INSTEON Developers Guide 20070816a
INSTEON Developers Guide 20070816a
Contents at a Glance
INTRODUCTION............................................................................................ 1
PART I — INSTEON BASICS .......................................................................... 4
Chapter 1 — Getting Started Quickly ......................................................... 5
Chapter 2 — About This Developer’s Guide ................................................ 8
Chapter 3 — INSTEON Overview .............................................................. 14
Chapter 4 — INSTEON Application Development Overview...................... 27
PART II — INSTEON REFERENCE ................................................................ 37
Chapter 5 — INSTEON Messages ............................................................. 38
Chapter 6 — INSTEON Signaling Details .................................................. 56
Chapter 7 — INSTEON Device Networking ............................................... 82
Chapter 8 — INSTEON Command Set ..................................................... 114
Chapter 9 — INSTEON BIOS (IBIOS) ..................................................... 166
Chapter 10 — INSTEON Modems............................................................ 217
Chapter 11 — SALad Language Documentation ..................................... 263
Chapter 12 — SmartLabs Device Manager (SDM) Reference .................. 336
Chapter 13 — INSTEON Hardware Documentation................................. 358
CONCLUSION............................................................................................ 378
GLOSSARY ................................................................................................ 379
NOTES ...................................................................................................... 384
Publication Dates
Date Author Version
INTRODUCTION
CONCLUSION378
Recaps the main features of INSTEON.
GLOSSARY379
Defines terms specific to INSTEON technology.
NOTES384
Contains footnotes referenced in the text.
In This Chapter
INSTEON Modem (IM) Quick Start6
Refer to this section if you are using a SmartLabs Powerline Modem™ (PLM) or
one of the INSTEON Modem chips.
PowerLinc Controller (PLC) Quick Start7
Refer to this section if you are using a SmartLabs PowerLinc Controller (PLC).
INSTEON Compared
This white paper (downloadable from www.insteon.net/pdf/insteoncompared.pdf)
compares INSTEON to other technologies for home control, such as ZigBee, Z-Wave,
WiFi, HomePlug, and X10.
Document Conventions
The following table shows the typographic conventions used in this INSTEON
Developer’s Guide.
Convention Description Example
Angle Brackets < and > Indicates user-supplied parameters <Address MSB>
Vertical Bar | Indicates a choice of one of several <0x06 (ACK) | 0x15 (NAK)>
alternatives
Getting Help
INSTEON Support
SmartLabs is keenly interested in supporting the community of INSTEON developers.
If you are having trouble finding the answers you need in this INSTEON Developer’s
Guide, you can get more help by accessing the INSTEON Developer’s Forum or by
emailing [email protected].
Providing Feedback
To provide feedback about this documentation, go to the INSTEON Developer’s
Forum or send email to [email protected].
Legal Information
Terms of Use
This INSTEON Developer’s Guide is supplied to you by SmartLabs, Inc. (SmartLabs)
in consideration of your agreement to the following terms. Your use or installation of
this INSTEON Developer’s Guide constitutes acceptance of these terms. If you do
not agree with these terms, please do not use or install this INSTEON Developer’s
Guide.
In consideration of your agreement to abide by the following terms, and subject to
these terms, SmartLabs grants you a personal, non-exclusive license, under
SmartLabs’ intellectual property rights in this INSTEON Developer’s Guide, to use
this INSTEON Developer’s Guide; provided that no license is granted herein under
any patents that may be infringed by your works, modifications of works, derivative
works or by other works in which the information in this INSTEON Developer’s Guide
may be incorporated. No names, trademarks, service marks or logos of SmartLabs,
Inc. or INSTEON may be used to endorse or promote products derived from the
INSTEON Developer’s Guide without specific prior written permission from
SmartLabs, Inc. Except as expressly stated herein, no other rights or licenses,
express or implied, are granted by SmartLabs and nothing herein grants any license
under any patents except claims of SmartLabs patents that cover this INSTEON
Developer’s Guide as originally provided by SmartLabs, and only to the extent
necessary to use this INSTEON Developer’s Guide as originally provided by
SmartLabs. SmartLabs provides this INSTEON Developer’s Guide on an "AS IS"
basis.
SMARTLABS MAKES NO WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT
LIMITATION THE IMPLIED WARRANTIES OF NON-INFRINGEMENT,
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, REGARDING THIS
INSTEON DEVELOPER’S GUIDE OR ITS USE, ALONE OR IN COMBINATION WITH ANY
PRODUCT.
IN NO EVENT SHALL SMARTLABS BE LIABLE FOR ANY SPECIAL, INDIRECT,
INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) ARISING IN ANY WAY OUT OF THE USE,
REPRODUCTION, MODIFICATION AND/OR DISTRIBUTION OF THIS INSTEON
DEVELOPER’S GUIDE, HOWEVER CAUSED AND WHETHER UNDER THEORY OF
CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE,
EVEN IF SMARTLABS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Copyright
© Copyright 2005-2007 SmartLabs, Inc., 16542 Millikan Ave., Irvine, CA 92606-
5027; 800-SMARTHOME (800-762-7846), 949-221-9200, www.smartlabsinc.com.
All rights reserved.
August 16, 2007 © 2005-2007 SmartLabs Technology
Dev Guide, Chapter 2 Page 13
Revision History
Release Author Description
Date
03-15-07 PVD 2nd Edition printed for review, 20 copies.
03-27-07 PVD Fixed bytecount in IM Command 0x62 Send INSTEON Standard or Extended
Message.
03-28-07 PVD Added IM Command 0x58 ALL-Link Cleanup Status Report.
03-29-07 PVD Updated explanation of IM Command 0x6F Manage ALL-Link Record.
04-02-07 PVD Updated explanation of IM Commands 0x61 Send ALL-Link Command, 0x56
ALL-Link Cleanup Failure Report, and 0x58 ALL-Link Cleanup Status Report.
04-06-07 PVD IM Command 0x58 ALL-Link Cleanup Status Report also sent when IM
interrupts its own Cleanup sequence.
04-17-07 PVD Corrected <X10 Flag> value in IM Commands 0x63 Send X10 and 0x52 X10
Received.
06-06-07 PVD Clarified IBIOS Command 0x4F INSTEON Message Received after NAK.
06-14-07 PVD Corrected nominal INSTEON powerline packet timing (-876 to 947 µs).
08-14-07 PVD Updated INSTEON Command Set Tables section from INSTEON Command
Tables 20070816a.doc, and INSTEON Product Key and SubCat Assignments
section from INSTEON DevCats and Product Keys 20060814a.doc.
INSTEON Command ED 0x2F00 Read/Write ALDB is now required for i2.
In This Chapter
Why INSTEON?15
Explains why SmartLabs undertook the development of INSTEON.
Hallmarks of INSTEON17
Gives the ‘project pillars’ and main properties of INSTEON.
INSTEON Specifications18
Shows the main features of INSTEON in table form.
INSTEON Fundamentals20
Shows how INSTEON devices communicate using both powerline and radio, how
all INSTEON devices repeat1 INSTEON messages, and how all INSTEON devices
are peers.
Why INSTEON?
INSTEON is the creation of SmartLabs, the world’s leading authority on electronic
home improvement. SmartLabs is organized into three divisions—Smarthome.com,
“the Amazon of electronic home improvement,” SmartLabs Design, creators of best-
in-class home control products, and SmartLabs Technology, the pioneering architects
of INSTEON. With Smarthome.com’s global distribution channel, SmartLabs Design’s
product development and manufacturing resources, and SmartLabs Technology’s
ongoing innovation, SmartLabs is uniquely positioned to support and encourage
INSTEON product developers.
But why did SmartLabs undertake the complex task of creating an entirely new
home-control networking technology in the first place?
SmartLabs has been a leading supplier of devices and equipment to home
automation installers and enthusiasts since 1992. Now selling over 5,000 products
into more than 130 countries, SmartLabs has first-hand experience dealing directly
with people all over the world who have installed lighting control, whole-house
automation, security and surveillance systems, pet care devices, gadgets, and home
entertainment equipment. Over the years, by talking to thousands of customers
through its person-to-person customer support operation, SmartLabs has become
increasingly concerned about the mismatch between the dream of living in a
responsive, aware, automated home and the reality of existing home-control
technologies.
Today’s homes are stuffed with high-tech appliances, entertainment gear,
computers, and communications gadgets. Utilities, such as electricity, lighting,
plumbing, heating and air conditioning are so much a part of modern life that they
almost go unnoticed. But these systems and devices all act independently of each
other—there still is nothing that can link them all together. Houses don’t know that
people live in them. Lights happily burn when no one needs them, HVAC is
insensitive to the location and comfort of people, pipes can burst without anyone
being notified, and sprinklers dutifully water the lawn even while it’s raining.
For a collection of independent objects to behave with a unified purpose, the objects
must be able to communicate with each other. When they do, new, sometimes-
unpredictable properties often emerge. In biology, animals emerged when nervous
systems evolved. The Internet emerged when telecommunications linked computers
together. The global economy emerges from transactions involving a staggering
amount of communication. But there is no such communicating infrastructure in our
homes out of which we might expect new levels of comfort, safety and convenience
to emerge. There is nothing we use routinely in our homes that links our light
switches or our door locks, for instance, to our PCs or our remote controls.
It’s not that such systems don’t exist at all. Just as there were automobiles for
decades before Henry Ford made cars available to everyone, there are now and have
been for some time systems that can perform home automation tasks. On the high
end, all kinds of customized systems are available for the affluent, just as the rich
could buy a Stanley Steamer or a Hupmobile in the late 1800s. At the low end, X10
powerline signaling technology has been around since the 1970s, but its early
adoption is its limiting factor—it is too unreliable and inflexible to be useful as an
infrastructure network.
SmartLabs is a major distributor of devices that use X10 signaling. In 1997, aware
of the reliability problems its customers were having with X10 devices available at
the time, SmartLabs developed and began manufacturing its own ‘Linc’ series of
improved X10 devices, including controllers, dimmers, switches, computer interfaces
and signal boosters. Despite the enhanced performance enjoyed by Linc products, it
was still mostly do-it-yourselfers and hobbyists who were buying and installing them.
SmartLabs knew that a far more robust and flexible networking standard would have
to replace X10 before a truly intelligent home could emerge. SmartLabs wanted a
technology that would meet the simplicity, reliability, and cost expectations of the
masses—mainstream consumers who want immediate benefits, not toys.
In 2001, SmartLabs’ engineers were well aware of efforts by others to bring about
the home of the future. The aging X10 protocol was simply too limiting with its tiny
command set and unacknowledged, ‘press and pray’ signaling over the powerline.
CEBus had tried to be everything to everybody, suffering from high cost due to
overdesign by a committee of engineers. Although CEBus did become an official
standard (EIA-600), developers did not incorporate it into real-world products.
Radio-only communication protocols, such as Z-Wave and ZigBee, not only required
complex routing strategies and a confusing array of different types of network
masters, slaves, and other modules, but radio alone might not be reliable enough
when installed in metal switch junction boxes or other RF-blocking locations.
Bluetooth radio has too short a range, WiFi radio is too expensive, and high-speed
powerline protocols are far too complex to be built into commodity products such as
light switches, door locks, or thermostats. Overall, it seemed that everything
proposed or available was too overdesigned and therefore would cost too much to
become a commodity for the masses in the global economy.
So, in 2001, SmartLabs decided to take its destiny into its own hands and set out to
specify an ideal home control network, one that would be simple, robust and
inexpensive enough to link everything to everything else. INSTEON was born.
Hallmarks of INSTEON
These are the project pillars that SmartLabs decided upon to guide the development
of INSTEON. Products networked with INSTEON had to be:
Instantly Responsive
INSTEON devices respond to commands with no perceptible delay. INSTEON’s
signaling speed is optimized for home control—fast enough for quick response, while
still allowing reliable networking using low-cost components.
Easy to Install
Installation in existing homes does not require any new wiring, because INSTEON
products communicate over powerline wires or they use the airwaves. Users never
have to deal with network enrollment issues because all INSTEON devices have an ID
number pre-loaded at the factory—INSTEON devices join the network as soon as
they’re powered up.
Simple to Use
Getting one INSTEON device to control another is very simple—just press and hold a
button on each device for 10 seconds, and they’re linked. This ALL-Linking™
procedure guarantees that any INSTEON Controller can operate any INSTEON
Responder, now and in the future. Because INSTEON messaging is two-way,
INSTEON Controllers can confirm that commands get through, making INSTEON
products dependable and ‘guest friendly.’
Reliable
An INSTEON network becomes more robust and reliable as it is expanded because
every INSTEON device repeats1 messages received from other INSTEON devices.
Dual Mesh™ communications using both the powerline and the airwaves ensures that
there are multiple pathways for messages to travel. Whether by radio or powerline,
INSTEON messages get repeated in unison whenever multiple INSTEON devices hear
them. This message simulcasting is like an entire chorus singing a melody at once
instead of one singer at a time—the ‘music’ is much easier to hear.
Affordable
INSTEON software is simple and compact, because all INSTEON devices send and
receive messages in exactly the same way, without requiring a special network
controller or complex routing algorithms. The cost of networking products with
INSTEON is held to at an absolute minimum because INSTEON is designed
specifically for home control applications, and not for transporting large amounts of
data.
INSTEON Specifications
The most important property of INSTEON is its no-frills simplicity.
INSTEON messages are fixed in length and synchronized to the AC powerline zero
crossings. They do not contain routing information beyond a source and destination
address. INSTEON is reliable and affordable because it is optimized for command
and control, not high-speed data transport. INSTEON allows infrastructure devices
like light switches and sensors to be networked together in large numbers, at low
cost. INSTEON stands on its own, but can also bridge to other networks, such as
WiFi LANs, the Internet, telephony, and entertainment distribution systems. Such
bridging allows INSTEON to be part of very sophisticated integrated home control
environments.
The following table shows the main features of INSTEON at a glance.
INSTEON Fundamentals
In This Section
INSTEON Device Communication21
Shows how INSTEON devices communicate over the powerline and via radio.
INSTEON Message Repeating23
Explains why network reliability improves when additional INSTEON devices are
added.
INSTEON Peer-to-Peer Networking25
Shows how any INSTEON device can act as a Controller (sending messages),
Responder (receiving messages), or Repeater1 (relaying messages).
INSTEON ALL-Linking26
Describes how any INSTEON Controller can operate any INSTEON Responder,
even when the Controller does not know the commands for the Responder.
INSTEON
PC RF
Devices
Serial USB / RS232 / Ethernet
RF INSTEON
INSTEON INSTEON INSTEON
PL / Serial PL / RF RF INSTEON PL / RF
Device Device Device
Powerline INSTEON & X10
Powerline INSTEON
Powerline INSTEON
Powerline X10
INSTEON INSTEON
PL X10 Devices PL X10 Devices
Devices Devices
Existing X10 devices also communicate over the powerline using the X10 protocol.
The INSTEON Powerline protocol is compatible2 with the X10 protocol, meaning that
designers can create INSTEON devices that can also listen and talk to X10 devices.
X10 devices, however, are insensitive to the INSTEON Powerline protocol.
INSTEON devices containing RF hardware may optionally communicate with other
INSTEON RF devices using the INSTEON RF protocol.
INSTEON BiPHY™ devices (those that can use both the INSTEON Powerline protocol
and the INSTEON RF protocol) solve a significant problem encountered by devices
that can only communicate via the powerline. Powerline signals originating on the
opposite powerline phase from a powerline receiver are severely attenuated, because
there is no direct circuit connection for them to travel over.
A traditional solution to this problem is to connect a signal coupling device between
the powerline phases, either by hardwiring it in at a junction box or by plugging it
into a 220 VAC outlet. INSTEON automatically solves the powerline phase coupling
problem through the use of INSTEON BiPHY devices capable of both powerline and
RF messaging. INSTEON RF messaging bridges the powerline phases whenever at
least one INSTEON PL/RF device is installed on each powerline phase.
When suitably equipped with a dedicated serial interface, such as USB, RS232, or
Ethernet, INSTEON devices can also interface with computers and other digital
equipment. In the figure above, an INSTEON PL/Serial device is shown
communicating with a PC using a serial link. In the Software Developer’s Kit, that
device is a SmartLabs PowerLinc™ V2 Controller with a USB or RS232 interface (see
The SmartLabs PowerLinc Controller28 and Chapter 9 — INSTEON BIOS (IBIOS)166).
Serial communications can bridge networks of INSTEON devices to otherwise
incompatible networks of devices in a home, to computers, to other nodes on a local-
area network (LAN), or to the global Internet. Such connections to outside resources
allow networks of INSTEON devices to exhibit complex, adaptive, people-pleasing
behaviors. INSTEON devices capable of running downloadable SALad Applications
(see Chapter 11 — SALad Language Documentation263) can be upgraded to perform
very sophisticated functions, including functions not envisioned at the time of
manufacture or installation.
PL PL
1A 1B
RF
2
PL PL
2A 2B
RF BP BP RF
1 1 2 3
PL PL
3A 3B
RF
4
PL PL
4A 4B
Powerline Powerline
Phase A Phase B
Every INSTEON device is capable of repeating1 INSTEON messages. They will do this
automatically as soon as they are powered up—they do not need to be specially
installed using some network setup procedure. Adding more devices not only
increases the number of available pathways for messages to travel, but it also
increases the signal strength of repeated messages because every device that hears
a message repeats it in unison with all other devices that heard the same message.
Path diversity and simulcasting both result in a higher probability that a message will
arrive at its intended destination, so the more devices in an INSTEON network, the
better.
As an example, suppose RF device RF1 desires to send a message to RF3, but RF3
is out of range. The message will still get through, however, because devices within
range of RF1, say BP1 and RF2, will receive the message and retransmit it by
simulcasting to other devices within range of themselves. In the drawing, BP1
might reach RF2, BP2, and RF4, and devices BP2 and RF1 might be within range of
the intended recipient, RF3. Therefore, there are many ways for a message to
travel: RF1 to RF2 to RF3 (1 retransmission), RF1 to BP1 to BP2 to RF3 (2
retransmissions), and RF1 to BP1 to RF2 to BP2 to RF3 (3 retransmissions) are
some examples.
On the powerline, path diversity has a similar beneficial effect. For example, the
drawing shows powerline device PL1B without a direct communication path to device
PL4B. In the real world, this might occur because of signal attenuation problems or
because a direct path through the electric wiring does not exist. But a message from
PL1B will still reach PL4B by taking a path through BP2 (1 retransmission), through
PL2B to BP2 (2 retransmissions), or through PL2B to BP2 to PL3B (3
retransmissions).
The figure also shows how messages can travel among powerline devices that are
installed on different phases of a home’s wiring. To accomplish phase bridging, at
least one INSTEON BiPHY RF/powerline device must be installed on each powerline
phase. In the drawing, BiPHY device BP1 is installed on phase A and BP2 is
installed on phase B. Direct RF paths between BP1 to BP2, or indirect paths using
RF2 or RF4 (1 retransmission) allow messages to propagate between the powerline
phases, even though there is no direct electrical connection.
With all devices repeating messages, there must be some mechanism for limiting the
number of times that a message may be retransmitted, or else messages might
propagate forever within the network. Network saturation by repeating messages is
known as a ‘data storm.’ The INSTEON protocol avoids this problem by limiting the
maximum number of times an individual message may be retransmitted to three
(see INSTEON Message Hopping49).
2 5
Responder Controller
1 3 6
Controller Responder Controller
4 7
Responder Controller
Any INSTEON device can repeat1 messages, as with device B, below, which is shown
relaying a message from device A acting as a Controller to device C acting as a
Responder.
A B C
Controller Repeater Responder
INSTEON ALL-Linking
ALL-Linking allows any INSTEON Controller device to operate any INSTEON
Responder device, even if the Controller does not know any of the Direct Commands
that the Responder can execute. The principle is simple—during ALL-Linking to a
button on a Controller, a Responder memorizes the state that it is in at the time.
After ALL-Linking, pushing that button on the Controller causes the Responder to go
back into the state that it memorized when it ALL-Linked.
When a button on a Controller ALL-Links to a Responder, the Controller creates an
ALL-Link Group, which the Responder joins. Multiple Responders can join the same
ALL-Link Group, so it is possible for a single button push to cause an entire ensemble
of devices to recall their memorized states.
All of the Responder devices in the ALL-Link Group will recall their memorized states
simultaneously, because when the Controller’s button is pushed, the Controller first
sends out an ALL-Link Broadcast message to all of the Group members at once,
followed by individual ALL-Link Cleanup messages to each Group member in turn.
In This Chapter
Interfacing to an INSTEON Network28
Describes INSTEON Bridge devices for connecting an INSTEON network to other
devices, systems, or networks.
Manager Applications31
Discusses INSTEON External Applications that send and receive INSTEON
messages directly.
INSTEON Modem Applications32
Explains how developers can create INSTEON Internal or External Applications to
run on any host device they choose, by connecting to an INSTEON Modem chip
via a serial port.
SALad Applications33
Explains how developers create INSTEON Internal Applications that run on
SALad-enabled INSTEON devices themselves.
INSTEON Developer’s Kits36
Describes the Software Developer’s Kit and various Hardware Development
Modules available to designers of INSTEON-enabled products.
Unlike the PLC, a PLM cannot operate in standalone mode because it cannot run
application programs by itself. External applications designed to work with a PLC,
such as SmartLabs Device Manager (SDM), will not work with a PLM.
In summary, these are the main differences between the PLC and the PLM:
• The PLM has a simplified command set compared to the PLC.
• The PLM does not dupport SmartLabs Device Manager (SDM) running on a
host computer.
• The PLC runs a downloadable SALad application, such as the SALad coreApp
Program272, but the PLM cannot run applications of any kind. An embedded
host on a daughter card or else an always-on external host must be available
full time to run applications and manage the PLM.
• The PLM does not have an internal realtime clock.
• If fewer than 32 ALL-Links need to be supported, the PLM can run without
external EEPROM. The PLC must have external EEPROM to store a
downloadable SALad program.
Manager Applications
An INSTEON Manager App is an External Application program that runs on a
computing device, like a PC or PDA, connected to an INSTEON network via an
INSTEON Bridge. Manager Apps can provide sophisticated user interfaces for
INSTEON devices, they can interact in complex ways with the outside world, and
they can orchestrate system behaviors that bring real lifestyle benefits to people.
A Manager App exchanges INSTEON messages directly with INSTEON devices, so it
must contain a software module that can translate between a user’s intentions and
the rules for composing and parsing INSTEON messages.
An example of a Manager App that encapsulates these functions is SmartLabs’
Device Manager (see Chapter 12 — SmartLabs Device Manager (SDM) Reference336),
a Windows program that connects to an INSTEON network via a PowerLinc™
Controller (PLC). SDM handles all the intricacies involved with sending and receiving
INSTEON messages via a PLC. To the outside world, it exposes an interface that
developers can connect their own custom top-level application layers to.
This topmost layer, often a user interface, communicates with SDM using the
Internet HTTP protocol or Microsoft’s ActiveX, so it can run on an Internet browser or
within a Windows program. SDM and the top layer communicate using a simple
text-based scripting language developed by SmartLabs called Home Network
Language™ (HNL).
SDM allows designers to concentrate on rapid application development of their end
products without having to deal directly with INSTEON messaging issues. Product
developers are encouraged to contact SmartLabs at [email protected] for more
4
SALad Applications
SALad is a language interpreter embedded in the firmware of SALad-enabled
INSTEON devices (see SALad Overview33). By writing and debugging SALad
programs in SmartLabs’ SALad Integrated Development Environment33, developers
can create INSTEON Internal Applications that run directly on SALad-enabled
devices.
Devices running SALad Apps can exhibit very sophisticated behavior. Moreover,
devices that have already been installed in the home can be upgraded by
downloading new SALad Apps to them. With INSTEON upgradeability, the world of
home control can dynamically adapt to people’s expectations and needs as the
marketplace evolves.
SALad Overview
Because the SALad instruction set is small, and addressing modes for the
instructions are highly symmetrical, SALad programs run fast and SALad object code
is very compact.
SALad is event driven. Events are triggered when a device receives an INSTEON
message, a user pushes a button, a timer expires, an X10 Command is received, and
so forth. As events occur, firmware in a SALad-enabled device posts event handles
to an event queue, and then starts the SALad program. The SALad program
determines what action to take based on the event that started it.
SALad programs can be downloaded into nonvolatile memory of INSTEON devices
using the INSTEON network itself, or via a serial link if the device has one. SALad
also contains a small debugger that allows programs to be started, stopped, and
single-stepped directly over the INSTEON network.
SALad programming mostly consists of writing event handlers. By following
examples in the INSTEON Software Development Kit, or by modifying SmartLabs’
SALad coreApp Program272, developers can rapidly create INSTEON devices with
wide-ranging capabilities. For more information about the SALad Language, consult
Chapter 11 — SALad Language Documentation263 in this Developer’s Guide, or
contact SmartLabs at [email protected].
4
For complete information on installing and using the SALad IDE, consult the SALad
Integrated Development Environment User’s Guide287 below.
In This Chapter
INSTEON Message Structure39
Gives the details about the contents of the various fields in INSTEON messages.
INSTEON Message Summary Table46
Gives a single table showing the usage of all of the fields in all possible INSTEON
message types. Recaps the usage of all of the different message types.
INSTEON Message Repetition49
Explains how all INSTEON devices engage in retransmitting each other’s
messages so that an INSTEON network will become more reliable as more
devices are added.
Message Lengths
There are only two kinds of INSTEON messages, 10-byte Standard-length messages
and 24-byte Extended-length messages.
The only difference between the two is that the Extended-length message contains
14 User Data bytes not found in the Standard-length message. The remaining
information fields for both types of message are identical except for an Extended
Message Flag bit.
Standard-length Message
Standard-length messages are designed for direct command and control. The
payload is just two bytes, Command 1 and Command 2.
Extended-length Message
In addition to the same fields found in Standard-length messages, Extended-length
messages carry 14 bytes of arbitrary User Data for downloads, uploads, encryption,
and advanced applications.
Message Fields
All INSTEON messages contain source and destination Device Addresses41, a
Message Flags41 byte, a 2-byte Command 1 and 244 payload, and a Message
Integrity Byte44. INSTEON Extended-length messages also carry 14 bytes of User
Data44.
Device Addresses
The first field in an INSTEON message is the From Address, a 24-bit (3-byte) number
that uniquely identifies the INSTEON device originating the message being sent.
There are 16,777,216 possible INSTEON devices identifiable by a 3-byte number.
This number can be thought of as an ID Code or, equivalently, as an address for an
INSTEON device. During manufacture, a unique ID Code is stored in each device in
nonvolatile memory.
The second field in an INSTEON message is the To Address, also a 24-bit (3-byte)
number. Most INSTEON messages are of the Direct type, where the intended
recipient is another single, unique INSTEON device.
If the message is indeed Direct (as determined by the Flags Byte), the To Address
contains the 3-byte unique ID Code for the intended recipient. However, INSTEON
messages can also be sent to all recipients within range, as Broadcast messages, or
they can be sent to all members of a group of devices, as ALL-Link Broadcast
messages. In the case of Broadcast messages, the To Address field contains a 1-
byte Device Category, a 1-byte Device Subcategory, and either 0xFF or a Firmware
Version byte. For ALL-Link Broadcast messages, the To Address field contains an
ALL-Link Group Number. ALL-Link Group Numbers only range from 0 to 255, given
by one byte, so the two most-significant bytes of the three-byte field will be zero.
Message Flags
The third field in an INSTEON message, the Message Flags byte, not only signifies
the Message Type but it also contains other information about the message. The
three most-significant bits, the Broadcast/NAK Flag (bit 7), the ALL-Link Flag (bit 6),
and the ACK Flag (bit 5) together indicate the Message Type. Message Types will be
explained in more detail in the next section (see Message Type Flags42). Bit 4, the
Extended Message Flag, is set to one if the message is an Extended-length message,
i.e. contains 14 User Data bytes, or else it is set to zero if the message is a
Standard-length message. The low nibble contains two two-bit fields, Hops Left (bits
3 and 2) and Max Hops (bits 1 and 0). These two fields control message
retransmission as explained below (see Message Retransmission Flags43).
The table below enumerates the meaning of the bit fields in the Message Flags byte.
The Broadcast/NAK Flag (bit 7, the most-significant byte), the ALL-Link Flag (bit 6),
and the ACK Flag (bit 5) together denote the eight possible Message Types.
Message Types
To fully understand the eight Message Types, consider that there are five basic
classes of INSTEON messages: Broadcast, ALL-Link Broadcast, ALL-Link Cleanup,
Direct, and Acknowledgement.
Broadcast messages contain general information with no specific destination.
Directed to the community of all devices within range, they are mainly used during
device ALL-Linking (see SET Button Pressed Broadcast Messages84, below).
Broadcast messages are not acknowledged.
ALL-Link Broadcast messages are directed to a group of devices that have
previously been ALL-Linked to the message originator (see INSTEON ALL-Link
Groups93, below). ALL-Link Broadcast messages are a means for speeding up the
response to a command intended for multiple devices. They are not acknowledged
directly. Instead, after sending an ALL-Link Broadcast message to an ALL-Link
Group of devices, the message originator then sends an ALL-Link Cleanup message
addressed to each member of the ALL-Link Group individually, with the expectation
of an acknowledgement back from each device in turn.
Direct messages (sometimes referred to as Point-to-Point messages) are intended
for a single specific recipient. The recipient responds to Direct messages by
returning an Acknowledgement message.
Acknowledgement messages (ACK or NAK) are messages from the recipient to the
message originator in response to a Direct or ALL-Link Cleanup message. There is
no acknowledgement to a Broadcast or ALL-Link Broadcast message. In some cases,
when a Direct message specifically requests returned data, an ACK message may
return one or two data bytes to the originator, or a NAK message may return an
error code.
receiving device decrements the Hops Left value by one, then retransmits the
message with the new Hops Left value. Devices that receive a message with a Hops
Left value of zero will not retransmit that message. Also, a device that is the
intended recipient of a message will not retransmit the message, no matter what the
Hops Left value is. See INSTEON Message Hopping49 for more information.
Note that the designator Max Hops really means maximum retransmissions allowed.
All INSTEON messages ‘hop’ at least once, so the value in the Max Hops field is one
less than the number of times a message actually hops from one device to another.
Since the maximum value in this field is three, there can be four actual hops,
consisting of the original transmission and three retransmissions. Four hops can
span a chain of five devices. This situation is shown schematically below.
Device Number 1 2 3 4 5
Max Hops 3 3 3 3 3
Hops Left 3 3→2 2→1 1→0 0
Hop Number 1 2 3 4
Retransmission Number 0 1 2 3
Command 1 and 2
The fourth field in an INSTEON message is a two-byte Command, made up of
Command 1 and Command 2. The usage of this field depends on the Message Type
as explained below (see INSTEON Message Summary Table46 and Chapter 8 —
INSTEON Command Set114).
User Data
Only if the message is an Extended-length message, with the Extended Message Flag
set to one, will it contain the fourteen-byte User Data field. Extended-length Direct
Commands have a predefined User Data field, but developers may define their own
User Data fields by employing so-called FX Commands (see User-Defined FX
Commands121).
If more than 14 bytes of User Data need to be transmitted, multiple INSTEON
Extended-length messages will have to be sent using FX Commands. Users can
define a packetizing method for their data so that a receiving device can reliably
reassemble long messages. Encrypting User Data can provide private, secure
communications for sensitive applications such as security systems.
Firmware in the INSTEON Engine handles the CRC byte automatically, appending it
to messages that it sends, and comparing it within messages that it receives.
Applications post messages to and receive messages from the INSTEON Engine
without the CRC byte being appended.
Detection of message integrity allows for highly reliable, verified communications.
The INSTEON ACK/NAK (acknowledge, non-acknowledge) closed-loop messaging
protocol based on this detection method is described below (see INSTEON Message
Retrying54).
SC Cleanup ID1_2 ID1_1 ID1_0 ID2_2 ID2_1 ID2_0 0 1 0 0 SA Cmd Group # CRC
SC Cleanup ACK ID1_2 ID1_1 ID1_0 ID2_2 ID2_1 ID2_0 0 1 1 0 SA Cmd Group # CRC
SC Cleanup NAK ID1_2 ID1_1 ID1_0 ID2_2 ID2_1 ID2_0 1 1 1 0 SA Cmd Error # CRC
SD [Direct] ID1_2 ID1_1 ID1_0 ID2_2 ID2_1 ID2_0 0 0 0 0 SD Cmd CRC
SD ACK ID1_2 ID1_1 ID1_0 ID2_2 ID2_1 ID2_0 0 0 1 0 ACK Echo or Data CRC
SD NAK ID1_2 ID1_1 ID1_0 ID2_2 ID2_1 ID2_0 1 0 1 0 NAK Error # CRC
14 Bytes 1 Byte
D1 ⇒ D14 CRC3
EB [Broadcast] Unused 1 0 0 1 Unused
EA Broadcast Unused 1 1 0 1 Unused
Extended
The top section of the table shows the possible Standard-length messages and the
bottom section shows Extended-length messages. Extended-length messages have
the same structure as Standard-length messages, except that Extended-length
messages have their Extended Message Flag set to one and they possess a 14-byte
User Data field.
Although there are eight possible Extended-length message types, the only one in
actual use is ED (Extended Direct). The reason is that Acknowledgement (ACK or
NAK) messages are always Standard-length, and ALL-Link and Broadcast messages
do not require the 14-byte User Data field.
The Command 1 and Command 2 fields contain different information depending on
the INSTEON message type.
SD and ED Messages
In the case of Direct messages, the two Command fields together comprise a 2-byte
Command chosen from a possible 65,536 Commands suitable for controlling an
individual device within an INSTEON Device Category, or DevCat. Each set of 65,536
possible SD or ED Commands can have a different interpretation, depending on the
DevCat of the Responder. For example, a Direct Command of 0x11AA tells a device
belonging to DevCat 0x01 (Dimmable Lighting Controls) to turn on the lamp it
SB Messages
In the case of SB (Broadcast) messages, the Command 1 field contains one of 256
possible SB Commands suitable for sending to all devices at once. (Command 2
should be set to 0xFF.) The main purpose of SB Commands is to support ALL-
Linking of Controllers with Responders. For example, a Controller invites Responder
devices to ALL-Link to one of its buttons by sending a SET Button Pushed Controller
SB Command of 0x02 (see SET Button Pressed Broadcast Messages84). Every
INSTEON device contains a database of Broadcast Commands that it is capable of
executing.
Recipients do not acknowledge SB messages.
Timeslot Synchronization
There is a specific pattern of transmissions, retransmissions and acknowledgements
that occurs when an INSTEON message is sent, as shown in the examples below.
An INSTEON message on the powerline occupies either six or thirteen zero crossing
periods, depending on whether the message is Standard- or Extended-length. This
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Example 1 0 Sender T
Example 1, the simplest, shows a Broadcast message with a Max Hops of zero (no
retransmissions). The T indicates that the Sender has originated and transmitted a
single message. There is no acknowledgement that intended recipients have heard
the message. The message required one timeslot of six or thirteen powerline zero
crossings to complete.
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Sender T
Example 2 1
Repeater 1 L R
Example 2 shows a Broadcast message with a Max Hops of one. Max Hops can
range from zero to three as explained above. The Sender transmits a Broadcast
message as signified by the T. Another INSTEON device, functioning as a Repeater,
listens to the message, as signified by an L, and then retransmits it in the next
timeslot as indicated by the R.
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Sender T L L L L
Repeater 1 L R L R L
Example 3 3
Repeater 2 L L R L L
Repeater 3 L L L R L
Up to three retransmissions are possible with a message. Example 3 shows the
progression of the message involving an originating Sender and three repeating
devices, with a Max Hops of three. Example 3 assumes that the range between
Repeaters is such that only adjacent Repeaters can hear each other, and that only
Repeater 1 can hear the Sender. Note that the Sender will not retransmit its own
message.
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Sender T C
Example 4 0
Recipient L A
When a Sender transmits a Direct message, it expects an acknowledgement from the
Recipient. Example 4 shows what happens if the Max Hops value is zero. The A
designates the timeslot in which the Recipient acknowledges receipt of the Direct
message. The C shows the timeslot when the Sender finds that the message is
confirmed.
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Sender T L L C
Example 5 1 Repeater 1 L R L R
Recipient L L A L
When Max Hops is set to one, a Direct message propagates as shown in Example 5.
Repeater 1 will retransmit both the original Direct message and the
acknowledgement from the Recipient.
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Sender T L C W
Example 6 1 Repeater 1 L R L R
Recipient L W A L
If Max Hops is set to one, but no retransmission is needed because the Recipient is
within range of the Sender, messages flow as shown in Example 6. The W in the
Sender and Recipient rows indicates a wait. The Recipient immediately hears the
Sender since it is within range. However, the Recipient must wait one timeslot
before sending its acknowledgement, because it is possible that a repeating device
will be retransmitting the Sender’s message. Repeater 1 is shown doing just that in
the example, although the Recipient would still have to wait even if no Repeaters
were present. Only when all of the possible retransmissions of the Sender’s message
are complete, can the Recipient send its acknowledgement. Being within range, the
Sender hears the acknowledgement immediately, but it must also wait until possible
retransmissions of the acknowledgement are finished before it can send another
message.
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Sender T L L L L L L C
Repeater 1 L R L R L R L R
Example 7 3 Repeater 2 L L R L L L R L
Repeater 3 L L L R L R L R
Recipient L L L L A L R L
Example 7 shows what happens when Max Hops is three and three retransmissions
are in fact needed for the message to reach the Recipient. Note that if the Sender or
Recipient were to hear the other’s message earlier than shown, it still must wait until
Max Hops timeslots have occurred after the message was originated before being
free to send its own message. If devices did not wait, they would jam each other by
sending different messages in the same timeslot. A device can calculate how many
timeslots have passed prior to receiving a message by subtracting the Hops Left
number in the received message from the Max Hops number.
All seven of the above examples are given again in the table below in order to show
the patterns more clearly.
Max Timeslot 1 2 3 4 5 6 7 8
Hops
Example 1 0 Sender T
Sender T
Example 2 1
Repeater 1 L R
Sender T L L L L
Repeater 1 L R L R L
Example 3 3
Repeater 2 L L R L L
Repeater 3 L L L R L
Sender T C
Example 4 0
Recipient L A
Sender T L L C
Example 5 1 Repeater 1 L R L R
Recipient L L A L
Sender T L C W
Example 6 1 Repeater 1 L R L R
Recipient L W A L
Sender T L L L L L L C
Repeater 1 L R L R L R L R
Example 7 3 Repeater 2 L L R L L L R L
Repeater 3 L L L R L R L R
Recipient L L L L A L R L
the case of Direct (SD, ED, or SC) messages, receivers will not send an
acknowledgement message, and in the case of Broadcast (SB or SA) messages,
other devices will not hop the message. In either case, the senders will begin a retry
sequence. With the randomized retry delay, each sender will begin the retry at a
different time with high probability. Whichever device starts first will gain the
channel. The other devices will abort their retry attempts and signal the retry failure
by setting the _MsgFail flag (bit 4) in the I_Error byte (see the i2 Engine Memory
Map170).
In This Chapter
INSTEON Powerline Signaling57
Covers bit encoding for powerline transmission, packetizing of INSTEON
messages, packet timing, X10 compatibility2, message timeslots, and powerline
data rates.
INSTEON Second Generation i2/RF Signaling65
Describes RF signaling for all INSTEON products except the SmartLabs
SignaLinc™ RF Signal Enhancer.
INSTEON First Generation i1/RF Signaling78
Describes RF signaling for the SmartLabs SignaLinc™ RF Signal Enhancer. All
other INSTEON products use INSTEON RF Signaling.
INSTEON Simulcasting80
Explains how allowing multiple INSTEON devices to talk at the same time makes
an INSTEON network more reliable as more devices are added, and eliminates
the need for complex, costly message routing.
In This Section
Powerline BPSK Modulation58
Shows how bits are modulated onto the powerline.
INSTEON Powerline Packets59
Shows the format of INSTEON packets associated with the powerline zero
crossing.
Powerline Packet Timing60
Gives the timing details for INSTEON powerline packets and X10 signals.
X10 Compatibility61
Explains how INSTEON coexists with X10 on the powerline.
Powerline Message Timeslots62
Explains how INSTEON packets are grouped into INSTEON messages on the
powerline.
INSTEON Full Message Cycle Times63
Gives the time required to send INSTEON messages over the powerline.
INSTEON Powerline Data Rates64
Calculates the net bits-per-second data rates for INSTEON messages on the
powerline.
SP BP BP BP BP
SP BP BP BP BP BP BP BP BP BP BP
A Start Packet appears as the first packet in an INSTEON message, as shown by the
symbol SP in both the Standard- and Extended-length messages. The remaining
packets in a message are Body Packets, as shown by the symbols BP.
Each packet contains 24 bits of information, but the information is interpreted in two
different ways, as shown below.
SP Start Packet
1 0 1 0 1 0 1 0 1 0 0 1 x x x x x x x x x x x x
4 Start Code
8 Sync bits 12 Data bits
bits
BP Body Packet
1 0 1 0 0 1 x x x x x x x x x x x x x x x x x x
2 Sync 4 Start Code
18 Data Bits
bits bits
Powerline packets begin with a series of Sync Bits. There are eight Sync Bits in a
Start Packet and there are two Sync Bits in a Body Packet. The alternating pattern
of ones and zeros allows the receiver to detect the presence of a signal.
Following the Sync Bits are four Start Code Bits. The 1001 pattern indicates to the
receiver that Data bits will follow.
The remaining bits in a packet are Data Bits. There are twelve Data Bits in a Start
Packet, and there are eighteen Data Bits in a Body Packet.
The total number of Data Bits in a Standard-length message is 84, or 10½ bytes.
The last four data bits in a Standard-length message are ignored, so the usable data
is 10 bytes. The total number of Data Bits in an Extended-length message is 192, or
24 bytes.
Zero Crossing
16.67 ms
INSTEON INSTEON
X10 X10
876 µs
947 µs
1823 µs
X10
Zero Crossing
1 BIT = 10 Cycles of 131.65 KHz 1 BURST = ½ BIT = 120 Cycles of 120 KHz
The top of the figure shows a single powerline cycle, which possesses two zero
crossings. An INSTEON packet is shown at each zero crossing. INSTEON packets
nominally begin 876 microseconds before a zero crossing and last until 947
microseconds after the zero crossing. To allow for hardware zero crossing detector
component tolerances and for load-dependent powerline phase shifts, the INSTEON
signal may begin up to 300 microseconds early or late with respect to the zero
crossing detected by a particular INSTEON device.
X10 Compatibility
The figure also shows how X10 signals are applied to the powerline. X10 is the
signaling method used by many devices already deployed on powerlines around the
world. Compatibility2 with this existing population of legacy X10 devices is an
important feature of INSTEON. At a minimum, X10 compatibility means that
INSTEON and X10 signals can coexist with each other, but compatibility also allows
designers to create hybrid devices that can send and receive both INSTEON and X10
signals.
The X10 signal uses a burst of approximately 120 cycles of 120 KHz carrier
beginning at the powerline zero crossing and lasting about 1000 microseconds. A
burst followed by no burst signifies an X10 one bit and no burst followed by a burst
signifies an X10 zero bit. An X10 message begins with two bursts in a row followed
by a one bit, followed by nine data bits. The figure shows an X10 burst at each of
the two zero crossings.
The X10 specification also allows for two copies of the zero crossing burst located
one-third and two-thirds of the way through a half-cycle of power. These points
correspond to the zero crossings of the other two phases of three-phase power.
INSTEON is insensitive to those additional X10 bursts and does not transmit them
when sending X10.
The middle of the figure shows an expanded view of an INSTEON packet with an X10
burst superimposed. The X10 signal begins at the zero crossing, 876 microseconds
after the beginning of the INSTEON packet, and ends 1000 microseconds after the
zero crossing.
INSTEON devices achieve compatibility with X10 by listening for an INSTEON signal
beginning 876 microseconds before the zero crossing. INSTEON receivers
implemented in software can be very sensitive, but at the cost of having to receive a
substantial portion of a packet before being able to validate that a true INSTEON
packet is being received. Reliable validation may not occur until as much as 450
microseconds after the zero crossing, although an INSTEON device will still begin
listening for a possible X10 burst right at the zero crossing. If at the 450-
microsecond mark the INSTEON receiver validates that it is not receiving an
INSTEON packet, but that there is an X10 burst present, the INSTEON receiver will
switch to X10 mode and listen for a complete X10 message over the next 11
powerline cycles. If instead the INSTEON device detects that it is receiving an
INSTEON packet, it will remain in INSTEON mode and not listen for X10 until it
receives the rest of the complete INSTEON message.
The bottom of the figure shows that the raw bitrate for INSTEON is much faster for
INSTEON than for X10. An INSTEON bit requires ten cycles of 131.65 KHz carrier, or
75.96 microseconds, whereas an X10 bit requires two 120-cycle bursts of 120 KHz.
One X10 burst takes 1000 microseconds, but since each X10 burst is sent at a zero
crossing, it takes 16,667 microseconds to send the two bursts in a bit, resulting in a
sustained bitrate of 60 bits per second. INSTEON packets consist of 24 bits, and an
INSTEON packet can be sent during each zero crossing, so the nominal raw
sustained bitrate for INSTEON is 2880 bits per second, 48 times faster than X10.
Note that this nominal INSTEON bitrate must be derated to account for packet and
message overhead, as well as message retransmissions. See INSTEON Full Message
Cycle Times63, below, for details.
i2/RF Modulation
Symbols are modulated onto the carrier using frequency-shift keying (FSK), where a
zero-symbol modulates the carrier half the FSK deviation frequency downward and a
one-symbol modulates the carrier half the FSK deviation frequency upward. The FSK
deviation frequency chosen for i2/RF is 200 KHz.
i2/RF Timing
Symbols are modulated onto the carrier at 9,124 symbols per second, resulting in a
raw data rata of half that, or 4,562 bits per second.
The master symbol clock derives from counting 274 ticks of a 400-nanosecond timer,
giving a symbol period of 109.600 microseconds, or a bit period of 219.200
microseconds.
i2/RF Range
The typical range for free-space reception is 400 feet to achieve a raw bit-error rate
of 0.1% using a half-wave dipole antenna. The presence of walls and other RF
energy absorbers will reduce this range.
At a bitrate of 4,562 bits per second (219.200 microseconds per bit), it takes 3.0688
milliseconds to send a 14-bit i2/RF Data Packet.
A full byte (two nibbles) of Sync Pattern precedes the first packet in an i2/RF
message. Its main function is to synchronize the decoder’s bit clock so that the
Start-Bit immediately following the Sync Pattern can be properly detected
The Sync Pattern also fills in the gaps between the end of the first transmission of an
i2/RF message and any hops of the same message that the originating transmitter
may send. The Sync Pattern is contained in a number of Sync Filler Packets followed
by a special Sync Gap Packet.
Standard-length messages will have three Sync Filler Packets and Extended-length
messages will have six. Sync Filler Packets are similar to i2/RF Data Packets except
that the data byte consists of two nibbles of Sync Pattern, like this:
The Sync Gap Packet that comes after the Sync Filler Packets has a Sleep Code of 0
followed by 15 nibbles of Sync Pattern. Sync Gap Packets look like this:
i2/RF Messages
INSTEON i2/RF messages contain the same information as INSTEON powerline
messages, but with the data reordered so that a battery-powered device can quickly
determine whether or not it is the addressee of an incoming message, and if it is not,
go back to sleep.
The Message Flags41 byte of the INSTEON message appears first so that receivers
can reject a message and go back to sleep at the earliest opportunity. By comparing
the Max Hops value to the Hops Left value in the Message Retransmission Flags43, a
receiver can determine how many repetitions of the current message remain in a
message cycle. Inspection of the Message Type Flags42 allows a receiver to
determine if the message cycle includes an acknowledgement, or if the current
message is itself an acknowledgement message. Receivers can establish the length
of a timeslot for a message repetition by looking at the Extended Message Flag43.
Along with the Sleep Code, this information is sufficient for a receiver to calculate
how much time will elapse before a new message cycle will begin. If a receiver
further determines that there is nothing relevant to it in the current message cycle,
then it can go back to sleep and wake up again during a later message cycle.
To help a receiver determine message relevancy quickly, either the From Address
appears next in the case of Broadcast Messages, or else the To Address appears next
in the case of Direct messages. Receivers can reject SD and ED Direct and SC ALL-
Link Cleanup messages with a To Address that does not match the receiver’s
INSTEON address. They can also reject SA ALL-Link Broadcast messages with a
From Address and an ALL-Link Group Number in the To Address low byte that do not
match any ALL-Link Records in the receiver’s INSTEON ALL-Link Database101.
The table shows a clear tradeoff between command-response latency and battery
life.
The center frequency, 904 MHz, lies in the band 902 to 924 MHz, which is permitted
for unlicensed operation in the United States. i1/RF radios cannot communicate with
i2/RF radios because they operate at different frequencies.
Symbols are modulated onto the carrier using frequency-shift keying (FSK), where a
zero-symbol modulates the carrier half the FSK deviation frequency downward and a
one-symbol modulates the carrier half the FSK deviation frequency upward. The FSK
deviation frequency chosen for INSTEON is 64 KHz.
Each bit is Manchester encoded, meaning that two symbols are sent for each bit. A
one-symbol followed by a zero-symbol designates a one-bit, and a zero-symbol
followed by a one-symbol designates a zero-bit.
Symbols are modulated onto the carrier at 76,800 symbols per second, resulting in a
raw data rata of half that, or 38,400 bits per second.
The typical range for free-space reception is 150 feet, which is reduced in the
presence of walls and other RF energy absorbers.
i1/RF Messages
Referring to the figures below, i1/RF messages begin with two sync bytes consisting
of AAAA in hexadecimal, followed by a start code byte of C3 in hexadecimal. Ten
data bytes (80 bits) follow in Standard-length messages, or twenty-four data bytes
(192 bits) in Extended-length messages. The last data byte in a message is a CRC3
over the data bytes as explained above (see Message Integrity Byte44).
The bytes in an INSTEON i1/RF message are transmitted most-significant byte first,
and the bits are transmitted most-significant bit first.
AA AA C3 x x x X x x x x x x n
1
2
Start 3
Sync 80 Data Bits (10 Data bytes) CRC
Code
bytes
byte
AA AA C3 x x x x x x x X x x x x x x x x x x x x x x x x n
1
2
Start 3
Sync 192 Data Bits (24 Data bytes) CRC
Code
bytes
byte
i1/RF Timing
It takes 2.708 milliseconds to send a 104-bit Standard-length message, and 5.625
milliseconds to send a 216-bit Extended-length message. Zero crossings on the
powerline occur every 8.333 milliseconds, so a Standard or Extended i1/RF message
can be sent during one powerline half-cycle. The waiting times after sending
powerline messages, as shown in the section Powerline BPSK Modulation58, are to
allow sufficient time for INSTEON i1/RF devices, if present, to retransmit a powerline
message.
INSTEON Simulcasting
By following the above rules for message propagation, INSTEON systems achieve a
marked increase in the reliability of communications. The reason is that multiple
INSTEON devices can transmit the same message at the same time within a given
timeslot. INSTEON devices within range of each other thus “help each other out.”
Most networking protocols for shared physical media prohibit multiple devices from
simultaneously transmitting within the same band by adopting complex routing
algorithms. In contrast, INSTEON turns what is usually a problem into a benefit by
ensuring that devices transmitting simultaneously will be sending the same
messages in synchrony with each other.
Powerline Simulcasting
One might think that multiple INSTEON devices transmitting on the powerline could
easily cancel each other out rather than boost each other. In practice, even if one
were trying to nullify one signal with another, signal cancellation by multiple devices
would be extremely difficult to arrange. The reason is that for two signals to cancel
at a given receiver, the two transmitters would have to send carriers such that the
receiver would see them as exactly equal in amplitude and very nearly 180 degrees
out of phase. The probability of this situation occurring and persisting for extended
periods is low.
The crystals used on typical INSTEON devices to generate the powerline carrier
frequency of 131.65 KHz run independently of each other with a frequency tolerance
of a few tenths of a percent. Phase relationships among multiple powerline carriers
therefore will drift, although slowly with respect to the 1823 microsecond duration of
an INSTEON packet. Even if the phases of two transmitters happened to cancel, it is
very unlikely that the amplitudes would also be equal at the location of a receiver, so
a receiver would very likely still see some signal even in the worst-case transient
phase relationship. INSTEON receivers have a wide dynamic range, from millivolts
to five volts or so, which will allow them to track signals even if they fade
temporarily. Adding more transmitters reduces the probability of signal cancellation
even more. With source diversity, the probability that the sum of all the signals will
increase in signal strength rises significantly.
The INSTEON powerline carrier is modulated using binary phase-shift keying (BPSK),
meaning that receivers are looking for 180-degree phase shifts in the carrier to
detect changes in a string of bits from a one to a zero or vice-versa. Multiple
transmitters, regardless of the absolute phase of their carriers, will produce signals
whose sum still possesses 180-degree phase reversals at bit-change boundaries, so
long as their relative carrier frequencies do not shift more than a few degrees over a
packet time. Of course, bit timings for each transmitter need to be fairly well locked,
so INSTEON transmitters are synchronized to powerline zero crossings. An INSTEON
bit lasts for ten cycles of the 131.65 KHz powerline carrier, or 76 microseconds. The
powerline zero crossing detector should be accurate within one or two carrier periods
so that bits received from multiple transmitters will overlay each other.
In practice, multiple INSTEON powerline transmitters simulcasting the same
message will improve the strength of the powerline signal throughout a building.
RF Simulcasting
Since RF signaling is used as an extension to powerline signaling, it also is based on
simulcasting. However, because of the short wavelength of 900 MHz RF carrier
signals, standing wave interference patterns can form where the RF carrier signal is
reduced, even when the carrier and data are ideally synchronized.
As with powerline, for a cancellation to occur, two carriers must be 180 degrees out
of phase and the amplitudes must be the same. Perfect cancellation is practically
impossible to obtain. In general, two co-located carriers on the same frequency with
random phase relationships and the same antenna polarization will sum to a power
level greater than that of just one transmitter 67% of the time. As one of the
transmitters is moved away from a receiver, the probability of cancellation drops
further because the signal amplitudes will be unequal. As the number of
transmitters increases, the probability of cancellation becomes nearly zero.
Mobile INSTEON RF devices, such as handheld controllers, are battery operated. To
conserve power, mobile devices are not configured as RF repeaters, but only as
message originators, so RF simulcasting is not an issue for them. INSTEON devices
that do repeat RF messages are attached to the powerline, so most of them will not
be moved around after initial setup. During setup, such RF devices can be located,
and their antennas adjusted, so that no signal cancellation occurs. With the location
of the transmitters fixed, the non-canceling configuration will be maintained
indefinitely.
In This Chapter
INSTEON Device Categories83
Explains how Device Categories, or DevCats, allow INSTEON Command Numbers
to be interpreted differently by different kinds of devices in an INSTEON network.
INSTEON Product Database87
Explains how an INSTEON Product Key (IPK) number stored in INSTEON devices
functions as a lookup key to an online INSTEON Product Database (IPDB)
containing detailed information about the device.
INSTEON Device ALL-Linking93
Describes how ALL-Linking allows an INSTEON Controller to operate any
INSTEON Responder even if it does not know the Direct Commands for the
Responder, explains the role of ALL-Link Groups, and gives examples of ALL-
Linking sessions.
INSTEON Security112
Gives an overview of how INSTEON handles network security issues.
Byte Data
D1 Reserved (always set to 0x00)
D9 ⇒ User-defined
D14
Note that the six bytes D9 through D14 are user-defined. If desired, the firmware
version number that previously appeared in the LSB of the To Address field of SET
Button Pressed SB messages may appear here, along with any other data that the
device manufacturer may require.
The maximum number of Responders that may ALL-Link to a given ALL-Link Group
in a Controller depends only on the available memory for the Link Database in the
Controller. Similarly, the maximum number of ALL-Link Groups that a Responder
may join depends only on the available memory for the ALL-Link Database in the
Responder. The minimum number of ALL-Link Groups that a Responder may join is
one.
The time it takes to search a Responder’s ALL-Link Database can present a practical
limit on how many ALL-Link Groups a Responder may belong to. Before executing
the Command in an SA ALL-Link Broadcast or SC ALL-Link Cleanup message, a
Responder must search its Link Database for an IID and ALL-Link Group Number
match, and this search takes time. The search time depends on the design of the
database—a Threaded ALL-Link Database (ALDB/T)105, as used in devices like the
SmartLabs PowerLinc™ Controller, is significantly faster to search than a Linear ALL-
Link Database (ALDB/L)102, as used in simpler devices. A safe practical limit is fifty
ALL-Link Group memberships for a Responder that uses linear searches.
Manual ALL-Linking
Easy setup is very important for products sold to a mass market. INSTEON devices
can be ALL-Linked together very simply:
• Push and hold for 10 seconds the button that will control an INSTEON device.
• Push and hold a button on the INSTEON device to be controlled.
This kind of manual ALL-Linking implements a form of security. Devices cannot be
probed by sending messages to discover their addresses—a user must have physical
possession of INSTEON devices in order to ALL-Link them together.
Designers are free to add to this basic ALL-Linking procedure. For example, when
multiple devices are being ALL-Linked to a single button on a Controller, a multilink
mode could enable a user to avoid having to press and hold the button for 10
seconds for each new device.
There must also be procedures to unlink devices from a button, and ways to clear
ALL-Links from buttons in case devices ALL-Linked to them are lost or broken. See
the INSTEON ALL-Link Database101 section below for more information on this point.
Electronic ALL-Linking
As the example below shows (see Example of an INSTEON ALL-Linking Session97),
ALL-Linking is actually accomplished by sending INSTEON messages, so a PC or
other device can create ALL-Links among devices if the device addresses are known
and if devices can respond to the necessary commands.
To maintain security, PC-INSTEON interface devices such as SmartLabs’ PowerLinc™
V2 Controller (PLC) mask the two high bytes of the address fields in INSTEON
messages received from unknown devices. Devices are only known if there is an
ALL-Link to the device stored in the ALL-Link Database of the PLC, or if the
message’s To Address matches that of the PLC. Such ALL-Links must have been
previously established by manual button pushing or else by manually typing in the
addresses of ALL-Linked devices (see Masking Non-linked Network Traffic112, below).
Firmware Version 0C
Firmware Version 30
00 00 CC 00 00 AA 0F 01 01 ControLinc (00 00 CC) sends message to LampLinc (00 00 AA) to join Group 1.
To Address 00 00 AA (LampLinc)
To Address 00 00 CC (ControLinc)
To Address Unused 00 00
ALL-Link Group 01
Number
Command 1 11 (On)
Command 2 00 (Unused)
To Address 00 00 AA (LampLinc A)
Command 1 11 (On)
To Address 00 00 CC (ControLinc)
Command 1 11 (On)
To Address 00 00 BB (LampLinc B)
Command 1 11 (On)
To Address 00 00 CC (ControLinc)
Command 1 11 (On)
In This Section
Linear ALL-Link Database (ALDB/L)102
Gives the layout of the Linear ALL-Link Database used in low-cost INSTEON
devices with limited memory.
Threaded ALL-Link Database (ALDB/T)105
Explains the structure of the Threaded ALL-Link Database for high-performance
devices such as the SmartLabs PowerLinc™ V2 Controller.
ALDB/L Overview
The ALDB/L starts at the top of external (serial) EEPROM and grows downward. In
most limited-memory INSTEON devices, top of memory is 0x0FFF. Each ALDB/L
Record is 8 bytes long, so the first record starts at 0x0FF8, the second record starts
at 0x0FF0, and so on. The ALDB/L starts out containing only one 8-byte physical
record.
In what follows, the 3-byte INSTEON Address contained in a record is called the
Device ID or sometimes just the ID. The high byte (MSB) of the Device ID is ID2,
the middle byte is ID1, and the low byte (LSB) is ID0.
Group 1 ALL-Link Group Number this Device ID belongs to (see INSTEON ALL-Link Groups93)
ID 3 Device ID (ID2, ID1, ID0 in that order)
Data 1 1 Link-specific data (e.g. On-Level)
Data 2 1 Link-specific data (e.g. Ramp Rates, Setpoints, etc.)
Data 3 1 Link-specific data (normally unused)
Put the ALL-Link Group number in the Group field, and put the Device ID in the ID
field. Finally, set the Data 1, Data 2, and Data 3 fields appropriately for the Record
Class you are storing.
Searching an ALDB/L
The most common search of an ALDB/L is for a particular 3-byte INSTEON ID and 1-
byte ALL-Link Group number matching the Device ID and Group fields in a record.
You will have to search the ALDB/L from the beginning until you find what you are
looking for, or until you get to the end without finding it.
If you are searching the database for something that may occur multiple times, such
as all records with a given ALL-Link Group Number, then you will have to look at all
of the records in the ALDB/L.
ALDB/T Overview
An ALDB/T starts at the top of external (serial) EEPROM and grows downward.
Because of the way Flat Memory Addressing168 works, top of memory can always be
found at 0xFFFF.
Each ALDB/T record is 8 bytes long, so the first physical record starts at 0xFFF8, the
second physical record starts at 0xFFF0, and so on. The ALDB/T starts out
containing a minimum of 128 physical records, so it occupies the top 1024 bytes of
external EEPROM. The ALDB/T can grow larger than 1024 bytes, until it bumps up
against the SALad application or other code that grows upward from the bottom of
EEPROM.
In what follows, the 3-byte INSTEON Address contained in a record is called the
Device ID or sometimes just the ID. The high byte (MSB) of the Device ID is ID2,
the middle byte is ID1, and the low byte (LSB) is ID0. MSb and LSb refer to most
and least significant bits, respectively. All addresses refer to the Flat Memory
Map170.
Link gives the 13 MSbs of the 16-bit address of the next record in this one of 128 possible
database threads. The 3 LSbs of this address are 0.
If the 8 MSbs of Link are 0, this is the last record in the thread.
If the 8 MSbs of Link are 0, the Record Class is 00, and ID0 LSb is 1, then this is the last
physical record in the database.
The 16-bit address of the first record in a thread is computed from ID0 by shifting ID0 left 2
(i.e. multiplying ID0 by 4), complementing the 16-bit result, then setting the 3 LSbs to 0.
Record Class indicates whether the record is available (Deleted), for an INSTEON Controller
(Master), for an INSTEON Responder (Slave), or user-defined (Other).
ID0 LSb is the LSb of ID0 in the Device ID.
Each record in the ALDB/T contains the ID of an INSTEON device that the PLC is ALL-
Linked to. The PLC may be ALL-Linked to the same ID multiple times, each time in a
different ALL-Link Group. To search for or to store a record in the ALDB/T, you use
the least-significant byte of the record’s ID, i.e. ID0, as a lookup key.
ALDB/T Threads
The ALDB/T is organized as a set of 128 linked lists of records. In the following
discussion, each linked list is called a thread.
A record’s ID0 tells which thread to store the record in. All records with the same
ID0 will be stored somewhere in the same thread. There are only 128 threads, but
the value of ID0 can range from 0 to 255 (0x00 to 0xFF), so both even and odd ID0
numbers are stored in the same thread. Thus, records with an ID0 of 0x00 or 0x01
will be stored in the first thread, records with an ID0 of 0x02 or 0x03 will be stored
in the second thread, and so forth, up to records with an ID0 of 0xFE or 0xFF, which
will be stored in the 128th thread.
The first record in the first thread is located at the top of memory, occupying 8
memory locations from 0xFFF8 to 0xFFFF. The first record in the second thread
starts 8 bytes below the first record, at 0xFFF0. The first records for the remaining
126 threads each occupy the next lower 8 bytes, down to a starting point of 0xFC00
for the first record in the 128th thread.
Now, given a particular ID0, you can calculate the memory address of the first record
in the thread for that ID0 very simply. Just multiply ID0 by four (that is, shift it left
by 2 into a 16-bit value), complement the 16-bit value, and then set the 3 LSbs of
the 16-bit value to 0 by ANDing the 16-bit value with 0xFFF8.
As an example, let’s try an ID0 of 0x01. Shifting left 2 gives 0x0004.
Complementing gives 0xFFF83. ANDing with 0xFFF8 gives 0xFFF8, which is the
correct starting address of the first record in the first thread, as expected. Note that
starting with an ID0 of 0x00, you would get the same record starting address. The
table below shows this and a few other examples.
Calculating an ALDB/T Record Address from ID0
Record Class
Bits 2 and 1 of the Record Control field designate the ALDB/T record’s Record Class.
If the Record Class is 10, then the ID in this ALDB/T record belongs to an INSTEON
Responder (Slave) Device. The device containing the ALDB/T is therefore an
INSTEON Controller (Master) of the Responder in the ALDB/T record.
August 16, 2007 © 2005-2007 SmartLabs Technology
Dev Guide, Chapter 7 Page 108
Similarly, if the Record Class is 11, then the ID in the ALDB/T record belongs to an
INSTEON Controller (Master) Device. The device containing this ALDB/T is therefore
an INSTEON Responder (Slave) to the Controller in the ALDB/T record.
(Another way to explain this is, within an ALDB/T, a Device Class of 10 means “I’m a
Controller,” and 11 means “I’m a Responder.”)
A Record Class of 01 indicates that the record contains information that may be
interpreted in different ways, depending on the application.
If both of the Record Class bits are zero, then this record is deleted, i.e. no longer in
use. In this discussion, deleted means the same as empty, unused, or available.
Deleted records are not removed from the ALDB/T. Instead, they are merely marked
as available for future use by setting the Record Class to 00.
The last physical record in the ALDB/T has a Record Control field with a high byte of
0x00 (last record in a thread), a Record Class of 00 (deleted), and an ID0 LSb of 1.
Records that are deleted but are not the last physical record will therefore have an
ID0 LSb set to zero.
An Empty ALDB/T
An empty ALDB/T starts out looking like this:
Empty ALDB/T
Thread Record’s Addr + 0 Addr + 1 Addr Addr Addr Addr Addr Addr
Number Address +2 +3 +4 +5 +6 +7
LastALDBRecordAddress, for saving the address of the last physical record. Thus, in
an empty ALDB/T, LastALDBRecordAddress would contain 0xFFB8.
Searching an ALDB/T
If you are searching the ALDB/T for a record with a particular ID, use ID0 to
calculate the starting address for the thread containing the ID, and then follow the
links in the thread until ID1, ID2, and ID0 LSb match. (Remember, to find the first
record in the ID’s thread, shift ID0 left by two into a 16-bit value, complement the
result, and then zero out the three low bits. A Link is just the Record Control field
with the three low bits set to zero.) If you get to the end of the thread without
finding the ID, then the ID is not in the ALDB/T. The last record in a thread has a
Link high byte of 0x00.
If you are searching the database for something that may occur multiple times, such
as all records with a given ALL-Link Group Number and/or all records in a given
Record Class, then you will have to look at all 128 threads. As you increment
through the threads, keep a ThreadIndex counter running from 0x00 to 0x7F. To
recover ID0 of the Device ID in a given record, multiply ThreadIndex by 2 and add in
the ID0 LSb bit.
ALDB/L 70 250
ALDB/T 8,960 32,000
INSTEON Security
INSTEON network security is maintained at two levels. ALL-Linking Control112
ensures that users cannot create ALL-Links that would allow them to control their
neighbors’ INSTEON devices, even though those devices may be repeating each
other’s messages. Encryption within Extended-length Messages113 permits
completely secure communications for applications that require it.
ALL-Linking Control
INSTEON enforces ALL-Linking Control by requiring that users have Physical
Possession of Devices112 in order to create ALL-Links, and by Masking Non-linked
Network Traffic112 when messages are relayed outside the INSTEON network itself.
Both fields may be used together to contain a single two-byte Command in the case
of SB Broadcast or SD or ED Direct messages. In the case of SA ALL-Link Broadcast
or SC ALL-Link Cleanup messages, however, only the Command 1 field is available
because the ALL-Link Group Number occupies the Command 2 field within SC ALL-
Link Cleanup messages. (In SA ALL-Link Broadcast messages the ALL-Link Group
Number appears as the low byte in the To Address field, and the Command 2 field is
set to 0x00.)
In This Chapter
INSTEON Command Categories115
Gives a two-letter system for designating the INSTEON message type that an
INSTEON Command appears in, and describes the different kinds of INSTEON
Commands.
INSTEON Command Set Tables124
Reprints all of the INSTEON Commands current as of the publication date of this
Developer’s Guide.
Required INSTEON Commands157
Groups all of the INSTEON Commands required for INSTEON conformance into
one table, current as of the publication date of this Developer’s Guide.
INSTEON Command Number Assignment161
Describes how to create new INSTEON Commands.
INSTEON Command Database (ICDB)161
Describes the database of INSTEON Commands currently under development.
About INSTEON Peek and Poke Commands162
Gives details and examples of how Peek and Poke Commands have been used in
the past.
Direct SD SD Standard 2
Commands
ED ED Extended 16
Broadcast SB SB Standard 1
Commands
EB EB Extended 16
The Command Designator and Valid for These Message Types columns use the same
abbreviations as first introduced in the INSTEON Message Summary Table46 above.
The first letter is the message length, either S for Standard-length or E for
Extended-length. The second letter is D for Direct, A for ALL-Link Broadcast, C for
ALL-Link Cleanup, or B for Broadcast. The text below and the tables of Commands
all use these same Command Designators.
SD and ED Direct Commands appear in SD and ED Direct Messages, respectively.
SA ALL-Link Commands appear in both SA ALL-Link Broadcast and SC ALL-Link
Cleanup Messages. SB Broadcast Commands appear in SB Broadcast Messages.
ALL-Link Commands
ALL-Linking allows any INSTEON Controller device to operate any INSTEON
Responder device, even if the Controller does not know any of the Direct Commands
that the Responder can execute. The principle is simple—during ALL-Linking to a
button on a Controller, a Responder memorizes the state that it is in at the time.
After ALL-Linking, pushing that button on the Controller causes the Responder to go
back into the state that it memorized when it ALL-Linked.
During INSTEON Device ALL-Linking93, when a button on a Controller ALL-Links to a
Responder, the Controller creates an ALL-Link Group, which the Responder joins (see
INSTEON ALL-Link Groups93, below). Multiple Responders can join the same ALL-
Link Group, so it is possible for a single button push to cause an entire ensemble of
devices to recall their memorized states. All of the Responder devices in the ALL-
Link Group will recall their memorized states simultaneously, because when the
Controller’s button is pushed, the Controller first sends out an SA ALL-Link Broadcast
message to all of the Group members at once, followed by individual SC ALL-Link
Cleanup messages to each Group member in turn, as described in the sections SA
ALL-Link Broadcast Messages48 and SC ALL-Link Cleanup Messages48 above.
Note that although EA and EC Extended-length ALL-Link Broadcast and ALL-Link
Cleanup Commands are logically possible, INSTEON does not currently use them.
ALL-Link Alias 2 High ALL-Link Alias 2 Low Light ON Fast Light OFF Fast
ALL-Link Alias 3 High ALL-Link Alias 3 Low Light Brighten One Step Light Dim One Step
ALL-Link Alias 4 High ALL-Link Alias 4 Low Light Start Manual Light Stop Manual
Change Change
Note that the ALL-Link Recall Command never has a substitute Direct Command,
because ALL-Link Recall is the basic required Command to support ALL-Linking. In
the case of lighting controls, the effect will be the same as executing a Light ON SD
Command, because an ALL-Linked light will go to a saved On-level at a saved Ramp
Rate.
Direct Commands
INSTEON SD (Standard-length Direct) Commands consist of two bytes, Command 1
and Command 2. INSTEON ED (Extended-length Direct) Commands consist of the
same Command 1 and Command 2 bytes plus fourteen additional bytes, D1 through
D14.
The interpretation of any given Direct Command Number depends on the DevCat
(Device Category) that the Direct Command is associated with. See Using DevCats
to Qualify INSTEON Commands86 above for more information.
Two-byte SD Commands are the payload within Standard-length INSTEON
messages. SD Commands are intended for frequent use, fast response, or both. ED
Commands, which require Extended-length INSTEON messages to transport, can be
more elaborate but they take more time to transmit.
Returning a NAK
When a Responder receives a Direct Command from a Controller, and the Responder
cannot execute the Command because the Command is not in its repertoire, then the
Responder may return a Direct NAK message instead of a Direct ACK message to the
Controller by altering the message flag bits.
0x00 ⇒ Reserved
0xFC
Returning an ACK
When a Responder receives an SD or ED Direct message or an SC ALL-Link Cleanup
message from a Controller, and validates that the received message is error-free,
then the Responder’s INSTEON Engine automatically returns an SD or SC ACK
message to the Controller (see SD ACK and SD NAK Messages47 and SC ACK and SC
NAK Messages48, above). Normally, the Command 1 and Command 2 fields of the
ACK message simply echo the Command 1 and Command 2 fields of the received
message. However, if the received Command is one that requests just one or two
bytes of returned data, an application may return the data in those fields. Only
selected SD and ED Direct Commands expect returned data, and that data is
normally one byte in the Command 2 field.
Because ACK messages are part of a timed INSTEON message cycle, an application
only has a limited amount of time to insert the returned bytes in the ACK message.
Worst case (when the message is received on the last hop), that time is 15
milliseconds.
User-Defined FX Commands
INSTEON supports user-defined Direct Commands known as FX Commands, so
named because the Command 1 field ranges from 0xF0 to 0xFF (and because these
Commands may create special effects).
Matching FX Usernames
In order to use FX Commands, both the Controller and Responder devices must be
pre-programmed with an 8-byte FX Username in nonvolatile read-only memory, and
both FX Usernames must match before a Controller may send an FX Command to a
Responder. The Controller’s application program has the responsibility to check that
the FX Username in the Controller matches the FX Username in any Responder
devices before it sends FX Commands to them.
A Controller may check for an FX Username match just after ALL-Linking to a
Responder, or it may check at any other time as needed. To check an INSTEON
device’s FX Username, another device may send it an FX Username Request SD
Command. The queried device will respond with an FX Username Response ED
Command. The first eight data bytes, D1 through D8, in the FX Username Response
Command contains the FX Username. The remaining six data bytes, D9 through
D14, may be user-defined.
To ensure that all 8-byte FX Usernames are unique, SmartLabs maintains an FX
Username database. Manufacturers who wish to use FX Commands need to submit
their desired FX Usernames to Smartlabs for approval before building devices that
use them.
All INSTEON devices that utilize FX Commands must implement the ED FX Username
Response Command. Controller devices that can send FX Commands must also
implement the SD FX Username Request Command. Devices that do not utilize FX
Commands should respond to an FX Username Request Command with an SD NAK.
Legacy devices, however, may respond with an SD ACK and then fail to send the ED
FX Username Response message.
FX Command Definitions
The value from 0xF0 through 0xFF in the Command 1 field of SD or ED messages
may be interpreted in whatever way the device designer desires. The Command 2
field, ranging from 0x00 to 0xFF, may be freely defined, and in the case of ED
messages, the fourteen bytes D1 through D14 are also user-defined.
SmartLabs encourages manufacturers who utilize FX Commands to disclose them so
that they may be published in a SmartLabs-maintained database. Popular FX
Commands are candidates for standardized Direct Commands defined within a
DevCat.
Broadcast Commands
By definition, INSTEON SB Broadcast Commands are addressed to all INSTEON
devices. Accordingly, the To Address field may contain three bytes of data that
pertain to the particular SB Broadcast Command. SB Broadcast Commands are not
acknowledged.
Note that the SB Broadcast Commands described in this section are not the same as
SA ALL-Link Broadcast Commands, which are first broadcast and then sent
sequentially as SC ALL-Link Cleanup messages. See the sections SB Messages47, SA
ALL-Link Broadcast Messages48, and SC ALL-Link Cleanup Messages48 above for
clarification.
Note that although EB Extended-length Broadcast Commands are logically possible,
INSTEON does not currently use them.
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Light Status Request 0x01 All 0x19 0x00 ⇒ 0xFF Not Parsed Returned ACK message will contain the
But On-Level in Command 2.
0x09 Command 1 will contain an ALL-Link
0x0A Database Delta number that increments
every time there is a change in the
addressee’s ALL-Link Database.
Light Status Request 0x02 0x0F 0x19 0x00 Returned ACK message will contain the
On-Level (0x00 or 0xFF only) in Command
(SmartLabs 2486S 2.
KeypadLinc Relay) Command 1 will contain an ALL-Link
Database Delta number that increments
every time there is a change in the
addressee’s ALL-Link Database.
0x01 Returned ACK message will contain the
LED Bit Flags in Command 2.
Command 1 will contain an ALL-Link
Database Delta number that increments
every time there is a change in the
addressee’s ALL-Link Database.
Light Status Request 0x02 All 0x19 0x00 ⇒ 0xFF Not Parsed Returned ACK message will contain the
But On-Level (0x00 or 0xFF only) in Command
0x0F 2.
Command 1 will contain an ALL-Link
Database Delta number that increments
every time there is a change in the
addressee’s ALL-Link Database.
Reserved 0x1A
⇒
0x1E
Get Operating Flags 0x00 0x04 0x1F Flags Requested Returned ACK message will contain the
0x06 0x00 Bit 0 0 = Program Lock requested data in Command 2.
(SmartLabs 2430 Off
ControLinc and 2830 1 = Program Lock
Icon Tabletop On
Controller)
Bit 1 0 = LED Off
1 = LED On
Bit 2 0 = Beeper Off
1 = Beeper On
Bit 3-7 = Unused
0x01 ALL-Link Database
Delta number
0x02 Unused
⇒
0xFF
Get Operating Flags 0x00 0x05 0x1F Flags Requested Returned ACK message will contain the
0x00 Bit 0 0 = Program Lock requested data in Command 2.
(SmartLabs 2843 Off
RemoteLinc) 1 = Program Lock
On
Bit 1 0 = LED Off
1 = LED On
Bit 2 0 = Beeper Off
1 = Beeper On
Bit 3 0 = Allow Sleep
1 = Stay Awake
Bit 4 0 = Allow Transmit
1 = Receive Only
Bit 5 0 = Allow
Heartbeat
1 = No Heartbeat
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
0x06 Unused
⇒
0xFF
Set Operating Flags 0x00 0x05 0x20 Flag to Alter Defaults given in bold.
0x00 Program Lock On
(SmartLabs 2843 0x01 Program Lock Off
RemoteLinc)
0x02 LED On
0x03 LED Off
0x04 Beeper On
0x05 Beeper Off
0x06 Stay Awake On
0x07 Stay Awake Off
0x08 Listen Only On
0x09 Listen Only Off
0x0A No I’m Alive On
0x0B No I’m Alive Off
0x0C Unused
⇒
0xFF
Set Operating Flags 0x01 0x09 0x20 Flag to Alter Defaults given in bold.
0x0A 0x00 Program Lock On
(SmartLabs 2486D 0x01 Program Lock Off
KeypadLinc Dimmer,
SmartLabs 2886D 0x02 LED On during TX
Icon In-Wall 0x03 LED Off during TX
Controller) 0x04 Resume Dim On
0x05 Resume Dim Off
0x06 8-Key KeypadLinc
0x07 6-Key KeypadLinc
0x08 LED Backlight Off
0x09 LED Backlight On
0x0A Key Beep On
0x0B Key Beep Off
0x0C Unused
⇒
0xFF
Set Operating Flags 0x01 All 0x20 Flag to Alter Defaults given in bold.
But 0x00 Program Lock On
0x09 0x01 Program Lock Off
0x0A
0x02 LED On during TX
Default for SubCat 0x00
(SmartLabs LampLinc
V2 Dimmer 2456D3)
0x03 LED Off during TX
Default for SubCat 0x01
(SmartLabs SwitchLinc
V2 Dimmer 2476D)
0x04 Resume Dim On
0x05 Resume Dim Off
0x06 Load Sense On
0x07 Load Sense Off
0x08 LED Off
0x09 LED On
0x0A Unused
⇒
0xFF
Set Operating Flags 0x02 0x0F 0x20 Flag to Alter Defaults given in bold.
0x00 Program Lock On
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
0x02 2 Taps
0x03 Unused
⇒
0xFF
Reserved 0x26
Light Set Status 0x01 N/A 0x27 0x00 ⇒ 0xFF On-Level Updates SwitchLinc Companion’s LEDs.
Set Address MSB All All 0x28 0x00 ⇒ 0xFF High byte of 16- DataTr, Depr
bit address Deprecated (do not use in the future).
Set Most-significant Byte of EEPROM
address for peek or poke.
Poke One Byte All All 0x29 0x00 ⇒ 0xFF Byte to write DataTr, Depr
Deprecated (do not use in the future).
Poke Data byte into address previously
loaded with Set Address MSB and Peek
commands (Peek One Byte sets LSB).
Reserved All All 0x2A 0x00 ⇒ 0xFF DataTr, Depr
These are the Block Data Transfer
commands in ED messages.
Peek One Byte All All 0x2B 0x00 ⇒ 0xFF LSB of address DataTr, Depr
to peek or poke Deprecated (do not use in the future).
The returned ACK message will contain the
peeked byte in Command 2.
Peek One Byte is also used to set the LSB
for Poke One Byte.
Peek One Byte All All 0x2C 0x00 ⇒ 0xFF LSB of internal DataTr, Depr
Internal memory address to peek or Deprecated (do not use in the future).
poke Works like Peek One Byte, except only
used to read from internal EEPROM of a
Smarthome ControLinc V2.
Poke One Byte All All 0x2D 0x00 ⇒ 0xFF Byte to write DataTr, Depr
Internal Deprecated (do not use in the future).
Works like Poke One Byte, except only
used to write into internal EEPROM of a
Smarthome ControLinc V2.
Light ON at Ramp 0x01 All 0x2E 0x00 ⇒ 0xFF On-Level and Bits 0-3 = 2 x Ramp Rate + 1
Rate Ramp Rate Combined Bits 4-7 = On-Level + 0x0F
Reserved 0x2F
⇒
0x3F
Sprinkler Valve ON 0x04 All 0x40 0x00 ⇒ 0xFF Valve Number
Sprinkler Valve OFF 0x04 All 0x41 0x00 ⇒ 0xFF Valve Number
Sprinkler Program 0x04 All 0x42 0x00 ⇒ 0xFF Program
ON Number
Sprinkler Program 0x04 All 0x43 0x00 ⇒ 0xFF Program
OFF Number
Sprinkler Control 0x04 All 0x44 Subcommand
0x00 Load Initialization
Values
0x01 Load EEPROM from Load RAM parameters from RAM EEPROM
RAM
0x02 Get Valve Status ACK contains 1-byte valve status in
Command 2
0 = Off
1 = On
0x03 Inhibit Command Stop accepting commands
Acceptance
0x04 Resume Command Resume accepting commands
Acceptance
0x05 Skip Forward Turn off active valve and continue with next
valve in program
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
0x06 Skip Back Turn off active valve and continue with
previous valve in program
0x07 Enable Pump on V8 Enable pump control on V8
0x08 Disable Pump on V8 Disable pump control on V8
0x09 Broadcast ON Enable SB 0x27 Device Status Changed
broadcast on valve status change
0x0A Broadcast OFF Disable SB 0x27 Device Status Changed
broadcast on valve status change
0x0B Load RAM from Load RAM parameters from EEPROM
EEPROM
0x0C Sensor ON Enable sensor reading
0x0D Sensor OFF Disable sensor reading
0x0E Diagnostics ON Put device in self-diagnostics
0x0F Diagnostics OFF Take device out of self-diagnostics
0x10 Unused
⇒
0xFF
Flash LED 0x01 0x13 0x45 Subcommand Dupl
0x00 Cancel LED Flashing
(SmartLabs 2676D-B 0x01 Begin LED Flashing Device’s LED flashes ½ second on, ½
ICON Dimmer)
⇒ second off, until canceled
0xFF
Flash LED 0x02 0x13 0x45 Subcommand Dupl
0x00 Cancel LED Flashing
(SmartLabs 2676R-B 0x01 Begin LED Flashing Device’s LED flashes ½ second on, ½
ICON Relay)
⇒ second off, until canceled
0xFF
Sprinkler Get Program 0x04 All 0x45 0x00 ⇒ 0xFF Program Dupl
Request Number Added 5/05/06
Addressee responds with ED 0x41xx
Sprinkler Get Program Response
I/O Output On 0x07 All 0x45 0x00 ⇒ 0xFF Output Number Dupl
Turns Output Number On
I/O Output Off 0x07 All 0x46 0x00 ⇒ 0xFF Output Number Turns Output Number Off
I/O Alarm Data 0x07 All 0x47 0x00 Addressee responds with an ED 0x4C00
Request Alarm Data Response message
Reserved 0x47 0x01 ⇒ 0xFF
I/O Write Output Port 0x07 All 0x48 0x00 ⇒ 0xFF Value to store ACK contains byte written to Output Port in
(only output bits are affected) Command 2
I/O Read Input Port 0x07 All 0x49 0x00 ACK contains byte read from Input Port in
Command 2
I/O Get Sensor Value 0x07 All 0x4A 0x00 ⇒ 0xFF Sensor number ACK contains Sensor Value in Command 2
I/O Set Sensor 1 0x07 All 0x4B 0x00 ⇒ 0xFF Nominal Value Set Nominal Value for Sensor 1 to reach.
Nominal Value Other sensors can be set with ED 0x4Bxx
Set Sensor Nominal
I/O Get Sensor Alarm 0x07 All 0x4C Bits 0-3 Sensor number Dupl
Delta Bits 4-6 Delta from nominal When added to or subtracted from
Bit 7 Delta Direction (+ if 0) midpoint, these are the values to trigger SB
0x27 Device Status Changed alarm
messages
Fan Status Report 0x05 0x00 0x4C Fan Capacity Dupl
0x02 Sent to controller when fan state changes.
0x00 Bits 0 - 6 = Fan
⇒ Capacity in CFM
0x7F Bit 7 = 0
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Pool Device ON 0x06 All 0x50 0x00 ⇒ 0xFF Device Number 0 = Unused
1 = Pool
2 = Spa
3 = Heat
4 = Pump
5 - 255 Aux
Pool Device OFF 0x06 All 0x51 0x00 ⇒ 0xFF Device Number 0 = All OFF
1 = Pool
2 = Spa
3 = Heat
4 = Pump
5 - 255 Aux
Pool Temperature Up 0x06 All 0x52 0x00 ⇒ 0xFF Temperature Increase current temperature setting by
Change Temperature Change x 0.5
Pool Temperature 0x06 All 0x53 0x00 ⇒ 0xFF Temperature Decrease current temperature setting by
Down Change Temperature Change x 0.5
Pool Control 0x06 All 0x54 Subcommand
0x00 Load Initialization
Values
0x01 Load EEPROM from
RAM
0x02 Get Pool Mode ACK contains 1-byte thermostat mode in
Command 2
0 = Pool
1 = Spa
2 - 255 Unused
0x03 Get Ambient NClar
Temperature ACK contains ambient temperature in
Command 2
0x04 Get Water Temperature NClar
ACK contains water temperature in
Command 2
0x05 Get pH ACK contains pH value in Command 2
0x06 Unused
⇒
0xFF
Reserved 0x55
⇒
0x57
Door Move 0x0F All 0x58 Subcommand
0x00 Raise Door
0x01 Lower Door
0x02 Open Door
0x03 Close Door
0x04 Stop Door
0x05 Single Door Open
0x06 Single Door Close
0x07 Unused
⇒
0xFF
Door Status Report 0x0F All 0x59 Subcommand
0x00 Raise Door
0x01 Lower Door
0x02 Open Door
0x03 Close Door
0x04 Stop Door
0x05 Single Door Open
0x06 Single Door Close
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
0x07 Unused
⇒
0xFF
Reserved 0x5A
⇒
0x5F
Window Covering 0x0E All 0x60 Subcommand
0x00 Open
0x01 Close
0x02 Stop
0x03 Program
0x04 Unused
⇒
0xFF
Window Covering 0x0E All 0x61 0x00 ⇒ 0xFF Position 0x00 is closed, 0xFF is open.
Position
Reserved 0x62
⇒
0x67
Thermostat 0x05 All 0x68 0x00 ⇒ 0xFF Temperature Increase current temperature setting by
Temperature Up Change x 2 (unsigned byte) Temperature Change x 0.5
Thermostat 0x05 All 0x69 0x00 ⇒ 0xFF Temperature Decrease current temperature setting by
Temperature Down Change x 2 (unsigned byte) Temperature Change x 0.5
Thermostat Get Zone 0x05 All 0x6A Bits 0-4 Zone Number 0-31 ACK contains Zone Temperature, Setpoint,
Information Bits 5,6 00 = Temperature Deadband, or Humidity as an unsigned
01 = Setpoint byte in Command 2
10 = Deadband
11 = Humidity
Bit 7 Unused
Thermostat Control 0x05 All 0x6B Subcommand
0x00 Load Initialization
Values
0x01 Load EEPROM from
RAM
0x02 Get Thermostat Mode ACK contains 1-byte thermostat mode in
Command 2
0x00 = Off
0x01 = Heat
0x02 = Cool
0x03 = Auto
0x04 = Fan
0x05 = Program
0x06 = Program Heat
0x07 = Program Cool
0x08 ⇒ 0xFF Unused
0x03 Get Ambient NClar
Temperature ACK contains ambient temperature in
Command 2
0x04 ON Heat Set mode to Heat
0x05 ON Cool Set mode to Cool
0x06 ON Auto Set mode to Auto
0x07 ON Fan Turn fan on
0x08 OFF Fan Turn fan off
0x09 OFF All Turn everything off
0x0A Program Heat Set mode to Program Heat
0x0B Program Cool Set mode to Program Cool
0x0C Program Auto Set mode to Program Auto
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
D7 ⇒ D14 Unused
0x05 Transfer Complete, DataTr
5 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D7 Final 5 bytes
D8 ⇒ D14 Unused
0x06 Transfer Complete, DataTr
6 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D8 Final 6 bytes
D9 ⇒ D14 Unused
0x07 Transfer Complete, DataTr
7 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D9 Final 7 bytes
D10 ⇒ D14 Unused
0x08 Transfer Complete, DataTr
8 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D10 Final 8 bytes
D11 ⇒ D14 Unused
0x09 Transfer Complete, DataTr
9 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D11 Final 9 bytes
D12 ⇒ D14 Unused
0x0A Transfer Complete, DataTr
10 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D12 Final 10 bytes
D13 ⇒ D14 Unused
0x0B Transfer Complete, DataTr
11 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D13 Final 11 bytes
D13 Unused
0x0C Transfer Complete, DataTr
12 bytes in this last message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D14 Final 12 bytes
0x0D Transfer Continues, DataTr
12 bytes in this message D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 ⇒ D14 12 bytes
0x0E ⇒ 0xFE Reserved
0xFF Request Block Data DataTr
Transfer D1 0x00 ⇒ 0xFF Source address MSB
D2 0x00 ⇒ 0xFF Source address LSB
D3 0x00 ⇒ 0xFF Destination addr MSB
D4 0x00 ⇒ 0xFF Destination addr LSB
D5 0x00 ⇒ 0xFF Block length MSB
D6 0x00 ⇒ 0xFF Block length LSB
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
D6 0x00 ⇒ 0xFF
Button’s X10 Unit
Code
D7 0x00 ⇒ 0x1F
Button’s Ramp Rate
D8 0x00 ⇒ 0xFF
Button’s On- Level
D9 0x11 ⇒ 0x7F
Global LED
Brightness
D10 0x00 ⇒ 0xFF
Non-toggle Bitmap
If bit = 0, associated
button is Toggle
If bit = 1, associated
button is Non-toggle
D11 0x00 ⇒ 0xFF
Button-LED State
Bitmap
If bit = 0, associated
button’s LED is Off
If bit = 1, associated
button’s LED is On
D12 0x00 ⇒ 0xFF
X10-All Bitmap
If bit = 0, associated
button sends X10
On/Off
If bit = 1, associated
button sends X10 All-
On/All-Off
D13 0x00 ⇒ 0xFF
Button Non-toggle
On/Off Bitmap
If bit = 0, associated
button, if Non-toggle,
sends Off
If bit = 0, associated
button, if Non-toggle,
sends On
D14 0x00 ⇒ 0xFF
Button Trigger-ALL-
Link Bitmap
If bit = 0, associated
button sends normal
Command
If bit = 0, associated
button sends ED
0x30 Trigger ALL-
Link Command to first
device in ALDB
D2 0x02 Set LED- D3 0x00 ⇒ 0xFF
Follow Mask for If bit = 0, associated
Button button’s LED is not
affected
If bit = 1, associated
button’s LED follows
this button’s LED
D4 ⇒ D14 Unused
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
D9 0x11 ⇒ 0x7F
Global LED
Brightness
D10 0x00 ⇒ 0xFF
Non-toggle Bitmap
If bit = 0, associated
button is Toggle
If bit = 1, associated
button is Non-toggle
D11 0x00 ⇒ 0xFF
Button-LED State
Bitmap
If bit = 0, associated
button’s LED is Off
If bit = 1, associated
button’s LED is On
D12 0x00 ⇒ 0xFF
X10-All Bitmap
If bit = 0, associated
button sends X10
On/Off
If bit = 1, associated
button sends X10 All-
On/All-Off
D13 0x00 ⇒ 0xFF
Button Non-toggle
On/Off Bitmap
If bit = 0, associated
button, if Non-toggle,
sends Off
If bit = 0, associated
button, if Non-toggle,
sends On
D14 0x00 ⇒ 0xFF
Button Trigger-ALL-
Link Bitmap
If bit = 0, associated
button sends normal
Command
If bit = 0, associated
button sends ED
0x30 Trigger ALL-
Link Command to first
device in ALDB
D2 0x02 Set LED- D3 0x00 ⇒ 0xFF
Follow Mask for If bit = 0, associated
Button button’s LED is not
affected
If bit = 1, associated
button’s LED follows
this button’s LED
D4 ⇒ D14 Unused
D2 0x03 Set LED- D3 0x00 ⇒ 0xFF
Off Mask for Button If bit = 0, associated
button’ LED is not
affected
If bit = 1, associated
button’s LED turns off
when this button is
pushed
D4 ⇒ D14 Unused
D2 0x04 Set X10 D3 0x00 ⇒ 0xFF
Address for Button X10 House Code
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
D4 0x00 ⇒ 0xFF
X10 Unit Code
D5 ⇒ D14 Unused
D2 0x05 Set Ramp D3 0x00 ⇒ 0x1F
Rate for Button Ramp Rate (0.1
second to 9 minutes)
D4 ⇒ D14 Unused
D2 0x06 Set On- D3 0x00 ⇒ 0xFF On-
Level for Button Level
D4 ⇒ D14 Unused
D2 0x07 Set Global D3 0x11 ⇒ 0x7F
LED Brightness Brightness for all
(ignores D1) LEDs when on
D4 ⇒ D14 Unused
D2 0x08 Set Non- D3 0x00 ⇒ 0x01
toggle State for 0 = Button is Toggle
Button 1 = Button is Non-
toggle
D4 ⇒ D14 Unused
D2 0x09 Set LED D3 0x00 ⇒ 0x01
State for Button 0 = Turn button’s LED
Off
1 = Turn button’s LED
On
D4 ⇒ D14 Unused
D2 0x0A Set X10 D3 0x00 ⇒ 0x01
All-On State for 0 = Button sends X10
Button On/Off
1 = Button sends X10
All-On/All-Off
D4 ⇒ D14 Unused
D2 0x0B Set Non- D3 0x00 ⇒ 0x01
toggle On/Off State 0 = If Non-toggle,
for Button Button sends Off
Command
1 = If Non-toggle,
Button sends On
Command
D4 ⇒ D14 Unused
D2 0x0C Set D3 0x00 ⇒ 0x01
Trigger-ALL-Link 0 = Button sends
State for Button normal Command
1 = Button sends ED
0x30 Trigger ALL-
Link Command to first
device in ALDB
D4 ⇒ D14 Unused
D2 0x0D ⇒ 0xFF Unused
Extended Set/Get 0x02 All 0x2E 0x00 D1 0x00 ⇒ 0xFF Button/Group Number
But D2 0x00 Data D3 ⇒ D14 Unused
0x0F Request
[Addressee
responds with Data
Response]
D2 0x01 Data D3 Unused
Response D4 Unused
[Response to Data
D5 0x00 ⇒ 0x0F X10
Request]
House Code
(0x20 = none)
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Address is
automatically
decremented by 8
for each record
returned.
D2 0x02 Write D3 0x00 ⇒ 0xFF
ALDB Record Address High Byte
D4 0x00 ⇒ 0xFF
Address Low Byte
D5 0x01 ⇒ 0x08
Number of Bytes
(0x09 ⇒ 0xFF is the
same as 0x08)
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
D6 ⇒ D13
0x00 ⇒ 0xFF 8-byte
Record to Write
D14 Unused
D2 0x03 ⇒ 0xFF Unused
Reserved 0x2F 0x01 ⇒ 0xFF
Trigger ALL-Link 0x01 0x01 0x30 0x00 D1 0x00 ⇒ 0xFF Button/Group Number
Command 0x04 D2 On-Level Switch
0x09 0x00 Use On-Level stored in ALDB
(SmartLabs 2476D 0x0A 0x01 Use On-Level in D3
SwitchLinc i2 Dimmer 0x02 ⇒ 0xFF Unused
600 W, 2476DH
SwitchLinc i2 Dimmer D3 0x00 ⇒ 0xFF On-Level if D2 = 0x01
1000 W, 2486D D4 0x00 ⇒ 0xFF SA Command 1 to send
KeypadLinc Dimmer, D5 0x00 ⇒ 0xFF SA Command 2 to send
2886D Icon In-Wall D6 Ramp Rate Switch
Controller) 0x00 Use Ramp Rate stored in ALDB
0x01 Use instant Ramp Rate
0x02 ⇒ 0xFF Unused
D7 ⇒ D14 Unused
Trigger ALL-Link 0x02 0x0A 0x30 0x00 D1 0x00 ⇒ 0xFF Button/Group Number
Command 0x0F D2 On-Level Switch
0x00 Use On-Level stored in ALDB
(SmartLabs 2476S 0x01 Use On-Level in D3
SwitchLinc i2 Relay, 0x02 ⇒ 0xFF Unused
2486S KeypadLinc
Relay) D3 0x00 ⇒ 0xFF On-Level if D2 = 0x01
D4 0x00 ⇒ 0xFF SA Command 1 to send
D5 0x00 ⇒ 0xFF SA Command 2 to send
D6 Ramp Rate Switch
0x00 Use Ramp Rate stored in ALDB
0x01 Use instant Ramp Rate
0x02 ⇒ 0xFF Unused
D7 ⇒ D14 Unused
Reserved 0x31
⇒
0x3F
Set Sprinkler Program 0x04 All 0x40 0x00 ⇒ 0xFF Program D1 to D14 contain program data to set
Number
(0x00 is Default Program)
Sprinkler Get Program 0x04 All 0x41 0x00 ⇒ 0xFF Program Added 5/05/06
Response Number D1 to D14 contain program data
[Response to SD (0x00 is Default Program)
0x45xx Sprinkler Get
Program Request]
Reserved 0x42
⇒
0x4A
I/O Set Sensor 0x07 All 0x4B 0x00 ⇒ 0xFF Sensor Number D1 0x00 ⇒ 0xFF Sensor Nominal Value
Nominal D2 ⇒ D14 Unused
I/O Alarm Data 0x07 All 0x4C 0x00 D1 ⇒ D14 Alarm 1-14 Data
Response
[Response to SD
0x4700 I/O Alarm
Data Request]
Reserved 0x4C 0x01 ⇒ 0xFF
Reserved 0x4D
⇒
0x4F
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SA Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SA Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ALL-Link Alias 2 Low All All 0x14 0x00 for initial SA Broadcast, Ignore Command unless, if previously set
0x00 ⇒ 0xFF (Group Number) up by default or by using ED 0x0304 Set
(Used as Light OFF for SC Cleanups ALL-Link Command Alias, then execute
Fast by legacy substitute Direct Command.
controllers)
For DevCats 0X01 and 0x02, defaults to
SD 0x1400 Light OFF Fast, which goes full
off instantly.
ALL-Link Alias 3 High All All 0x15 0x00 for initial SA Broadcast, Ignore Command unless, if previously set
0x00 ⇒ 0xFF (Group Number) up by default or by using ED 0x0304 Set
(Used as Light for SC Cleanups ALL-Link Command Alias, then execute
Brighten One Step by substitute Direct Command.
legacy controllers)
For DevCats 0X01 and 0x02, defaults to
SD 0x1500 Light Brighten One Step. There
are 32 steps from off to full brightness.
ALL-Link Alias 3 Low All All 0x16 0x00 for initial SA Broadcast, Ignore Command unless, if previously set
0x00 ⇒ 0xFF (Group Number) up by default or by using ED 0x0304 Set
(Used as Light Dim by for SC Cleanups ALL-Link Command Alias, then execute
legacy controllers) substitute Direct Command.
SA Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ALL-Link Alias 5 All All 0x21 0x00 for initial SA Broadcast, Ignore Command unless, if previously set
0x00 ⇒ 0xFF (Group Number) up by default or by using ED 0x0304 Set
for SC Cleanups ALL-Link Command Alias, then execute
substitute Direct Command.
EA Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SB Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Reserved 0x00
SET Button Pressed All All 0x01 Reserved Req-Ex (Required for Responder-only or
Responder (Set to 0xFF) Controller/Responder devices)
Possible Linking Mode for a Responder or
Controller/Responder device.
Every INSTEON device must send either
SB 0x01 or SB 0x02
SET Button Pressed All All 0x02 Reserved Req-Ex (Required for Controller-only
Controller (Set to 0xFF) devices)
Possible Linking Mode for a Controller-only
device.
Every INSTEON device must send either
SB 0x01 or SB 0x02
Test Powerline Phase All All 0x03 0x00 Sender is on powerline phase A (low cycle).
(Only sent by i2/RF Receiver blinks LED fast for 10 seconds if
devices, with Max on same phase.
Hops = 0) Receiver blinks LED slow for 10 seconds if
on opposite phase.
0x01 Sender is on powerline phase B (high
cycle).
Receiver blinks LED fast for 10 seconds if
on same phase.
Receiver blinks LED slow for 10 seconds if
on opposite phase.
Reserved 0x03 0x03 ⇒ 0xFF
Heartbeat 0x00 0x05 0x04 0x00 ⇒ 0xFF Battery Level Req-DC
Periodic broadcast set up using ED 0x2E
(SmartLabs 2843 Extended Set/Get
RemoteLinc)
Reserved 0x05
⇒
0x26
Device Status All All 0x27 Reserved Sent by a device when its status changes
Changed (Set to 0xFF)
SB Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Reserved 0x28
⇒
0x48
SALad Debug All All 0x49 0x00 ⇒ 0xFF Not Parsed Req-Ex (Only required for SALad-enabled
Report devices)
The two low bytes of the To Address
contain the high and low bytes of the
Program Counter for a SALad program
being remotely debugged.
Reserved 0x4A
⇒
0xFF
EB Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Reserved 0x00
⇒
0xFF
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Assign to ALL-Link All All 0x01 0x00 ⇒ 0xFF Group Number Req-All
Group Used during INSTEON device linking
session.
Delete from ALL- All All 0x02 0x00 ⇒ 0xFF Group Number Req-All
Link Group Used during unlinking session.
Product Data All All 0x03 0x00 Req-All, Req-Ex (Required after 2/1/07)
Request Addressee responds with an ED 0x0300
Product Data Response message
Enter Linking Mode All All 0x09 0x00 ⇒ 0xFF Group Number Req-All
Same as holding down SET Button for 10
seconds
NOTE: Not supported by i1 devices
Enter Unlinking All All 0x0A 0x00 ⇒ 0xFF Group Number Req-All
Mode NOTE: Not supported by i1 devices
Get INSTEON Engine All All 0x0D 0x00 Req-All
Version Returned ACK message will contain the
INSTEON Engine Version in Command 2.
0x00 = i1 (default echo for legacy devices)
0x01 = i2
Ping All All 0x0F 0x00 Req-All
(0x01 ⇒ 0xFF Not Parsed in Addressee returns an ACK message but
legacy devices. Use only 0x00 performs no operation.
in the future.)
ID Request All All 0x10 0x00 Req-All
(0x01 ⇒ 0xFF Not Parsed in Addressee first returns an ACK message,
legacy devices. Use only 0x00 then it sends an SB 0x01 SET Button
in the future.) Pressed Responder or SB 0x02 SET
Button Pressed Controller Broadcast
message, but it does not enter Linking
Mode.
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
Product Data All All 0x03 0x00 Req-All, Req-Ex (Required after 2/1/07)
Response D1 0x00 Reserved (always set to 0x00)
[Response to SD
D2 0x00 ⇒ 0xFF
0x0300 Product Data
INSTEON Product Key MSB
Address is
automatically
decremented by 8
for each record
returned.
D2 0x02 Write D3 0x00 ⇒ 0xFF
ALDB Record Address High Byte
D4 0x00 ⇒ 0xFF
Address Low Byte
D5 0x01 ⇒ 0x08
Number of Bytes
(0x09 ⇒ 0xFF is the
same as 0x08)
D6 ⇒ D13
0x00 ⇒ 0xFF 8-byte
Record to Write
D14 Unused
D2 0x03 ⇒ 0xFF Unused
SA Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
ALL-Link Recall All All 0x11 0x00 for initial SA Broadcast, Req-All
0x00 ⇒ 0xFF (Group Number) Responder reverts to state remembered
(Used as ALL-Link for SC Cleanups during ALL-Linking.
Light ON by legacy
controllers)
SB Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SET Button Pressed All All 0x01 Reserved Req-Ex (Required for Responder-only or
Responder (Set to 0xFF) Controller/Responder devices)
Possible Linking Mode for a Responder or
Controller/Responder device.
Every INSTEON device must send either
SB 0x01 or SB 0x02
SET Button Pressed All All 0x02 Reserved Req-Ex (Required for Controller-only
Controller (Set to 0xFF) devices)
Possible Linking Mode for a Controller-only
device.
Every INSTEON device must send either
SB 0x01 or SB 0x02
Note that the SET Button Pressed Responder and SET Button Pressed Controller SB
Commands are included in this table because one or the other, or possibly both
Commands must be supported by all INSTEON devices.
SD Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
FX Username All All 0x03 0x01 Req-Ex (Only required for devices that
Request support FX Commands) , FX
Addressee responds with an ED 0x0301
FX Username Response message
ED Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SB Commands
Dev Sub Cmd Cmd 2 Note Keys, Description
Cat Cat 1
SALad Debug Report All All 0x49 0x00 ⇒ 0xFF Not Parsed Req-Ex (Only required for SALad-enabled
devices)
The two low bytes of the To Address
contain the high and low bytes of the
Program Counter for a SALad program
being remotely debugged.
ICDB Records
Queries to the ICDB will return XML files. The XML schema is not yet defined, but
some fields could be:
• Text name of the Command
• Button label for the Command
• INSTEON Products (given by the INSTEON Product Key) that use the
Command
• Allowed Command parameters
• Reply expected
To peek or poke remote memory data, first use the SD 0x28 Set Address MSB
Command to set the high byte of the 16-bit address you want to read from or write
to. You will set the LSB of the address differently depending on what you will be
doing next. If you are going to Poke One Byte or Poke One Byte Internal, you first
have to execute a Peek One Byte Command to set the address LSB. In the other
cases, Peek One Byte and Peek One Byte Internal, you will set the LSB in the
Command itself. Note that the address LSB does not auto-increment.
To peek one byte of data, use Peek One Byte or Peek One Byte Internal. The SD
Acknowledgement message that you receive back will contain the peeked byte in the
Command 2 field.
To poke one byte of data, use Poke One Byte or Poke One Byte Internal. Remember
to set the address you want to poke to by using a Set Address MSB Command
followed by a Peek One Byte Command. The Command 2 field of the SD
August 16, 2007 © 2005-2007 SmartLabs Technology
Dev Guide, Chapter 8 Page 163
Acknowledgement message that you receive back will contain the value of the byte
you are poking before it was altered by the poke.
Peek an On-Level
PLC Sends LampLinc Responds
In This Chapter
IBIOS Flat Memory Model167
Describes how physical memory is mapped into a single 16-bit address space and
gives a table of all important memory locations.
IBIOS Events185
Lists the Events that IBIOS generates and explains how they work.
IBIOS Serial Communication Protocol and Settings192
Describes the serial communication protocol, the port settings for an RS232 link,
and how to use a USB link.
IBIOS Serial Commands196
Lists and describes the IBIOS Serial Commands, and gives usage examples.
IBIOS INSTEON Engine211
Discusses the functionality of the INSTEON Engine.
IBIOS Software Realtime Clock/Calendar212
Describes how to use the software realtime clock/calendar.
IBIOS X10 Signaling213
Explains usage of the X10 powerline interface.
IBIOS Input/Output214
Gives details on the Pushbutton input and LED flasher.
IBIOS Remote Debugging215
Describes how SALad programs can be remotely debugged using IBIOS.
IBIOS Watchdog Timer216
Describes how the watchdog timer works.
August 16, 2007 © 2005-2007 SmartLabs Technology
Dev Guide, Chapter 9 Page 167
In This Section
Flat Memory Addressing168
Describes how the various physical memory regions are mapped into one 16-bit
address space, and how I2C addressing works.
Flat Memory Map170
Gives a table of all important IBIOS memory locations.
I2C_Addr Register
I2C_Addr Register
Bit Meaning
7 (MSb) Top nibble of I2C Address burned into I2C chip by manufacturer.
1 3rd of 3 chip-select pins must be tied low in hardware design, so that IBIOS can use this bit as
follows:
0 = I2C chip uses 8-bit addressing (e.g. realtime clock chip).
1 = I2C chip uses 16-bit addressing (e.g. serial EEPROM).
0 (LSb) Defined by I2C spec as Read/Write bit, but used by IBIOS as follows:
0 = bottom 32K of I2C chip is mapped to top 32K of flat memory.
1 = top 32K of I2C chip is mapped to top 32K of flat memory.
0x0033 NTL_BUFFER Pointer to end of Timer Buffer, which begins at 0x0046. This
8-bit pointer defaults to 0x4D to allow room for 4 timers which
are 2 bytes each.
NOTE: The following serial receive buffer only exists for devices with serial communications
_RF_Disable 1 1=Disables RF
NOTE: The following locations are the same with or without an RX_Buffer
0 1 Animation (Trace)
1 0 Execution halted
0x0166 LED_DLY Period between each flash. Defaults to 5, which is 1/8 second
per bit in LED_MODE.
_RS_ComReset 7 These are used for serial command time limit. This limits how
long a command remains active in SALad. This prevents the
_RS_ComLimit2 6 serial engine from locking you out if SALad receives a corrupt
command (non-native serial command). Default time limit is
_RS_ComLimit1 5 two seconds. To disable, clear bits 5⇒7.
_EM_BtnTap 7 1=enabled
_EM_BtnHold 6 1=enabled
_EM_BtnRel 5 1=enabled
_EM_TickTimer 4 1=enabled
_EM_Alarm 3 1=enabled
_EM_Midnight 2 1=enabled
_EM_2AM 1 1=enabled
_EM_RX 0 1=enabled
0x017D I2C_ADDR Address of I2C device; bit 0 controls 0x8000 ⇒ 0xFFFF of flat
model, 1=hi region, 0=low region
0x01AA DB_9
_TxBroadcastBit 7 Broadcast
_TxGroup 6 ALL-Link
_TxAckBit 5 Acknowledge
_TxExtMsgBit 4 Extended
0x0230 ⇒ SALad application code for fast execution; Microcontroller Internal EEPROM
0x02FF
0x0033 NTL_BUFFER Pointer to end of Timer Buffer, which begins at 0x0046. This
8-bit pointer defaults to 0x4D to allow room for 4 timers which
are 2 bytes each.
0 1 Animation (Trace)
1 0 Execution halted
0x016A LED_DLY Period between each flash. Defaults to 5, which is 1/8 second
per bit in LED_MODE.
_RS_ComReset 7 These are used for serial command time limit. This limits how
long a command remains active in SALad. This prevents the
_RS_ComLimit2 6 serial engine from locking you out if SALad receives a corrupt
command (non-native serial command). Default time limit is
_RS_ComLimit1 5 two seconds. To disable, clear bits 5⇒7.
_EM_BtnTap 7 1=enabled
_EM_BtnHold 6 1=enabled
_EM_BtnRel 5 1=enabled
_EM_TickTimer 4 1=enabled
_EM_Alarm 3 1=enabled
_EM_Midnight 2 1=enabled
_EM_2AM 1 1=enabled
_EM_RX 0 1=enabled
0x017D I2C_ADDR Address of I2C device; bit 0 controls 0x8000 ⇒ 0xFFFF of flat
model, 1=hi region, 0=low region
0x01AA DB_9
0x01AB DB_A
_TxBroadcastBit 7 Broadcast
_TxGroup 6 ALL-Link
_TxAckBit 5 Acknowledge
_TxExtMsgBit 4 Extended
0x01DF RX_PTR Points to next open slot in serial receive buffer, if it contains
0xE8, the buffer is empty
0x0230 ⇒ SALad application code for fast execution; Microcontroller Internal EEPROM
0x02FF
IBIOS Events
IBIOS events are all Static Events. If a SALad application is present, all of these
Static Events are sent to a SALad event handler, like the one in the SALad coreApp
Program272, which comes pre-installed in The SmartLabs PowerLinc Controller28. In
fact, some of these events, such as receiving INSTEON or X10 messages, require
SALad handling in order to guarantee realtime processing. Timer Events also occur,
but these must be handled by a SALad application, so they are documented
elsewhere (see SALad Timers273).
Whenever an IBIOS Event occurs (assuming you have not disabled event reporting),
IBIOS will notify your PC by sending an Event Report (0x45) IBIOS Serial Command.
See the IBIOS Serial Command Summary Table197 for more information about event
reporting.
You can force an event to fire under program control by sending a Simulated Event
IBIOS Command to the PLC. See the IBIOS Serial Command Summary Table197
below for more information, and the IBIOS Simulated Event209 section for an
example.
Eight events (0x0A through 0x11) can be prevented from occurring by clearing
individual bits in the EventMask register at 0x016F (see Flat Memory Map170).
Initialization code sets EventMask to 0xFF at power up, so all events are enabled by
default. Bit 7 (the MSb) of EventMask controls event 0x0A, down through bit 0 (the
LSb), which corresponds to event 0x11.
0x0A EVNT_BTN_TAP 7 The SET Button was tapped for the first time.
0x0C EVNT_BTN_REL 7 The SET Button is no longer being tapped or held down.
The number of taps is in the TAP_CNT register at 0x0156.
0x33 EVNT_INIT_DB_NO_CLR 12 Reinitialize RAM but do not clear the ALL-Link Database
coreApp
coreApp
When power is first applied, IBIOS runs its initialization code, then it checks for
the existence of a valid SALad application program. If there is one, IBIOS fires
this event and then starts SALad with this event in the event queue.
You can force a power-on reset in software by setting bit 7 (_Reset) of the
Control register at 0x0154 to one (see Flat Memory Map170).
2. EVNT_IRX_MYMSG (0x01), EVNT_IRX_MSG (0x02), EVNT_IRX_PKT
(0x03)
When IBIOS first receives a new INSTEON message that has not been seen
before, the message may be arriving on its first hop, or it may be arriving on a
subsequent hop, depending on the INSTEON environment. If the To Address of
this new message matches the 3-byte IBIOS ID burned in at the factory, then the
new message is to me, and an EVNT_IRX_MYMSG (0x01) event will fire. If
the new message is not to me, then an EVNT_IRX_MSG (0x02) event will fire
instead. If the new message was received before its last hop, then the same
message may be received again on subsequent hops. Whenever this happens an
EVNT_IRX_PKT (0x03) event will fire whether the duplicate message is to me
or not to me.
After any of these events fire, IBIOS will use a SALad application like the SALad
coreApp Program272 to send an INSTEON Received (0x4F) IBIOS Serial Command
(see IBIOS Serial Command Summary Table197).
3. EVNT_IRX_ACK (0x04), EVNT_IRX_NACK (0x05)
received, IBIOS will automatically retry sending the Direct message again. If
after five retries the addressee still does not respond with an Acknowledgement
message, IBIOS will fire an EVNT_IRX_NACK (0x05) event. One or the other
(but not both) of these events is guaranteed to fire after sending a Direct
message, although the EVNT_IRX_NACK (0x05) event may not fire for a long
time due to the retries.
After either of these events fires, IBIOS will use a SALad application like the
SALad coreApp Program272 to send an INSTEON Received (0x4F) IBIOS Serial
Command (see IBIOS Serial Command Summary Table197).
4. EVNT_IRX_BADID (0x06)
If the To Address of an incoming INSTEON message does not match the 3-byte
IBIOS ID burned in at the factory (i.e. the message is not to me), and the To
Address does not match any of the IDs in IBIOS’s INSTEON ALL-Link Database101,
then for security reasons, the message is censored. A censored INSTEON
message will have all of its data bytes replaced with 0xFFs, except for the low
bytes of the From Address and the To Address. See Masking Non-linked Network
Traffic112 for more information on INSTEON Security112.
After this event fires, IBIOS will use a SALad application like the SALad coreApp
Program272 to send an INSTEON Received (0x4F) IBIOS Serial Command (see
IBIOS Serial Command Summary Table197).
5. EVNT_IRX_ENROLL (0x07)
After this event fires, IBIOS will send an INSTEON Received (0x4F) IBIOS Serial
Command (see IBIOS Serial Command Summary Table197).
6. EVNT_XRX_MSG (0x08), EVNT_XRX_XMSG (0x09)
These events occur when IBIOS receives an X10 byte over the powerline. When
IBIOS receives a new X10 byte, it fires an EVNT_XRX_MSG (0x08) event. If
IBIOS determines that subsequent received X10 bytes are part of an Extended
X10 message, then it will fire an EVNT_XRX_XMSG (0x09) event for those
bytes. After IBIOS detects the end of the Extended X10 message (three 0x00
After either of these events occurs, IBIOS will use a SALad application like the
SALad coreApp Program272 to send an X10 Byte Received (0x4A) IBIOS Serial
Command (see IBIOS Serial Command Summary Table197).
7. EVNT_BTN_TAP (0x0A), EVNT_BTN_HOLD (0x0B), EVNT_BTN_REL
(0x0C)
These events fire when the SET Button is pushed in various ways. A Button Tap
occurs when the user pushes the SET Button and then lets up less than 350
milliseconds (350 ms) later. A Button Hold occurs when the user pushes the SET
Button and then lets up more than 350 ms later.
The first time IBIOS detects a Button Tap, it fires an EVNT_BTN_TAP (0x0A)
event. If there are more Button Taps following the first one, with less than 350
ms between each one, then IBIOS does not fire an event, but it does count the
number of Button Taps. When more than 350 ms elapses after a Button Tap,
IBIOS fires an EVNT_BTN_REL (0x0C) event to indicate the SET Button has
been released. At that time, you can inspect the TAP_CNT register at 0x0156
(see Flat Memory Map170) to see how many Button Taps occurred before the
release.
Note that a Button Hold can follow some number of Button Taps, in which case
events EVNT_BTN_TAP (0x0A), EVNT_BTN_HOLD (0x0B), and
EVNT_BTN_REL (0x0C) would occur in that order. Inspect TAP_CNT after the
EVNT_BTN_REL (0x0C) event to see how many Button Taps there were.
8. EVNT_TICK (0x0D), EVNT_ALARM (0x0E), EVNT_MIDNIGHT (0x0F),
EVNT_2AM (0x10)
You can use EVNT_TICK (0x0D) to measure short time intervals, ranging from
8.333 milliseconds (ms) up to 2.125 seconds. Each tick is one powerline zero
crossing, which is 1/120 second, or 8.333 ms. To cause this event to fire, load a
value from 1 to 255 into the NTL_TICK register at 0x0042 (see Flat Memory
Map170). After that number of ticks, IBIOS will fire this event one time only. You
can disable this event at any time by loading 0x00 into NTL_TICK.
Registers RTC _TIME_H and RTC _TIME_L at 0x0158 and 0x0159 contain a 16-bit
value ranging from 0 to 1439 that counts the number of minutes that has elapsed
since midnight. You can cause an EVNT_ALARM (0x0E) event to fire by loading
a valid minutes-from-midnight value into the NTL_TIME_H and NTL _TIME_H
registers at 0x0040 and 0x0041. When the value in RTC_TIME_H,L matches your
August 16, 2007 © 2005-2007 SmartLabs Technology
Dev Guide, Chapter 9 Page 190
value in NTL_TIME_H,L, IBIOS will fire EVNT_ALARM (0x0E). The value you
loaded into NTL_TIME_H,L is not altered when the event fires, so the event will
fire every day. However, if you load an invalid value (greater than 1439) into
NTL_TIME_H,L, then the event will never fire.
These events allow the number of IBIOS Serial Commands196 to be extended. All
IBIOS Serial Commands begin with 0x02, followed by the number of the
Command. If IBIOS receives a Serial Command Number outside the range 0x40
through 0x48 (see IBIOS Serial Command Summary Table197), it will fire the
EVNT_SRX_COM (0x12) event, then start a two-second timer. Thereafter,
every time IBIOS receives a serial byte, it will fire the EVNT_RX_COM (0x11)
event and restart the two-second timer. If the two-second timer expires, IBIOS
will send a serial NAK (ASCII 0x15) and stop firing EVNT_RX_COM (0x11)
events.
When you are finished parsing the incoming IBIOS Serial Command, clear the
two-second timer yourself by clearing bits 5 and 6, _RSComLimit1 and
_RSComLimit, in the RS_CONTROL register at 0x016B (see Flat Memory Map170).
If you want more time, you can get another two seconds by setting the same two
bits to one.
10. EVNT_DAUGHTER (0x13)
IBIOS fires this event when it detects that port pin RB6 on the microprocessor
went low. Normally this is caused by an attached daughter card requesting an
interrupt.
11. EVNT_LOAD_ON (0x14), EVNT_LOAD_OFF (0x15)
These events are for monitoring electrical loads connected to the INSTEON
device. They will fire in response to the state of current-sensing hardware, and
so are implementation-specific. Contact the INSTEON Developer’s Forum or
email [email protected] for more information.
12. EVNT_INIT_DB_CLR (0x32), EVNT_ INIT_NO_DB_CLR (0x33) [coreApp]
These events can only be fired under program control, by sending the Simulated
Event IBIOS Command to the PLC. (Send 0x02 0x47 0x32 0x00, or 0x02 0x47
0x33 0x00 respectively.) See the IBIOS Serial Command Summary Table197
below for more information.
The action of these events is similar to EVNT_INIT (0x00), except the realtime
clock is not reset.
13. EVNT_LINK (0x41) [coreApp]
This event fires when the user pushes the SET Button for 10 seconds to put the
PLC into ALL-Linking mode.
14. EVNT_MULTI_LINK (0x42) [coreApp]
This event fires when the user pushes the SET Button for 10 seconds to put the
PLC into ALL-Linking mode, and then taps the SET Button to enter multilinking
mode. Multilinking allows the user to ALL-Link more than one device without
having to push the SET Button again for 10 seconds.
15. EVNT_UNLINK (0x43) [coreApp]
This event fires when the user pushes the SET Button for 10 seconds to put the
PLC into ALL-Linking mode, and then pushes the SET Button a second time for
another 10 seconds to enter unlinking mode.
16. EVNT_MULTI_UNLINK (0x44) [coreApp]
This fires when the user pushes the SET Button for 10 seconds to put the PLC
into ALL-Linking mode, pushes the SET Button a second time for another 10
seconds to enter unlinking mode, and then taps the SET Button to enter multi-
unlinking mode. Multi-unlinking allows the user to unlink more than one device
without having to push the SET Button again for 10 seconds.
17. EVNT_END_LINK (0x45) [coreApp]
This event fires when the user taps the SET Button to end ALL-Link mode, or else
when the four-minute ALL-Link mode timer automatically terminates ALL-Link
mode.
18. EVNT_CONTINUE_LINK (0x46) [coreApp]
This event fires when the user ALL-Links to an INSTEON device while in
multilinking mode, or else when the user unlinks a device while in multi-unlinking
mode.
If IBIOS is not ready, it will respond with an echo of the 0x02 and the Serial
Command Number followed by ASCII 0x15 (NAK, Negative Acknowledge).
S: 0x02 <Command Number> <parameters>
R: 0x15 (NAK)
Data Bits 8
Parity N
Stop Bits 1
Count Data
The PLC will reply with data similar to the following (data bytes are bold; 0x80 in the
count indicates that the PLC is ready to receive more data):
HID USB 8-byte Packet
Count Data
In This Section
IBIOS Serial Command Table196
Describes all of the IBIOS Serial Commands in an IBIOS Serial Command
Summary Table197 and gives IBIOS Serial Command Details198.
IBIOS Serial Command Examples201
Gives examples of how to use the IBIOS Serial Commands.
Parameter Description
Address High (Low) MSB (LSB) of a 16-bit address
Length High (Low) MSB (LSB) of a 16-bit length of a data block
Checksum High (Low) MSB (LSB) of a 16-bit value calculated by summing all the bytes in a
data block specified in an IBIOS Serial Command, then taking the two’s
complement
Data Block of data bytes
Event Handle 8-bit number indicating the event that fired (see IBIOS Events185)
Timer Value 8-bit time value:
1 to 127 seconds, if the MSb (bit 7) is 0 (clear)
1 to 127 minutes, if the MSb (bit 7) is 1 (set)
0x40 Download 1 S: 0x02 0x40 <Address High> <Address Low> <Length High> <Length
Low> <Checksum High> <Checksum Low> <Data…>
(IBIOS
receives data R: 0x02 0x40 <Address High> <Address Low> <Length High> <Length
from you) Low> <0x06 (ACK) | 0x15 (NAK)>
0x42 Upload 1 S: 0x02 0x42 <Address High> <Address Low> <Length High> <Length
Low>
(IBIOS sends
data to you) R: 0x02 0x42 <Address High> <Address Low> <Length High> <Length
Low> <Data…> <Checksum High> <Checksum Low> 0x06
0x44 Get 3 S: 0x02 0x44 <Address High> <Address Low> <Length High> <Length
Checksum Low>
R: 0x02 0x44 <Address High> <Address Low> <Length High> <Length
Low> <Checksum High> <Checksum Low> 0x06
0x46 Mask 5 S: 0x02 0x46 <Address High> <Address Low> <OR mask> <AND
mask>
R: 0x02 0x46 <Address High> <Address Low> <OR mask> <AND
mask> 0x06
0x49 Debug 8 R: 0x02 0x49 <Next SALad instruction to execute Address High> <Next
Report SALad instruction to execute Address Low>
SALad
0x4A X10 Byte 9 R: 0x02 0x4A <0x00 (X10 Address) | 0x01 (X10 Command)> <X10
Received Byte>
SALad
You can neither read nor write the firmware in IBIOS’s EPROM. The
microprocessor’s program counter (appearing at locations 0x0002, 0x0082,
0x0102, and 0x0182) is write-protected, as is the Enrollment Timer at 0x016D.
No harm will occur if you attempt to read or write address locations where there
is no memory, but the results will be indeterminate.
After downloading, even if you receive 0x06 (ACK), you should immediately issue
a Get Checksum (0x44) Serial Command to verify that IBIOS wrote the data to
memory correctly.
If you are setting or clearing individual flag bits in a register, use the Mask
These Serial Commands require a SALad application such as the SALad coreApp
Program272 to be running. A SALad program can send up to 255 bytes of
unrestricted (ASCII or binary) data to the host using a Fixed-length Message
(0x41) Serial Command containing a length byte.
To send simple text messages without a length restriction, a SALad program can
use the Variable-length Text Message (0x43) Serial Command. This
Command does not use a length byte. Instead, it uses an ASCII 0x03 (ETX, End-
of-Text) byte to delimit the end of the ASCII text message, so the text message
must not contain an embedded ETX character before the actual end of the
message.
3. Get Checksum (0x44)
IBIOS calculates checksums by summing up all of the bytes in the given range
into a 16-bit register, then taking a two’s complement of the 16-bit sum. You
can take a two’s complement by inverting all 16 bits and then incrementing by
one, or else you can just subtract the 16-bit value from 0x0000.
4. Event Report (0x45)
IBIOS sends this Serial Command whenever one of the IBIOS Events185 given in
the IBIOS Event Summary Table185 fires.
You can prevent IBIOS from sending Event Reports by setting bit 1,
_NoEventRpt, in the Control register at 0x0154 to one (see Flat Memory Map170).
IBIOS clears this flag to zero at power up, so Event Reports are enabled by
default.
5. Mask (0x46)
Use this Serial Command to set or clear individual flag bits in a register without
affecting flags you are not changing.
To set one or more bits in a register to one, set the corresponding bits in the OR
Mask to one. Bits set to zero in the OR Mask will not change the corresponding
bits in the register.
To clear one or more bits in a register to zero, set the corresponding bits in the
AND Mask to zero. Bits set to one in the AND Mask will not change the
corresponding bits in the register.
6. Simulated Event (0x47)
You can force IBIOS to fire one of the Static Events in the IBIOS Event Summary
Table185 with this Serial Command by sending the desired <Event Handle>
number with a <Timer Value> of zero. You cannot use this Serial Command to
fire an EVNT_INIT (0x00) initialization event, but there is an alternate method
to force a power-on reset (see IBIOS Event Details187, Note 1).
IBIOS will fire Timer Events, but unless you are running a SALad program with
Timer Event handling code, nothing will happen. See SALad Timers273 for an
explanation of SALad Timer events. To simulate a Timer Event, set <Event
Handle> to the Timer Index number of the SALad handler for the timer, and set
<Timer Value> to a non-zero value denoting how much time should elapse
before the Timer Event fires. If the high bit of <Timer Value> is 0, then the time
will be 1 to 127 seconds; if the high bit is 1, then the time will be 1 to 127
minutes.
7. Get Version (0x48)
This Serial Command retrieves the 3-byte INSTEON ID number (see Device
Addresses41), a 1-byte DevCat, a 1-byte SubCat, and a 1-byte reserved field
formerly used for a Firmware Version (see INSTEON Device Categories83) that
were burned in at the factory. This information is read-only.
8. Debug Report (0x49)
You can remotely debug a SALad program with this Serial Command. This is the
underlying mechanism used by the IDE debugger described in the SALad
Integrated Development Environment User’s Guide287.
See the IBIOS Remote Debugging215 section for details on how IBIOS remote
debugging works. When remote debugging is enabled, IBIOS will use this Serial
Command to report the location of the next SALad instruction to be executed.
9. X10 Byte Received (0x4A)
This Serial Command requires a SALad application such as the SALad coreApp
Program272 to be running. After IBIOS fires an EVNT_XRX_MSG (0x08) or
EVNT_XRX_XMSG (0x09) (see IBIOS Event Details187), The SALad app will
report the received X10 byte by sending this Serial Command.
The byte following the 0x4A Command Number tells whether the received X10
byte is an X10 Address (the byte is 0x00) or X10 Command (the byte is 0x01).
If you are receiving an X10 Extended Message, then this byte is irrelevant.
This Serial Command requires a SALad application such as the SALad coreApp
Program272 to be running. After IBIOS fires any of the events 0x01 through
0x07 (see IBIOS Event Details187), The SALad app will report the INSTEON
message received by sending this Serial Command.
If the IBIOS event is 0x05 (EVNT_ITX_NACK), then IBIOS did not receive an
expected INSTEON Acknowledgement message after five retries. In that case,
this IBIOS Command will not contain an <INSTEON message (9 or 23 bytes)>
field—instead, you will only receive the three bytes 0x02 0x4F 0x05.
In This Section
IBIOS Get Version202
Get the INSTEON Address, Device Type, and Firmware Revision of the PLC.
IBIOS Read and Write Memory203
Read and write memory in the PLC based on the flat memory map.
IBIOS Get Checksum on Region of Memory204
Get the checksum over a region of PLC memory based on the flat memory map.
IBIOS Send INSTEON205
Send an INSTEON Command.
IBIOS Receive INSTEON206
Receive an INSTEON Command.
IBIOS Send X10207
Send an X10 Command.
IBIOS Simulated Event209
Fire an IBIOS Event and start the SALad Engine with the event.
Procedure
1. Send the Get Version (0x48) IBIOS Serial Command from the IBIOS Serial
Command Summary Table197:
0x02 0x48.
2. The response should be:
Procedure
1. Use the Upload (0x42) IBIOS Serial Command from the IBIOS Serial Command
Summary Table197 to read 0x0004 bytes starting at 0x0300:
You can check the response to see what the four bytes are. See the IBIOS Serial
Command Summary Table197 for the response syntax.
2. Now use Download (0x40) to write 0x55 0xAA 0x55 0xAA into those
locations:
0x02 0x40 0x03 0x00 0x00 0x04 0xFD 0xFB 0x55 0xAA 0x55 0xAA.
It is not mandatory that you include a valid checksum (here 0xFDFB), but it is
strongly recommended, because you can then use a Get Checksum (0x44)
IBIOS Serial Command to be sure the data was properly written, without having
to read all of the data back.
Note that the response merely echoes the first 6 bytes of the received Command,
followed by an ASCII 0x06 (ACK) indicating that the Command was properly
received. The ACK does not indicate that the Command executed properly.
3. Now read out the four bytes at 0x0300 again as in Step 1:
Check that the response contains the 0x55 0xAA 0x55 0xAA data. For further
validation, you can also verify that the checksum in the response matches a
checksum that you compute over the received data.
Procedure
1. Use the Get Checksum (0x44) IBIOS Serial Command from the IBIOS Serial
Command Summary Table197 to get the checksum on the region starting at
0x0230 and extending 0x000a bytes:
0x02 0x44 0x02 0x30 0x00 0xA0 <checksum MSB> <checksum LSB> 0x06.
Procedure
1. Use the Download (0x40) IBIOS Serial Command from the IBIOS Serial
Command Summary Table197 to load this 6-byte INSTEON message starting with
the To Address field
into the PLC’s Construction Buffer starting at the To Address field at location
0x1A4 (see Flat Memory Map170). NOTE: Although the Construction Buffer starts
at 0x1A1, the first three bytes are the From Address, which the INSTEON Engine
automatically fills in during sends.
The fully formed Download (0x40) IBIOS Serial Command, with the embedded
INSTEON message in bold, is:
0x02 0x40 0x01 0xA4 0x00 0x06 0xFD 0x88 0x00 0x02 0xAC 0x0F 0x11
0xFF.
The returned serial message should be an echo of the first 6 bytes of the Serial
Command followed by an ASCII 0x06 (ACK), like this:
Procedure
1. When an INSTEON message is received, coreApp (and all applications built upon
it) will send the message data to your PC using the following format:
Procedure
1. Use the Download (0x40) IBIOS Serial Command from the IBIOS Serial
Command Summary Table197 to load an X10 A1 address (0x66) into the X10
transmit buffer X10_TX at 0x0165 (i1 Engine, shown here) or 0x01EE (i2 Engine)
(see Flat Memory Map170) by sending:
then check for the ASCII 0x06 (ACK) at the end of the echoed response:
then check for the ASCII 0x06 (ACK) at the end of the echoed response:
Procedure
1. Using the SALad IDE, download the following SALad application into the
PowerLinc V2 Controller (iPLC_Map.sal has the definitions and equates for the
Flat Memory Map170, and Event.sal has equates for the IBIOS Events185):
INCLUDE "iPLC_Map.sal"
INCLUDE "Event.sal"
; API Macro Definitions
DEFINE API DATA 0x04
DEFINE SendString API 0x86 ; send a null terminated string
DEFINE SendByte API 0x44
; application header
ORG 0x210
DATA 0x02 0x10 ; start at 0x0210
DATA 0x00 0x01 ; length 1
DATA 0x00 0x00 ; checksum 0 (no verification)
; entry point for timers
ORG 0x230
END ; just exit if timer
; entry point for static events
ORG 0x237
COMP= #EVNT_INIT, NTL_EVENT, ButtonEvent ; if initialization
MOVE$ #0x00, NTL_TIMERS, 0x2D ; clear out NTL_TIMERS
ButtonEvent
COMP= #EVNT_BTN_TAP, NTL_EVENT, Exit ; check for button tap
SendString strButtonMessage
Exit
END
strButtonMessage
DATA "Button tap detected", 0x0d, 0x0a, 0x00
2. Tap the SET Button on the PLC and you should see the message ‘Button tap
detected’ displayed in the IDE’s Comm Window – ASCII Window322.
3. Now send the Simulated Event serial Command from the IBIOS Serial
Command Summary Table197 to fire the EVNT_BTN_TAP (0x0A) IBIOS Event:
You should see the same ‘Button tap detected’ message displayed in the IDE’s
ASCII Window.
When you set the software RTC, you should also set the RTC_TIME_H,L minutes-
from-midnight value, because IBIOS will only set it by zeroing it at the next
midnight.
The software RTC handles leap year, but it does not handle daylight-savings time.
CoreApp, however, does handle daylight savings.
To send an X10 byte, place it in the X10_TX buffer, set or clear _X10_TXCOMMAND
to show whether it is an X10 Command or X10 Address, then set the _X10_RTS flag.
To see if there is a new received X10 byte in the X10_TX buffer, inspect the
_X10_VALID flag, or just wait for an EVNT_XRX_MSG (0x08) or
EVNT_XRX_XMSG (0x09) IBIOS Event. Look at _X10_RXCOMMAND to see if the
received byte is an X10 Command or X10 Address, and look at _X10_EXTENDED to
see if it is part of an X10 Extended message.
IBIOS Input/Output
IBIOS I/O drivers are limited to an IBIOS LED Flasher214 and an IBIOS SET Button
Handler214.
0x016A 0x0166 LED_DLY Period between each flash. Defaults to 5, which is 1/8
second per bit in LED_MODE.
LED_MODE is a bitmap that defines 8 on or off periods for the LED, and LED_DLY
defines how fast the bits are shifted to flash the LED. The default LED_DLY value is
5, which is 1/8 second per bit. Larger values will slow down the flashing.
To flash the LED, load the number of seconds that you want it to flash into LED_TMR.
For example, to flash the LED on and off at half-second intervals for three seconds,
load 0xF0 into LED_MODE and then load 0x03 into LED_TMR.
Three flags in the NTL_CONTROL register at 0x0076 (see Flat Memory Map170)
control IBIOS remote debugging. These flags are bit 7, (_RD_STEP), bit 6
(_RD_HALT), and bit 5 (_RD_BREAK). A 16-bit address for breakpoints or range
checking can be set in the RD_H and RD_L registers at 0x0026.
i1 Addr i2 Addr Register and Bits Description
0 1 Animation (Trace)
1 0 Execution halted
To run a SALad program normally, clear both _RD_HALT and _RD_STEP. This is the
default at power up.
To halt a SALad program as soon as possible, set _RD_HALT and clear _RD_STEP.
Execution will stop after the current instruction executes and a Debug Report
(0x49) IBIOS Serial Command will report the address of the next instruction to be
executed.
To send a Debug Report before every instruction executes, clear _RD_HALT and set
_RD_STEP.
To single-step through a SALad program, set both _RD_HALT and _RD_STEP. This
will cause the next instruction to execute followed by an immediate halt. The halt
will cause a Debug Report to be sent.
To do range checking or to set a breakpoint, load a comparison address into the
RD_H and RD_L registers. If RH_H contains 0x00 (the default power-up condition),
range checking and breakpoints are disabled.
Clear the _RD_BREAK flag to use the comparison address for range checking or else
set _RD_BREAK to use the comparison address as a breakpoint.
If you are range checking and program execution is attempted at a location greater
than the comparison address, execution will be halted, a Debug Report will be sent,
and the IBIOS Watchdog Timer216 will cause a power-on reset.
If you are using the comparison register for a breakpoint, execution will halt only if
the beginning of the next instruction exactly matches the comparison address.
You can also do remote debugging over the INSTEON network alone by setting the
flag _I_DebugRpt (bit 6) in the I_Control register at 0x0142. This flag is cleared at
power up. When the _I_DebugRpt flag is set, every time a Debug Report (0x49)
IBIOS Serial Command would be sent over a serial connection, a Debug Report
(0x49) INSTEON SB Command from the table of INSTEON Standard-length
Broadcast Commands155 will be sent in an INSTEON Broadcast message. You can
use INSTEON SD Peek and Poke Commands from the table of INSTEON Standard-
length Direct Commands125 to set the comparison address and the debugging control
flags in the remote INSTEON device.
In This Chapter
IM Serial Communication Protocol and Settings218
Describes the serial communication protocol, the port settings for an RS232 link,
and a recommended terminal program.
IM Power-up and Reset States221
Explains what happens when you power up the IM or reset it.
IM Serial Commands222
Lists the IM Serial Commands and describes what they do, in a single table and
individual charts grouped by functionality.
If the IM is not ready, it will respond with an echo of the 0x02 and the IM Command
Number followed by ASCII 0x15 (NAK, Negative Acknowledge).
S: 0x02 <Command Number> <parameters>
R: 0x15 (NAK)
Data Bits 8
Parity N
Stop Bits 1
There is no flow control when the IM sends data to the host—the IM will transfer data
to the host as fast as it can send it.
IM Power-up Behavior
The table below shows the state of the IM when it powers up. Holding down the SET
Button while powering up will cause a factory reset.
LED on steadily The IM detected an external EEPROM (up to 32 KB) for storage of database
links.
LED blinks six times The IM did not detect an external EEPROM, so it will use the internal EEPROM in
the processor chip. A maximum of 31 ALL-Links are permitted. An attempt to
add a 32nd ALL-Link will result in the 31st being erased.
LED off The user pressed and held the IM’s SET button for 10 seconds while powering
up, causing the IM to perform a factory reset and go into the IM Factory Reset
State221. At the conclusion of the reset, the IM’s LED will give one of the two
indications above. You will also receive a User Reset Detected253 message from
the IM.
IM Serial Commands
The IM Serial Command set is a simple but complete interface between a host
application and an INSTEON network. For example, a microcontroller in a
thermostat could use an INSTEON Powerline Modem to send and receive messages
to other INSTEON or X10 devices on the home’s powerline.
IM Serial Commands are similar to the IBIOS Serial Commands196 in both format and
functionality.
In this section, the IM Serial Commands are presented twice, once in the same table
format used for the IBIOS Serial Commands196, and again as a series of charts
grouped by functionality.
In This Section
IM Serial Command Summary Table223
Describes all of the IM Serial Commands in table form ordered by Command
Number.
IM Serial Command Charts227
Describes all of the IM Serial Commands using individual charts for each
Command, grouped by functionality.
R: 0x02 0x64
<0x00 (IM is Responder) | 0x01 (IM is Controller) |
0x03 (IM is either) | 0xFF (Link Deleted)>
<ALL-Link Group>
<0x06>
0x65 Cancel ALL-Linking244 S: 0x02 0x65
R: 0x02 0x65
<0x06>
0x66 Set Host Device S: 0x02 0x66
Category258 <Device Category> <Device Subcategory> <0xFF | Firmware Revision>
R: 0x02 0x66
<Device Category> <Device Subcategory> <0xFF | Firmware Revision>
<0x06>
0x67 Reset the IM252 S: 0x02 0x67
R: 0x02 0x67
<0x06>
0x68 Set INSTEON ACK S: 0x02 0x68
Message Byte234 <Command 2 Data>
R: 0x02 0x68
<Command 2 Data>
<0x06>
0x69 Get First ALL-Link S: 0x02 0x69
Record246 R: 0x02 0x69
<0x06>
0x6A Get Next ALL-Link S: 0x02 0x6A
Record247 R: 0x02 0x6A
<0x06>
0x6B Set IM Configuration255 S: 0x02 0x6B
<IM Configuration Flags>
R: 0x02 0x6B
<IM Configuration Flags>
<0x06>
0x6C Get ALL-Link Record for S: 0x02 0x6C
Sender248 R: 0x02 0x6C
<0x06>
0x6D LED On261 S: 0x02 0x6D
R: 0x02 0x6D
<0x06>
0x6E LED Off262 S: 0x02 0x6E
R: 0x02 0x6E
<0x06>
0x6F Manage ALL-Link S: 0x02 0x6F
Record250 <Control Flags>
<ALL-Link Record Flags>
<ALL-Link Group>
<ID high byte> <ID middle byte> <ID low byte>
<Link Data 1> <Link Data 2> <Link Data 3>
R: 0x02 0x6F
<Control Flags>
<ALL-Link Record Flags>
<ALL-Link Group>
<ID high byte> <ID middle byte> <ID low byte>
<Link Data 1> <Link Data 2> <Link Data 3>
<0x06>
0x70 Set INSTEON NAK S: 0x02 0x70
Message Byte236 <Command 2 Data>
R: 0x02 0x70
<Command 2 Data>
<0x06>
0x71 Set INSTEON ACK S: 0x02 0x71
Message Two Bytes235 <Command 1 Data>
<Command 2 Data>
R: 0x02 0x71
<Command 1 Data>
<Command 2 Data>
<0x06>
0x72 RF Sleep259 S: 0x02 0x72
R: 0x02 0x72
<0x06>
0x73 Get IM Configuration255 S: 0x02 0x73
R: 0x02 0x73
<IM Configuration Flags>
<Spare 1>
<Spare 2>
<0x06>
In This Section
INSTEON Message Handling228
Commands for sending and receiving INSTEON messages.
X10 Message Handling237
Commands for sending and receiving X10 messages.
INSTEON ALL-Link Commands239
Commands for sending ALL-Link Commands with automatic handling of ALL-Link
Cleanup Commands.
ALL-Linking Session Management243
Commands for creating ALL-Links between an IM and other INSTEON devices.
ALL-Link Database Management246
Commands for managing ALL-Link Records in the IM’s ALL-Link Database.
IM Status Management252
Commands for resetting and configuring the IM.
IM Input/Output260
Commands for managing the IM’s SET Button and LED.
Notes
The From Address is not required because the IM will automatically insert its own INSTEON ID into the
message.
For more information on INSTEON Commands and the latest Command set, please download the current
INSTEON Command Tables Document9 from www.insteon.net.
Notes
The From Address is not required because the IM will automatically insert its own INSTEON ID into the
message.
For more information on INSTEON Commands and the latest Command set, please download the current
INSTEON Command Tables Document9 from www.insteon.net.
Notes
This is the same as IM 0x51 INSTEON Extended Message Received232, except that there is no <User
Data>.
Normally, the IM will only send the host INSTEON messages that are explicitly addressed to the IM or that
are from devices that the IM is ALL-Linked to. This behavior can be modified—see the About Monitor
Mode256 note in the Set IM Configuration255 chart for more information.
For more information on INSTEON Commands and the latest Command set, please download the current
INSTEON Command Tables Document9 from www.insteon.net.
Notes
This is the same as IM 0x50 INSTEON Standard Message Received231, except that there are 14 bytes of
<User Data>.
Normally, the IM will only send the host INSTEON messages that are explicitly addressed to the IM or that
are from devices that the IM is ALL-Linked to. This behavior can be modified—see the About Monitor
Mode256 note in the Set IM Configuration255 chart for more information.
For more information on INSTEON Commands and the latest Command set, please download the current
INSTEON Command Tables Document9 from www.insteon.net.
Notes
You have only about 15 milliseconds after the receipt of an INSTEON Direct message from the IM to send
this Command to the IM. The reason is that the INSTEON Engine in the IM automatically sends
Acknowledgement messages in assigned timeslots.
Use Set INSTEON ACK Message Two Bytes235 when you need to return two bytes of data in an ACK
message.
Use Set INSTEON NAK Message Byte236 when you need to return one byte of data in a NAK message.
Certain INSTEON Direct Commands require returned data in the Acknowledgement message. For more
information on INSTEON Commands and the latest Command set, please download the current INSTEON
Command Tables Document9 from www.insteon.net.
Notes
You have only about 15 milliseconds after the receipt of an INSTEON Direct message from the IM to send
this Command to the IM. The reason is that the INSTEON Engine in the IM automatically sends
Acknowledgement messages in assigned timeslots.
Use Set INSTEON ACK Message Byte234 when you only need to return one byte of data in an ACK
message.
Use Set INSTEON NAK Message Byte236 when you need to return one byte of data in a NAK message.
Certain INSTEON Direct Commands require returned data in the Acknowledgement message. For more
information on INSTEON Commands and the latest Command set, please download the current INSTEON
Command Tables Document9 from www.insteon.net.
Notes
You have only about 15 milliseconds after the receipt of an INSTEON Direct message from the IM to send
this Command to the IM. The reason is that the INSTEON Engine in the IM automatically sends
Acknowledgement messages in assigned timeslots.
Use Set INSTEON ACK Message Byte234 or Set INSTEON ACK Message Two Bytes235 when you need to
return one or two bytes of data in an ACK message.
NAK messages report certain error conditions in a receiving device. See NAK Error Codes119 for more
information.
X10 Received
X10 Received (0x52)
What it does Informs you of an X10 byte detected on the powerline.
When you’ll get this Any X10 traffic is detected on the powerline.
What you’ll get 4 bytes.
LED indication The LED will blink during X10 reception.
Related Commands IM 0x63 Send X10237
IM 0x50 INSTEON Standard Message Received231
IM 0x51 INSTEON Extended Message Received232
Notes
The IM automatically sends ALL-Link Cleanup messages to each member of an ALL-Link Group following
an ALL-Link Broadcast message. If the IM detects other INSTEON traffic during this process, it will abort
the ALL-Link Cleanup sequence and send you an ALL-Link Cleanup Status Report242 with a Status Byte of
0x15 (NAK). The Cleanup sequence proceeds in the order in which the devices in the ALL-Link Group
were added to the ALL-Link Database. If the IM finishes sending all of the Cleanup messages, it will send
you an ALL-Link Cleanup Status Report242 with a Status Byte of 0x06 (ACK).
For each ALL-Link Cleanup message that the IM sends, you will either receive an INSTEON Standard
Message Received231 when the Responder answers with a Cleanup acknowledgement message, or else you
will receive an ALL-Link Cleanup Failure Report241 if the Responder fails to answer with a Cleanup
acknowledgement message. The IM will send you an ALL-Link Cleanup Status Report242 whether or not
every ALL-Link Group member acknowledges the Cleanup Command that the IM sends to it.
You can cause the IM to cancel its own Cleanup sequence by sending it a new Send ALL-Link Command239
or Send INSTEON Standard or Extended Message228 during the time that it is sending a Cleanup sequence
(i.e. after it has finished sending an ALL-Link Broadcast message). The IM will send you an ALL-Link
Cleanup Status Report242 in those cases.
The IM first sends an ALL-Link Broadcast message with Max Hops set to 3. When it sends the ensuing
ALL-Link Cleanup messages, it sets Max Hops to 1. If the IM’s INSTEON Engine needs to retry a Cleanup
message, it will automatically increment Max Hops for each retry, up to a maximum of value of 3.
Notes
The IM automatically sends ALL-Link Cleanup messages to each member of an ALL-Link Group following
an ALL-Link Broadcast message. If the IM detects other INSTEON traffic during this process, it will abort
the ALL-Link Cleanup sequence. If the Cleanup sequence is aborted, you will not receive this message nor
will you receive a Cleanup acknowldgement message for any subsequent devices in the ALL-Link Group.
The Cleanup sequence proceeds in the order in which the devices in the ALL-Link Group were added to the
ALL-Link Database.
For each ALL-Link Cleanup message the IM sends, you will either receive an INSTEON Standard Message
Received231 when the Responder sends you an ACK, or you will receive this message. However, it can
take awhile before you receive this message. Worst case, if the IM has to wait for a clear line and then
retries the Cleanup message for the maximum of five times, the wait will be 2.150 seconds after sending
the ALL-Link Broadcast message, or 1.550 seconds after receiving the first Cleanup acknowledgement or
this message. If the Cleanup sequence was aborted due to other INSTEON traffic, you will not get this
message even then. However, you will receive ALL-Link Cleanup Status Report242 with a Status Byte of
0x15 (NAK) indicating that the Cleanup sequence was aborted.
It is possible that this ALL-Link Group member did in fact properly receive the ALL-Link Broadcast
message that preceded the ALL-Link Cleanup message.
Notes
The IM automatically sends ALL-Link Cleanup messages to each member of an ALL-Link Group following
an ALL-Link Broadcast message. If the IM detects other INSTEON traffic during this process, it will abort
the ALL-Link Cleanup sequence and send you this message with a Status Byte of 0x15 (NAK). The
Cleanup sequence proceeds in the order in which the devices in the ALL-Link Group were added to the
ALL-Link Database. If the IM finishes sending all of the Cleanup messages, it will send you this message
with a Status Byte of 0x06 (ACK).
For each ALL-Link Cleanup message that the IM sends, you will either receive an INSTEON Standard
Message Received231 when the Responder answers with a Cleanup acknowledgement message, or else you
will receive an ALL-Link Cleanup Failure Report241 if the Responder fails to answer with a Cleanup
acknowledgement message. The IM will send you this message whether or not every ALL-Link Group
member acknowledges the Cleanup Command that the IM sends to it.
You can cause the IM to cancel its own Cleanup sequence by sending it a new Send ALL-Link Command239
or Send INSTEON Standard or Extended Message228 during the time that it is sending a Cleanup sequence
(i.e. after it has finished sending an ALL-Link Broadcast message). The IM will send you this message in
those cases.
Cancel ALL-Linking
Cancel ALL-Linking (0x65)
What it does Cancels the ALL-Linking process that was started either by holding down the
IM’s SET Button or by sending a Start ALL-Linking243 Command to the IM.
What you send 2 bytes.
What you’ll get 3 bytes.
LED indication The LED will stop blinking.
Related Commands IM 0x64 Start ALL-Linking243
IM 0x54 Button Event Report260
ALL-Linking Completed
ALL-Linking Completed (0x53)
What it does Informs you of a successful ALL-Linking procedure.
When you’ll get this An ALL-Linking procedure has been completed between the IM and either a
Controller or Responder.
What you’ll get 10 bytes.
LED indication None.
Related Commands IM 0x64 Start ALL-Linking243
IM 0x65 Cancel ALL-Linking244
Note
Use this to begin scanning the IM’s ALL-Link Database. Follow up with Get Next ALL-Link Record247
Commands until you receive a NAK.
In the IM Factory Reset State221 the ALL-Link Database will be cleared, so you will receive a NAK.
Note
Use this to continue scanning the IM’s ALL-Link Database until you receive a NAK. Begin the scan up with
a Get First ALL-Link Record246 Command.
In the IM Factory Reset State221 the ALL-Link Database will be cleared, so you will receive a NAK.
Note
If you send this after receiving an INSTEON message from an INSTEON device that is not in the IM’s ALL-
Link Database, you will receive a NAK in response.
Sending a Get Next ALL-Link Record247 Command after this will return the ALL-Link Record that follows
this one, but your actual position within the ALL-Link Database will be unknown (unless you are at the
end).
In the IM Factory Reset State221 the ALL-Link Database will be cleared, so you will receive a NAK.
Note
See the section INSTEON ALL-Link Database101 above for details about the contents of an ALL-Link Record.
Notes
See the section INSTEON ALL-Link Database101 above for details about the contents of an ALL-Link Record.
Please be aware that you can damage the IM’s ALL-Link Database if you misuse this Command. For
instance, if you use a <Control Code> of 0x20 to zero bit 1 of the <ALL-Link Record Flags> byte in the
first ALL-Link Record, the ALL-Link Database will then appear empty.
IM Status Management
Reset the IM
Reset the IM (0x67)
What it does Puts the IM into the IM Factory Reset State221, which clears the entire ALL-Link
Database.
What you send 2 bytes.
What you’ll get 3 bytes.
LED indication While the reset procedure is being processed, the Status LED will turn off. At
the conclusion of the reset procedure, the Status LED will illuminate steadily.
Related Commands IM 0x55 User Reset Detected253
Notes
The IM will send the <ACK/NAK> byte after it erases the EEPROM.
~20 seconds for models with external EEPROM
~2 seconds for models with no external EEPROM
See the IM Factory Reset State221 section for complete information on the state of the IM after sending
this Command.
Notes
The IM will send this message after it erases the EEPROM.
~20 seconds for models with external EEPROM
~2 seconds for models with no external EEPROM
See the IM Factory Reset State221 section for complete information on the state of the IM after receiving
this message.
Get IM Configuration
Get IM Configuration (0x73)
What it does Returns the IM’s Configuration Flags byte. Also returns two spare bytes of data
reserved for future use.
What you send 2 bytes.
What you’ll get 6 bytes.
LED indication None.
Related Commands IM 0x6B Set IM Configuration255
Note
Because Set IM Configuration255 sets all of the <IM Configuration Flags> at once, to change an individual
bit, first use this Command to determine the current state of all of the <IM Configuration Flags>.
Set IM Configuration
Set IM Configuration (0x6B)
What it does Allows you change operating parameters of the IM.
What you send 3 bytes.
What you’ll get 4 bytes.
LED indication None.
Related Commands IM 0x73 Get IM Configuration255
IM 0x54 Button Event Report260
IM 0x50 INSTEON Standard Message Received231
IM 0x51 INSTEON Extended Message Received232
IM 0x6D LED On261
IM 0x6E LED Off262
Notes
When the IM is in the IM Factory Reset State221, the <IM Configuration Flags> will all be set to zero.
This Command sets all of the <IM Configuration Flags> at once. To change an individual bit, first use Get
IM Configuration255 to determine the current state of all of the <IM Configuration Flags>.
Normally, the IM will only send the host an INSTEON Standard Message Received231 or INSTEON Extended
Message Received232 notification when it receives an INSTEON messages directed specifically to the IM.
There are three possibilities:
1. The IM received a Direct message with a To Address matching the IM’s INSTEON ID,
2. The IM received an ALL-Link Broadcast message sent to an ALL-Link Group that the IM belongs to
as a Responder (i.e. the message’s From Address and ALL-Link Group Number match a
Responder entry in the IM’s ALL-Link Database), or
3. The IM received an ALL-Link Cleanup message with a To Address matching the IM’s INSTEON ID
and the message’s From Address and ALL-Link Group Number match a Responder entry in the
IM’s ALL-Link Database.
In Monitor Mode, the IM will also notify the host of received INSTEON messages that contain a From
Address matching any INSTEON ID in the IM’s ALL-Link Database, even if the To Address does not match
the IM’s INSTEON ID or the IM does not belong to an ALL-Link Group associated with the message. In
other words, if the message originator is in the IM’s ALL-Link Database as either a Controller or
Responder, the IM will pass the message to the host even if it is not specifically directed to the IM. In this
way you can monitor messages between other INSTEON devices as long as the sender is in the IM’s ALL-
Link Database.
Please be aware that the IM may not always detect this traffic. If the message originator and addressee
are close to one another and the IM is farther away, the message originator may not cause the message
to hop enough times for the IM to hear it. To know for sure what an INSTEON device’s status is, you can
usually query it directly using an appropriate INSTEON Direct Command. For more information on
INSTEON Commands and the latest Command set, please download the current INSTEON Command
Tables Document9 from www.insteon.net.
Get IM Info
Get IM Info (0x60)
What it does Identifies the IM’s 3 byte INSTEON ID, Device Category (DevCat), Device
Subcategory (SubCat), and firmware version.
What you send 2 bytes.
What you’ll get 9 bytes.
LED indication None.
Related Commands IM 0x66 Set Host Device Category258
IM 0x73 Get IM Configuration255
IM 0x6B Set IM Configuration255
Note
Using the Set Host Device Category258 Command to change the host’s DevCat and SubCat will only affect
the data transmitted by the IM to other INSTEON devices during ALL-Linking.
When the host sends this Command to the IM, the IM will return the original DevCat, SubCat and firmware
version hard-coded into the IM’s firmware at the factory.
Notes
For INSTEON compliance, you must obtain an approved DevCat and SubCat assignment for your host
product from SmartLabs.
The IM stores these values in EEPROM so they will not be erased if power is lost.
When the IM is in the IM Factory Reset State221, these values will be set to those hard-coded into the IM’s
firmware at the factory.
Using this Command to change the host’s DevCat and SubCat will only affect the data transmitted by the
IM to other INSTEON devices during ALL-Linking.
When the host sends a Get IM Info257 Command to the IM, the IM will return the original DevCat, SubCat
and firmware version hard-coded into the IM’s firmware at the factory.
For the latest list of assigned INSTEON DevCats, please download the INSTEON Device Categories and
Product Keys Document9 from www.insteon.net.
RF Sleep
RF Sleep (0x72)
What it does Directs an RF IM to go into power saving sleep mode. To wake up the RF IM,
send it one byte of serial data.
What you send 2 bytes.
What you’ll get 3 bytes.
LED indication None.
Related Commands None.
Notes
It does not matter what byte you send serially to wake up the RF IM.
When the RF IM wakes up, it will reinitialize, but memory will not be altered as it would be in the IM
Factory Reset State221. Wait a minimum of 40 milliseconds before sending any further IM Serial
Commands.
IM Input/Output
Button Event Report
Button Event Report (0x54)
What it does Reports user SET Button events.
When you’ll get this The user operates the SET Button, or if they exist, Button 2 or Button 3.
What you’ll get 3 bytes.
LED indication If the event is SET Button Press and Hold the IM will automatically go into ALL-
Linking mode which will cause the LED to blink continuously at a rate of ½
second on and ½ second off. Automatic linking may be turned off by setting IM
Configuration Flags bit 7 (see Set IM Configuration255).
Related Commands IM 0x53 ALL-Linking Completed245
IM 0x64 Start ALL-Linking243
IM 0x65 Cancel ALL-Linking244
0x13 There was a Button 2 Press and Hold for more than three
seconds.
0x14 Button 2 was released after a Button 2 Press and Hold event
was recorded.
0x22 Button 3 was Tapped
0x23 There was a Button 3 Press and Hold for more than three
seconds.
0x24 Button 3 was released after a Button 3 Press and Hold event
was recorded.
LED On
LED On (0x6D)
What it does Turns on the IM’s LED if IM Configuration Flags bit 5 = 1.
What you send 2 bytes.
What you’ll get 3 bytes.
LED indication The LED will go on.
Related Commands IM 0x6B Set IM Configuration255
IM 0x6E LED Off262
LED Off
LED Off (0x6E)
What it does Turns off the IM’s LED if IM Configuration Flags bit 5 = 1.
What you send 2 bytes.
What you’ll get 3 bytes.
LED indication The LED will go off.
Related Commands IM 0x6B Set IM Configuration255
IM 0x6D LED On261
In This Chapter
SALad Programming Guide264
Shows the structure of a SALad program, lists sample ‘Hello World’ programs,
and gives tips for developing SALad applications.
SALad Language Reference275
Lists the register locations critical to SALad, and describes the SALad instruction
set and addressing modes.
SALad Integrated Development Environment User’s Guide287
Describes a comprehensive software tool used for writing and debugging
embedded SALad applications.
If you are using the SALad IDE, you can use labels and skip filling in the checksum,
like this:
ORG 0x0210
;=======Application Header================================
DATA Start ;Beginning of application
DATA App_End-Start ;Length of application
DATA 0x00, 0x00 ;Two’s complement checksum
DATA App_End ;End of application
Program Body
The general structure of a SALad program is similar to that of other low-level
assembly programming languages, with varying details depending on the application.
As a stand-alone language, SALad has no specific structural requirements. However,
most INSTEON applications are event-driven, requiring that SALad event handlers
follow a definite structural organization.
For a simple direct SALad application, start the program at 0x0237, which is the
standard entry vector for Static IBIOS Events185. When the PLC is reset (either by
power cycling or a reset Command), the SALad application will be started with an
initialization EVNT_INIT (0x00) IBIOS Event posted to the event queue.
It is possible to write a SALad application without event handlers, but you must then
poll all hardware for a change of state, and SALad Timers273 will not work without
event processing.
By far the easiest way to write SALad applications is use the IDE as explained in the
SALad Integrated Development Environment User’s Guide287 to modify the event
handlers in the open-source SALad coreApp Program272.
ORG 0x0210
;=======Application Header================================
DATA Start ;Beginning of application
DATA App_End-Start ;Length of application
DATA 0x00, 0x00 ;Two’s complement checksum
DATA App_End ;End of application
ORG 0x0237
;=======Application Code==================================
Start
API 0x82, Message ;Send Message to RS232 port
JUMP Start ;Loop non-stop
Message
DATA "Hello "
DATA "World!"
DATA 0x0D,0x0A,0x00 ;Zero terminates string
App_End
;=======Register Definitions==============================
APP_TMP_H EQU 0x006E ;These stay alive only until
APP_TMP_L EQU 0x006F ;the first CALL. They are
;used for the Event handler.
ORG 0x0210
;=======Application Header================================
DATA Start ;Beginning of application
DATA App_End-Start ;Length of application
DATA 0x00, 0x00 ;Two’s complement checksum
ORG 0x0230
;=======Event Process Code================================
Start
StartTimer
JUMP ProcessTimer ;jump to Timer process
StartEvent
MOVE NTL_EVENT, APP_TMP_L ;setup event offset
MUL #0x0002, APP_TMP_H ;multiply by 2 for
;word offset (16bit)
ADD #EventJmpTbl, APP_TMP_H ;add table address 0243:
;to offset (16bit)
JUMP ProcessEvent ;process table entry
ProcessTimer
MOVE NTL_EVENT, APP_TMP_L ;setup event offset
MUL #0x0002, APP_TMP_H ;multiply by 2 for
;word offset (16bit)
ADD #EventJmpTbl,APP_TMP_H ;add table address 0256:
;to offset (16bit)
ProcessEvent
MOVE$ @APP_TMP_H,APP_TMP_H,2 ;get indirect pointer
;from table
JUMP @APP_TMP_H ;execute code at table
;entry
EventJmpTbl
DATA Event00 ;EVNT_INIT
DATA Event01 ;EVNT_IRX_MSG
DATA Event02 ;EVNT_IRX_NACK
DATA Event03 ;EVNT_XRX_MSG
DATA Event04 ;EVNT_XRX_XMSG
DATA Event05 ;EVNT_BTN_TAP
DATA Event06 ;EVNT_BTN_HOLD
DATA Event07 ;EVNT_BTN_REL
DATA Event08 ;EVNT_ALARM
DATA Event09 ;EVNT_MIDNIGHT
TimerJmpTbl
DATA 0x00, 0x00 ;No Timer Events
;=======Static Events==============================
;-------EVNT_INIT
Event00
END
;-------EVNT_IRX_MSG
Event01
END
;-------EVNT_IRX_NACK
Event02
END
;-------EVNT_XRX_MSG
Event03
END
;-------EVNT_XRX_XMSG
Event04
END
;-------EVNT_BTN_TAP
Event05
END
;-------EVNT_BTN_HOLD
Event06
END
;-------EVNT_BTN_REL
Event07
END
;-------EVNT_ALARM
Event08
END
;-------EVNT_MIDNIGHT
Event09
END
;-------EVNT_2AM
Event0A
END
;======Timer Events================================
; No Timer Events
App_End
;=======Register Definitions==============================
APP_TMP_H EQU 0x006E ;These stay alive only until
APP_TMP_L EQU 0x006F ;the first CALL. They are
;used for the Event handler.
ORG 0x0210
;=======Application Header================================
DATA Start ;Beginning of application
DATA App_End-Start ;Length of application
DATA 0x00, 0x00 ;Two’s complement checksum
ORG 0x0230
;=======Event Process Code================================
Start
StartTimer
JUMP ProcessTimer ;jump to Timer process
StartEvent
MOVE NTL_EVENT, APP_TMP_L ;setup event offset
MUL #0x0002, APP_TMP_H ;multiply by 2 for
;word offset (16bit)
ADD #EventJmpTbl, APP_TMP_H ;add table address 0243:
;to offset (16bit)
JUMP ProcessEvent ;process table entry
ProcessTimer
MOVE NTL_EVENT, APP_TMP_L ;setup event offset
MUL #0x0002, APP_TMP_H ;multiply by 2 for
;word offset (16bit)
ADD #EventJmpTbl,APP_TMP_H ;add table address 0256:
;to offset (16bit)
ProcessEvent
MOVE$ @APP_TMP_H,APP_TMP_H,2 ;get indirect pointer
;from table
JUMP @APP_TMP_H ;execute code at table
;entry
EventJmpTbl
DATA Event00 ;EVNT_INIT
DATA Event01 ;EVNT_IRX_MSG
DATA Event02 ;EVNT_IRX_NACK
DATA Event03 ;EVNT_XRX_MSG
DATA Event04 ;EVNT_XRX_XMSG
DATA Event05 ;EVNT_BTN_TAP
DATA Event06 ;EVNT_BTN_HOLD
DATA Event07 ;EVNT_BTN_REL
DATA Event08 ;EVNT_ALARM
DATA Event09 ;EVNT_MIDNIGHT
DATA Event0A ;EVNT_2AM
DATA Event0B ;EVNT_SRX_COM
TimerJmpTbl
;=======Static Events==============================
;-------EVNT_INIT
Event00
END
;-------EVNT_IRX_MSG
Event01
END
;-------EVNT_IRX_NACK
Event02
END
;-------EVNT_XRX_MSG
Event03
END
;-------EVNT_XRX_XMSG
Event04
END
;-------EVNT_BTN_TAP
Event05
API 0x82, Message1 ;Send Message to RS232 port
END
;-------EVNT_BTN_HOLD
Event06
API 0x82, Message2 ;Send Message to RS232 port
END
;-------EVNT_BTN_REL
Event07
END
;-------EVNT_ALARM
Event08
END
;-------EVNT_MIDNIGHT
Event09
END
;-------EVNT_2AM
Event0A
END
;======Timer Events================================
; No Timer Events
Message1
DATA "Hello "
DATA "World!"
DATA 0x0D,0x0A,0x00 ;Zero terminates string
Message2
DATA "Goodbye "
DATA "World!"
DATA 0x0D,0x0A,0x00 ;Zero terminates string
App_End
SALad Timers
You can set up a SALad Timer Event by loading 2 bytes into a timer buffer. The first
byte, called the Timer Index, is the number of the timer handler routine that you
want to execute when the Timer Event fires. The second byte, called the Timer
Time, designates how much time you want to elapse from the time you set up the
Timer Event until the Timer Event fires. If the high bit of Timer Time is 0, the other
7 bits designate 1 to 127 seconds; if the high bit is 1, the other 7 bits designate 1 to
127 minutes. A Timer Time of 0x00 designates that the timer is disabled.
The default number of co-pending Timer Events that you can set up is four. If you
need more Timer Events, increase the pointer value stored in NTL_BUFFER at
0x0033 (see Flat Memory Map170) by two for each additional Timer Event you want to
support. NTL_BUFFER points to the end of the timer buffer, which begins at 0x0046.
You need to write a SALad timer handler routine for each Timer Index that you will
be using. Timer Index 1 will fire the first handler, Timer Index 2 will fire the second
handler, and so on.
There are four SALad instructions for setting up and removing Timer Events (see
Two-byte SALad Instructions283):
ONESHOT (Timer Index, Timer Time)
Set up a new Timer Event if there is no pre-existing Timer Event with the same
Timer Index. If there is such a Timer Event, replace its Timer Time value. After
this Timer Event fires, remove it by setting its Timer Index to 0x00.
TIMER (Timer Index, Timer Time)
Set up a new Timer Event if there is no pre-existing Timer Event with the same
Timer Index. If there is such a Timer Event, replace its Timer Time value. After
this Timer Event fires, disable it by setting its Timer Time to 0x00, but do not
remove it.
TIMERS (Timer Index, Timer Time)
Set up a new Timer Event unconditionally. After this Timer Event fires, disable it
by setting its Timer Time to 0x00, but do not remove it.
KILL (Timer Index)
If there is a pre-existing Timer Event with the same Timer Index, remove it by
setting its Timer Index to 0x00.
If you try to set up a Timer Event but there is no room in the timer buffer, the Timer
Event will not be set up. If this happened, the _NTL_BO buffer overrun flag (bit 1) of
NTL_STAT at 0x0075 will be 1.
_RS_AppLock 3 _RS_AppLock
This mechanism is not implemented in PLC firmware versions earlier than 2.10K.
_DB_END 4 _DB_END
_DB_PASS 3 _DB_PASS
_NTL_DZ 2 _NTL_DZ
_NTL_BO 1 _NTL_BO
_NTL_CY 0 _NTL_CY
In This Section
SALad Universal Addressing Module (UAM)278
Describes addressing modes of SALad instructions.
SALad Parameter Encoding279
Describes how parameters for SALad instructions are encoded.
SALad Instruction Summary Table281
Describes SALad instructions and parameters.
Source Destination
Command Mode
Parameter Parameter
Command Mode
0=Direct
7-bit command identifier
1=Indirect
Command
In This Section
Parameter Reference Tables280
Contains reference tables for encoding SALad instructions.
KILL 0x03 0x04 None <index> Delete pending timer event specified by
index from event queue
PAUSE 0x03 0x05 None <time> Pause for time in 25ms increments
FIND 0x03 0x06 None <flags> Find record in database. These bits define
the field(s) of the record that you are
searching for in the Enrollment database.
DB_FLAGS
76543210
XXXXXXXX
ID0-------------+|||||||
ID1--------------+||||||
ID2---------------+|||||
Group--------------+||||
Linear Search-------+|||
Mode-----------------++|
INSTEON Master/Slave---+
00 Deleted
01 Other
10 INSTEON Slave
11 INSTEON Master
LED 0x03 0x09 None <pattern><time> Flash LED; Pattern defines the blinking
pattern, and time specifies the duration of
the blinking from 0 to 255 seconds. For
example: LED 0x55 0x0A would make the
LED blink at 8Hz for 10 seconds; The delay
between blinks can be controlled by
writing to LED_DLY
RANDOM 0x03 0x0A None <limit><register> Generates random number between 0 and
limit and stores in register
RANDOMIZE 0x03 0x0B None <dest> Get next random number from generator
using 16 bit absolute address to an 8-bit
seed value and stores in NTL_RND
ONESHOT 0x03 0x0C None <index><time> Set One-Shot timer: Index is the event
number that the firmware stores in
NTL_EVENT when the timer expires; Time
is 0⇒127 seconds, or 2 minutes 8 seconds
⇒ 130 minutes 8 seconds if MSb is set.
X10EXT 0x03 0x10⇒ Half-UAM <dest> Additional data for extended X10 message
0x03 0x11
SEND$ 0x03 0x20 ⇒ Half-UAM <dest> Send 9 byte INSTEON message located at
0x03 0x21 destination (from ID is inserted
automatically)
SENDEXT$ 0x03 0x30 ⇒ Half-UAM <dest> Send 23 byte INSTEON message located at
0x03 0x31 destination (from ID is inserted
automatically)
MUL 0x03 0x50⇒ Full-UAM <source><dest> Multiply source to destination, store result
0x03 0x5F in destination and destination +1
DIV 0x03 0x60⇒ Full-UAM <source><dest> Divide source into destination, store result
0x03 0x6F in destination
MOD 0x03 0x70⇒ Full-UAM <source><dest> Divide source into destination, store
0x03 0x7F remainder in destination
PROC 0x03 0x80⇒ Full-UAM <source><dest><jump> Place source on stack and call destination,
0x03 0x8F jump if _NTL_CY=0 upon return
MASK 0x03 0x90⇒ Full-UAM <source><dest><jump> AND source to destination, jump if zero
0x03 0x9F
COMP$< 0x03 0xB0⇒ Full-UAM <source><dest><len> Compare source string less than
0x03 0xBF <jump> destination string, jump if false
TJUMP 0x03 0xC0⇒ Full-UAM <source><dest><limit> Increment destination, branch while less
0x03 0xCF source: <index> than source
dest: <base address>
limit: <end of table>
In This Section
SALad IDE Quickstart288
Explains how to get started using the SALad IDE right away.
IDE Main Window291
Describes the IDE’s main menus and toolbar.
IDE Editor303
Gives the features of the IDE’s Editor.
IDE Watch Panel306
Explains how to use Watches during debugging.
IDE Options Dialog Box307
Discusses the IDE’s setup options.
IDE Windows and Inspectors315
Explains the many additional tools available in the IDE.
IDE Virtual Devices331
Describes how to use the software PLC Simulator, Virtual Powerline, and Virtual
LampLinc.
IDE Keyboard Shortcuts335
Shows how to use the keyboard to perform common actions in the IDE.
If you are using a real PLC, connect a USB or RS232 serial cable from it to your
Windows PC, and then plug the PLC into an electrical outlet.
If you wish to use the PLC Simulator instead, simply turn it on by selecting PLC
Simulator from the IDE’s Mode menu.
2. Run the SALad IDE.
When you run the IDE for the first time, a Startup Wizard will automatically help
you test the serial connection to the PLC. You can also launch the Startup Wizard
from the View menu.
If you would rather test the serial connection to the PLC manually, follow these
steps:
a. Click the Edit->Application Options menu item. An Options dialog box will
appear.
b. Under the Communications tab, select either USB or the COM (RS232)
port you are using to connect to the PLC. If you are using the PLC
Simulator, it does not matter what you select here.
c. Click the Connect Now button, which will establish the serial connection
and then automatically perform the same test as the Test Connection
button. After a short delay, a Successfully connected message should
appear next to the Test Connection button.
d. You do not have to press the Download Core Application button because
you will be downloading a different SALad application below.
e. Click OK to close the Options window.
4. Load the sample ‘Hello World’ SALad program.
In the IDE, press the Open toolbutton (or else click the File->Open… menu item),
then find and open HelloWorld1.sal in the Samples directory. A collection of files
will appear in the editor window, with each file under a different tab. The tab
labeled HelloWorld1 should automatically be selected after the files finish loading
into the editor.
Right-click on the HelloWorld1 tab and select Mark as Main Code Module. This
tells the compiler which file contains the beginning of the SALad application
program.
6. View the ASCII Communications Window.
Select the Comm Window tab at the bottom of the IDE in the Windows and
Inspectors section.
Under the Comm Window tab, select the ASCII Window tab to see text messages
sent from the PLC to the PC.
7. Compile and Download HelloWorld1.sal.
In the IDE, press the Compile/Download toolbutton, or else click the Project-
>Compile/Download menu item.
The IDE’s LED will turn yellow and a progress bar will indicate that
HelloWorld1.sal is being compiled and downloaded to the PLC. The IDE's LED will
turn green when the download is completed.
After the PLC receives the code, it will automatically reset and run the
downloaded HelloWorld1.sal program from the beginning.
NOTE: If the PLC’s LED continues to flash on and off once per second after the
download, the SALad program failed its checksum test. Recheck the serial
connection and try the Compile/Download again.
8. Test the HelloWorld1.sal program.
Tap the PLC's SET Button (located above the LED) to fire the Button Tap SALad
event. The HelloWorld1 SALad program will respond to the event by sending an
ASCII message to the PC.
To the right of the toolbar, click the Debug Mode checkbox to begin a debugging
session. A watch window will appear to the left of the editor pane. In debug
mode, the PLC will report the address of its program counter to the IDE and
optionally stop on each line, allowing you to debug the code.
To try out the debugger, press the Fast Step toolbutton, and then tap the PLC's
SET Button again. This time, the IDE will step rapidly through the program in the
August 16, 2007 © 2005-2007 SmartLabs Technology
Dev Guide, Chapter 11 Page 290
You can cause the debugger to execute one line of code at a time by single
stepping. Try pressing the Single Step toolbutton, and then tap the PLC’s SET
Button. The editor will highlight the first line of SALad code to be executed.
Thereafter, each time you press the Single Step toolbutton, the highlighted line of
code will execute, then the editor will jump to and highlight the next line to be
executed after that one.
You can set (soft) breakpoints in the code by clicking on the green dots in the
margin at the left of the code. Active breakpoints are indicated by a red dot. To
clear a breakpoint, just click it again.
Try using a breakpoint by single-stepping a few lines into the code and setting a
breakpoint there. Press the Fast Step toolbutton to let the code finish executing,
and then press the PLC’s SET Button to fire a new event. The debugger will stop
at the breakpoint you set.
To run the debugger as fast as it will go, press the Run toolbutton. Soft
breakpoints will be ignored but code highlighting will still work. If you don’t want
the editor to jump around in the code as it executes, uncheck the Show CP check
box (CP means Code Point).
To exit the debugging session and allow the PLC to run normally, simply uncheck
Debug Mode.
10. Congratulations, you have compiled, downloaded, tested and debugged a
sample SALad program running on a PowerLinc Controller.
You can become more familiar with INSTEON and X10 SALad programming by
reading this Developer’s Guide, trying out other sample SALad programs, and
using the debugger. Since SALad programs mostly consist of event handlers, the
easiest and safest way to write SALad code is to modify existing code, such as
coreUser.sal that already contains the necessary infrastructure.
SmartLabs and other leading developers are continuously creating new sample
and real-world SALad applications. Be sure to check the INSTEON Forum
frequently at http://www.insteon.net/sdk/forum/ for the latest information.
IDE Menus
These are the main menus in the SALad IDE.
In This Section
Menu – File293
Opens and saves source and output files.
Menu – Edit295
Helps you navigate within your source code, find text, replace found text, and
modify IDE options.
Menu – View297
Changes the appearance of the IDE by displaying and hiding various parts of it.
Menu – Project298
Controls compilation options and loading of new firmware into the PLC.
Menu – Mode298
Switches between using a real PLC, a simulated PLC, or no PLC.
Menu – Virtual Devices299
Launches the Virtual Powerline and Virtual LampLinc devices for use with the PLC
Simulator.
Menu – Help300
Launches this Developer’s Guide in compiled help form, gives version information
about the IDE, lets you check for IDE updates, and links you to the INSTEON
Developer’s Forum.
Menu – File
The File menu is for opening and saving source and output files.
Menu – Edit
The Edit menu helps you navigate within your source code, find text, replace found
text, and modify IDE options.
You use Ctrl-Down to find the next occurrence of the string you are finding, and
Ctrl-Up to find the previous occurrence.
You can use Ctrl-Down to find the next occurrence of the string you are finding, and
Ctrl-Up to find the previous occurrence.
Menu – View
The View menu changes the appearance of the IDE by displaying and hiding various
parts of it.
You can check only one of the options. Full, the default, displays (from left to right)
hex addresses, hex bytecode, source code line numbers, and breakpoint markers, as
shown in the section IDE Editor303, below. If you check Extended, the gutter pane is
widened so you can see more of the bytecode. If you check any of the other
options, so will only what you selected. During debugging, you will not be able to set
breakpoints unless the Markers column is displayed.
Menu – Project
The Project menu controls compilation and loading of new firmware into the PLC.
Menu – Mode
The Mode menu switches between using a real PLC, a simulated PLC, or no PLC. You
can select only one of the options.
Menu – Help
The Help menu launches a Developer’s Guide in compiled help form, gives version
information about the IDE, lets you check for IDE updates, and links you to the
INSTEON Developer’s Forum.
IDE Toolbar
This is what the main Toolbar looks like:
Save File. Save the current SALad file (*.sal) or SALad Template (*.salt).
Reset. Reset the PLC by forcing an EVNT_INIT (0x00) IBIOS Event (see
IBIOS Event Details187, Note 1). This will start the SALad program with EVNT_INIT
(0x00) in its event queue.
Pause. During debugging only, pause the SALad program at the next line of
code.
Single Step. During debugging only, execute the next line of code in the
SALad program. This line is normally highlighted in the IDE.
Fast Step to Next Breakpoint. During debugging only, execute one line of
code at a time, reporting each line executed, and stop at the next soft or hard
breakpoint.
Find and Replace. Find and replace text in the currently displayed SALad
program.
Compile and Download. Compile the SALad program and download the
bytecode into the PLC over the serial port. If you right-click this button, the
following options appear:
and red means you are not connected. After pressing the Compile/Download
button, green means the program downloaded to the PLC successfully, red means
the program did not download successfully, and yellow means the program is
currently downloading.
Go Back. Return to the previous SALad program location in the editor. Use
this after hot-jumping to another SALad program by right-clicking on a label.
IDE Editor
The IDE editor handles multiple source files and displays SALad source code in
context-sensitive color. The screenshot below shows how an editing session would
typically appear.
You can change the appearance of the editor by right-clicking anywhere in the editor
pane and selecting Editor Properties…. This displays the Editor tab in the Options
dialog box. See the Options – Editor312 section for details.
You can change which columns of information are displayed in the ‘gutter’ using the
View->Gutter menu item (see Menu – View297 above).
The OK and Cancel buttons appear at the bottom of each panel, but they are not
shown in the figures below. Settings take effect when you push OK. If you push
Cancel the previous settings will remain in effect.
In This Section
Options – General308
Controls overall IDE behavior.
Options – Quick Tools308
A set of tools for working with the PLC’s firmware and ALL-Link Database.
Options – Debugging309
Contains controls for debugging sessions.
Options – Compiling309
Contains controls for the compiler.
Options – Communications310
Has setup options and tools to control communication with the PLC.
Options – Unit Defaults311
Controls settings for the PLC firmware.
Options – Directories311
Sets file search paths.
Options – Editor312
Controls how the editor looks and behaves.
Options – Saving313
Sets file saving and backup options.
Options – Loading314
Sets file loading options.
Options – Project314
Designates the file containing the beginning of your SALad program.
Options – General
The General tab controls overall IDE behavior.
Currently the only option is to show the Splash Screen when the program starts.
This defaults to off after the first time the program is run.
Convert INC into UMP and Convert INC into SAL are utilities for converting assembler
include (INC) files into Unit Map files (UMP) or SALad source code files (SAL).
Zero Database (FC00-FFFF) clears the PLC’s Threaded ALL-Link Database
(ALDB/T)105 from hex address 0xFC00 to 0xFFFF by writing zeros into it. You can
also zero the ALL-Link Database from the PLC Database326 tab under Windows and
Inspectors.
Options – Debugging
The Debugging tab contains controls for debugging sessions.
Auto-disconnect device after 5 consecutive access violations stops serial data flow if
faulty SALad code is generating an access violation storm that prevents you from
seeing where the code went awry.
Log all raw data into <specified log file> lets you designate a text file that will log
the data that appears in the Comm Window – Raw Data318 panel.
Options – Compiling
The Compiling tab contains controls for the compiler.
Prevent download when errors exist, when checked, will not download bytecode to
the PLC if the compiler generates errors. This option is checked by default.
Options – Communications
The Communications tab has setup options and tools to control communication with
the PLC.
Press Find my PowerLinc Controller to check your serial ports for an attached PLC. If
a PLC is found, the port to which it is attached will appear in the Port: pulldown box.
If you want to manually designate the serial port that your PLC is attached to, you
can use the pulldown box directly. The pulldown box contains options for your
available COM (RS232) and USB ports. If you are using the PLC Simulator it does
not matter which option you choose.
Press the Connect Now button to establish a connection with your PLC over the port
designated in the Port: pulldown box. Pushing the Connect Now button will
automatically “push” the Test Connection button.
If you are already connected to your PLC, you can test the connection at any time by
pressing the Test Connection button.
Press Download Core Application to download a precompiled version of the
coreApp.sal SALad coreApp Program272 to your PLC. This file to be downloaded,
named coreApp.slb, is the one in the Program Files\Smarthome\Salad IDE\core
directory.
Press Advanced Commands… to toggle the appearance of a pulldown box containing
PLC command options that only apply to particular versions of the PLC. The
command shown, Set Daughterboard Monitoring OFF is for a Hardware Development
Kit. Press the Send button to actually send the chosen command to the PLC
Image Base: is the base address for the downloaded compiled SALad bytecode. This
should match the ‘org’ of the first executable code in the file you designate as ‘main’
in the Options – Project314 tab. The default is 0x0210.
Map File: lets you designate a unit map (UMP) file other than the one that the IDE
defaults to by auto-sensing which firmware version is running in your PLC.
Options – Directories
The Directories tab sets file search paths.
Enter the path to files that you would like the IDE to search for to be included in your
project. Press the button to open a standard dialog box to find a directory. If you
want multiple search paths, separate them with a semicolon. The default search
paths are your current project’s directory (usually under Smarthome\SALad
IDE\Projects), then the Smarthome\SALad IDE\Include directory, then the
Smarthome\SALad IDE\Core directory.
Options – Editor
The Editor tab controls how the editor looks and behaves. You can also launch this
page directly from the editor by right-clicking anywhere in it and choosing Editor
Properties….
Use the Theme: pulldown box to select a previously saved collection of the color and
font settings on this page. The default theme is called standard. You can create
custom themes by choosing the editor options you want on this page and then
pressing Save Current Theme… to store the settings under a name you choose.
Whenever you launch the IDE, the editor will use the theme that last appeared in the
pulldown box.
To change the foreground or background color for text of a given type, click on the
color box and choose the color you want.
Check the BOLD box if you want text of the given type to appear bold, and check the
Use BG box if you want the specified background color to actually be used.
Use the Editor Font: pulldown box to choose the font for the editor.
Check Show Code Hints if you want tooltips to appear as you type SALad
instructions. The tooltips show the parameters for the instruction and a brief
description of what it does.
Check Allow (ctrl-space) Code Completion Window if you want to see possible SALad
word completions by pressing Control-Space after you’ve typed a partial word.
Check Smart Tabs if you want the editor to automatically indent or outdent the next
line, depending on context, when you press Enter at the end of a code line.
Set the number of spaces for a tab in the Tab Size: box. The default is 3. Tabs are
converted to spaces in saved files.
Options – Saving
The Saving tab sets file saving and backup options.
Check Save all files on close if you want the IDE to automatically save all open
source code files when you close the IDE. The files will be saved in whatever
condition they are in at the time, so be careful when using this option. The default is
unchecked.
Check Save all files on IDE errors if you want the IDE to automatically save all open
source code files whenever an error occurs in the IDE program. Then, if the IDE
crashes, when you restart it you will get a dialog box informing you that your files
were auto-recovered from backups, and giving you the option of keeping the auto-
recovered files or not. The default for this option is checked.
Check Backup files on load up to N levels if you want the IDE to automatically save
source code files with a bak extension whenever they are loaded. If you set the
number of levels greater than 1 (the default is 5), then bak files are first renamed
with an extension bk1, bk1 files are renamed bk2, and so forth. This option is
checked by default. NOTE: This option has not been implemented as of version
1.0.5.170 of the IDE.
Check Save all on download if you want the IDE to automatically save all open
source code files whenever you download compiled code to your PLC program. The
default is checked.
Options – Loading
The Loading tab sets file loading options.
Check Automatically load all included files if you want the IDE to find and load any
files that you have named in a source file using an include "<filespec>"
statement. The default is checked.
Options – Project
The Project tab lets you designate the file containing the beginning of your SALad
program. If you do not do this, the compiler will not know where program execution
begins. This setting is persistent, meaning that the IDE will remember it between
sessions.
You can either type the name of the file in the text box, or you can right-click on the
file’s tab in the editor and choose Mark as main unit.
Choosing Comm Window317 will display a series of subtabs with more tools.
You can make the Windows and Inspectors pane collapse or expand quickly by
clicking anywhere in its title bar. You can resize the pane by dragging its top border.
In This Section
Compile Errors316
Lists errors the compiler finds and lets you jump to them in the editor for
debugging.
Comm Window317
Has a collection of subtabs that help you to see what is going on in the INSTEON
environment.
Trace325
Lets you inspect the execution history of your program to help you with
debugging.
PLC Database326
A tool for manipulating the ALL-Link Database in your PLC.
SIM Control327
Operates the PLC Simulator.
Compile Errors
This page shows errors that the compiler finds. Each line displays an error number,
the filespec of the file containing the error, the line number and column positions of
the error within the file, and an error message. Double-clicking an error places you
on the offending line in the editor.
In the example above, an error was deliberately induced by changing a valid label
(tjump) to an invalid one (tjumpfoo). Double-clicking on one of the lines above
shows the error in the editor like this:
Comm Window
The Comm Window has a number of sub-tabs that look like this:
In This Section
Comm Window – Raw Data318
Shows the serial data exchanged between the PLC and your PC.
Comm Window – PLC Events318
Displays PLC Events that have occurred.
Comm Window – INSTEON Messages319
Displays received INSTEON messages, and it lets you compose and send
INSTEON messages of your choosing.
Comm Window – X10 Messages320
Displays received X10 Commands, and it lets you compose and send X10
Commands of your choosing.
Comm Window – Conversation321
Allows you to have a two-way serial conversation with the PLC.
Comm Window – ASCII Window322
Displays text explicitly sent from a SALad program running on your PLC.
Comm Window – Debug Window323
Lets you directly inspect and alter bytes within your PLC.
Comm Window – Date/Time324
Gives you control over the realtime clock in the PLC and lets you test realtime
events.
The left column displays the event number in hexadecimal, followed by the event
name and a description of the conditions that caused the event.
The top section of this page displays INSTEON messages received by the PLC. See
Message Fields41 above for a description of the column headings.
The bottom section lets you compose and send an INSTEON message. You can
choose from a number of pre-composed commands using the pulldown box at the
left.
You can enter From and To Device Addresses41 in the text boxes by typing the 3-byte
address as three decimal numbers separated by periods. This is similar to the way
an IP address is specified on the Internet.
You can set the Message Type Flags42 the message using the check boxes.
Use the RemHops and TotHops boxes to set the Message Retransmission Flags43.
Enter the Command 1 and 244 that you want to send as hexadecimal bytes in the
respective boxes.
If you are sending an Extended-length message, enter the User Data44 in the
Extended Data text box. If you enter any data in this box, an Extended-length
message will be sent. If you enter more than 14 bytes, only the first 14 bytes will be
sent. If you enter fewer than 14 bytes, the remaining bytes will be sent as 0x00. If
you want to send a Standard-length message, clear this box.
You do not have to deal with the Message Integrity Byte44 (CRC) because the
INSTEON Engine handles this for you.
When you have composed the INSTEON message that you want, press the Send
INSTEON button to transmit it.
Enter plc in the Unit ID: box to inspect (peek) and write to (poke) bytes in your PLC.
If you want to peek and poke bytes in a remote INSTEON device, enter that device’s
INSTEON Address as, for example, 1.2.3.
Type the hex address you wish to inspect or write to in the Address: box. Press Get
Byte to fetch a single hex byte at that address and display it in the Value: box, or
else press Get Block to fetch a string of 32 hex bytes and display them all in the
lower box.
To poke a byte, type the hex byte you wish to poke at the given Address: in the
Value: box, then press Set Byte.
The System Time box displays the time according to your PC, and the PLC Time box
displays the time according to your PLC.
To synchronize your PLC to your PC, press the Set-> button. The time in the PLC
Time box will update to the system time.
To set the PLC’s RTC to an arbitrary date/time, enter the date and time you wish to
set in the boxes above the Set Date/Time of PLC button, then press that button. The
time in the PLC Time box will update within the next minute. To quickly restore the
date and time boxes to the current PLC time, press the Restore Date/Time Now
button.
Press the Test Set to Near Midnight button to set the PLC’s time to 23:59:45 so you
can test functions that occur at midnight.
Press the Clear RTC PowerOff button if you do not want the PLC’s RTC to save the
current time if the PLC loses power.
If you want to test timers that depend on the PLC’s minutes-from-midnight counter
(see IBIOS Event Details187 Note 8), you can set the counter by entering a value
from 0 to 1439 in the Min from Mid (Minutes from Midnight) box and pressing the Set
button to the right.
Enter a minutes-from-midnight value from 0 to 1439 in the Next Alarm box and
press the Set button to the right to cause an EVNT_ALARM (0x0E) IBIOS Event to
fire when the PLC’s minutes-from-midnight value matches the value you entered.
See IBIOS Event Details187 Note 8 for more information.
Press the Calc Sunset/Sunrise >>> button to fill in the boxes to the right with the
sunrise and sunset times for the PLC date. The box to the right gives the hour-
difference between the local time zone and GMT (Greenwich Mean Time).
Trace
The Trace page lets you inspect the execution history of your program to help you
with debugging.
Tracing is active whenever you are in Debug mode (i.e. the Debug Mode checkbox is
checked).
The first column gives the hexadecimal address of the object code that was
executed.
The second column gives the line number and the source code filename of the line of
code that was executed.
The rightmost column shows the program statement that was executed.
PLC Database
The PLC Database page is a tool for manipulating the ALL-Link Database in your PLC.
See INSTEON ALL-Link Database101 above for more information.
To examine the contents of the PLC’s ALL-Link Database, press Read Database. The
contents will appear in the text box at the right. If the text box is blank, the ALL-
Link Database is zeroed out.
To erase the ALL-Link Database by zeroing it out, press the Zero DB (FC00-FFFF)
button. Zeros will be written to addresses 0xfc00 to 0xffff in the PLC’s EEPROM
(nonvolatile memory).
To add an entry to the ALL-Link Database, type the INSTEON Address of the device
you wish to add in the ID: box, and the number of the ALL-Link Group you would like
the device to belong to in the Group: box, and then press the Add to PLC Database
button. When you enter the 3-byte INSTEON Address, type it as three decimal
numbers, ranging from 0 to 255, separated by periods (for example: 126.23.4).
To remove an entry from the ALL-Link Database, put the entry’s ID and ALL-Link
Group Number in the appropriate boxes, and then press Remove from PLC Database.
After zeroing the ALL-Link Database or adding or removing an ALL-Link Database
entry, you can press the Read Database button to see the effect of the change.
If you double-click on a line in the text box, the IDE will jump to the Comm Window
– Debug Window323 and display a hex dump of the bytes in the ALL-Link Database
starting at the address of the entry you double-clicked on.
As an example, if you press the Zero DB (FC00-FFFF) button, enter an ID of 2.3.4
and an ALL-Link Group of 1, press the Add to PLC Database button, and finally press
the Read Database button, the following line will appear in the text box:
(id=02.03.04,mode=sla,addr=FFE8,laddr=0000,g=1,cmds=00 00,d=00)
See Threaded ALL-Link Database (ALDB/T)105 above for the meaning of these fields.
SIM Control
The SIM Control window operates the PLC Simulator. To use the PLC Simulator in
place of a real PLC, turn it on by choosing the Mode->Simulator menu item (see
Menu – Mode298).
The PLC Simulator Control Panel328 is at the upper left. The text box at the upper
right is a hex PLC Simulator Memory Dump329, and the text box at the bottom is a
PLC Simulator Trace330 of code execution. You can vary the size of the Trace box by
dragging its top border.
In This Section
PLC Simulator Control Panel328
Explains the controls at the top of the window.
PLC Simulator Memory Dump329
Shows how to view memory in the PLC Simulator.
PLC Simulator Trace330
Describes the trace information in the bottom text box.
A simulated SET Button (which you can press) and a simulated white Status LED
(which you can view) appear at the left.
You can simulate unplugging and plugging in the PLC using the Plugged In checkbox.
If you would like to simulate a factory reset, uncheck Plugged In, check Factory
Reset, then check Plugged In.
Check Overclock to run the simulated PLC’s realtime clock at very high speed
between events. This lets you easily test code that depends on realtime events
without waiting for the actual time to elapse or manually resetting the PLC’s clock to
fire an event.
Use the Speed control at the far right to slow down simulated execution speed. This
can be useful for debugging.
If you are simulating a PLC with a Hardware Development Kit (HDK) added, choose
the HDK from the Supplemental Sims: pulldown box.
You can cause the PLC Simulator to execute a string of ASCII text commands from a
macro file by typing the filespec for the macro file in the text box to the left of the
Execute button, then pressing the button. Contact [email protected] for the format
for the macro file.
To poke a byte or bytes into the PLC Simulator’s memory, enter the hex address to
poke to, and the hex byte(s) you want to poke, in the text boxes to the left of the
Poke button, and then press the button. If you are poking multiple bytes, separate
them with spaces.
To simulate the occurrence of an IBIOS Event, enter the Event Handle number (see
IBIOS Events185) in the text box to the left of the Event button, then press the
button.
Check the Show Output checkbox if you want the PLC Simulator Trace330 to display
code execution information.
Push the Erase button to blank the PLC Simulator Trace330 text box.
To view memory contents in the PLC Simulator, enter a hex address, a range of
addresses, or some combination of addresses and ranges in the Memory Map View:
text box. The text box will immediately display the memory contents you specified.
Indicate an address range by typing a beginning and ending address separated by a
hyphen. Use a comma to separate multiple addresses or address ranges.
The memory dump normally refreshes automatically every few milliseconds. If for
some reason refreshing stops (if you switch serial ports, for instance), you can
restart it by typing anything in the Memory Map View: box.
Push the Erase button in the PLC Simulator Control Panel328 to blank the text box.
Check the Show Output checkbox in the PLC Simulator Control Panel328 if you want
the text box to display code execution information.
When Show Output is checked, trace information like that shown above with an
asterisk at the left will appear. Immediately following the asterisk is the hex address
of the code line that was executed, followed by the object code itself. Effects that
the code may have are shown to the right. For example,
0676:00->FF
means that memory location 0676 was changed from containing 00 to containing FF;
and
(comp=)0000<(0050)0676
means that a compare was done between the literal value 0000 and the contents of
the 16-bit value beginning at memory location 0050, namely 0676, and that 0000 is
less than 0676.
Whether or not the Show Output checkbox is checked, the text window will show
INSTEON messages and X10 Commands sent over the powerline by the PLC, as well
as both ASCII and hex data sent serially to your PC.
In This Section
PLC Simulator332
Explains how to use the PLC Simulator.
Virtual Powerline333
Shows how to set up a software-simulated powerline environment.
Virtual LampLinc334
Explains how to add software-simulated LampLinc devices to the Virtual
Powerline.
PLC Simulator
The PLC Simulator is a pure-software version of a real PLC running on your PC. To
use the PLC Simulator in place of a real PLC, turn it on by choosing the Mode-
>Simulator menu item (see Menu – Mode298).
The PLC Simulator can do everything that a real PLC can do, but it is more
transparent, thanks to a set of special software tools. These tools appear in the SIM
Control327 window, which looks like this:
For a complete explanation of how to use these tools, see the SIM Control327 section.
Virtual Powerline
The Virtual Powerline is a software-simulated powerline environment that works in
conjunction with the PLC Simulator332. To turn it on, choose the Virtual Devices-
>Powerline menu item (see Menu – Virtual Devices299). The Virtual Powerline will
appear as a separate window that looks like this:
The button at the top will be labeled Enable Powerline if the Virtual Powerline is
currently disabled, or else it will say Disable Powerline while the Virtual Powerline is
enabled. To use the Virtual Powerline, enable it. If the PLC Simulator is not running,
turn it on, or if it is running, you may have to ‘Unplug’ it then ‘Plug’ it back in. When
the PLC Simulator is using the Virtual Powerline properly, the message
connection accepted
will appear in the Virtual Powerline’s text box. The same message will appear every
time you connect a virtual device, such as a Virtual LampLinc334. When you remove
a virtual device you will get the message
connection removed
You can place a message on the Virtual Powerline by typing the ASCII string you
want to send in the box to the left of the Place on PL button, then pressing the
button. The string you sent will appear in the text box.
INSTEON messages that appear in the Virtual Powerline will show up as hex bytes
preceded by A: in the text box.
To stop using the Virtual Powerline, close its window.
Virtual LampLinc
Virtual LampLinc devices are software simulations of real SmartLabs LampLinc™ V2
Dimmers. Virtual LampLincs are connected to a Virtual Powerline333, which in turn
connects to a PLC Simulator332. To launch a Virtual LampLinc, choose the Virtual
Devices->LampLinc menu item (see Menu – Virtual Devices299). The Virtual
LampLinc will appear as a separate window that looks like this:
Choose Spawn 4 more to create four more Virtual LampLincs, each in a separate
window, and each with a different INSTEON Address. Choose Auto-Position All to
neatly tile all open Virtual LampLinc windows. If you choose Auto-Position and Zone
All, groups of Virtual LampLincs will appear in different Virtual Powerline zones.
Choose Quit All to close all of the Virtual LampLinc devices at once.
Key Action
F9 (not in debug mode) Compile and Download the program to the PLC
In This Chapter
SDM Introduction337
Gives an overview of the SDM and lists system requirements.
SDM Quick Test338
Gets you up and running using either a browser or SDM’s Main Window.
SDM Commands340
Lists the available SDM Commands.
SDM Windows Registry Settings357
Gives the Windows Registry settings that SDM uses.
SDM Introduction
The SmartLabs Device Manager™ (SDM) is a communication and translation gateway
to The SmartLabs PowerLinc Controller28 (PLC). Developers use simple text
commands (Home Networking Language™) through ActiveX or HTTP calls to
communicate over INSTEON or X10 without the hassle of dealing with USB packets
or RS232 resource issues.
These commands will also be extended to PowerLinc/IP and other Internet
transports.
Using the SmartLabs Device Manager, developers can focus on their application,
whether in Macromedia Flash®, Java®, .NET® or even in a Word® document, Excel®
spreadsheet, or a PowerPoint® presentation.
Commands such as "SetOnLevelText=01.02.03,ON" perform the action and return a
response, providing developers with simple and reliable control. Additional
commands such as "speak," inet," and "mailto" further provide the developer with
powerful capabilities.
In This Section
SDM Test Using a Browser338
Use a browser like Internet Explorer or FireFox to interface with SDM.
SDM Test Using SDM’s Main Window339
Use SDM’s Main Window to interface with SDM.
3. Type isresponding into the bottom text box and press Send.
4. You should see a textual response isresponding=False or isresponding=True with
other cached responses.
SDM Commands
This section lists and explains the available SDM Commands.
SDM Commands are not case-sensitive.
In This Section
SDM Commands – Getting Started341
Utility commands for managing the PLC.
SDM Commands – Home Control342
Commands for controlling INSTEON and X10 devices.
SDM Commands – Notification Responses343
Notifications of INSTEON, X10, and serial communication reception.
SDM Commands – Direct Communications344
Low-level INSTEON, X10, and serial communication commands.
SDM Commands – Memory345
Commands for reading and writing PLC memory.
SDM Commands – PLC Control347
Commands for managing the PLC, including the realtime clock.
SDM Commands – Device Manager Control350
Commands for managing the SDM itself.
SDM Commands – ALL-Link Database Management352
Commands for searching and setting ALL-Link Databases in the PLC and remote
INSTEON devices.
SDM Commands – Timers354
Commands to create and delete timers, and to manage sunrise and sunset times.
downloadSALadFile=<filename>
Downloads the SALad program with the given filename (as a binary/compiled file,
not hex). Automatically resets the PLC after downloading.
Example: downloadSALadFile=coreUser.slb
downloadBinaryFile=<address>,<filename>
Downloads the binary file with the given filename to the given address. This
command does not automatically reset the PLC after download.
Example: downloadBinaryFile=<0x2000>,myTable.bin
setPath
Sets the search path for expected files.
Example: setPath=c:\mysaladfiles
getPath
Gets the search path for expected files.
Example: getPath
Returns: getPath=c:\mysaladfiles
verifyCoreApp
Returns true if the currently downloaded SALad application matches the expected
SALad coreApp.
Example: verifyCoreApp
Returns: verifyCoreApp=true
salad
Returns true for a valid SALad application loaded in the PLC. Returned vid and pid
are specific to the manufacturer, and rev is the SALad application’s revision number.
Example: salad
Returns: salad=true,vid=0001,pid=0003,rev=000C.
unlockSALad
Disables SALad code protection to allow downloads of SALad code.
Example: unlockSALad
lockSALad
Enables SALad code protection to prevent overwriting SALad code (default on
powerup).
Example: lockSALad
isSALadLocked
Returns the status of the SALad code protection lock.
Example: isSALadLocked
setRTClock
Sets only the Realtime Clock, not the Running Clock. Next time the PLC is plugged in
or reset, coreApp will reset the Running Clock with the time from the Realtime Clock.
Example: setRTClock=8/12/2004 5:03:39 PM
getDST
Returns the PLC’s current daylight savings time settings.
Example: getDST
connect
Connects to the PLC after a disconnection. Connecting is automatic at startup.
Example: connect
disconnect
Disconnects the PLC's port connection.
Example: disconnect
isResponding
Asks the SDM if the port is responding (sends 0x02 0x48) and responds true or false.
This also reads the map for proper name-based downloading. This is the ultimate
heartbeat method to determine if the PLC is connected and talking.
Example: isResponding
Returns: isResponding=true
GetPLCStatus
Returns a set of statuses for PowerLinc Controller (port, connection, etc).
Example: getPLCStatus
help
Provides a quick visual list of commands.
Example: help
getMyID
Returns the PLC's ID (INSTEON Address).
Example: getMyID
Returns: getMyID=01.02.03
diag1
Does a first-level diagnosis of the PLC. Returns true or false.
Example: diag1
Returns: diag1=true
debugAnimate=<map|<mapfile>|true>
Causes PLC to return its code pointer, optionally with SALad mapping.
Example: debugAnimate=true.
debugOff
Turns off code pointer information from debugAnimate.
Example: debugOff.
setAuthUsername=<username>
Allows the user to set an authorization username for the http/web connection to
require. Shipped default is empty - no authorization required.
Example: setAuthUsername=me
setAuthPassword=<password>
Allows the user to set an authorization password for the http/web connection to
require. Shipped default is empty - no authorization required. To clear, send
setAuthPassword with no password.
Example: setAuthPassword=12345
icon=<hide|show>
Hides or shows the SDM icon.
Example: icon=hide
repeat=<times>,<command>
Repeats a command for testing the SDM.
Example: repeat=5,setOnLevelText=00.57.75,on
dm
Opens the edit field with focus on white space.
cls
Closes the log.
closeDM or haltDM or exitDM
These are different ways to force a shutdown of the SDM.
Sets the preset On-Level value for the PLC or sourceINSTEONid (defaults to PLC's
ID) in the remoteINSTEONid's database.
Example: setPresetDim=04.05.06, 1, 25%
setRampRate=<remoteINSTEONid>, <groupID>, <newRampRate>
[,<sourceINSTEONid>] [,<hops>]
Sets the Ramp Rate value for the PLC or sourceINSTEONid (defaults to PLC's ID) in
the remoteINSTEONid's ALL-Link Database. Ramp rate values are 0x00 (slow) to
0x1F (fast).
Example: setPresetDim=04.05.06, 1, 0x1F
getPresetDim=<remoteINSTEONid>, <groupID>, [,<sourceINSTEONid>]
[,<hops>]
Gets the preset On-Level value for the PLC or sourceINSTEONid (defaults to PLC's
ID) in the remoteINSTEONid's ALL-Link Database.
Example: getPresetDim=04.05.06, 1
getRampRate=<remoteINSTEONid>, <groupID>, [,<sourceINSTEONid>]
[,<hops>]
Gets the Ramp Rate value for the PLC or sourceINSTEONid (defaults to PLC's ID) in
the remoteINSTEONid's ALL-Link Database. Ramp rate values are 0x00 (slow) to
0x1F (fast).
Example: setPresetDim=04.05.06, 1
exportLinks=<filename>
Saves the PLC’s ALL-Link Database to a file.
Example: exportLinks=links.txt
importLinks=<filename>
Loads the PLC’s ALL-Link Database from a file.
Example: importLinks=links.txt
timer=3,active,19:59,INSTEON:04 05 06 4F 11 00,M,SEC
timer=4,active,sunset+20,04.05.06:OFF,SuSaFThWTuM,NOSEC
endlist
getTimer=<recordnumber>
Same as listTimers, except lists a single timer (not block-listed) specified by
<recordnumber>.
Example: getTimer=2
Returns: timer=2,active,20:00,04.05.06:50%,SuSaFThWTuM,NOSEC.
diagTimers
Checks over the timer format for format errors and reports them.
Example: diagTimers.
setStateCity=<state>,<city>
Sets the latitude and longitude and sunrise/sunset information based on a state and
city name. The user interface can enumerate the information located in places.csv
and places.idx. You can query getLatLong or getSunrise or getSunset after
setting the state and city.
Examples: setStateCity=CA,IRVINE
or: setStateCity=California,Tustin
setLatLong=<latitude>,<longitude>
Sets the latitude and longitude and sunrise/sunset information. You can query
getLatLong or getSunrise or getSunset after setting this.
Example: setLatLong=33.684065,-117.792581
getLatLong
Returns the currently set latitude and longitude used for sunrise and sunset
calculations.
Example: getLatLong
Returns 33.684065,-117.792581
downloadSunTable
Verifies that the TimerCoreApp is installed and downloads the sunrise/sunset table
(based on latitude and longitude) to the PLC for use within the TimerCoreApp. This
is required once to enable the sunrise/sunset time specifications.
Example: downloadSunTable
getSunrise
Returns today's sunrise time as calculated using setStateCity or setLatLong.
Example: getSunrise
Returns 8/30/2005 6:24:00 AM
getSunset
Returns today's sunset time as calculated using setStateCity or setLatLong.
Example: getSunset
Returns: 8/30/2005 7:20:00 PM
interpretSunTable
Returns the sunrise and sunset times for the whole year
Example: interpretSunTable.
getNextAlarmTime
Returns the PLC's next scheduled alarm time. For timers that have <SEC|NOSEC>
set to SEC, the returned time will be the actual time that the alarm will fire, which
will occur randomly in the interval from 15 minutes before to 15 minutes after the
alarm setting time. When the minutes-from-midnight (getMinutes) matches the
getNextAlarmTime, the alarm or alarms that match will fire.
Example: getNextAlarmTime
Returns: HH:MM such as 14:25
setNextAlarmTime=HH:MM
Sets the PLC's next alarm time. Useful to skip alarms, if desired, while they remain
set for the next day.
Example: setNextAlarmtime=18:00
This example skips all timers until 6pm today.
getMinutes
Returns the PLC's Running Clock, set on initialization and auto-incremented each
minute.
Example: getMinutes
Returns HH:MM such as 15:25.
setMinutes=HH:MM
Sets the PLC's Running Clock, normally set on initialization and auto-incremented
each minute. Useful to debug timers by setting the PLC's match for alarms without
actually changing the PLC's Realtime Clock.
Example: setMinutes=18:00
RS232 4800,8,N,1
Level Converter
I2C Bus
RS232 Tranceiver
I2C
JP 1
INSTEON MCU TTL RS232
In This Section
SmartLabs Powerline Modem (PLM) Main Board368
Gives the schematic and bill of materials for the PLM Main Board.
SmartLabs PLM Serial (RS232) Daughter Board372
Gives the schematic and bill of materials for the Serial (TTL RS232) Daughter
Board.
SmartLabs PLM Ethernet (IP) Daughter Board375
Gives the schematic and bill of materials for the Ethernet (IP) Daughter Board.
In This Section
SmartLabs PLM Main Board Schematic369
Gives the schematic and bill of materials for the PLM main board.
SmartLabs PLM Main Board Bill of Materials370
Specifies the parts used in the main board.
In This Section
SmartLabs PLM Serial Daughter Board Schematic373
Gives the schematic and bill of materials for the serial (RS232) Daughter Board.
SmartLabs PLM Serial Daughter Board Bill of Materials374
Specifies the parts used in the Serial Daughter Board.
In This Section
SmartLabs PLM Ethernet (IP) Daughter Board Schematic376
Gives the schematic and bill of materials for the IP (Ethernet) Daughter Board.
SmartLabs PLM Ethernet (IP) Daughter Board Bill of Materials377
Specifies the parts used in the IP Daughter Board.
CONCLUSION
“Everything should be made as simple as possible, but not simpler.”
Albert Einstein (1879-1955)
GLOSSARY
This glossary is in alphabetical order. Bold terms in a definition refer to other
glossary entries.
NOTES
1. Battery operated INSTEON RF devices, such as security sensors and handheld
remote controls, must conserve power. Accordingly, they may optionally be
configured so that they do not retransmit INSTEON messages from other
INSTEON devices, but act as message originators only. Such devices can
nevertheless both transmit and receive INSTEON messages, in order to allow
simple setup procedures and to ensure network reliability.
2. At a minimum, X10 compatibility means that INSTEON and X10 signals can
coexist with each other on the powerline without mutual interference. INSTEON-
only powerline devices do not retransmit or amplify X10 signals. But X10
compatibility also means that designers are free to create hybrid INSTEON/X10
devices that operate equally well in both environments. By purchasing such
hybrid devices, current users of legacy X10 products can easily upgrade to
INSTEON without making their X10 investment obsolete.
3. Firmware in the INSTEON Engine handles the CRC byte automatically, appending
it to messages that it sends, and comparing it within messages that it receives.
Applications post messages to and receive messages from the INSTEON Engine
without the CRC byte being appended. See Message Integrity Byte44 for more
information.
4. See GAO Telecommunications Report: May 2006 (GAO-06-426.
5. See
http://www.wirelessweek.com/article/CA6334955.html?spacedesc=Departments.