Somfy Wire (RS-485) Protocol

Somfy uses a very simple protocol for controlling the motors over RS-485, and it has been fairly easy to reverse engineer, so far. Somfy even provides the "ILT Command Calculator" utility (available at https://www.somfypro.com/downloads), which will show the raw bytes of every control command for a given motor or group address. I have provided information on all the control commands that are covered by Somfy's command calculator. There are also a number of other messages, and I have decoded a couple of those, too.

Overall Message Format

All messages that I've decoded so far follow the same basic format:

• Byte 0: Message ID
• Byte 1: Message length, subtracted from 0xFF
• Byte 2: Unknown
• Bytes 3..N: Payload
• Bytes N..N+1: Checksum

Length

The length is the overall length of the message, including the ID, length field, payload, and checksum. It is encoded by subtractin from 0xFF. For example, a length of 14 bytes would be encoded as F1.

Checksum

The checksum bytes simply contains the lower two bytes of the summation of all the previous bytes of the message, in big-endian order.

Control Commands

The control command message used a message ID of 0xAB. The entire message contains these fields:

• Byte 0: Message ID (AB)
• Byte 1: Message length (F1, decoded to 14)
• Byte 2: Unknown (observed to be FF)
• Bytes 3..5: Group address
• Bytes 6..8: Motor address
• Byte 9: Command
• Bytes 10..11: Parameters
• Bytes 12..13: Checksum

 

Addresses

The command either addresses a motor or a group, but not both at once. The unused address field is set to FF FF FF.

The motor address is the real address of the motor, not the ST30 address that is printed on the motor label (assuming it's an ST30 motor). I can't figure out why Somfy just doesn't print the real address on the motor label! Anyway, the conversion formula is very simple: reverse the order of the bytes and flip every bit. So, for instance:

Label Address: 06091F (00000110 00001001 00011111‬)

Real Address: E0F6F9 (11100000 11110110 11111001‬)

 

Command Byte

The command byte is one of the following:

• FE: Up
• FD: Down
• FC: Stop
• FA: Next IP UP
• F9: Next IP DOWN
• FB: Go to IP
• EF: Go to %
• F5: Jog Up 10 ms
• F4: Jog Down 10 ms

IPs are preset positions which are configured into the motor via the configuration utility at the above link. There are also some lock commands visible in the calculator tool, but I haven't documented them, because I haven't really looked into what they do.

Parameters

The parameter bytes are only used for some commands. For commands that don't take parameters,  these bytes should be FF. If a parameter byte is used, it's encoded by subtracting from FF. So 10 is encoded as F5. Of the above commands, the following take one parameter in the first parameter byte (values shown without encoding):

• Down: 0 or 10-255 (I'm not sure what this parameter is used for. The default seems to be 0, encoded as FF.)
• Go to IP: IP index (1-16)
• Go to %: Position (0-255)
• Jog Up/Down 10 ms: 1-255 (I'm not sure what this is used for. Number of 10 ms increments?)

 

Examples

Here are some examples of complete commands:

Tell motor with address ABCDEF to go up: AB F1 FF FF FF FF AB CD EF FE FF FF 0A FB

Tell group with address FEDCBA to go up: AB F1 FF FE DC BA FF FF FF FE FF FF 0B 28

Tell motor with address ABCDEF to go to 50%: AB F1 FF FF FF FF AB CD EF EF 80 FF 0A 6D

 

Other Messages

There are a number of other messages that are not shown in the ILT Command Calculator. These are are used for things like configuration (setting limits, group addresses, preset positions, etc.) as well as querying information from the motors (position, configuration). These are used by the "ILT2-ST30 Configuration Tool" (see Somfy link above). I was interested in being able to query the positions of my shades, so I decoded those messages. I haven't looked into any other messages.

Position Query

To query the position of the motor, the tool sends a message like this:

BB F4 FF 80 80 80 E0 F6 F9 6 FD

This contains the following fields:

• Byte 0: Message ID (BB)
• Byte 1: Message length (F1, decodes to 14)
• Byte 2: Unknown (observed to be FF)
• Bytes 3..5: Group address
• Bytes 6..8: Motor address
• Bytes 9..10: Checksum

The fields are used just like in the command messages above, except I've noticed the tool sets the group address to 80 80 80 instead of FF FF FF. In my experimentation, it doesn't seem to matter as long as a motor address is supplied.

You can send a position query to a group of motors by setting the motor address field to FF FF FF while setting the group address appropriately, and all the motors in that group will reply. I'm not sure this is a good idea, because the motors might try to talk over each other, but in practice, I haven't had this be an issue.

Position Reply

The motor replies with a message like this:

9B F1 DF E0 F6 F9 80 80 80 38 FB 60 08 4D

This contains the following fields:

• Byte 0: Message ID (9B)
• Byte 1: Message length (F1)
• Byte 2: Unknown (observed to be DF)
• Bytes 3..5: Motor address
• Bytes 6..8: Group address, always the same as in the query message
• Bytes 9..10: Position in pulses from top (encoded)
• Byte 11: Relative position (0 is bottom limit, FF is top limit)
• Bytes 12..13: Checksum

The position in pulses is encoded in little-endian, unlike the checksum (go figure!) and subtracted from 0xFFFF (as Somfy seems to like to do).