Home > Domotica > Plugwise Protocol Analysis, Part 2

Plugwise Protocol Analysis, Part 2

Continuing in my attempts to understand the PlugWise protocol, I discovered a few more command/reply types in my captured.

Role call

Periodically the source queries the Circle+ node for all nodes that could be connected to the Circle+. This is done with the command/reply sequence 0018/0019.  The 0018 command queries 64 nodes and the 0019 reply contains the MAC of the Circle+ and the MAC of another Circle or “FFFFFFFFFFFFFFFF” and the associated nodeID .

The first query (nodeID=00):

w 0018 000D6F0000B1B64B 00
r 0000 027A 00C1
r 0019 027A 000D6F0000B1B64B 000D6F0000B1B967 00

The last query (nodeID=3F)

w 0018 000D6F0000B1B64B 3F
r 0000 02B9 00C1
r 0019 02B9 000D6F0000B1B64B FFFFFFFFFFFFFFFF 3F

Switching a circle on and off

Captured the command for switching a node on and off this uses the command 0017. This command does not have its own reply code, but returns a 0000 reply message.containing the usual 16-bit reply value (might be a bitfield) and the MAC of the circle that switched. The reply for on or off is different.

Switch the circle ON

w 0017 000D6F0000AF4C47 00
r 0000 037B 00C1
r 0000 037B 00DE 000D6F0000AF4C47

Switch the circle OFF
w 0017 000D6F0000AF4C47 01
r 0000 038F 00C1
r 0000 038F 00D8 000D6F0000AF4C47

Error reply that leads to a command resend

I noticed this behaviour in my logs. This was after one of the many 0023 requests, and instead of the 0024 reply there was an 0000 reply with code 00E1. Is this a NAC or Timeout, or Network Busy reply? It repeats a few times, and then a 0008 command is send (is this some sort of restart?), after which a short initialisation sequence follows and everything continues.

w 0023 000D6F0000B1B5B6
r 0000 0312 00C1
! no reply received!

! another request that succeeds.
w 0023 000D6F0000B1B967
r 0000 0313 00C1
r 0024 0313 000D6F0000B1B967 0B047EAE 00044440 0185 653907014023 4CCEC0C2 02

! the ‘timeout’ reply.
r 0000 0312 00E1

! same request as the one that failed.
w 0023 000D6F0000B1B5B6
r 0000 0317 00C1
r 0000 0317 00E1

! retries, this is the 16th.
w 0023 000D6F0000B1B5B6
r 0000 0328 00C1
r 0000 0328 00E1

! seems it is giving up retrying, sends command 0008.
w 0008 00
r 0000 0329 00C1
r 0000 0329 00DD 000D6F0000B1B64B

Then a short initialisation; First a 0023 to the stick, followed by a sequence to the Circle+ 0023,0029,003E,0012, followed with normal 0023 commands to other circles.

w 0023 000D6F0000B835CB
r 0000 032A 00C1
r 0024 032A 000D6F0000B835CB 0000000000000000 00 80 6539 0700 8510 4CCEC22A 00

w 0023 000D6F0000B1B64B
r 0000 032B 00C1
r 0024 032B 000D6F0000B1B64B 0B047EAF00044450 01 85 6539 0700 7324 4CCEBFA1 01

w 0029 000D6F0000B1B64B
r 0000 032C 00C1
r 003A 032C 000D6F0000B1B64B 07311206230411

w 003E 000D6F0000B1B64B
r 0000 032D 00C1
r 003F 032D 000D6F0000B1B64B 0C1F070601457A

w 0012 000D6F0000B1B64B
r 0000 032E 00C1
r 0013 032E 000D6F0000B1B64B 00260129 0000F03B 00000000 0002

w 0023 000D6F0000B1B967
r 0000 032F 00C1
r 0024 032F 000D6F0000B1B967 0B047EAF 00044440 01 85 653907014023 4CCEC0C2 02

I also saw an 0059/0000 command reply after it got all circles. This was part of an 0023, 004A, 0029, 0012, 0059 sequence to the Circle+

w 004A 000D6F0000B1B64B
r 0000 034F 00C1
r 0000 034F 00F1 000D6F0000B1B64B

w 0029 000D6F0000B1B64B
r 0000 0350 00C1
r 003A 0350 000D6F0000B1B64B 08321206230411

w 0012 000D6F0000B1B64B
r 0000 0351 00C1
r 0013 0351 000D6F0000B1B64B 00250126 0000F8DE 00000000 000C

w 0059 000D6F0000B1B64B FFFF
r 0000 0352 00C1
r 0000 0352 00FA 000D6F0000B1B64B

No idea yet what the purpose of command 0059 is, it sends FFFF and the reply returns a status 00FA in a generic 0000-reply.
I suppose it would be nice to find the meaning of the 0000-reply. It almost has to be a 16-bit bitfield. Some 0000-replies return extra data (like a MAC).

Categories: Domotica Tags: ,
  1. No comments yet.
  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: