[Dilbert66]

That's not normal. There isnt that much data coming in normally. There can't be that much data missed.. There is definitively something afoot here Watson! lol. The modded code i gave you should have picked up any unknown packets. Instead the traffic you show really doesnt make sense. For example. A 98 cmd should look like this:

16:19:17][I][CMD:350]: 98 2E 40 20 F1 B4 00 00 00 00 00 00 
[16:19:18][I][CMD:350]: 98 2E 80 20 F1 74 00 00 00 00 00 00 

Yours looks like this. This is totally wrong. So it's more than just a few lost bytes, it's every byte is incorrect.

[20:21:13][I][CMD:347]: 98 66 7E 00 78 60 00 00 00 00 00 00
[20:31:06][I][CMD:347]: 98 F8 66 00 00 FE 00 00 00 00 00 00

[Dilbert66]

I can't see how the address would be a factor as it's only needed when the keypad needs to write to the bus, otherwise it just sits idly capturing data. Who knows I guess. Only way to know is to change the address on the keyapd and see what happens.

[Dilbert66]

I wonder if it's a baud rate issue... hmmm You can always try different baud rates to see if it makes any difference? Here's the line in vista.cpp (line 21)

  vistaSerial->begin(4800,SWSERIAL_8E2);

You can try other bauds like 1200, 9600, 2400, etc

I suppose it could using 7 bits instead of 8 so that would need to change too. That's why a logic analyzer is nice. You can spot it right away. Who knows...

[jn3va]

No joy. Validated the wiring of the board, opto, resistors - all correct. The only thing I'm using that's different is a 4N35 optocoupler, vs a 4N26. The 35 has a higher current transfer ratio but otherwise they are the same.

I tried different bauds 300,1200, 2400, 4800, 9600 I even added some additional Parity and stop values to SWSerial and tried 8E1, 7E2, 7N1. Saw some 7Fs but no F7s. I decided to buy an updated panel. Probably take me a couple of weeks to get that up and running. When I do, I'll circle back and hook the board up and go from there. Thanks for your help and great work on this!

[jn3va]

p.s. In a post above you mentioned the bytes look wrong. Do you have an example of what the bytes should look like?

[Dilbert66]

That 's so bizarre about that board. It sure has my curiosity peaked as to why it's different. As to the wrong bytes, look at the cmd 98 I posted above. It shows typical vs your values. A 98 in my case always starts with 98 2e and that never changes. Your 98's were just random bytes the code picked up from the stream of bytes your panel sent. Which is why this tells me there's a comm discrepency somewhere. The protocol would need to be close to the same for the keypad to work in my opinion.

Anyhow, don't throw that board out!

[jn3va]

New panel, success! I'm now getting F7s and messages, so must have been something with the old panel. I am still having one issue though. I'll open a separate issue b/c I think this might be related to the wireless sensors.

[Dilbert66]

Do you still have that older SE board? I would love to analyze it. someone reported a similar issue with a vista-20SE. Could you ship it to me for temporary testing? I would send it back to you. I'll pay for shipping both ways.

[jn3va]

Hi Alain

Yes I still have it. Sure you can use it. I re-used the wireless sensor module in the new system so its just the alarm panel main board, but you are welcome to use it. Let me know where to send it and I can estimate the shipping. Do you need the power transformer too?

Joe

On Wed, Sep 8, 2021 at 10:59 AM Alain Turbide @.***> wrote:

Do you still have that older SE board? I would love to analyze it. someone reported a similar issue with a vista-20SE. Could you ship it to me for temporary testing? I would send it back to you. I'll pay for shipping both ways.

— You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub https://github.com/Dilbert66/esphome-vistaECP/issues/21#issuecomment-915315816, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIKH66RHJR4QAOF55DLEKV3UA526HANCNFSM44TOZLDA . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.