NuvoNet protocol - AVS Forum | Home Theater Discussions And Reviews
Forum Jump: 
 2Likes
Reply
 
Thread Tools
post #1 of 49 Old 03-22-2018, 01:28 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Introduction

The NuvoNet protocol connects excellent but now legacy products in Nuvo's wire based product line. E.g. the Grand Concerto, Essentia, the M3 and MPS4 music players, tuners, etc.. and various sorts of Keypads which use NuvoNet.

The Nuvo protocol is published by Nuvo/Legrand and enables communication over RS232.
http://smarthomebus.com/dealers/Prot...20Protocol.pdf
It does many tricks, but does e.g. not permit 100% access to the KeyPads. In particular the "menu button" and the ability to produce menus with some depth.

In order to keep this otherwise excellent and robust system alive, it will be necessary to integrate with more modern equipment and perhaps also Nuvo's wireless series. For some unmodern reason Legrand has been reluctant to help the community gain access to this protocol.

This forum is an attempt to collectively try to understand the NuvoNet protocol and how it can be used.

Last edited by Bobone; 03-22-2018 at 03:08 PM.
Bobone is offline  
Sponsored Links
Advertisement
 
post #2 of 49 Old 03-22-2018, 01:59 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Physical and MAC layers (work in progress)

- The physical layer is RS485, half duplex with two main wires + ground.
According to the Grand Concerto installation manual, pins 4 and 5 on the RJ45 are for Databus- and Databus+ (1,3 & 7 are Grd, 8 is +24V!!!)

- Baudrate is 230400 Baud. Tolerance between 215 and 245 kBaud.

- Frame: 1 parity bit, 8 bit data length, 1 stop bit produces legible and relevant ascii, i.e. a good hypothesis so far.

- Unclear at this moment which parity bit is required: even, odd, mark or space. (For reading puroposes parity does not matter.)
Bobone is offline  
post #3 of 49 Old 03-22-2018, 02:28 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Communication protocol (work in progress)

First of all we believe that it is a bus, i.e. everyone gains access to the same information.

- all can read and write on the same bus.

- The Grand Concerto is the master and powers the keypads and "runs the system".

- 20 times per second the GC (probably) spews out the following message if there is no other interaction with the system:

366 IRP_MJ_READ - Transfers data from a COM port to a client (COM2) - 49 bytes of 49
STATUS_SUCCESS
01 02 00 00 00 b8 f0 82 82 83 83 84 84 85 85 86 .....¸ð‚‚ƒƒ„„……†
86 87 87 88 88 8d 8d 8e 8f 8f a2 a3 a3 a4 a4 a5 †‡‡ˆˆŽ¢££¤¤¥
a5 a8 a9 aa ab e2 e3 e3 e4 e4 e5 e5 ac ad ae af ¥¨©ª«âããääå嬬®¯
ff ÿ

- all messages (with my UART), start with 01 and end with ff
- there is probably a header, a message and a footer
- the actual message length depends on your system configuration
- 82 to e5 is a list of the zones, panels and sources. I have cracked the alorithm for the zones and panels.
- I have also an understanding of the source logic: which ones they are and if they are NuvoNet acessible or not.

- Before 82 is unclear. Some messages have 14 instead of 02 in the second two byte word. Some 0e. It’s not the sender address as all three types com from the GC.
- After e5 is also unclear.
- Just like the zones and panels come in pairs, so do the sources. Could be transport functions vs. meta data.

Last edited by Bobone; 03-22-2018 at 11:19 PM.
Bobone is offline  
Sponsored Links
Advertisement
 
post #4 of 49 Old 03-22-2018, 03:04 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
A captured event

So, how is the protocol used?

The following event captures the pressing of the "Menu button" and thereby returning to the top level, while being "in" a GC menu, "on" a non-Nuvo source.
(event chosen for maximum simplicity as few things are triggered):

01 02 00 00 00 b8 f0 82 82 83 83 84 84 85 85 86 .....¸ð‚‚ƒƒ„„……†
86 87 07 02 00 00 00 b8 f0 0a 00 0f 07 ff ff ff †‡.....¸ð....ÿÿÿ
ff 01 00 00 00 fe b0 88 88 8d 8d 8e 8f 8f a2 a3 ÿ....þ°ˆˆŽ¢£
a3 a4 a4 a5 a5 a8 a9 aa ab e2 e3 e3 e4 e4 e5 e5 £¤¤¥¥¨©ª«âããääåå
ac ad ae af ff ¬*®¯ÿ

Remarks:

1) The header is the same as the standard msg. No sender information there (if its from the keypad)!
2) Things become different on line two, wordbyte "07". 87 Is replaced by 07 followed by 02 (observe the previously believed header thereafter )
3) 87/07 represent the sixth zone! (yes that is part of the logic, more later!)
4) 02 00 00 00 b8 f0 is some sort of header
5) 00 0f 07 ff ff ff ff 01 00 00 00 fe b0 means something. The four "ff"s most likely represent the top menuID.
6) the standard format resumes with 88.

It sure looks like a bus!
What is terrifyingly unclear is which device sent this message?
Is it is the 6th zone keypad or the master GC? I hope the keypad as there is no other trace of this event in the flow!

Last edited by Bobone; 04-19-2018 at 07:20 AM.
Bobone is offline  
post #5 of 49 Old 03-22-2018, 03:34 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
How to send and get a reaction?

This is where I am getting stuck in my progress....

I have made one attempt to get a reaction, and it was not successful.

Very many things can go wrong;

1) My serial sniffer is tolerant towards the parity choice. The NuvoNet devices may not be.
Is there some smart way of actually finding out? Any recommended SW to actually see the parity bit?
-> 4 trial and error tests are acceptable....
2) I am a little concerned by the first "01" wordbyte. In some settings it does not appear.
-> 8 combinations....
3) I am actually not 100% sure if the data length is 7 or 8 bits. It does not matter when reading...
--> 16 combinations
4) 1 or 2stop bits...
--> 32 combinations

And now a bigee:
5) is the timing important? Does it matter when the message is sent? Only certain slots? Are the 20 standard messages/second for synchronization?
--> I don't have the skills to trigger at a certain point. How can I try?

Or an even bigger one:
6) It is technically possible to run two different baudrates on top of the same lines. Requiring two interfaces per device. One could be used for master broadcast and the other for keypads responses. The point is, I do not see any acknowledgements. Or am I only seeing acknowledgements...?


I need help. Any ideas?

Last edited by Bobone; 03-22-2018 at 11:25 PM.
Bobone is offline  
post #6 of 49 Old 03-23-2018, 03:42 AM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Standard messages /header structure

All of the messages below are sent by the GC:
(None of the panels are plugged in and the MPS4 is disconnected on both Serial and RJ45 (Nuvoprotocol and NuvoNet protocol).)

1) The "standard Bus" :
- Repeated 20 times per second:
01 02 00 00 00 b8 f0 82 83 84 85 86 87 88 8d 8e .....¸ð‚ƒ„…†‡ˆŽ
8f a2 a3 a4 a5 a8 a9 aa ab e2 e3 e4 e5 ac ad ae ¢£¤¥¨©ª«âãäå¬*®
af ff ¯ÿ
-structure briefly described previously

2) "System overview?"
- Repeated every second:
01 0e 01 1b 00 01 01 01 01 01 01 01 00 00 00 00 ................
01 01 01 00 00 00 00 00 00 01 01 01 01 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 4f 6c 69 76 69 ...........Olivi
61 00 56 69 6b 74 6f 72 00 53 6f 76 72 75 6d 00 a.Viktor.Sovrum.
56 61 72 64 61 67 73 72 75 6d 00 4d 61 74 72 75 Vardagsrum.Matru
6d 00 4b f6 6b 00 4d 61 72 63 75 73 00 5a 6f 6e m.Kök.Marcus.Zon
65 20 38 00 53 77 3a 46 61 6d 69 6c 79 20 52 6f e 8.Sw:Family Ro
6f 6d 00 5a 6f 6e 65 20 31 30 00 5a 6f 6e om.Zone 10.Zon
65 20 31 31 00 42 61 64 72 75 6d 00 41 72 62 65 e 11.Badrum.Arbe
74 73 72 75 6d 00 56 69 6e 64 00 5a 6f 6e 65 20 tsrum.Vind.Zone
31 35 00 5a 6f 6e 65 20 31 36 00 5a 6f 6e 65 20 15.Zone 16.Zone
31 37 00 5a 6f 6e 65 20 31 38 00 5a 6f 6e 65 20 17.Zone 18.Zone
31 39 00 5a 6f 6e 65 20 32 30 00 53 70 6f 74 69 19.Zone 20.Spoti
66 79 00 52 61 64 69 6f 20 31 00 52 61 64 69 6f fy.Radio 1.Radio
20 32 00 4d 75 73 69 63 20 53 65 72 76 65 72 00 2.Music Server.
41 69 72 70 6c 61 79 20 2d 20 4e 75 76 6f 00 4b Airplay - Nuvo.K
e4 6c 6c 61 20 36 00 00 00 00 00 00 00 00 00 00 älla 6..........
00 00 00 02 bb 82 83 84 85 86 87 88 8d 8e 8f a2 ....»‚ƒ„…†‡ˆŽ¢
a3 a4 a5 a8 a9 aa ab e2 e3 e4 e5 ac ad ae af ff £¤¥¨©ª«âãäå¬*®¯ÿ

- Zone and Source names separated by Null (00)
- names/numbers of unused zones and sources are taken from GC
- this data reminds me of lists available in some set-up menus in the panels. But it lacks info of which are active or not. How could it be used (manipulated)?


3) "No clue"

Repeated every two seconds:
01 14 00 08 00 01 00 00 00 00 00 00 00 00 00 00 ................
52 00 00 00 00 00 00 2a 6a 82 83 84 85 86 87 88 R......*j‚ƒ„…†‡ˆ
8d 8e 8f a2 a3 a4 a5 a8 a9 aa ab e2 e3 e4 e5 ac Ž¢£¤¥¨©ª«âãäå¬
ad ae af ff *®¯ÿ


Not so easy to see patterns, apart from the end starting with 82 (zone 1)...
(especially as the editor detsrys the formatting)

Last edited by Bobone; 06-11-2019 at 01:41 PM.
Bobone is offline  
post #7 of 49 Old 03-23-2018, 02:20 PM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
Just doing a quick reply to be notified of any new messages. Will study this this weekend.

Joe

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #8 of 49 Old 03-24-2018, 04:13 AM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Quote:
Originally Posted by Bobone View Post
First of all we believe that it is a bus, i.e. everyone gains access to the same information.

- all can read and write on the same bus.

- The Grand Concerto is the master and powers the keypads and "runs the system".

- 20 times per second the GC (probably) spews out the following message if there is no other interaction with the system:

366 IRP_MJ_READ - Transfers data from a COM port to a client (COM2) - 49 bytes of 49
STATUS_SUCCESS
01 02 00 00 00 b8 f0 82 82 83 83 84 84 85 85 86 .....¸ð‚‚ƒƒ„„……†
86 87 87 88 88 8d 8d 8e 8f 8f a2 a3 a3 a4 a4 a5 †‡‡ˆˆŽ¢££¤¤¥
a5 a8 a9 aa ab e2 e3 e3 e4 e4 e5 e5 ac ad ae af ¥¨©ª«âããääå嬬®¯
ff ÿ

- all messages (with my UART), start with 01 and end with ff
- there is probably a header, a message and a footer
- the actual message length depends on your system configuration
- 82 to e5 is a list of the zones, panels and sources. I have cracked the alorithm for identifying zones and panels.
- I have also an understanding of the source logic: which ones they are and if they are NuvoNet acessible or not.

- Before 82 is unclear. Some messages have 14 instead of 02 in the second two byte word. Some 0e. It’s not the sender address as all three types com from the GC.
- After e5 is also unclear.
- Just like the zones and panels come in pairs, so do the sources. Could be transport functions vs. meta data.
More on the Bus structure:

The base Bus looks like this:
01 02 00 00 00 b8 f0 82 83 84 85 86 87 88 8d 8e 8f a2 a3 a4 a5 a8 a9 aa ab e2 e3 e4 e5 ac ad ae af ff

When an action occurs to a zone, a payload is inserted at the relevant address. In the following case for Zone 8"d" (zone 12):

01 02 00 00 00 b8 f0 82 83 84 85 86 87 88 0d 0d 14 00 08 00 01 00 01 2a 01 00 00 00 00 00 00 52 00 00 00 00 00 00 2f 16 02 00 00 00 b8 f0 8e 8f a2 a3 a3 a4 a4 a5 a5 a8 a9 aa ab e2 e3 e3 e4 e4 e5 e5 ac ad ae af ff

- 8d becomes 0d for both zone and panel addresses indicating the start of the payload (in italics)
- the payload is in bold
- it ends with 8e (italics) which is the next Zone. Zone 13 (8e) does not have a keypad and is hence not doubled

So what about the payload?
Here are 6 examples of volume change, 3 up and 3 down:

0d 14 00 08 00 01 00 01 2a 01 00 00 00 00 00 00 52 00 00 00 00 00 00 2f 16 02 00 00 00 b8 f0
0d 14 00 08 00 01 00 01 17 01 00 00 00 00 00 00 52 00 00 00 00 00 00 f3 c8 02 00 00 00 b8 f0
0d 14 00 08 00 01 00 01 0f 01 00 00 00 00 00 00 52 00 00 00 00 00 00 65 3b 02 00 00 00 b8 f0
0d 14 00 08 00 01 00 01 2a 01 00 00 00 00 00 00 52 00 00 00 00 00 00 2f 16 02 00 00 00 b8 f0
0d 14 00 08 00 01 00 01 3e 01 00 00 00 00 00 00 52 00 00 00 00 00 00 72 9c 02 00 00 00 b8 f0
0d 14 00 08 00 01 00 01 4e 01 00 00 00 00 00 00 52 00 00 00 00 00 00 fd e8 02 00 00 00 b8 f0

I believe that the numbers in bold correspond to negative dB (in decimals):
42
23
15
42
62
78

The codes in italic are not comprehensible right now. They are most likely some sort of CRC. In decimals:
47 22
243 200
101 59
47 22
114 156
253 232



It is more or less a coincidence that volume set #1 and #4 is the same.

EDIT: the packets above are actually responses from the GC to changes in volume. I have identified the corresponding requests from the pads, see below.

Last edited by Bobone; 04-19-2018 at 07:03 AM.
Bobone is offline  
post #9 of 49 Old 03-25-2018, 09:00 AM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Important to get a reaction!

At this point I would say that we are gaining a pretty good understanding of the bus protocol.
At least how to decipher it further!

The next phase would be to step by step enter Nuvo protocol commands on RS232 and see what their equivalent in NuvoNet RS485 looks like.

But, this does not make any sense as long as we do not get any reaction from the system when feeding back the commands. As stated before, something is wrong....

Having tested commands from the pad with those from the MPS4 and a RS232 respectively (most render identical RS485 hex).
I have also tested reading my sent commands with a second UART, and they look fine! I am out of ideas.

I think that something fundamental in the communication is wrong that is not noticed when reading on 230400, 8E1.

I understand that a logic analyzer could be handy. Don't have one, though.

Need help!
Bobone is offline  
post #10 of 49 Old 03-27-2018, 02:21 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Now what?

An update:

Within the protocol, the keys are numbered as follows:
- 01: OK
- 02: Play/Pause
- 03: RW
- 04: FF
- 05: Power
- 06: ?
- 07: Up
- 08: Down
- OA(?): Menu

Anything that you have encountered before in the Nuvo world?

I now believe that I can capture (unique) key requests sent from the Keypad and responses sent back by the GC!

- There is some sort of three step cycling for every pressed key rendering almost identical requests. Unclear if all three steps need to be received by the GC to trigger the final request.
(The steps could be a way to avoid too many commands if you leave your finger too long)

From 12th zone/activated keypad (8f/0f), volume down (08) request cycles (1,2,3):
01 02 00 00 00 b8 f0 82 82 83 83 84 84 85 85 86 86 87 87 88 88 8d 8d 8e 8f 0f 02 00 00 00 b8 f0 0f 00 0e 0f 08 03 00 00 00 00 00 00 00 00 00 00 00 8f 1f a2 a3 a3 a4 a4 a5 a5 a8 a9 aa ab e2 e3 e3 e4 e4 e5 e5 ac ad ae af ff

01 02 00 00 00 b8 f0 82 82 83 83 84 84 85 85 86 86 87 87 88 88 8d 8d 8e 8f 0f 02 00 00 00 b8 f0 0f 00 0e 0f 08 02 00 00 00 00 00 00 00 00 00 00 00 da 9a a2 a3 a3 a4 a4 a5 a5 a8 a9 aa ab e2 e3 e3 e4 e4 e5 e5 ac ad ae af ff

01 02 00 00 00 b8 f0 82 82 83 83 84 84 85 85 86 86 87 87 88 88 8d 8d 8e 8f 0f 02 00 00 00 b8 f0 0f 00 0e 0f 08 01 00 00 00 00 00 00 00 00 00 00 00 34 1d a2 a3 a3 a4 a4 a5 a5 a8 a9 aa ab e2 e3 e3 e4 e4 e5 e5 ac ad ae af ff

This could explain why only one request did not work in my write simulation...

So my question to you as "product managers" is:

Having cracked the protocol in general for reading,
and having Slightly deeper knowledge of the keypad including the menu button,
and knowing the vast majority of requests (and responses) very clearly on rs232 already now:

--> What would you like to do with this capability?
😊

Cheers!

Last edited by Bobone; 04-19-2018 at 07:25 AM.
Bobone is offline  
post #11 of 49 Old 03-28-2018, 04:59 AM
Newbie
 
Join Date: Feb 2018
Posts: 9
Mentioned: 1 Post(s)
Tagged: 0 Thread(s)
Quoted: 6 Post(s)
Liked: 4
Quote:
Originally Posted by Bobone View Post
An update:

Within the protocol, the keys are numbered as follows:
- 01: OK
- 02: Play/Pause
- 03: RW
- 04: FF
- 05: Off/(on?)
- 06:?
- 07: Up
- 08: Down
- FF: Menu
(FD for Sub Menu)

Anything that you have encountered before in the Nuvo world?

I now believe that I can capture (unique) key requests sent from the Keypad and responses sent back by the GC!

- There is some sort of three step cycling for every pressed key rendering almost identical requests. Unclear if all three steps need to be received by the GC to trigger the final request.
(The steps could be a way to avoid too many commands if you leave your finger too long)

This could explain why only one request did not work in my write simulation...

So my question to you as "product managers" is:

Having cracked the protocol in general for reading,
and having Slightly deeper knowledge of the keypad including the menu button,
and knowing the vast majority of requests (and responses) very clearly on rs232 already now:

--> What would you like to do with this capability?
😊

Cheers!
Hi Bob,

I've been following your thread and must express my admiration for your perseverance and stubbornness in deciphering the NuVoNet proprietary protocol. I own a NuVo Essentia E6GM (expanded to 12 zones wth an Essentia E6GX), a NuVo MPS4-E Music Port Server Elite, and a NuVo T2FAM dual tuner. I am a great fan of the products, but - as everybody has been saying in all the threads in this forum - am baffled by the refusal of NuVo/Legrand to provide an upgrade soluton for integration with its newer products or with third-party products with regard to displaying metadata and effecting control from the Essentia/Concerto control pads. I believe they have a good technology, which - albeit old in terms of number of years - is still very valuable to the clients and the numerous fans of the brand (as evidenced by the efforts of people like yourself, Jeff, Jim et al), and can produce revenue or at least intangible business benefits like increased customer loyalty and satisfaction. But - as they say in China - you can only take a horse to the river, you cannot make it drink the water...

It will be VERY helpful if you could post more details about the NuVoNet protocol, like commands you have been able to determine as working, standard response strings and protocol conventions - syntax, naming, addressing etc. As far as I understand from your recent posts, you are using a USB-to-RS485 standard converter, connected to pins 4 and 5 (Control Data Bus -/+) on the NuVoNet RJ45 connectors, probably through a RJ45-to-RS485 terminal block adapter. You are also using a standard terminal programme (like Hercules, ZOC7 Terminal, PuTTY etc.) to read and send data from/to the NuVoNet network. The baudrate is 230400, databits 8 (7?), stopbit 1, parity unclear, flow control unclear. This technical setup is cheap and easy to make. I imagine one can use configurable "virtual remote" emulators like iRule to control the system and send metadata through this channel over Ethernet, if one uses a TCP-to-RS485 converter (readily availabe) instead of a USB-to-RS485 converter. The only thing one would need is a more or less reliable description of the comms protocol and the command and response syntax. You've obviously made serious progress in this field and this is a great case-in-point of the utility and practicality of forums like this one, where experience is shared for the benefit of all participants. Would you care to publish in this thread those commands and responses, which you have already been able to determine as working on the NuVoNet control pads, with a description of the relevant prefix/suffix bits and any symbols required to initiate/end command/response sequences? Ideally it would be excellent to have somenting like a manual of the kind NuVo published for the RS232 control of its products, but this is too much to ask from a volunteer, even a very devoted one. I am not an engineer or a software programmer myself (although I did manage to configure iRule with a standard TCP-to-RS232 adapter to control my NuVo system), so this would be tremendously helpful in anybody's efforts to prolong the productive use of NuVo's otherwise excellent products by integrating them fully with other more recent systems. There is probably more to the NuVoNet protocol than just ASCII command sequences and responses, as the NV-CTP36 control pad carries image metadata too, for example, but starting from transferring simple text metadata withpout the need of a (less and less reliable or non-existent) NuVo Music Port inbetween, and using the NuVo control pads to send commands and manage other devices on the home network would be a major development by any means.

Thank you for your efforts!

Best regards,

Nicola
nyankov is offline  
post #12 of 49 Old 03-28-2018, 03:06 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Quote:
Originally Posted by nyankov View Post
Hi Bob,

I've been following your thread and must express my admiration for your perseverance and stubbornness in deciphering the NuVoNet proprietary protocol. I own a NuVo Essentia E6GM (expanded to 12 zones wth an Essentia E6GX), a NuVo MPS4-E Music Port Server Elite, and a NuVo T2FAM dual tuner. I am a great fan of the products, but - as everybody has been saying in all the threads in this forum - am baffled by the refusal of NuVo/Legrand to provide an upgrade soluton for integration with its newer products or with third-party products with regard to displaying metadata and effecting control from the Essentia/Concerto control pads. I believe they have a good technology, which - albeit old in terms of number of years - is still very valuable to the clients and the numerous fans of the brand (as evidenced by the efforts of people like yourself, Jeff, Jim et al), and can produce revenue or at least intangible business benefits like increased customer loyalty and satisfaction. But - as they say in China - you can only take a horse to the river, you cannot make it drink the water...
Dear Nicola,

First of all I would like to thank you for your kind words!
I really, really appreciate it. Especially as I have hit some resistance and need help.

I am like you a frustrated Nuvo (fairly large) owner that wants to make a good system prolong its service, but with limited own programming skills. I suppose that I am at an "iRule+" level, but not much more.


By cracking this together, I was hoping that some more skilled programmers would take this to the next level and realize the sought after integrations. We have come a long way from zero, and I fully agree that documenting NuvoNet more thoroughly would be valuable.

The truth is that right now I need other people to start looking into the final critical hurdles.
Although I can read and mostly understand the interaction going on between Nuvo devices in Hex,
I cannot trigger anything using the RS485 NuvoNet as of today.

My feeling is that it is due to one of the following:

1) Something is missing in the frame/byte definition. Although the error is not critical enough for bytes to not be read by my sniffer SW, sent bytes may be discarded by the receiver due to an incorrect frame configuration.
- I believe this is worth looking into is because my SW (RealTerm) and UART report "UART Receiver Framing Error" or "UART Receiver Parity Error" depending on settings
- the way to challenge this hypothesis is probably to look at the line signal and count bits.... A "logic analyzer" would possibly do the trick, but I do not have access to one! Anyone?

2) There is some timing error. Perhaps the GC only permits sending in certain time slots?
- I have however tested to spam the NuvoNet with simple commands down to 1 millisecond intervals to no avail.
- I have tried to do millisecond analysis of the timing of messages on the NuvoNet, but nothing evident has popped out.
- The truth is that I don't really know what I am looking for!?

3) There is some devilish code or CRC in the messages that I am missing
- I find this quite unlikely as the packets do not change much at all in a session, and I have reinjected freshly copied commands without success.

4) Other? Don't know...


Cracking the sending will enable us to go from hypothesis, to tests, to a real documentation of the protocol.
Anyone wanting to solve this, please dig in with a UART or a Logic analyzer!!!

On a side note:
One part of the problem has been for me as a novice to just handle the enormous amount of data being generated. The NuvoNet is in that respect nothing like the Nuvo protocol which is 100% sequential, minimalistic and very easy to grasp and use.

I have used:
- RealTerm and Eltima (trial) as serial port sniffer SW
- MS Word and Excel extensively for data restructuring and pattern search

Actually my journey has brought me to actually appreciating a few thousand lines of cleaned Hex (from irrelevant status mgs, etc...). Not sure that this challenge is healthy for my spirits...

Again, I hope the Easter Bunny 🐰 brings this forum some logic analyzers and people with 485 uarts. I bought one just for the project.

Cheers,
Bob

Last edited by Bobone; 03-29-2018 at 01:15 AM.
Bobone is offline  
post #13 of 49 Old 03-29-2018, 07:11 AM
Member
 
lleo_'s Avatar
 
Join Date: Sep 2004
Location: US/NJ
Posts: 40
Mentioned: 0 Post(s)
Tagged: 0 Thread(s)
Quoted: 16 Post(s)
Liked: 11
Hi, just to add my admiration and support to your efforts.
While my skills are limited, have a GC, tuner and NuvoNet adapter, as well as a few RS485 adapters.
Also suggest that you cross-post this thread over at cocoontech.com where a number of folks were involved in the reverse engineering of the Carrier Infinity RS485 protocol. Maybe they can give you some ideas how to move on, if you get stuck.
Best, Lleo

Last edited by lleo_; 03-29-2018 at 07:45 AM.
lleo_ is offline  
post #14 of 49 Old 08-19-2018, 02:29 PM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
Hey Bob,

I am just coming alive again on the forum. For some reason I was not getting any AVS notifications. I will have to see what is going on there.

I am still using the serial protocol. I have integrated Alexa and made the code much more precise.

I have been waiting for the new Sonos API, but they are so late in getting it out. The announced it last October and I just received a notice that they are still working on it.

Joe

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #15 of 49 Old 08-19-2018, 03:01 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Hello Joe,

Glad to hear from you again.

Meanwhile, I moved on with the ordinary protocol and started a new thread devoted to solutions

https://www.avsforum.com/forum/36-ho...l#post56583256

and hacked together myself a pretty nice solution using the HomeSeer platform and CCA. It works really nice.

Have a look at the videos in the thread above, it may inspire the your work.

I still believe a lot in the MG1 (with CCA).

Cheers,

Bob
Bobone is offline  
post #16 of 49 Old 08-22-2018, 02:23 PM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
Quote:
Originally Posted by Bobone View Post
Hello Joe,

Glad to hear from you again.

Meanwhile, I moved on with the ordinary protocol and started a new thread devoted to solutions

https://www.avsforum.com/forum/36-ho...l#post56583256

and hacked together myself a pretty nice solution using the HomeSeer platform and CCA. It works really nice.

Have a look at the videos in the thread above, it may inspire the your work.

I still believe a lot in the MG1 (with CCA).

Cheers,

Bob
Yes, I AM re-inspired!!

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #17 of 49 Old 12-11-2018, 01:50 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Red face NuvoNet over MPS4!

A milestone has been reached!

Many have spent time trying to send some serial NuvoNet commands to the GC. Mostly to customize menus, etc...
As the NV-NNA is virtually impossible to get hold of, two paths remained: Hack the RS485 code or work through the MPS4.

I don't know how many threads I have read and hours people have spent w/o apparent success. Support has been difficult to get and documentation a nightmare. Those that have tried, have encountered all sorts of problems. The various Telnet port alternatives 80, 5004, 5004d(!) and 5006 have been very confusing and discouraging.
E.g. Port 5004 kicks you out with this message: "Error: Your license does not permit this unauthorized client." Documentation led us to think that NuvoNet restrictions had to do with the Elite license....

Port 5006 has also looked dead. No activity. No help with commands. Nothing.
But, then comes an occasional "#PING". Like a message from outer space! It's not dead!
It's actually THE best/only port where you can Telnet the serial protocol NuvoNet commands that are necessary for menus and artwork!
From "*VER" to more complex commands. (GC must be awake).

Looks promissing!

Last edited by Bobone; 12-12-2018 at 02:11 AM.
Bobone is offline  
post #18 of 49 Old 12-11-2018, 02:51 PM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
Yes, I can see tons of information.

Have you actually tried menu manipulation yet?

Joe

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #19 of 49 Old 12-11-2018, 10:06 PM
Member
 
xs10shl's Avatar
 
Join Date: Mar 2014
Posts: 131
Mentioned: 3 Post(s)
Tagged: 0 Thread(s)
Quoted: 59 Post(s)
Liked: 33
This is really positive news - in the last 6 months, things have gone from "Hopeless" to "Promising!"


Keep up the excellent work - more discoveries await!
xs10shl is offline  
post #20 of 49 Old 12-12-2018, 02:57 AM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Yes, I have managed to make menu changes.

The logs did not give me full positive feedback according to the specs, but I was glad when I had a look at the panel to see the changes!

Menu item selection is also fed back to Telnet.
(Nuvonet feedback is not sent to the ordinary serial port.)

Still learning... New top level menus will work as well as changing items in Favorites.
Probably populating items in the top menus as well. Have not tried yet.


The work process is still a bit messy. Two steps forward followed by one step backward!
Many variables and possible sequences of events to understand.
- Nuvo GC and original source configuration
- MPS4 and its (re)configuration of all sources (not only its four channels)
- learning the new commands and how they propagate to all sources (unclear)
- Some changes are written over by the GC or MPS4 at start-up. Some not.
- not clear if its best to start with a non Nuvonet source and enable NuvoNet on it or start with another Nuvo source (Tuner, MP, etc...)?.

Attempting to use the NNA setting failed (got stuck), but then I did not make a perfect test. (two places to change in the configurator followed by the MPS4 getting stuck looking for a serial connection?)

Basically, I could need a helping hand!
:-)

Last edited by Bobone; 12-12-2018 at 04:41 AM.
Bobone is offline  
post #21 of 49 Old 12-12-2018, 07:03 AM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
Quote:
Originally Posted by Bobone View Post
Yes, I have managed to make menu changes.

The logs did not give me full positive feedback according to the specs, but I was glad when I had a look at the panel to see the changes!

Menu item selection is also fed back to Telnet.
(Nuvonet feedback is not sent to the ordinary serial port.)

Still learning... New top level menus will work as well as changing items in Favorites.
Probably populating items in the top menus as well. Have not tried yet.


The work process is still a bit messy. Two steps forward followed by one step backward!
Many variables and possible sequences of events to understand.
- Nuvo GC and original source configuration
- MPS4 and its (re)configuration of all sources (not only its four channels)
- learning the new commands and how they propagate to all sources (unclear)
- Some changes are written over by the GC or MPS4 at start-up. Some not.
- not clear if its best to start with a non Nuvonet source and enable NuvoNet on it or start with another Nuvo source (Tuner, MP, etc...)?.

Attempting to use the NNA setting failed (got stuck), but then I did not make a perfect test. (two places to change in the configurator followed by the MPS4 getting stuck looking for a serial connection?)

Basically, I could need a helping hand!
:-)
A few updates:

1. I was able to install windows 7 on anew hard drive and install the server software. Once I told the software to run in compatibility mode of XP Sp3 everything worked. It even found a serial number on the MPS4 hardware itself and became licensed.

2. I have been monitoring the 5006 telnet port and I can see all of the # resulting responses. I can also see the keypad key presses. I cannot see any of the * commands yet. I plan to put a sniffer on it to see both sides of the serial port.

3. As we work forward we will need to recognize that we have a little bit different goals. I hope to find a solution to the menu system that does not require the MPS4 any more. based on what you have discovered so far, I think that the odds of my finding a solution are higher. It seems that the MPS4 can be part of a custom solution.

4. I would like to see some code that shows how you are controlling the menus.

Two steps forward and one back is more than we have been able to accomplish for quite some time!!!


Joe

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #22 of 49 Old 12-12-2018, 09:21 AM
Member
 
xs10shl's Avatar
 
Join Date: Mar 2014
Posts: 131
Mentioned: 3 Post(s)
Tagged: 0 Thread(s)
Quoted: 59 Post(s)
Liked: 33
Agreed on the menu controls being a priority. The less-than-ideal menu solutions we've implemented are a bit heavy-handed. Folks like me who just want to hit a button on a wall are being left behind for cloud-based solutions, which monitor everything you do.



<RANT>Funny how those in the surveillance state has worked for decades to be able to bug your house without a warrant- and now, along comes Amazon - "Can we listen in on all your conversations? We'll let you control your lights by voice command in return." "Sure - no problem - we'll even pay you, and install it ourselves."</RANT>
Bobone likes this.
xs10shl is offline  
post #23 of 49 Old 12-23-2018, 07:30 AM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
Quote:
Originally Posted by Bobone View Post
Above most probably relates to the internal COM2 port between the computer card and the NuVo card. It seems to be the only data connection between the two (+ one sound cable, one power(ish) cable and a pure power cable)

Have any of you guys sniffed on this port? Looks VERY interesting.
Regarding the comment on the internal COM2 port, I believe that you are correct. I tried to get a sniffer working but had trouble trying to get two pieces of software to share the port. For com ports it seems that any usage is exclusive.

I also tried some software that created virtual com ports but the server only allowed com1 and com2 in the confg dropdown. Maybe I will play with this file and see if I can get a virtual com port to work. That would allow the Nuvo commands to work and a sniffer at the same time.

What sort of usable stuff are you seeing in the logs? I have yet to seriously play with those.

Joe

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #24 of 49 Old 12-23-2018, 03:15 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Quote:
Originally Posted by jmorris644 View Post
Regarding the comment on the internal COM2 port, I believe that you are correct. I tried to get a sniffer working but had trouble trying to get two pieces of software to share the port. For com ports it seems that any usage is exclusive.

I also tried some software that created virtual com ports but the server only allowed com1 and com2 in the confg dropdown. Maybe I will play with this file and see if I can get a virtual com port to work. That would allow the Nuvo commands to work and a sniffer at the same time.

What sort of usable stuff are you seeing in the logs? I have yet to seriously play with those.

Joe
Com2 is even printed on the board. :-)
Last spring I seem to remember downloading some SW that could do what you are looking for.
I will focus on getting HomeSeer up and running before I get into the plumbing again. Will not be easy on Win XPe.

I look at the NuvoBridge logs continuously to monitor what is going on and if the system is running smoothly. I have seen some new commands as well.
I think a large benefit will be when sniffing the ports. Timestamps are by the millisecond and timing may be an important issue.
Bobone is offline  
post #25 of 49 Old 12-26-2018, 04:48 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Quote:
Originally Posted by Bobone View Post
Com2 is even printed on the board. :-)
Last spring I seem to remember downloading some SW that could do what you are looking for.
I will focus on getting HomeSeer up and running before I get into the plumbing again. Will not be easy on Win XPe.

I look at the NuvoBridge logs continuously to monitor what is going on and if the system is running smoothly. I have seen some new commands as well.
I think a large benefit will be when sniffing the ports. Timestamps are by the millisecond and timing may be an important issue.
I managed to sniff on COM2.

You need to temporarily shut down the bridge to insert a sniffer.
115 kBaud. "Advanced Serial Port Monitor" by Agg Sytems or good old "Portmon.exe"

Last edited by Bobone; 01-11-2019 at 06:11 AM.
Bobone is offline  
post #26 of 49 Old 12-30-2018, 08:19 AM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
Quote:
Originally Posted by Bobone View Post
I managed to sniff on COM2.
It was somewhat disappointing.
Less rich than Telnet (no Button actions) and definitely less rich than the NuvoBridge log.
You need to temporarily shut down the bridge to insert a sniffer.
115 kBaud. "Advanced Serial Port Monitor" or good old "Portmon.exe"

Strange...
That IS very puzzling. Wonder how the MCS really works then. If this is true, how does the "next" button work for example? How does the MPS4 get that signal?

Joe

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #27 of 49 Old 12-30-2018, 08:42 AM
AVS Forum Special Member
 
smoothtlk's Avatar
 
Join Date: Feb 2002
Location: Michigan
Posts: 2,247
Mentioned: 12 Post(s)
Tagged: 0 Thread(s)
Quoted: 274 Post(s)
Liked: 84
Quote:
Originally Posted by Bobone View Post

By cracking this together, I was hoping that some more skilled programmers would take this to the next level and realize the sought after integrations. We have come a long way from zero, and I fully agree that documenting NuvoNet more thoroughly would be valuable.


Bob
What hardware are you trying to integrate? Grand Concerto? Essentia? The no longer supported media player?
At least the Grand Concerto and Essentia is already fully supported in at least myServer. You can manage the switch and write info to the keyboards (if installed). I also assumed it was supported in CQC and Homeseer (likely in HS by a third party driver).
myServer doesn't have a specific driver for the Nuvo media player because it was redundant and less effective than the equivalent capability built into myServer (that is still well supported).
The protocol document apparently has been available for at least the GC and Essentia. Also not sure how consistent the protocol is across Nuvo devices. My assumption is the baseline communication methods were likely same (as they should have been).
smoothtlk is offline  
post #28 of 49 Old 12-30-2018, 08:59 AM
AVS Forum Special Member
 
jmorris644's Avatar
 
Join Date: Nov 2004
Location: St. Paul, MN
Posts: 1,277
Mentioned: 4 Post(s)
Tagged: 0 Thread(s)
Quoted: 42 Post(s)
Liked: 20
I have a Nuvo Essentia, a Nuvo P300 player and a Sonos Connect. The MG1 currently provides seamless control between the Essentia and the two streaming boxes. Along with maintaining the meta data on the keypad displays. But I feel this is an incomplete answer to replacing the MPS4 as I have yet to figure out how to manage the menu system.

I also began work on the Google chromecast that Bob was looking for.

All of this is also controlled by Alexa through the MG1.

Joe
Bobone likes this.

A Proud Father >
Daughter's Music
jmorris644 is offline  
post #29 of 49 Old 01-07-2019, 02:13 PM - Thread Starter
Senior Member
 
Join Date: Dec 2017
Location: Sweden
Posts: 218
Mentioned: 2 Post(s)
Tagged: 0 Thread(s)
Quoted: 96 Post(s)
Liked: 16
Quote:
Originally Posted by jmorris644 View Post
That IS very puzzling. Wonder how the MCS really works then. If this is true, how does the "next" button work for example? How does the MPS4 get that signal?
Joe
Sorry, I missed your question.

RS485: - Baudrate is 230400 Baud. Tolerance between 215 and 245 kBaud (see the edited second post in this thread).

The "Nuvo-Card" probably gets e.g. "Button dwn" from the NuVoNet RS485 and passes it on to the "PC-Card" in some way. Reading the hex appears quite feasible to crack, as I sketched above last spring.

Some other cable must be providing the data?
BTW, what does the traffic look like in the cable between the GC and the MPS4 (NuvoCard)? Is it like the more advanced telnet traffic or is the passthrough just a dumb physical connection with standard Nuvo protocol?

Last edited by Bobone; 01-11-2019 at 06:12 AM.
Bobone is offline  
post #30 of 49 Old 01-07-2019, 03:03 PM
AVS Forum Addicted Member
 
jautor's Avatar
 
Join Date: Jun 2001
Location: NW Houston, TX
Posts: 10,851
Mentioned: 33 Post(s)
Tagged: 1 Thread(s)
Quoted: 1385 Post(s)
Liked: 896
So this can be explained from the original MusicPort - which was the Autonomic MCS software (that you run on your PC acting as a server) along with the NuVoNet adapter (NNA).

Single serial cable connected from the PC running MCS to the NNA - and from the NNA you need at least the Rs485 NuVoNet connection, and optionally (but really want it) RS232 to the GC's port.

All of the "source" commands flow over RS485, but system configuration and other non-source-specific commands go over RS232 to the GC. You can operate MCS using just RS485 - but some commands like #ALLOFF aren't seen. The NuVoNet adapter routes commands from the PC to the 485/232 outputs as required. With the MPS4 that hardware is on board, so Com2 is likely the RS232 output which won't show much traffic as a source - it mostly gets used during configuration time.

There are also some special commands that aren't forwarded by the NNA - for example the NuVo Tuner units react as if they get an "All Off" command (which comes over RS232), but they only connect via NuVoNet - and there's no NuVoNet equivalent command seen on the NNA output! So there's some special NuVoNet commands that are eaten by the NNA and never seen by the host. Very odd in that respect.

I assume this was all done to ensure that 3rd parties couldn't (easily) build source products that would compete with NuVo's own products back in those days...


Jeff

Rock Creek Theater -- CIH, Panamorph, Martin Logan, SVS PB2000, Carada Masquerade, Grafik Eye, Bar table, Green Glue, JVC RS50 
NOTE: If you find dead photo / blocked Photobucket links in any of my posts, please PM me and I will fix them.
jautor is offline  
Sponsored Links
Advertisement
 
Reply Home A/V Distribution

Tags
grand concerto , nuvo , nuvonet , protocol , rs485

Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page


Forum Jump: 

Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off