AA55-protocol - some potential useful findings, insights, explanations

[mirko]

Hello,

I discovered this project by searching for info re the AA55-protocol, as I'm implementing some version of it myself for a different project in a different environment/language.

While reading the source, I noticed some bytes appear to be unknown to the authors of this project, what they mean or represent.

Maybe my findings help:

Bytes:

1-2: Static preamble
\xAA\x55 is - as is probably clear, a static preamble prefixing every message.

3/4: Src and dst addr
Source and destination address, which explains why those bytes are being swapped in every response.
Source is usually \xC0 for whatever reason (didn't check if it can be something else) and destination's default is \x7F.
By default destination needs to be \x7F but can be modified via a special registration handshake, not bothering as most people will only have one inverter on their bus.

5: Control code
\x00 is used for the re-adressing / registration handshake. \0x01 for READ, \0x03 for EXEC.

6: Function code
Calls a function - this project appears to document more what function does what, so I don't bother..
The response contains the same function code, +0x80. I see in your code, you define it explicitly for validation, however it can be easily calculated from the command by just adding +128 to the function part of the request/command code.

7: Length of potential parameter / value

In regard of responses, I came to the conclusion that \x06 means something like "successful" (e.g. when using EXEC), and \x15 something like "failed". However that is based on a very examples and should definitely be taken with a grain of salt.

Hope it helps, if not, nevermind.. :)