Find great deals for Hörmann Universaladapterplatine UAP 1. Shop with confidence on eBay!. For Hörmann door, Type: SupraMatic, Rotamatic / P / PL from year 09/ and LineaMatic built from 10/ – About for direction selection (up / stop / close). For inputs to Hormann: does it mean that I have to run 6 wires for this section from Loxone to Hormann? Or is it possible to reuse the wire for
|Published (Last):||20 February 2014|
|PDF File Size:||2.36 Mb|
|ePub File Size:||17.6 Mb|
|Price:||Free* [*Free Regsitration Required]|
To control the door via a home automation system you have several options:. I searched the internet for information about hoormann bus, but little to nothing can be found about it. So I decided to reverse engeneer and document the bus!
low voltage – Hormann garage door opener automation with Loxone – Home Improvement Stack Exchange
Top side of uwp1 circuit board: Bottom side of the circuit board: Not much to see here, just that all pins of the 6-pin RJ12 sockets are directly conected to each other. I expected a rather simple protocoll where no comunication happens until the UAP1 gets triggered by a switch, but I was more than wrong. Here’s what I got using the USB converter with the door closed idling:.
That occured at baud 8N1 so I think that must be the correct baudrate. Then I encountered another problem I didn’t think about in the first place. RS is Half-Duplex, that means that only one participant on the bus can talk at a given time.
But how can I tell who is sending which bytes!? Whith that one Hormaann can tell when the UAP1 is sending and when it is receiving! I hoped to find the signals there as well but it turned out usp1 is not the case.
But at least I can connect to GND there. I decided to look at the boards communications without the motor connected. To supply the board with 24VDC, which normally comes in via the RJ12 connector, I simply used the terminals taht normally connect the switches.
When the board is powered while the logic analyzer is collecting data, we see these bytes comming in:. Unfortunately no other communication is happening when I trigger a “close door” for example.
It seems that this must happen when the UAP1 is connected to the motor. I’ve set two analyzers for async serial data on both, the RX and the TX line. They make me able to export the analyzed data as CSV.
Hörmann Universaladapterplatine UAP 1
This is hormanb far i got until now. I’ll try to extend this artcle or write a followup in the future. The description in the patents is not cristal clear at least to me but still extremely helpful in figureing out whats going on on the bus. After being able to seperate the byte stream into messages, I still wasn’t able to calculate the checksum. No common Normann generator gave me the same result as the messages have.
I tried some CRC brute force attempts but without success. After having discussed that issue with my Italian friend he was able to figure out the polynom 0x07 as well as the initial value 0xF3 for the CRC algorithm. I used the CRC calculator at http: Fortunately the page gives you a nice lookup table for the CRC values which I then used in my Python program to verify all the messages I’ve recorded so far.
These are the messages I was able to make sense of so far.
Reverse engeneering the Hörmann UAP1 protocoll
I might misinterprete some of hormnn at this point: At startup the Master scans the bus for devices. In my case it starts at address 0x8D which is in decimal. It decrements this address and scans the entire bus. Why it doesnt scan the adresses down to ? The slave responds to a status request by the master. The message can be between 1 and 3 bytes long and the patent states that it can be expanded.
Furthermore I’ve only see this reply all the time. As you can see the only status bit set, is from the second byte and means reversing according to the patent which makes no sense to me. To dig deaper into the protocoll I need more data.
Therefore I plan to hook up the bus to a network outlet I have in my garage that leads all the way down into my basement where my network rack sits. That way I’m able to trace the bus in realtime without the need to leave the house It’s pretty cold outside at this time of the year. To control the door via a home automation system you have several options: Connect potential free contacts directly to the motor. That means you have just very basic control over the motor because you can’t give up and down command but just a go command as you can with the radio controls.
Usa a UAP1, a small extension box to have better control over the motor and get some feedback signals. Speak directly to the motor and get the signals directly onto the homeautomation system. Exactly what I want to have: Hardware Top side of the circuit board: Drives at least the three relais, maybe more. Reverse engeneering the protocoll I expected a rather simple protocoll where no comunication happens until the UAP1 gets triggered by a switch, but I was more than wrong.
Here’s what I got using the USB converter with the door closed idling: RX When the board is powered while the logic analyzer is collecting data, we see these bytes comming in: Later I captured traces using my logic analyzer for each possible command, these are: A message is always formed like this: The CRC checksum After being able to seperate the byte stream into messages, I still wasn’t able to calculate the checksum.
Address Ranges The patent gives a list of adresses for certain device categories: Intelligent contol panels Not specified in the patent Dynamically assigned by the master Reserved Messages These are the messages I was able to make sense of so far. Bus scan At startup the Master scans the bus for devices. In my case the UAP1 answers: Unfortunately the patent doesn’t say anything about the device codes.
Broadcast status From the beginning yap1 master sends a broadcast status message. Light on Bit 1: Radio control getting teached Bit 2: Option relay on Bit 3: Quiescent current circuit open Bit 4: Not referenced Bit 5: Pedestrian hormqnn Bit 6: Learning button assignment Bit 7: Burglar alarm As you can see the only status bit set, is from the second byte and means reversing according to the patent which makes no sense to me.