Compatibility with Solution 3000 board

[brendon]

Hi there, I was wondering what you thought about the possibility of this software working with the Bosch Solution 3000 panel?

I think it might work quite similarly to the B and G series boards. TCP/SSL on port 7700. There is a Vera integration already written (apparently by Bosch): https://boschsecurityaustralia.freshdesk.com/support/solutions/articles/35000135521-solution-2000-3000-configuration-guide-for-vera-controller

I've tried to reverse engineer that but while I'm able to connect to the board via something like openssl s_client -connect 192.168.1.134:7700 and also via Ruby, I can't seem to get any output. The byte sequences seem fairly arcane and the Lua code doesn't help as I'm not familiar with that language! :D

I can use A-Link to connect to the panel via local TCP/SSL so I know the interface is working in principle. I just lack the magic incantations :D

I'd be happy to test your software out on my panel if you think it's close enough to work :D

[EHylands]

@sanjay900 I contacted Bosch US to get a copy of the documentation: Integrated.Solutions@us.bosch.com

I would rather not distribute this document publicly myself since it is not available online.

There is no function to determine the type of sensor or point profil associated with a point. Any type of NO/NC sensor could be connected to this control panel with proper wiring. This is why user need to configure every points in Homebridge configuration file prior to launching the plugin.

[EHylands]

@sanjay900 Is is possible you code is not sending properly a command last byte ?

WhatAreYou: [1,1,1] works but not [1,2,1,1]

ReqPointText: [1,4,3C,0,PointNumber,0] works in your case but not [1,5,3C,0,PointNumber,0,0] ?

Your code is not available online anymore so I can't double check.

Oh something else crossed my mind, it turns out that the WhatAreYou packet is actually different for the solutions 3000.... its just [1.1.1] not [1.2.1.1]

[sanjay900]

I had to restructure my home assistant project for HACS, new link for the file is: https://github.com/sanjay900/solutions3000-home-assistant/blob/main/custom_components/solutions3000/solutions3000.py

With the WhatAreYou, i was originally using your code to test, and found it was in your code that i needed [1,1,1], so it isn't just my code that had that change

With the ReqPointText (or the other text requests) i found that with your code, the response from the alarm was different and that was why i had to change code for that. It wasn't that i had to send a different command, but the response itself no longer contains the points, it just hands you the text immediately after the length

[sanjay900]

@EHylands Do you know how to trigger the siren or strobe?

[EHylands]

@EHylands Do you know how to trigger the siren or strobe?

Mode2SetOutputState 0x32 to change output state associated with your Bell or Strobe on your panel.

[sanjay900]

what i find really odd is that when i use 0x30 to read the configured outputs, i just get all zeros back as if no outputs are configured, and when trying to read output text that also fails

[sanjay900]

Also, supposedly they are internally testing their new home automation focused firmware, and the product manager is chatting to the engineers about getting me an NDA to sign so that i can get access to documentation. I should still be able to keep my stuff open source but the engineers would have to okay that

[EHylands]

what i find really odd is that when i use 0x30 to read the configured outputs, i just get all zeros back as if no outputs are configured, and when trying to read output text that also fails

0x30 returns a mask of all configured output if your user has authority to view them.

Can you control outputs in RSC+ app with same passcode ?

[sanjay900]

Your right, no outputs show there either, i guess i need to configure something from A-Link plus, however i could never get that working correctly either, it gets stuck if i try to pull the settings from my panel

[sanjay900]

I was watching a video on configuring the panel, and oddly it seems like the horn and strobe don't count as outputs that can be controlled from RSC+ either, you have to specifically set an output as "remote control" for it to show up in RSC+, so i guess the solution 3000 has another difference there.

[sanjay900]

good news is that the points and arming / disarming from my home assistant integration do work with a solution 2000

[sanjay900]

@EHylands Do you have any idea what the format for the 0x15 raw history events response is? I would like to read that history data out, but annoyingly command 0x16 just does not work with my panel

[sanjay900]

Ah okay so parsing it is not fun but https://github.com/sanjay900/solutions3000-home-assistant/blob/main/custom_components/solutions3000/solutions3000.py and https://github.com/sanjay900/solution3000-home-assistant/blob/main/custom_components/solutions3000/bosch_history.py

can parse the extended raw history command response

[E46er]

Hi Guys, interesting reading this. It would be great to get a working plugin for Homebridge and the sol 3000. I don't have the technical knowledge as yourself, so any plans to release a homebridge version? Thanks heaps

[EHylands]

Hi Guys, interesting reading this. It would be great to get a working plugin for Homebridge and the sol 3000.

I don't have the technical knowledge as yourself, so any plans to release a homebridge version?

Thanks heaps

Hi, As per Bosch documentation, this plugin "should" work on Solution 3000 panels. However, @sanjay900 has discovered many differences between B panels and solution 3000 panels IP integration.

Official Solution 3000 serie documentation doesn't look to be available without signing an NDA.

Without physical or remote access to a Solution 3000 panel, it will be hard to change code ...

[brendon]

Hi @sanjay900, how far down the track did you end up getting with your integration? Were you satisfied with the outcome? :)

[sanjay900]

My home assistant integration is working alright and quite a few people seem to be using it at the moment.

On Mon, 11 Jul 2022, 2:21 pm Brendon Muir, @.***> wrote:

Hi @sanjay900 https://github.com/sanjay900, how far down the track did you end up getting with your integration? Were you satisfied with the outcome? :)

— Reply to this email directly, view it on GitHub https://github.com/EHylands/homebridge-boschcontrolpanel_bgseries/issues/1#issuecomment-1179892622, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAOGYQHKSXX3N23BQ4575PTVTOAIZANCNFSM5PQOK4AQ . You are receiving this because you were mentioned.Message ID: @.*** .com>

[brendon]

That's great to hear! :)

[sanjay900]

Ive also been in talks with bosch, and they are working on a home automation focused firmware, and once thats done they will send me a copy and documentation once i sign a NDA. I may do that, they say that i can publicly release a copy once its checked over by their devs, so that could be interesting. Its good to know that this firmware is in development though.

The current problem is that the solution 3000 firmware doesn seem to support subscribing to events, and so you have to poll for events which isn't great, and it doesn't seem to have some features that would be nice either

[brendon]

Thanks @sanjay900, good to hear they're still working on this. Hopefully they add those features as part of that firmware upgrade.

[fredhandle]

I can shed some light on the B/G Series vs the 2000/3000 controllers and the Mode2 automation if you are still interested. Also happy to share a 3000 with the latest firmware in your still working on this?

[sanjay900]

Id be down to hear what you know about it, im maintaining a home assistant integration and any info you know would be great https://github.com/sanjay900/solution3000-home-assistant

[EHylands]

Thank you @fredhandle for your comments https://github.com/sanjay900/solution3000-home-assistant/issues/3

Closing the issue Homebridge plugin for B and G series is not compatible with Solution 3000 board for the moment.

[EHylands]

@sanjay900 @fredhandle @brendon

Just released v0.5.0-beta in Homebridge-UI Trying to provide Legacy Support for solution 2000-3000 panels (Maybe AMAX panel). Only using older Command Format 1 API for Legacy Mode Pooling panel for update rather then using push notifications. Area Arming and Area Alarm Triggered still not implemented.

May have to do some fine tuning of the RSC Passcode command. As per Sanjay example, only providing A-Link passcode should work.

Please let me know if you can run the plugin. Please provide log with debug option if you encounter errors.

Tnx !

[brendon]

Hi @EHylands, unfortunately I bricked my network card while trying to flash it. I'll look at ordering a new one to try this out on :)

[sanjay900]

I can't really test either as i don't have homebridge myself

[EHylands]

I can't really test either as i don't have homebridge myself

@sanjay900 Are you still trying to detect active alarm on each area ?

[sanjay900]

I put an implementation in there but never actually got around to setting my alarm off, so i've got not idea if it works

[EHylands]

I tried to read Event history on panel to detect alarm, without defenitive success.

Can now pool panel and detect alarms with following instructions: Mode2ReqAlarmMemorySummary [0x08] Mode2ReqAlarmMemoryDetail [0x023]

Both commands are version 1.23 and 1.24 and should be avalaible on your panel.

[sanjay900]

Cool, ill port that to my code base and give it a go at some point

[sanjay900]

I can confirm that those commands work, thank you!

[sanjay900]

I did notice that you use Mode2ReqAlarmMemorySummary, and then Mode2ReqAlarmMemoryDetail for every priority, was there a reason for doing this over just looking at the ones that have counts? I found that the priorities are all off by one, so you need to subtract one. Also, you can use a command format of 2 to include BurglaryTamper if you want that.

response = await self._xfer_packet(Commands.ReqAlarmMemorySummary, 0xFE, [2], [])
response = response[1:]
for priority in AlarmMemoryPriorities:
    i = (priority.value - 1) * 2
    count = (response[i] >> 8) + response[i+1]
    if count == 0:
        for area in self.areas:
            area.alarms.discard(priority)
    else:
        await self._req_alarm_status_details(priority)

[EHylands]

I did notice that you use Mode2ReqAlarmMemorySummary, and then Mode2ReqAlarmMemoryDetail for every priority, was there a reason for doing this over just looking at the ones that have counts?

I wanted to detect alarm restoral. I agree that removing alarmpriority within every areas if count is 0 like you do it is more effective.

Also, still not detecting fault and tamper in my plugin so may only check for alarm priorities 7,8,9,10.

I found that the priorities are all off by one, so you need to subtract one.

Alarm priorities are from 1 to 10 in protocol version 1 and from 1 to 18 in protocol version 5.

Its unclear exactly with commands are supported on other panels yet. Will stay with protocol version 1 commands.

Thanks for the feed back !

Also, you can use a command format of 2 to include BurglaryTamper if you want that.

response = await self._xfer_packet(Commands.ReqAlarmMemorySummary, 0xFE, [2], [])

response = response[1:]

for priority in AlarmMemoryPriorities:

    i = (priority.value - 1) * 2

    count = (response[i] >> 8) + response[i+1]

    if count == 0:

        for area in self.areas:

            area.alarms.discard(priority)

    else:

        await self._req_alarm_status_details(priority)

[brendon]

Hi @EHylands, I've finally purchased a new Ethernet adapter card and also an 8 output card for the Solution 3000 so will see how it works with your plugin and report back once it arrives.

[brendon]

Hi @sanjay900, my replacement network board has arrived and I've been able to connect to the system using A-Link and the Cloud method using the long ID code that's printed on the board (with the QR code).

I can't seem to connect locally on port 7700, or at least the log says:

Control Panel Connection Error (connect ECONNREFUSED 192.168.1.73:7700)

Is the A-Link password the long string used for cloud connect or just the system's default 8 digit admin code (00000000)? or even the main user 4 digit alarm code?

Hoping you can help :D

[EHylands]

Hi @sanjay900, my replacement network board has arrived and I've been able to connect to the system using A-Link and the Cloud method using the long ID code that's printed on the board (with the QR code).

I can't seem to connect locally on port 7700, or at least the log says:

Control Panel Connection Error (connect ECONNREFUSED 192.168.1.73:7700)

Is the A-Link password the long string used for cloud connect or just the system's default 8 digit admin code (00000000)? or even the main user 4 digit alarm code?

Hoping you can help :D

With that error, it means your device is not listenning on port 7700. I thing a further step is needed to enable mode2 automation on A-Link. Trying to find spec again.

[brendon]

You're correct @EHylands. I think the B426-M boards (cloud enabled) come configured with local connection disabled by default. I'm hoping since @sanjay900 has the same board, that he knows what to change in A-Link to enable that interface :)

[EHylands]

@brendon, trying to go through B426-M config manual.

Did you enable encryption on your B426-M IP module ? Network Module Porgraming -> Module [1-2] -> Encryption and Security Settings -> Enhanced Security Enable: Enable ?

• Can you ping 192.168.1.73 from your homebridge server ?
• Can you check if TLS encryption is enabled on port 7770: openssl s_client -connect 192.168.1.73:7700 (I get 'New, TLSv1.2, Cipher is AES256-GCM-SHA384' on my panel)

[brendon]

Hi @EHylands, I'm away from the house but have checked the config and Enhanced Security Enable is disabled. Should it be enabled?

I can recall that I can ping the IP address and it responds to pings. I'll try the openssl thing when I get home :)

[EHylands]

Homebridge plugin will only work on a TLS > 1.0 connection. Lets first see if TLS is enabled on your port 7700.

[brendon]

Roger. I'll turn it on when I get home and see how it goes :)

[sanjay900]

funnily enough i didn't actually change anything myself

[brendon]

Lol :) Would you mind me taking a look at your A-Link configuration pages for networking? (excluding any particular private config of course!) :D

[sanjay900]

Here is the module config ill check alink but i need to fire up a VM for that

[brendon]

Hi @EHylands, I can confirm that I can ping the board fine but:

❯ openssl s_client -connect 192.168.1.73:7700
connect: Connection refused
connect:errno=61

That's with Enhanced Security Enable: Enable.

[sanjay900]

I had this problem at one point for no reason and then it just fixed itself for absolutly no reason

[sanjay900]

What exactly did you want from A-Link?

[sanjay900]

[brendon]

Thanks @sanjay900, The entire web interface is disabled on this board and they even put a scary warning on the bag containing the board packaging saying not to visit the web interface or change the password or it would void the warranty :) They must have had some problems with people messing with their boards to the point of bricking them.

Yea I have A-Link running under Parallels on my Mac. Works pretty well considering. Would be great to see those pages when you have time :)

[sanjay900]

Is it possible that in disabling the web interface, they also disabled talking to it directly like this? Do you need any other pages besides those two?