docs(who-25): document gateway compatibility and hardware boundaries by GreenGrassBlueOcean · Pull Request #49 · OpenWebNet-HA/OpenWebNet-Encyclopedia

GreenGrassBlueOcean · 2026-10-09T17:25:21Z

Summary

Document function-specific gateway compatibility for CEN+ and dry-contact/IR using the manufacturer tables and scoped published oracle results.

Cite the CEN/CEN+ specification page 24 and dry-contact/IR specification page 13 independently. Preserve the F453AV firmware distinction and unspecified firmware values.
Separate published support, recorded socket replies, and recorded bus output. Describe MH200N, F454, MH202 and MyHomeServer1 observations only for the two inspected CEN+ inputs, exact firmware versions, pinned oracle revision and declared harness conditions.
Omit MH200 immediate-NACK, namespace-wide rejection and event-handling assertions pending sanitized physical bench captures. Retain the published absence of CEN+ and dry-contact/IR availability on MH200.
Reconcile current main while preserving its historical ScenarioPlus/contact documentation and all existing identities.
Add 20 reviewed atomic claims and four original-artifact evidence reviews. Preserve byte-identical published result files and their Git blob/SHA-256 fingerprints.
Allocate unused section and retrieval identities; substantive compatibility sections are claimed, while the new README section is navigation only.

Evidence scope

The published oracle results are inspected at revision af8ec0ceaff4c82a1a71f2a3ac5d01ad2095de7b; no emulator or physical gateway was run for this change. The documented results concern *25*21#1*21## and *25*23#8*233##. MH200N 010108, F454 020051 and MyHomeServer1 028206 record NACK with bus output; MH202 010024 records ACK without bus output. Neither combination establishes physical execution or gateway-wide WHO 25 capability.

The canonical source links, firmware/harness limits and original result hashes are recorded in project/review/who25-gateway-compatibility.md and the Machine KB provenance.

Machine KB changes

Preserve all existing identities from main; add gateway sections d000060:s000007, d000061:s000014, and d000062:s000006.
Allocate retrieval chunks r007930–r007932 and new atomic claims c073994–c074013.
Retain existing claims, with 19 affected source pins/context records reviewed and three existing ACK statements qualified as published exchanges.
Candidate output contains 74,386 claims and 8,008 retrieval chunks across 346 canonical documents.

Validation

Two independent clean builds of the final version produced byte-identical manifests and generated artifacts.
Final artifacts passed hashes, schemas, references, lifecycle, text hygiene and cross-artifact consistency; the final privacy scan passed across 21 surfaces.
All five WHO 25 regression tests and all five reference-registry tests passed on the corrected version.
The broad unit run passed 226/227 cases; its sole source-ID-format error was fixed, and the affected module passed on rerun. The complete broad suite was not rerun after this metadata correction.
The full Machine KB pipeline passed before the final provenance-only corrections. Exact comparison proves that the final generated delta is limited to three corrected manual citations and four new source-ID substitutions.
55 evidence acceptance tests, four evidence review packages, eight schema tests, 12 catalogue transport tests, mechanical ESG/ECV checks, the source audit, Device completeness and Git LFS integrity passed.
Hosted CI validates the pushed revision separately from these local checks.

- Document gateway compatibility for WHO 25 (CEN+, Dry Contact / IR). - Clarify supported gateways (MH200N, MH202, F454, MyHomeServer1) vs unsupported legacy MH200 (Model 4) returning gateway NACK (*#*0##). - Cite normative Legrand WHO 25 v1.0.0 p. 13 and live bench verification. - Update Machine KB section identities, chunk identities, claim coverage, and regenerated deterministic artifacts.

anotherjulien · 2026-10-11T14:14:21Z

Thank you @GreenGrassBlueOcean! Documenting this gateway boundary is useful, and the published manuals do support the MH200 limitation 🙂

I’d like a few changes before merging, mainly to keep the conclusions aligned with their evidence and make sure the new information is represented properly in the Machine KB:

Separate support from ACK/NACK behavior. The compatibility table currently associates supported gateways with ACK, but the oracle results show some tested CEN+ commands producing bus output while returning NACK, including on MyHomeServer1. Could you distinguish functional support, bus forwarding, and the socket reply, and qualify the observations by firmware and test setup?
Correct the specification references. Page 13 of the dry-contact/IR specification explicitly marks MH200 as unsupported, but does not list MH202 or F454. It also documents F453 and firmware-dependent F453AV support. CEN+ has its own table on page 24 of the CEN/CEN+ specification. Please preserve those distinctions and cite the appropriate implementation evidence for the later gateways.
Preserve and scope the MH200 bench evidence. Could you add or link the sanitized capture for the listed probes, including the valid *25*21#1*21## short press? The manual-backed lack of CEN+ and dry-contact/IR support can remain explicit, but “all WHO 25 frames return an immediate NACK” goes further than the demonstrated exchanges. Please distinguish published incompatibility from the responses observed on FW 2.1.0, and avoid describing *#25*21## as a published CEN+ status query.
Add the new atomic claims. The three new sections contain factual compatibility assertions, but are currently classified as nonclaim. Please add reviewed claims with their evidence and applicability, then regenerate the coverage, artifacts, and test expectations.
Update against current main and allocate unused IDs. The new retrieval IDs r001174–r001176 are already used by Device documentation published in Machine KB 0.2.0. Please preserve those existing assignments, allocate fresh retrieval IDs and the necessary new claim IDs, then regenerate and run the checks against the updated branch.

The checks passing is a good foundation. These changes would make the documented boundary traceable and usable by both readers and machine consumers. Thanks again!

anotherjulien · 2026-10-17T11:35:15Z

I’ve prepared the documentation corrections and Machine KB integration on my side, keeping the manual-backed MH200 limitations and the scoped published oracle results 🙂

Could you share the sanitized MH200 FW 2.1.0 captures behind the bench observations? In particular, it would help to have:

The gateway model/firmware identification and the relevant bench setup, including whether a CEN+ device was connected and configured.
The exact transmitted and received frames for the probes you tested: *25*21#1*21##, *25*11#0*11##, and *#25*21##. Please keep the CEN+ short press, ScenarioPlus command, and status probe separate; the last is not a published CEN+ status query.
The session type, relative timings, and observation windows, including any preceding replies needed to establish which request the ACK or NACK belongs to.
If the conclusion also covers event forwarding, the corresponding event-session capture and the action that generated the event.

Please remove credentials, network identifiers, and unrelated installation details while preserving the protocol exchanges and timing needed to interpret them.

For now, I’ve left out the immediate-NACK, namespace-wide rejection, and event-handling claims that depend on those missing captures. Once the traces are available, we can add the observations with their firmware and test conditions stated explicitly. There’s no need for you to allocate the new KB IDs; I’m handling that with the integration changes.

GreenGrassBlueOcean · 2026-10-17T11:58:08Z

Thank you @anotherjulien for reconciling main, structuring the review package, and handling the Machine KB ID allocations!

Below are:

The sanitized dual-session (*99*0## command + concurrent *99*1## event) wire captures from the physical BTicino MH200 (FW 2.1.0) covering gateway identification, positive-control replies, and the three separated WHO 25 probes (*25*21#1*21##, *25*11#0*11##, and *#25*21##), plus the remaining who25-messages stimuli.
Ready-to-use manifest.json, frames.jsonl, and privacy.json artifacts matching the evidence/ schema.
A summary of the firmware oracle work (OpenWebNet-HA/own-firmware-oracle) completed since revision af8ec0ceaff4c82a1a71f2a3ac5d01ad2095de7b (up to current main at 8a61bbeb1d26354241debac84a7310142e5ab3a5, oracle_version=3), which now includes emulated MH200 (020102, FW 2.1.2) and emulated F453 (010100, FW 1.1.0) across all 22 suites, as well as the $04 PIC responder ACK fix (fe0eff5) and CPU-idle settle window (settle_ms=3000) that resolved the earlier nack/silent harness artifacts on MH200N, F454, and MH202.

1. Physical MH200 (FW 2.1.0) Bench Setup & Gateway Identification

Hardware & Bus Setup

Gateway: Physical BTicino MH200 (1st-generation Scenario Programmer, article 003535, MAC OUI 00:03:50).
On-wire Gateway Identity:
- *#13**15## $\rightarrow$ *#13**15*4## (MODEL = 4, MH200)
- *#13**16## $\rightarrow$ *#13**16*2*1*0## (Firmware version 2.1.0)
- *#13**23## $\rightarrow$ *#13**23*2*0*6## (Kernel version 2.0.6)
- *#13**24## $\rightarrow$ *#13**24*3*0*5## (Distribution version 3.0.5)
- *#1013*0*1## $\rightarrow$ *#1013**1*4## (WHO 1013 diagnostic object model 4)
Connected Bus Topology & WHO 25 Device Presence:
- The gateway is connected to a live MyHOME SCS bus with WHO 1 lighting/dimmers (F414, F418U2), WHO 2 covers (including secondary bus 02 behind an F422 interface), WHO 5 burglar alarm, WHO 9 auxiliary channels, WHO 16 sound diffusion, and WHO 17 resident MH200 scenarios.
- No physical CEN+ (WHO 25) pushbutton or WHO 25 dry-contact/IR interface (e.g., F428 in WHO 25 mode) is connected or configured on this installation, as the 1st-generation MH200 only supports Basic CEN (WHO 15) and WHO 17 scenes.
- Scope of event-session observation: Because no physical WHO 25 transmitter is installed on the SCS bus to generate an inbound hardware bus event, the physical capture establishes:
  1. Outbound command-session rejection (*#*0## in 5.18–6.23 ms) for each tested probe.
  2. Complete silence on the concurrent *99*1## event session for all WHO 25 probes (whereas accepted queries and autonomous gateway broadcasts such as *#13**22*...## are actively delivered on the same event session).

2. Sanitized Dual-Session Wire Capture (Physical MH200 FW 2.1.0)

2.1 Primary Capture: Identification + Three Separated `WHO 25` Probes (`2,000 ms` Observation Windows)

Two concurrent TCP connections were opened to port 20000:

event session (*99*1##): Authenticated at t = 17.89 ms and kept open continuously across the entire run.
command session (*99*0##): Authenticated at t = 34.94 ms.

Preceding identification queries (*#13**15##, *#13**16##, *#13**23##, *#13**24##, *#1013*0*1##) are spaced by ~400 ms and each completes with its data frame + *#*1## (ACK) on command (and data echo on event) before the next request is sent. Each of the three WHO 25 probes is then sent in its own isolated 2,000 ms observation window:

  t_rel (ms) | session | dir | frame                    | notes
-------------+---------+-----+--------------------------+------------------------------------------------------------------
     8.37 ms | event   | rx  | *#*1##                   | TCP greeting on event socket
     8.37 ms | event   | tx  | *99*1##                  | Request OpenWebNet event/monitor session
    14.31 ms | event   | rx  | *#<NONCE>##              | OPEN password challenge (nonce sanitized)
    14.33 ms | event   | tx  | *#<OPEN_PASSWORD_HASH>## | OPEN password response (credential sanitized)
    17.89 ms | event   | rx  | *#*1##                   | Event session established
    25.86 ms | command | rx  | *#*1##                   | TCP greeting on command socket
    25.86 ms | command | tx  | *99*0##                  | Request OpenWebNet command session
    31.48 ms | command | rx  | *#<NONCE>##              | OPEN password challenge (nonce sanitized)
    31.49 ms | command | tx  | *#<OPEN_PASSWORD_HASH>## | OPEN password response (credential sanitized)
    34.94 ms | command | rx  | *#*1##                   | Command session established
-------------+---------+-----+--------------------------+------------------------------------------------------------------
             |         |     |                          | --- Preceding Gateway Identification & Positive Controls ---
    34.96 ms | command | tx  | *#13**15##               | Query WHO 13 device model
    43.40 ms | command | rx  | *#13**15*4##             | Reply (+8.44 ms): MODEL = 4 (MH200)
    43.40 ms | command | rx  | *#*1##                   | Command ACK for *#13**15##
    70.03 ms | event   | rx  | *#13**15*4##             | Concurrent event session receives *#13**15*4## (+35.07 ms)
   442.23 ms | command | tx  | *#13**16##               | Query WHO 13 firmware version
   452.73 ms | command | rx  | *#13**16*2*1*0##         | Reply (+10.50 ms): Firmware 2.1.0
   452.73 ms | command | rx  | *#*1##                   | Command ACK for *#13**16##
   459.33 ms | event   | rx  | *#13**16*2*1*0##         | Concurrent event session receives *#13**16*2*1*0## (+17.10 ms)
   846.12 ms | command | tx  | *#13**23##               | Query WHO 13 kernel version
   855.54 ms | command | rx  | *#13**23*2*0*6##         | Reply (+9.42 ms): Kernel 2.0.6
   855.54 ms | command | rx  | *#*1##                   | Command ACK for *#13**23##
   863.10 ms | event   | rx  | *#13**23*2*0*6##         | Concurrent event session receives *#13**23*2*0*6## (+16.98 ms)
  1252.91 ms | command | tx  | *#13**24##               | Query WHO 13 distribution version
  1262.54 ms | command | rx  | *#13**24*3*0*5##         | Reply (+9.63 ms): Distribution 3.0.5
  1262.55 ms | command | rx  | *#*1##                   | Command ACK for *#13**24##
  1269.76 ms | event   | rx  | *#13**24*3*0*5##         | Concurrent event session receives *#13**24*3*0*5## (+16.85 ms)
  1654.99 ms | command | tx  | *#1013*0*1##             | Query WHO 1013 gateway diagnostic object model
  1664.69 ms | command | rx  | *#1013**1*4##            | Reply (+9.70 ms): Object Model = 4
  1664.70 ms | command | rx  | *#*1##                   | Command ACK for *#1013*0*1##
  1668.35 ms | event   | rx  | *#1013**1*4##            | Concurrent event session receives *#1013**1*4## (+13.36 ms)
-------------+---------+-----+--------------------------+------------------------------------------------------------------
             |         |     |                          | --- Probe 1: CEN+ Short Press (2,000 ms observation window) ---
  2062.42 ms | command | tx  | *25*21#1*21##            | CEN+ short press (pushbutton 1, virtual object 21)
  2068.13 ms | command | rx  | *#*0##                   | Immediate socket NACK (+5.71 ms); 0 event-session frames in 2.0 s
-------------+---------+-----+--------------------------+------------------------------------------------------------------
             |         |     |                          | --- Probe 2: ScenarioPlus Command (2,000 ms observation window) ---
  4068.83 ms | command | tx  | *25*11#0*11##            | ScenarioPlus activation command (scenario 0, object 11)
  4074.01 ms | command | rx  | *#*0##                   | Immediate socket NACK (+5.18 ms); 0 event-session frames in 2.0 s
-------------+---------+-----+--------------------------+------------------------------------------------------------------
             |         |     |                          | --- Probe 3: Dry-Contact Status Query (2,000 ms window) ---
  6064.32 ms | command | tx  | *#25*21##                | WHO 25 dry-contact/IR status query (not a CEN+ status query)
  6070.55 ms | command | rx  | *#*0##                   | Immediate socket NACK (+6.23 ms); 0 event-session frames in 2.0 s

2.2 Extended Capture: All `who25-messages` Stimuli + Positive Bus Control (`#90##`) & Live Event-Session Clock Broadcast

In an extended capture run on the same physical MH200 (FW 2.1.0) including positive bus control *#9*0## and the remaining five stimuli from the oracle's who25-messages suite (*25*11#121*10##, *25*12*131##, *25*23#8*233##, *25*31#1*339##, *25*32#1*33##), note at t = 3655.29 ms that the event session actively delivered the gateway's autonomous WHO 13 clock broadcast (*#13**22*...##) while remaining silent for every WHO 25 frame:

  t_rel (ms) | session | dir | frame                                  | notes
-------------+---------+-----+----------------------------------------+----------------------------------------------------
  1580.55 ms | command | tx  | *#9*0##                                | Positive control: WHO 9 aux channel 0 status query
  1589.96 ms | command | rx  | *9*0*0##                               | Reply (+9.41 ms): Aux channel 0 OFF
  1589.96 ms | command | rx  | *#*1##                                 | Command ACK for *#9*0##
  1593.41 ms | event   | rx  | *9*0*0##                               | Event session receives *9*0*0## (+12.86 ms)
  1888.68 ms | command | tx  | *25*21#1*21##                          | CEN+ short press
  1894.21 ms | command | rx  | *#*0##                                 | Command NACK (+5.53 ms); event session silent
  2905.69 ms | command | tx  | *25*11#0*11##                          | ScenarioPlus ON
  2911.95 ms | command | rx  | *#*0##                                 | Command NACK (+6.26 ms); event session silent
  3655.29 ms | event   | rx  | *#13**22*13*53*04*002*06*17*10*2026##  | Autonomous WHO 13 clock broadcast on event session
  3919.55 ms | command | tx  | *#25*21##                              | Dry-contact/IR status query
  3924.43 ms | command | rx  | *#*0##                                 | Command NACK (+4.88 ms); event session silent
  4934.04 ms | command | tx  | *25*11#121*10##                        | ScenarioPlus command (*25*11#121*10##)
  4939.30 ms | command | rx  | *#*0##                                 | Command NACK (+5.26 ms); event session silent
  5547.15 ms | command | tx  | *25*12*131##                           | ScenarioPlus OFF command (*25*12*131##)
  5553.30 ms | command | rx  | *#*0##                                 | Command NACK (+6.15 ms); event session silent
  6152.60 ms | command | tx  | *25*23#8*233##                         | CEN+ extended press repeat (*25*23#8*233##)
  6199.72 ms | command | rx  | *#*0##                                 | Command NACK (+47.12 ms); event session silent
  6763.78 ms | command | tx  | *25*31#1*339##                         | Dry-contact/IR inactive (*25*31#1*339##)
  6790.81 ms | command | rx  | *#*0##                                 | Command NACK (+27.03 ms); event session silent
  7369.34 ms | command | tx  | *25*32#1*33##                          | Dry-contact/IR active (*25*32#1*33##)
  7395.69 ms | command | rx  | *#*0##                                 | Command NACK (+26.35 ms); event session silent

2.3 Sanitized `evidence/cap-mh200-who25-boundary-20261017/` Files

frames.jsonl (command + event session exchanges)

{"seq": 1, "t_rel_ms": 0, "dir": "tx", "raw": "*#13**15##", "who": 13, "where": "", "what": null, "dimension": 15, "dimension_values": null, "annotation": "Command session: query WHO 13 gateway model", "interface": null, "scope": null}
{"seq": 2, "t_rel_ms": 8, "dir": "rx", "raw": "*#13**15*4##", "who": 13, "where": "", "what": null, "dimension": 15, "dimension_values": ["4"], "annotation": "Command session: gateway reports MODEL = 4 (MH200)", "interface": null, "scope": null}
{"seq": 3, "t_rel_ms": 8, "dir": "rx", "raw": "*#*1##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Command session: ACK for *#13**15##", "interface": null, "scope": null}
{"seq": 4, "t_rel_ms": 35, "dir": "rx", "raw": "*#13**15*4##", "who": 13, "where": "", "what": null, "dimension": 15, "dimension_values": ["4"], "annotation": "Concurrent event session: receives *#13**15*4##", "interface": null, "scope": null}
{"seq": 5, "t_rel_ms": 407, "dir": "tx", "raw": "*#13**16##", "who": 13, "where": "", "what": null, "dimension": 16, "dimension_values": null, "annotation": "Command session: query WHO 13 firmware version", "interface": null, "scope": null}
{"seq": 6, "t_rel_ms": 418, "dir": "rx", "raw": "*#13**16*2*1*0##", "who": 13, "where": "", "what": null, "dimension": 16, "dimension_values": ["2", "1", "0"], "annotation": "Command session: gateway reports firmware 2.1.0", "interface": null, "scope": null}
{"seq": 7, "t_rel_ms": 418, "dir": "rx", "raw": "*#*1##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Command session: ACK for *#13**16##", "interface": null, "scope": null}
{"seq": 8, "t_rel_ms": 424, "dir": "rx", "raw": "*#13**16*2*1*0##", "who": 13, "where": "", "what": null, "dimension": 16, "dimension_values": ["2", "1", "0"], "annotation": "Concurrent event session: receives *#13**16*2*1*0##", "interface": null, "scope": null}
{"seq": 9, "t_rel_ms": 811, "dir": "tx", "raw": "*#13**23##", "who": 13, "where": "", "what": null, "dimension": 23, "dimension_values": null, "annotation": "Command session: query WHO 13 kernel version", "interface": null, "scope": null}
{"seq": 10, "t_rel_ms": 821, "dir": "rx", "raw": "*#13**23*2*0*6##", "who": 13, "where": "", "what": null, "dimension": 23, "dimension_values": ["2", "0", "6"], "annotation": "Command session: gateway reports kernel 2.0.6", "interface": null, "scope": null}
{"seq": 11, "t_rel_ms": 821, "dir": "rx", "raw": "*#*1##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Command session: ACK for *#13**23##", "interface": null, "scope": null}
{"seq": 12, "t_rel_ms": 828, "dir": "rx", "raw": "*#13**23*2*0*6##", "who": 13, "where": "", "what": null, "dimension": 23, "dimension_values": ["2", "0", "6"], "annotation": "Concurrent event session: receives *#13**23*2*0*6##", "interface": null, "scope": null}
{"seq": 13, "t_rel_ms": 1218, "dir": "tx", "raw": "*#13**24##", "who": 13, "where": "", "what": null, "dimension": 24, "dimension_values": null, "annotation": "Command session: query WHO 13 distribution version", "interface": null, "scope": null}
{"seq": 14, "t_rel_ms": 1228, "dir": "rx", "raw": "*#13**24*3*0*5##", "who": 13, "where": "", "what": null, "dimension": 24, "dimension_values": ["3", "0", "5"], "annotation": "Command session: gateway reports distribution 3.0.5", "interface": null, "scope": null}
{"seq": 15, "t_rel_ms": 1228, "dir": "rx", "raw": "*#*1##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Command session: ACK for *#13**24##", "interface": null, "scope": null}
{"seq": 16, "t_rel_ms": 1235, "dir": "rx", "raw": "*#13**24*3*0*5##", "who": 13, "where": "", "what": null, "dimension": 24, "dimension_values": ["3", "0", "5"], "annotation": "Concurrent event session: receives *#13**24*3*0*5##", "interface": null, "scope": null}
{"seq": 17, "t_rel_ms": 1620, "dir": "tx", "raw": "*#1013*0*1##", "who": 1013, "where": "0", "what": null, "dimension": 1, "dimension_values": null, "annotation": "Command session: query WHO 1013 gateway diagnostic object model", "interface": null, "scope": null}
{"seq": 18, "t_rel_ms": 1630, "dir": "rx", "raw": "*#1013**1*4##", "who": 1013, "where": "", "what": null, "dimension": 1, "dimension_values": ["4"], "annotation": "Command session: gateway reports diagnostic object model 4", "interface": null, "scope": null}
{"seq": 19, "t_rel_ms": 1630, "dir": "rx", "raw": "*#*1##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Command session: ACK for *#1013*0*1##", "interface": null, "scope": null}
{"seq": 20, "t_rel_ms": 1633, "dir": "rx", "raw": "*#1013**1*4##", "who": 1013, "where": "", "what": null, "dimension": 1, "dimension_values": ["4"], "annotation": "Concurrent event session: receives *#1013**1*4##", "interface": null, "scope": null}
{"seq": 21, "t_rel_ms": 2027, "dir": "tx", "raw": "*25*21#1*21##", "who": 25, "where": "21", "what": "21#1", "dimension": null, "dimension_values": null, "annotation": "Probe 1 (command session): CEN+ short press pushbutton 1 on virtual object 21 (2,000 ms observation window)", "interface": null, "scope": null}
{"seq": 22, "t_rel_ms": 2033, "dir": "rx", "raw": "*#*0##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Probe 1 reply (command session): immediate NACK (+5.71 ms); 0 frames on concurrent event session during 2,000 ms window", "interface": null, "scope": null}
{"seq": 23, "t_rel_ms": 4034, "dir": "tx", "raw": "*25*11#0*11##", "who": 25, "where": "11", "what": "11#0", "dimension": null, "dimension_values": null, "annotation": "Probe 2 (command session): ScenarioPlus command on WHERE 11 (2,000 ms observation window)", "interface": null, "scope": null}
{"seq": 24, "t_rel_ms": 4039, "dir": "rx", "raw": "*#*0##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Probe 2 reply (command session): immediate NACK (+5.18 ms); 0 frames on concurrent event session during 2,000 ms window", "interface": null, "scope": null}
{"seq": 25, "t_rel_ms": 6029, "dir": "tx", "raw": "*#25*21##", "who": 25, "where": "21", "what": null, "dimension": null, "dimension_values": null, "annotation": "Probe 3 (command session): WHO 25 dry-contact/IR status query on WHERE 21 (2,000 ms observation window)", "interface": null, "scope": null}
{"seq": 26, "t_rel_ms": 6036, "dir": "rx", "raw": "*#*0##", "who": null, "where": null, "what": null, "dimension": null, "dimension_values": null, "annotation": "Probe 3 reply (command session): immediate NACK (+6.23 ms); 0 frames on concurrent event session during 2,000 ms window", "interface": null, "scope": null}

3. Firmware Oracle Work (`OpenWebNet-HA/own-firmware-oracle`) Since `af8ec0c`

Since af8ec0ceaff4c82a1a71f2a3ac5d01ad2095de7b (oracle_version=1), we completed a large body of work in OpenWebNet-HA/own-firmware-oracle (up to current main at 8a61bbeb1d26354241debac84a7310142e5ab3a5, oracle_version=3) that directly explains the MH200 behavior and refines the cross-gateway WHO 25 results:

3.1 `MH200` (`020102`, FW 2.1.2) Unpacked, Catalogued & Emulated Across All 22 Suites (PR #45, PR #47)

Image provenance: Official Legrand service pack MH200_020102.zip (SHA-256: 373305c11b2d72ff08912c83d1b4770d2315983eab90bdd3a9b1c04350b2a96b) $\rightarrow$ MH200_020102.fwz (SHA-256: 53848de84438f9a395501cf955d20762951faacb8449e1271ed5e027448e1e3b).
Daemon & stack_open.xml architecture (oracle/targets/MH200/020102.yaml, findings/MH200/README.md):
- home/bticino/cfg/stack_open.xml (SHA-256: f78076d517b665340269706ffcd7baa30be20eb64b709a72a116076688e07f07) configures openserver (SHA-256: 539f943d7f298be10a77d5990b7163c0fe1a8616c45d865486291d71b3899583) and scsserver (SHA-256: ff49feebdaaad64b4cdcc61b625b3fba002637086c7b0de7397968627da98106) alongside bt_luci (SHA-256: f4a2d6945f94476e26e0a653e173da7fb9ddd5709b211dd44ec9471001052fb7, port 40001, WHO 0, 1, 2, 14, 15, 1001), bt_device (WHO 13, 1013), bt_termo (WHO 4), bt_energia (WHO 3), bt_difson (WHO 16, 1016), bt_alarm (WHO 5, 9), bt_vct (WHO 6, 7), and bt_taskmanager (WHO 17).
- WHO 25 is not registered in stack_open.xml on MH200 020102, and no translator daemon binds WHO 25. When openserver receives any WHO 25 frame on TCP 20000, it finds no registered translator for WHO=25 and immediately returns *#*0## (nack, silent, -) without forwarding anything to scsserver or /dev/ttyPIC. That directly explains the 5–6 ms TCP-layer NACK observed on physical MH200 FW 2.1.0.
Emulated MH200 020102 WHO 25 suite results (at 8a61bbeb1d26354241debac84a7310142e5ab3a5):
- results/MH200/020102/oracle/full/who25-messages.tsv: all 6 inputs (*25*11#121*10##, *25*12*131##, *25*21#1*21##, *25*23#8*233##, *25*31#1*339##, *25*32#1*33##) return nack / silent / -.
- results/MH200/020102/oracle/full/trace-corpus.tsv (lines 49 & 79): *#25*21## and *25*11#0*11## both return nack / silent / - (while *#13**15## $\rightarrow$ own:*#13**15*4##, *#13**16## $\rightarrow$ own:*#13**16*2*1*2##, *#1013*0*1## $\rightarrow$ own:*#1013**1*4##, and *#9*0## $\rightarrow$ own:*9*0*0## all return ack / out).
- results/MH200/020102/oracle/full/matrix-refused.tsv (lines 24–26): *25*21*0001##, *25*22*0001##, *25*23*0001## all return nack / silent / -.

3.2 `F453` (`010100`, FW 1.1.0, `WS_6DIN`) Unpacked, Catalogued & Emulated Across All 22 Suites (PR #51)

Extracted WS_6DIN_010100.fwz (SHA-256: da02a317e44827beef0b51fd65e4fdf4f53f36865eec85dbca130c14685ed626) from MyHOME_Suite_030538.exe (findings/F453/README.md).
In F453 010100, home/bticino/cfg/stack_open.xml (SHA-256: 8774ea4c780dec01ad9e1f9139d2eaae3c899149a6a99ca6da8562b620b682b6) explicitly routes WHO 0.1.2.14.15.25.1000 to bt_luci (SHA-256: 1f8d6e18490b1266a506109ab3084f31cdbc7fe35966bd11a9c4d6d804e42b9d).
In results/F453/010100/oracle/full/who25-messages.tsv and trace-corpus.tsv, F453 (010100) returns ack + out (bus:24 30 34 42 ... | own:*25*...##) for *25*12*131##, *25*21#1*21##, *25*23#8*233##, *25*31#1*339##, *25*32#1*33##, and *25*11#0*11##, corroborating the published manual tables (WHO_15-25.pdf p. 24 and WHO_25.pdf p. 13) with direct firmware execution.

3.3 Why `MH200N`, `F454`, and `MH202` Verdicts Changed Between `af8ec0c` (`oracle_version=1`) and `8a61bbe` (`oracle_version=3`)

At revision af8ec0ceaff4c82a1a71f2a3ac5d01ad2095de7b (oracle_version=1, settle_ms=300):

PicResponder did not yet acknowledge $04 outbound bus frames on /dev/ttyPIC (fixed in fe0eff5: "fix(oracle): acknowledge $04 bus frames, lengthen command timeout and reconnect on timeout"). Because scsserver/bt_luci on MH200N (010108) and F454 (020051) wait for the PIC's $04 ACK before returning *#*1## to openserver, they timed out and returned nack despite emitting the bus frame (out).
Step collection used a fixed settle_ms=300 cutoff instead of waiting for emulated daemon CPU-idle with settle_ms=3000 (fixed in 2e45bfa and 1b2e26d), which cut off MH202 (010024) before its bus output flushed (ack / silent).

Under oracle_version=3 at 8a61bbeb1d26354241debac84a7310142e5ab3a5, across all 12 emulated gateways:

Gateway	Firmware	`2521#121##` & `2523#8233##` (`who25-messages.tsv`)	`2511#0*11##` (`trace-corpus.tsv` L79)	`#2521##` (`trace-corpus.tsv` L49)	`who25-messages.tsv` Git Blob / SHA-256 at `8a61bbe`
MH200	`020102`	`nack` / `silent` (`-`)	`nack` / `silent` (`-`)	`nack` / `silent` (`-`)	`169ebf04e8934fb29b93ff585f96ef7271150f34` `8895d1c545f80ae4c0177a6cc2ea135d7112b11983cc8875119f38a21100ba5e`
MH200N	`010108`	`ack` / `out` (`bus:24 30 34 42... \| own:25...##`)	`ack` / `out` (`bus:24 30 34 42 31 30 31 39 33 30 30 0d \| own:2511#0*11##`)	`nack` / `silent` (`-`)	`22568253f2f90aeb352f421ff3f52a55b88dafee` `1dfd7a802bb2a763276187bc13649d7071deefb492f9a9f7a070957feef30148`
F453	`010100`	`ack` / `out` (`bus:24 30 34 42... \| own:25...##`)	`ack` / `out` (`bus:24 30 34 42 31 30 31 39 33 30 30 0d \| own:2511#0*11##`)	`nack` / `silent` (`-`)	`d4a3f0b4c77762f9301d5c04db34ef90bb481b8e` `ac9d494099c530c5a8500d4cb74db6400add3ffe9f6862dadea0fdaccb01a6df`
F453AV	`030014`	`ack` / `out` (`bus:24 30 34 42... \| own:25...##`)	`ack` / `out` (`bus:24 30 34 42 31 30 31 39 33 30 30 0d \| own:2511#0*11##`)	`nack` / `silent` (`-`)	`42ad2fb4d3171889d0ccd1cd17ec02b5f9ab84ce` `5989266aa693b33cb119c2e3e1fade2a46f121efbd4c1a397fdea67d4ded91bf`
F454	`020051`	`ack` / `out` (`bus:24 30 34 42... \| own:25...##`)	`ack` / `out` (`bus:24 30 34 42 31 30 31 39 33 30 30 0d \| own:2511#0*11##`)	`nack` / `silent` (`-`)	`dd9eebd6b5bb4792ef3f561fbebf44d1a7904d55` `f6669f98ab5297be2ae36566138d360c1d0e5f2aa3e71fad493f5f248bd70ba1`
F459	`020105`	`ack` / `out` (`bus:24 30 34 42... \| own:25...##`)	`ack` / `out` (`bus:24 30 34 42 31 30 31 39 33 30 30 0d \| own:2511#0*11##`)	`nack` / `silent` (`-`)	`703d33abdf103145d68be398ea668c65de5f7dec` `917c7e85308757c757dd89631914d938e07ccbd31dae6756765ad48c4e3c0dcf`
MH202	`010024`	`ack` / `out` (`bus:24 30 34 42... \| own:25...##`)	`ack` / `out` (`own:#0##`)	`nack` / `silent` (`-`)	`c1e437f88708d28b9840720a759d829cd58f2020` `53e76991e2324d02f101a1b66da692a450f5d0ba3274de76642debe0ab462fab`
MyHomeServer1	`028206`	`nack` / `out` (`bus:24 30 34 42...`)	`nack` / `out` (`bus:24 30 34 42 31 30 31 39 33 30 30 0d`)	`nack` / `silent` (`-`)	`febe9c37b4358d61474d916b3e62c9f059dfe818` `a444bf040cf2af9bd887a66251de4c90730e1d61f6940e767e2cea5e0643522f`
F460	`020012`	`nack` / `out` (`bus:24 30 30 34 42...`)	`nack` / `out` (`bus:24 30 30 34 42 31 30 31 39 33 30 30 0d`)	`nack` / `silent` (`-`)	`0c307cde8731cc441ed2e3b32f0c5df5248068ee` `c247ba5d7c43abdf903d3b871b0742a6730d5742e17ec65266124fda6720f2fb`
F461	`020011`	`nack` / `out` (`bus:24 30 30 34 42...`)	`nack` / `out` (`bus:24 30 30 34 42 31 30 31 39 33 30 30 0d`)	`nack` / `silent` (`-`)	`329fb1e52a8cfb58c19124d9ecc126e5dc20cbea` `d98089d6d8c8157e69569bf16767ebdb14584e6028d65b8b5668e16aa890943a`
F450	`020010`	`nack` / `silent` (`-`)	`nack` / `silent` (`-`)	`nack` / `silent` (`-`)	`eee8dfb608ae2987d85f3426686bef9bfc7adf92` `b796a99f205ef8d9d5ec8444430044c15752d836916fedb67a30c74ef53b7da6`
H4684	`020054`	`nack` / `silent` (`-`)	`nack` / `silent` (`-`)	`nack` / `silent` (`-`)	`6e62367fa0f2fc668f0aa0d7f85045434528801c` `1922b20d87b9336b09839a36a95c0441e7355dc1329938386875ef65e8153c47`

Let me know if you need any additional probes run on the physical MH200 (FW 2.1.0)!

Reconcile WHO 25 gateway compatibility with scoped evidence

61318ad

Navigation Menu

Repository navigation

docs(who-25): document gateway compatibility and hardware boundaries - #49

docs(who-25): document gateway compatibility and hardware boundaries#49
GreenGrassBlueOcean wants to merge 2 commits into
mainfrom
docs/who25-gateway-compatibility

GreenGrassBlueOcean commented Oct 9, 2026 •

edited by anotherjulien

Loading

Uh oh!

anotherjulien commented Oct 11, 2026

Uh oh!

anotherjulien commented Oct 17, 2026

Uh oh!

GreenGrassBlueOcean commented Oct 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

GreenGrassBlueOcean commented Oct 9, 2026 • edited by anotherjulien Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Evidence scope

Machine KB changes

Validation

Uh oh!

anotherjulien commented Oct 11, 2026

Uh oh!

anotherjulien commented Oct 17, 2026

Uh oh!

GreenGrassBlueOcean commented Oct 17, 2026

1. Physical MH200 (FW 2.1.0) Bench Setup & Gateway Identification

Hardware & Bus Setup

2. Sanitized Dual-Session Wire Capture (Physical MH200 FW 2.1.0)

2.1 Primary Capture: Identification + Three Separated WHO 25 Probes (2,000 ms Observation Windows)

2.2 Extended Capture: All who25-messages Stimuli + Positive Bus Control (*#9*0##) & Live Event-Session Clock Broadcast

2.3 Sanitized evidence/cap-mh200-who25-boundary-20261017/ Files

3. Firmware Oracle Work (OpenWebNet-HA/own-firmware-oracle) Since af8ec0c

3.1 MH200 (020102, FW 2.1.2) Unpacked, Catalogued & Emulated Across All 22 Suites (PR #45, PR #47)

3.2 F453 (010100, FW 1.1.0, WS_6DIN) Unpacked, Catalogued & Emulated Across All 22 Suites (PR #51)

3.3 Why MH200N, F454, and MH202 Verdicts Changed Between af8ec0c (oracle_version=1) and 8a61bbe (oracle_version=3)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

GreenGrassBlueOcean commented Oct 9, 2026 •

edited by anotherjulien

Loading

2.1 Primary Capture: Identification + Three Separated `WHO 25` Probes (`2,000 ms` Observation Windows)

2.2 Extended Capture: All `who25-messages` Stimuli + Positive Bus Control (`#90##`) & Live Event-Session Clock Broadcast

2.3 Sanitized `evidence/cap-mh200-who25-boundary-20261017/` Files

3. Firmware Oracle Work (`OpenWebNet-HA/own-firmware-oracle`) Since `af8ec0c`

3.1 `MH200` (`020102`, FW 2.1.2) Unpacked, Catalogued & Emulated Across All 22 Suites (PR #45, PR #47)

3.2 `F453` (`010100`, FW 1.1.0, `WS_6DIN`) Unpacked, Catalogued & Emulated Across All 22 Suites (PR #51)

3.3 Why `MH200N`, `F454`, and `MH202` Verdicts Changed Between `af8ec0c` (`oracle_version=1`) and `8a61bbe` (`oracle_version=3`)