Plugwise protocol unleashed part 2: device information


In the Plugwise protocol unleashed series, I will describe the plugwise protocol. As far as I have been able to re-engineer it. I did this re-engineering work because there is no Linux/OSX software available to control your plugwise devices. All information in these series are based on the 2.0 firmware version!

DISCLAIMER: use of the information in these articles is at your own risk.
This information is not supported by Plugwise B.V. in any way.

In this part of the series we will have a look at the device information request and response.

Device information request

The device information request looks like this:


0023 – indicates the request code, in this case it’s the device information request code.
00D6F000023XXXX – is the mac address of the device we are requesting information about.
231B – is the CRC checksum.

Device information response

The device information response looks like this:
0024 0025000D6F000023XXXX 0A 01 866F 0004DFE8 01 85 0000 0473 0007 4AA66380 01 36EE

0024 – indicates the response code, in this case it’s the device information response code.
0025 – unknown, reverse checksum? Not interesting anyway.
000D6F000023XXXX – mac address of the device we requested information about.
0A – Year of the internal Plugwise clock, convert 0A to integer and you get 10.. add 2000 to it and you have 2010.
01 – Month of the internal Plugwise clock, convert 01 to integer and you get 1.
866F – Number of minutes of the internal Plugwise clock, convert 886F to integer and you get 34415. You can use this to calculate the days, hours and minutes, to get a datetime value.
0004DFE8 – Latest log buffer address, each log buffer contains 4 hours of information about the power usage. Convert this to integer, Then use: (logaddress – 278528) / 32 to get the log address. In this example the log address is: (319464 – 278528) / 32 = 1279
01 – Relay status (power on/power off) 01=ON, 00=OFF.
85 – Amount of herz the plugin operates on.
I use the following python code to determine the amount of hz:

    def determinehz(self, herz):
        Determines number of hz of a plugwise device.
        if herz == '85':
            return 50
        elif herz == 'C5':
            return 60
            return 0

000004730007 – This indicates the hardware version of the circle. No conversion is needed. In this case the hardware version is: 0000-0473-0007.
4AA66380 – This is the firmware version of the circle. The datetime is a POSIX (epoch) timestamp. The following python function converts it to a datetime object:

datetime.fromtimestamp(timestamp[, tz])

If you have any questions regarding the device information please let me know.. till next week! And happy plugwising! :-)

This is a multipart series, the other parts can be found here:
Plugwise protocol unleashed part 1: introduction

You can leave a response, or trackback from your own site.

9 Responses to “Plugwise protocol unleashed part 2: device information”

  1. Ettore Ferranti says:

    Hi, and thanks a lot for this very useful reverse engineering :)

    I was wondering if it was possible to extract more information from a plugwise than its power consumption (i.e. current, volt etc…). Do you if the plug is sending more info than a simple watts value?

    Looking forward to the next chapter ;)


  2. Maarten says:

    Hi Ettore,

    The plug is sending puless. So no current and voltage info.
    However you could use the following formula’s to calculate the current I think:
    Current = Watt / Volt

    You know the volts right? 230v in my case.
    So you could get the current aswell..


  3. Ettore Ferranti says:

    Hi Marteen,

    yes it would be possible to use that formula, it’s just that the volt value is never so constant. Anyway it will have to be enough :) Thanks a lot!!!


  4. […] series, the other parts can be found here: Plugwise protocol unleashed part 1:  introduction Plugwise protocol unleashed part 2: device information Posted in Plugwise unleashed | Tags: linux, Plugwise, POL « Plugwise protocol unleashed […]

  5. jhgrc says:

    Hmm, I get different kind of answer with 0024 reply code, is it because different firmware?

    IN : H: 30|30|32|34|30|30|30|44|36|46|30|30|30|30|22|43|49|52|34|22|30|30|30|30|35|44|44|35|30|30|30|34|34|34|01|60|35|30|30|31|38|35|30|30|30|30|30|34|34|30|30|31|30|37|34|38|42|34|32|35|33|38|30|32
    IN : A: 0 0 2 4 0 0 0 D 6 F 0 0 0 0 ” C I R 4 ” 0 0 0 0 5 D D 5 0 0 0 4 4 4 ` 5 0 0 1 8 5 0 0 0 0 0 4 4 0 0 1 0 7 4 8 B 4 2 5 3 8 0 2

    So I have 0024 but not 0025 what you suspect some checksum. Immediately after 0024 I have MAC if Circle reporting my “CIRCLE4”. Then if after MAC is a year, my year is 2000 according to your analyzation.

    Then I am wondering why I have “01 60” -hex codes time to time inside answers. Have you seen those?

    Well I think it is easier to discuss at domotiga forums. I just wanted to note my findings here as I was coding my perl-software to diagnose plugwise protocol. And I could not decode 0024 well..

  6. Maarten says:


    This is indeed because of a different firmware version.
    Plugwise unleashed is focused on the newest firmware (v2)
    V2 completely changed the way things are handled..


  7. Roelof says:

    I am tying to figure out how to get data from the plugs. Do you know more about reading the buffers (archived data) in the plugs. Or better, how are the buffers structured. Looking for a way to read the data in a usefull way.

  8. […] For an explanation of the fields, see Maartens blog. […]

  9. robomotic says:

    Did you have a chance to work with the recent scan & sense bundle?

Leave a Reply