- Visonic Powermax Remote Programmer Software Manual
- Visonic Powermax Remote Programmer Software Download
- Visonic Powermax Remote Programmer Software Download
- Visonic Powermax Remote Programmer Software Windows 10
- Visonic Powermax Remote Programmer Software Update
- Visonic Powermax Remote Programmer Software Price
- Visonic Powermax Remote Programmer Software
Powermax Programming Software Click Here to download the Visonic Powermax Remote Programming Software Link from our download section. The prefered method of downloading Paxton's software is to visit the dealer extranet at Alternately you can try this link: paxton.info/1438. I´m a happy ovner of PowerMax+ system and now I´m intresting to try your new Remote Program for it. I have installed the program but want the password XXXXX install. Are you able to support. Regars, Gunnar Karl. How can I get the newest PowerMax remote programmer software? Download PowerMax Remote Programmer 3.1.1 from our software library for free. The current installer available for download occupies 10.4 MB on disk. This program is a product of Visonic Ltd. PMax.exe is the common file name to indicate the PowerMax Remote Programmer installer. The most popular versions among the software users are 3.1, 3.0 and 1.0.
.General Message Format
Messages are a sequence of bytes. Messages can have arbitrary length. Messages start with a preamble (0x0D) and end with postamble (0x0A). The last byte before the postamble is a checksum.
- Code: Select all
<Preamble> <Payload> <Checksum> <Postamble>
Because the payload can contain the preamble as well as the postamble as data, you should calculate the checksum whenever you receive the postamble (0x0A). If the checksum is correct you know it was the postamble, if it is not this byte is just part of the data.
Calculation of the checksum
The checksum is calculated as follows:
1. Sum all bytes except for the preamble, postamble and the checksum itself.
2. Divide this sum by 255.
3. Take the one complement of the remainder, but only if the remainder is bigger than 0.
Example of calculating the checksum in Python:
- Code: Select all
checksum = 0
for char in msg[1:len(msg) - 2]:
checksum += ord(char)
checksum = checksum % 255
if checksum % 0xFF != 0:
checksum = checksum ^ 0xFF
Other way to calculate the checksum:
1. Sum all the payload bytes in a word;
2. Subtract both high and low byte from FFFF;
3. Low byte contains the checksum.
Why: the 'if' seems rather odd to me in a checksum calculation; this one always does the same calculation.
A few examples:
- Code: Select all
Payload : A5 00 07 00 00 00 00 00 10 00 00 43
Checksum : 00 (from Visonic)
Sum : A5+07+10+43 = 00FF
Checksum : FFFF-00-FF = FF00, low byte = 00
Payload : A5 00 02 94 06 00 00 00 00 00 00 43
Checksum : 7A
Sum : A5+02+94+06+43 = 0184
Checksum : FFFF-01-84 = FF7A, low byte = 7A
Payload : A5 00 01 00 00 00 00 00 00 00 00 43
Checksum : 16
Sum : A5+01+43 = 00E9
Checksum : FFFF-00-E9 = FF16, low byte = 16
Payload : A5 00 02 B4 06 00 00 00 00 00 00 43
Checksum : 5A
Sum : A5+02+B4+06+43=01A4
Checksum : FFFF-01-A4 = FF5A, low byte = 5A
Communication parameters
The parameters of the RS232 interface are:
- Code: Select all
9600 Baud; Data Bits 8; Stop Bits 1; Parity None
The enrollment process
The (emulated) Powerlink needs a pin code in order to:
- Get some information from the Powermax
- Use the bypass command
- Use the disarm and arm commands
During the enrollment process the Powerlink will create a pin and register this pin at the Powermax. The advantage is that none of the already pins is required.
On the Powermax+ and Powermax Pro the (emulated) Powerlink can be enrolled via the installer menu, on the Powermax Complete the Powerlink will be registered automatically (what does this dialog look like?)
When the (emulated) Powerlink is connected and the 'Install Powerlink' option is selected from the installer menu the Powermax sends the following message:
- Code: Select all
0xAB 0x0A 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x43
The (emulated) Powerlink should respond with the following message:
- Code: Select all
0xAB 0x0A 0x00 0x00 <pin1> <pin2> 0x00 0x00 0x00 0x00 0x00 0x43
where <pin1> and <pin2> are the digits of the pin code that needs to be registered in order to be used by the Powerlink. When the enrollment process is completed successfully, a beep will be sounded.
Note: When a new Powerlink module needs to be registered while there is already a Powerlink registered, the previous registered one needs to be uninstalled. You can do so by selecting 'Install Powerlink' from the installer menu en then press the disarm button.
Establishing connection
Communication can be established by sending an AB message (see messages below) to the Powermax. The Powermax will respond with a Panel ACK message. All messages sent by the Powermax must be responded to with an ACK message. If messages are not acknowledged the communication drops and has to be re-initialised sending an AB message.
Message types
Note: The all messages must be prefixed by the preamble and postfixed by the checksum and postamble.
0x02 - Acknowledgement
Length: 2 bytes
- Code: Select all
0x02 0x43
This acknowledgement must be sent in reply to all messages from the panel in order to keep the communication alive.
0x08 - Access denied
Length: 2 bytes
- Code: Select all
0x08 0x43
This message is sent by the Powermax when a command has been sent which requires a pin code and none or an incorrect pin is specified.
0x46 - Set date and time
Length: 11 bytes
Note: This seems to work only on the Powermax Pro and not on the Powermax Plus.
- Code: Select all
0x46 0xF8 0x00 0x00 <Minutes> <Hours> <Day> <Month> <Year> 0xFF 0xFF
Where:
hours must be specified in 24 hour format
day must be the day of the month (1-31)
month must be between 1-12
year must be specified as the years since 2000.
Example: To set the time to 21:56, August 3 2011, send the following message:
- Code: Select all
0x46 0xF8 0x00 0x00 0x38 0x15 0x03 0x08 0x0B 0xFF 0xFF
0xA0 - Get event log
Length: 12 bytes
- Code: Select all
0xA0 0x00 0x00 0x00 <Byte 4> <Byte 5> 0x00 0x00 0x00 0x00 0x00 0x43
Where:
Byte 4 contains the first 2 digits of the pin code to be used
Byte 5 contains the third and fourth digit of the pin code to be used
Note: If your pin is 1357, you should replace <Byte 4> <Byte 5> with 0x13 0x57, do not translate your pin to hex directly!
The response is a large number of messages, each indicating a log entry. The responses are also starting with 0xA0.
The format of these messages is:
- Code: Select all
0xA0 <Byte1> <Byte2> <Byte 3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte 9> <Byte10> 0x43
Where:
Byte 1 indicates the total number of messages returned
Byte 2 indicates the current message number
Byte 3 indicates the seconds of the timestamp
Byte 4 indicates the minutes of the timestamp
Byte 5 indicates the hours of the timestamp specified in 24 hour format
Byte 6 indicates the day of the month
Byte 7 indicates the month
Byte 8 indicates the number of years since 2000
Byte 9 Zone/User, see appendix E
Byte 10 indicates the event occurred. A list of all log events can be found in appendix C
Example:
- Code: Select all
0xA0 0xFB 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x03 0x00 0x43
0xA0 0xFB 0x02 0x07 0x38 0x16 0x06 0x08 0x0B 0x4D 0x33 0x43
.
.
0xA0 0xFB 0xFB ...
The reply consists out of 251 (0xFB) messages.The second message is the latest log entry, in this case a telephone line failure on August 6, 2011 at 16:38.
0xA1 - Arm or disarm the Powermax
Length: 12 bytes
- Code: Select all
0xA1 0x00 0x00 <Byte3> <Byte4> <Byte5> 0x00 0x00 0x00 0x00 0x00 0x43
Where:
Byte 3 must be one of the following commands:
0x00 Disarm
0x04 Arm home
0x05 Arm away
0x14 Arm home instantly
Byte 4 must be the first 2 digits of the pin code to be used
Byte 5 must be the third and fourth digit of the pin code to be used
Note: If your pin is 1357, you should replace <Byte4> <Byte5> with 0x13 0x57. Do not translate your pin to hex directly!
0xA2 - Request status update
Length: 12 bytes
- Code: Select all
0xA2 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x43
The reponse consists of multiple rows/messages (9 (0x09) for the Powermax+ and Powermax Pro and 14 (0x0D) for the Powermax Complete) of the following format:
- Code: Select all
0xA5 <Number of rows> <Row> ...... <0x43>
Till now only the second, third, fourth and sixth message have been decoded partly.
The second row indicates the status of the zones:
- Code: Select all
0xA5 <Numberof rows> 0x02 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
The description is the same as for the 0xA5 0x00 0x02 message, see later on.
The third row indicates which zones are tampered or inactive:
- Code: Select all
0xA5 <Numberof rows> 0x03 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
The description is the same as for the 0xA5 0x00 0x03 message, see later on.
The fourth row indicates the status of the system panel:
- Code: Select all
0xA5 <Numberof rows> 0x04 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
See for a detailed description the 0xA5 0x00 0x04 message later on.
The sixth row also indicates whether a zone is enrolled and bypassed:
- Code: Select all
0xA5 <Numberof rows> 0x06 <Byte3> <Byte4> <Byte5> <Byte6> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
Byte 3 indicates which of zones 1 - 8 are enrolled
Byte 4 indicates which of zones 9 - 16 are enrolled
Byte 5 indicates which of zones 17 - 24 are enrolled
Byte 6 indicates which of zones 25 - 30 are enrolled
Byte 7 indicates which of zones 1 - 8 are bypassed
Byte 8 indicates which of zones 9 - 16 are bypassed
Byte 9 indicates which of zones 17 - 24 are bypassed
Byte 10 indicates which of zones 25 - 30 are bypassed
Each bit represents a zone, e.g. bit 0 of byte 7 (Zone 1-8) represents zone 1 and bit 7 represents zone 8. When a bit is set it indicates the corresponding zone is bypassed. Note: bits are numbered from right to left starting at 0.
0xA5 - General event description
Length: 12 bytes
- Code: Select all
0xA5 0x00 <Byte2> <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
Byte 2 indicates the type of event:
0x01 Log event ?
0x02 Status message
0x03 Tamper event
0x04 Zone event
Keep Alive (Byte 2 = 0x02)
This message reports the status of each zone. It is send periodically and as part of a response to a status request. The message indicates per zone whether the zone is opened and the condition of the battery (low or not).
- Code: Select all
0xA5 0x00 0x02 <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
Byte 3 indicates the status of zone 1 - 8 - when a bit is set it indicates the corresponding zone is open
Byte 4 indicates the status of zone 9 - 16
Byte 5 indicates the status of zone 17 - 24
Byte 6 indicates the status of zone 25 - 30
Byte 7 indicates the battery condition of zone 1 - 8 - when a bit is set it indicates the corresponding zone has a low battery
Byte 8 indicates the battery condition of zone 9 - 16
Byte 9 indicates the battery condition of zone 17 - 24
Byte 10 indicates the battery condition of zone 25 - 30
Each bit represents a zone, e.g. bit 0 of byte 3 (Zone 1-8) represents zone 1 and bit 7 represents zone 8. When a bit is set it indicates the corresponding zone is opened or a low battery.
Note: bits are numbered from right to left starting at 0.
Tamper (Byte 2 = 0x03)
This message is send as part of a status report or when a zone is tampered. The message indicates per zone if the zone is active and if the zone is tampered.
- Code: Select all
0xA5 0x00 0x03 <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
Byte 3 indicates the status of zone 1 - 8
Byte 4 indicates the status of zone 9 - 16
Byte 5 indicates the status of zone 17 - 24
Byte 6 indicates the status of zone 25 - 30
Byte 7 indicates the tamper status of zone 1 - 8Byte 8 indicates the tamper status of zone 9 - 16
Byte 9 indicates the tamper status of zone 17 - 24
Byte 10 indicates the tamper status of zone 25 - 30
Each bit represents a zone, e.g. bit 0 of byte 3 (Zone 1-8) represents zone 1 and bit 7 represents zone 8. When a bit is set it indicates the corresponding zone is tampered or inactive.
Note: bits are numbered from right to left starting at 0.
Event (BYTE 2 = 0x04)
- Code: Select all
0xA5 0x00 0x04 <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
Byte 3 indicates the system status (See appendix A)
Byte 4 contains the system state flags (See appendix B)
Byte 5 indicates the zone triggering the event (only when bit 5 of Byte 4 is set)
Byte 6 indicates the type of zone event (only when bit 5 of Byte 4 is set). A complete list can be found in appendix D.
Byte 8: ? (reported values: 0x01, 0x05)
Byte 9: ? (reported values: 0x22, 0x30, 0x32, 0x34, 0x36)
0xA7 - Panel status change
Length: 12 bytes
- Code: Select all
0xA7 0x00 <Byte2> <Byte3> <Byte4> <Byte5> <Byte6> <Byte7> <Byte8> <Byte9> <Byte10> 0x43
Byte 1:
0x01 ?
0x02 ?
Byte 2:
Byte 3: Zone/User (See appendix E for a complete list of all log events)
Byte 4: Log event (See appendix C for a complete list of all log events)
0xAA - Enable and disabe bypass
Length : 12 bytes
Bypass enable
- Code: Select all
0xAA <Byte 1> <Byte 2> <Byte 3> <Byte 4> <Byte 5> <Byte 6> 0x00 0x00 0x00 0x00 0x43
Where:
Byte 1 contains the first 2 digits of the pin code to be used
Byte 2 contains the third and fourth digit of the pin code to be used
Byte 3 indicates the mode for zones 1 - 8. When a bit is set it indicates bypass of the corresponding zone will be enabled
Byte 4 indicates the mode for zones 9 - 16
Byte 5 indicates the mode for zones 17 - 24
Byte 6 indicates the mode for zones 25 - 30
Bypass disable
- Code: Select all
0xAA <Byte 1> <Byte 2> 0x00 0x00 <0x00> <0x00> <Byte 7> <Byte 8> <Byte 9> <Byte 10> 0x43
Where:
Byte 1 contains the first 2 digits of the pin code to be used
Byte 2 contains the third and fourth digit of the pin code to be used
Byte 7 indicates the mode for zones 1 - 8. When a bit is set it indicates bypass of the corresponding zone will disabled
Byte 8 indicates the mode for zones 9 - 16
Byte 9 indicates the mode for zones 17 - 24
Byte 10 indicates the mode for zones 25 - 30
General Remarks
* Sensors (pirs) are only reported when motion is detected (05)
* Sometimes the keep alive (hartbeat) packet is not received any more.
You have registered as a power link, i noticed the same we have to do some more sniffing on that. Do not reply with 0xAB 0x0A 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x43 during the PL 'inleren'. To reset the PM back (disconnet mains an battery) and have it start sending xA5 x00 x02 messages again you have to startup the remote programmer once (that is what fixed it for me) do not start the 'inleren' and reply with a x02 ACK message when you receive a message from the PL.
Appendix A - System Status
0x00 Disarm
0x01 Exit Delay
0x02 Exit Delay
0x03 Entry Delay
0x04 Armed Home
0x05 Armed Away
0x06 User Test
0x07 Downloading
0x08 Programming
0x09 Installer
0x0A Home Bypass
0x0B Away Bypass
0x0C Ready
0x0D Not Ready
Appendix B - System state flags
bit 0: Ready if set
bit 1: Alert in Memory if set
bit 2: Trouble if set
bit 3: Bypass On if set
bit 4: Last 10 seconds of entry or exit delay if set
bit 5: Zone event if set
bit 6: Arm, disarm event if set
bit 7: Alarm event if set
Note: bits are numbered from right to left starting at 0
Appendix C - Log events
0x00 None
0x01 Interior Alarm
0x02 Perimeter Alarm
0x03 Delay Alarm
0x04 24h Silent Alarm
0x05 24h Audible Alarm
0x06 Tamper
0x07 Control Panel Tamper
0x08 Tamper Alarm
0x09 Tamper Alarm
0x0A Communication Loss
0x0B Panic From Keyfob
0x0C Panic From Control Panel
0x0D Duress
0x0E Confirm Alarm
0x0F General Trouble
0x10 General Trouble Restore
0x11 Interior Restore
0x12 Perimeter Restore
0x13 Delay Restore
0x14 24h Silent Restore
0x15 24h Audible Restore
0x16 Tamper Restore
0x17 Control Panel Tamper Restore
0x18 Tamper Restore
0x19 Tamper Restore
0x1A Communication Restore
0x1B Cancel Alarm
0x1C General Restore
0x1D Trouble Restore
0x1E Not used
0x1F Recent Close
0x20 Fire
0x21 Fire Restore
0x22 No Active
0x23 Emergency
0x24 No used
0x25 Disarm Latchkey
0x26 Panic Restore
0x27 Supervision (Inactive)
0x28 Supervision Restore (Active)
0x29 Low Battery
0x2A Low Battery Restore
0x2B AC Fail
0x2C AC Restore
0x2D Control Panel Low Battery
0x2E Control Panel Low Battery Restore
0x2F RF Jamming
0x30 RF Jamming Restore
0x31 Communications Failure
0x32 Communications Restore
0x33 Telephone Line Failure
0x34 Telephone Line Restore
0x35 Auto Test
0x36 Fuse Failure
0x37 Fuse Restore
0x38 Keyfob Low Battery
0x39 Keyfob Low Battery Restore
0x3A Engineer Reset
0x3B Battery Disconnect
0x3C 1-Way Keypad Low Battery
0x3D 1-Way Keypad Low Battery Restore
0x3E 1-Way Keypad Inactive
0x3F 1-Way Keypad Restore Active
0x40 Low Battery
0x41 Clean Me
0x42 Fire Trouble
0x43 Low Battery
0x44 Battery Restore
0x45 AC Fail
0x46 AC Restore
0x47 Supervision (Inactive)
0x48 Supervision Restore (Active)
0x49 Gas Alert
0x4A Gas Alert Restore
0x4B Gas Trouble
0x4C Gas Trouble Restore
0x4D Flood Alert
0x4E Flood Alert Restore
0x4F X-10 Trouble
0x50 X-10 Trouble Restore
0x51 Arm Home
0x52 Arm Away
0x53 Quick Arm Home
0x54 Quick Arm Away
0x55 Disarm
0x56 Fail To Auto-Arm
0x57 Enter To Test Mode
0x58 Exit From Test Mode
0x59 Force Arm
0x5A Auto Arm
0x5B Instant Arm
0x5C Bypass
0x5D Fail To Arm
0x5E Door Open
0x5F Communication Established By Control Panel
0x60 System Reset
0x61 Installer Programming
0x62 Wrong Password
0x63 Not Sys Event
0x64 Not Sys Event
0x65 Extreme Hot Alert
0x66 Extreme Hot Alert Restore
0x67 Freeze Alert
0x68 Freeze Alert Restore
0x69 Human Cold Alert
0x6A Human Cold Alert Restore
0x6B Human Hot Alert
0x6C Human Hot Alert Restore
0x6D Temperature Sensor Trouble
0x6E Temperature Sensor Trouble Restore
Appendix D - Zone event types
0x00 None
0x01 Tamper Alarm
0x02 Tamper Restore
0x03 Open
0x04 Closed
0x05 Violated (Motion)
0x06 Panic Alarm
0x07 RF Jamming
0x08 Tamper Open
0x09 Communication Failure
0x0A Line Failure
0x0B Fuse
0x0C Not Active
0x0D Low Battery
0x0E AC Failure
0x0F Fire Alarm
0x10 Emergency
0x11 Siren Tamper
0x12 Siren Tamper Restore
0x13 Siren Low Battery
0x14 Siren AC Fail
Appendix E - Zone/User
0X00 System
0x01 Zone 1
0x02 Zone 2
0x03 Zone 3
0x04 Zone 4
0x05 Zone 5
0x06 Zone 6
0x07 Zone 7
0x08 Zone 8
0x09 Zone 9
0x0A Zone 10
0x0B Zone 11
0x0C Zone 12
0x0D Zone 13
0x0E Zone 14
0x0F Zone 15
0X10 Zone 16
0x11 Zone 17
0x12 Zone 18
0x13 Zone 19
0x14 Zone 20
0x15 Zone 21
0x16 Zone 22
0x17 Zone 23
0x18 Zone 24
0x19 Zone 25
0x1A Zone 26
0x1B Zone 27
0x1C Zone 28
0x1D Zone 29
0x1E Zone 30
0X1F Keyfob1
0X20 Keyfob2
0X21 Keyfob3
0X22 Keyfob4
0X23 Keyfob5
0X24 Keyfob6
0X25 Keyfob7
0X26 Keyfob8
0X27 User1
0X28 User2
0X29 User3
0X2A User4
0X2B User5
0X2C User6
0X2D User7
0X2E User8
0X2F Wireless Commander1
0X30 Wireless Commander2
0X31 Wireless Commander3
0X32 Wireless Commander4
0X33 Wireless Commander5
0X34 Wireless Commander6
0X35 Wireless Commander7
0X36 Wireless Commander8
0x37 Wireless Siren1
Visonic Powermax Remote Programmer Software Manual
0x38 Wireless Siren2Visonic Powermax Remote Programmer Software Download
0x39 2Way Wireless Keypad1
0x3A 2Way Wireless Keypad2
0x3B 2Way Wireless Keypad3
0x3C 2Way Wireless Keypad4
0x3D X10-1
0x3E X10-2
0x3F X10-3
0x40 X10-4
0x41 X10-5
0x42 X10-6
0x43 X10-7
0x44 X10-8
0x45 X10-9
0x46 X10-10
0x47 X10-11
0x48 X10-12
0x49 X10-13
0x4A X10-14
0x4B X10-15
0x4C PGM
0x4D GSM
0x4E Powerlink
0x4F Proxy Tag1
0x50 Proxy Tag2
0x51 Proxy Tag3
0x52 Proxy Tag4
0x53 Proxy Tag5
0x54 Proxy Tag6
0x55 Proxy Tag7
0x56 Proxy Tag8
Examples
Window Zone 07 open
- Code: Select all
0x0D 0xA5 0x00 0x04 0x00 0x20 0x07 0x03 0x00 0x03 0xAF 0x0F 0x43 0x27 0x0A
Window Zone 07 close
- Code: Select all
0x0D 0xA5 0x00 0x04 0x00 0x21 0x07 0x04 0x00 0x03 0xAF 0x0F 0x43 0x25 0x0A
Movement Zone 11
- Code: Select all
0x0D 0xA5 0x00 0x04 0x00 0x21 0x0B 0x05 0x00 0x03 0xAF 0x0F 0x43 0x20 0x0A
Movement in Zone 11 with tamper alarm in memory
- Code: Select all
0x0D 0xA5 0x00 0x04 0x00 0x23 0x0B 0x05 0x00 0x03 0xAF 0x0F 0x43 0x1E 0x0A
Door Open in Zone 01 while arming away (exit delay)
- Code: Select all
0x0D 0xA5 0x00 0x04 0x02 0x60 0x01 0x03 0x00 0x03 0x00 0x00 0x43 0xA9 0x0A
Visonic Powermax Remote Programmer Software Download
Door Close in Zone 01 while arming away (exit delay)
Visonic Powermax Remote Programmer Software Windows 10
Visonic Powermax Remote Programmer Software Update
- Code: Select all
0x0D 0xA5 0x00 0x04 0x02 0x61 0x01 0x04 0x00 0x03 0x00 0x00 0x43 0xA7 0x0A