Plugwise protocol unleashed part 2: device information


Introduction

In the Plugwise protocol unleashed series, I will describe the plugwise protocol. As far as I have been able to re-engineer it. I did this re-engineering work because there is no Linux/OSX software available to control your plugwise devices. All information in these series are based on the 2.0 firmware version!

DISCLAIMER: use of the information in these articles is at your own risk.
This information is not supported by Plugwise B.V. in any way.

In this part of the series we will have a look at the device information request and response.

Device information request

The device information request looks like this:

0023000D6F000023XXXX231B

0023 – indicates the request code, in this case it’s the device information request code.
00D6F000023XXXX – is the mac address of the device we are requesting information about.
231B – is the CRC checksum.

Device information response

The device information response looks like this:
00240025000D6F000023XXXX0A01866F0004DFE801850000047300074AA663800136EE
0024 0025000D6F000023XXXX 0A 01 866F 0004DFE8 01 85 0000 0473 0007 4AA66380 01 36EE

0024 – indicates the response code, in this case it’s the device information response code.
0025 – unknown, reverse checksum? Not interesting anyway.
000D6F000023XXXX – mac address of the device we requested information about.
0A – Year of the internal Plugwise clock, convert 0A to integer and you get 10.. add 2000 to it and you have 2010.
01 – Month of the internal Plugwise clock, convert 01 to integer and you get 1.
866F – Number of minutes of the internal Plugwise clock, convert 886F to integer and you get 34415. You can use this to calculate the days, hours and minutes, to get a datetime value.
0004DFE8 – Latest log buffer address, each log buffer contains 4 hours of information about the power usage. Convert this to integer, Then use: (logaddress – 278528) / 32 to get the log address. In this example the log address is: (319464 – 278528) / 32 = 1279
01 – Relay status (power on/power off) 01=ON, 00=OFF.
85 – Amount of herz the plugin operates on.
I use the following python code to determine the amount of hz:

    def determinehz(self, herz):
        """
        Determines number of hz of a plugwise device.
        """
        if herz == '85':
            return 50
        elif herz == 'C5':
            return 60
        else:
            return 0

000004730007 – This indicates the hardware version of the circle. No conversion is needed. In this case the hardware version is: 0000-0473-0007.
4AA66380 – This is the firmware version of the circle. The datetime is a POSIX (epoch) timestamp. The following python function converts it to a datetime object:

datetime.fromtimestamp(timestamp[, tz])

If you have any questions regarding the device information please let me know.. till next week! And happy plugwising! 🙂

This is a multipart series, the other parts can be found here:
Plugwise protocol unleashed part 1: introduction

Maarten

Hi, I am Maarten and I am the owner of this weblog. I post on various IT subjects that matter in my life as an IT professional.

9 thoughts on “Plugwise protocol unleashed part 2: device information

  1. Hi, and thanks a lot for this very useful reverse engineering 🙂

    I was wondering if it was possible to extract more information from a plugwise than its power consumption (i.e. current, volt etc…). Do you if the plug is sending more info than a simple watts value?

    Looking forward to the next chapter 😉

    Ettore

  2. Hi Ettore,

    The plug is sending puless. So no current and voltage info.
    However you could use the following formula’s to calculate the current I think:
    Current = Watt / Volt

    You know the volts right? 230v in my case.
    So you could get the current aswell..

    Maarten

  3. Hi Marteen,

    yes it would be possible to use that formula, it’s just that the volt value is never so constant. Anyway it will have to be enough 🙂 Thanks a lot!!!

    Ettore

  4. Hmm, I get different kind of answer with 0024 reply code, is it because different firmware?

    IN : H: 30|30|32|34|30|30|30|44|36|46|30|30|30|30|22|43|49|52|34|22|30|30|30|30|35|44|44|35|30|30|30|34|34|34|01|60|35|30|30|31|38|35|30|30|30|30|30|34|34|30|30|31|30|37|34|38|42|34|32|35|33|38|30|32
    IN : A: 0 0 2 4 0 0 0 D 6 F 0 0 0 0 ” C I R 4 ” 0 0 0 0 5 D D 5 0 0 0 4 4 4 ` 5 0 0 1 8 5 0 0 0 0 0 4 4 0 0 1 0 7 4 8 B 4 2 5 3 8 0 2

    So I have 0024 but not 0025 what you suspect some checksum. Immediately after 0024 I have MAC if Circle reporting my “CIRCLE4”. Then if after MAC is a year, my year is 2000 according to your analyzation.

    Then I am wondering why I have “01 60” -hex codes time to time inside answers. Have you seen those?

    Well I think it is easier to discuss at domotiga forums. I just wanted to note my findings here as I was coding my perl-software to diagnose plugwise protocol. And I could not decode 0024 well..

    1. Hi,

      This is indeed because of a different firmware version.
      Plugwise unleashed is focused on the newest firmware (v2)
      V2 completely changed the way things are handled..

      Greets,
      Maarten

  5. I am tying to figure out how to get data from the plugs. Do you know more about reading the buffers (archived data) in the plugs. Or better, how are the buffers structured. Looking for a way to read the data in a usefull way.

Comments are closed.

Recent Posts