Skip to content

Diagnostic WHO Domains

Jump to bottom
anotherjulien edited this page Sep 14, 2026 · 2 revisions

Overview

The OpenWebNet diagnostic protocol is divided into several Diagnostic WHO domains.

Each domain appears to correspond to a functional/configuration family and provides a common framework for operations such as:

  • Device discovery;
  • Device selection;
  • Device interview;
  • configuration reading;
  • programming.

The diagnostic mechanism is similar across domains, but the addressing model can differ.

Known Diagnostic WHO Domains

The following domains have been observed or documented:

Functional domain Diagnostic WHO Observed discovery request
Automation WHO1001 *#1001*0*13##
Temperature Control WHO1004 *#1004*0*13##
Energy Management WHO1018 *#1018*0*13##
Access Control WHO1023 *#1023*0*13##
Device Diagnostic WHO1013 Not yet investigated in this project

Public OpenWebNet documentation explicitly identifies:

  • WHO1001 as Automation diagnostic;
  • WHO1004 as Thermoregulation diagnostic;
  • WHO1013 as Device diagnostic.

WHO1018 and WHO1023 have been observed in MyHOME Suite captures.

Common Diagnostic Model

The observed domains share a similar high-level workflow:

Diagnostic WHO
      │
      ▼
Discovery
      │
      ▼
Device selection
      │
      ▼
Device interview
      │
      ▼
Configuration reading
      │
      ▼
Programming

A common discovery pattern is:

*<DIAG_WHO>*12*0##
*#<DIAG_WHO>*0*13##

where:

  • WHAT12 prepares or resets discovery;
  • DIM13 requests hardware-ID enumeration.

This pattern has been observed with multiple Diagnostic WHO values.

WHO1001 — Automation Diagnostic

WHO1001 is the best-understood Diagnostic WHO in the current reverse-engineering work.

It covers MyHOME Suite's Automation domain and is used with Devices implementing functions such as:

  • lighting;
  • shutter/automation;
  • commands;
  • scenarios;
  • sensors;
  • mixed actuator/command Devices.

Addressing Model

WHO1001 uses an A/PL-style topology.

Examples include:

A = 1
PL = 1
→ WHERE 11

and extended forms such as:

A = 0
PL = 15
→ WHERE 0015

Discovery Methods

WHO1001 supports at least two discovery strategies.

Hardware-ID Discovery

*#1001*0*13##

This returns Device hardware IDs through DIM13.

Address Discovery

WHO1001 can also discover Devices by A/PL address using DIM1.

Examples:

*#1001*00*1##
*#1001*1*1##

Devices at occupied addresses answer with DIM1.

This makes WHO1001 unusual among the currently investigated domains because both hardware-ID and address-based discovery have been observed in detail.

WHO1004 — Temperature Control Diagnostic

WHO1004 is the diagnostic domain associated with Temperature Control / Thermoregulation.

Observed discovery sequence:

*1004*12*0##
*#1004*0*13##

No Temperature Control Devices were present in the investigated installation, so no complete WHO1004 Device interview has yet been captured.

Addressing

Temperature Control does not use the same simple A/PL addressing model as Automation.

The detailed Diagnostic WHERE structure for WHO1004 therefore remains to be investigated.

WHO1018 — Energy Management Diagnostic

WHO1018 has been observed during MyHOME Suite Energy Management scans.

Observed discovery sequence:

*1018*12*0##
*#1018*0*13##

No Energy Management Devices responded in the investigated installation.

The discovery mechanism therefore appears compatible with the general hardware-ID enumeration model, while the domain-specific address model remains unknown.

WHO1023 — Access Control Diagnostic

MyHOME Suite uses WHO1023 when scanning the Access Control domain.

Observed sequence:

*1023*12*0##
*#1023*0*13##
*1023*6*0##

The capture also contained ACK/NACK activity and several unusual large frames.

Because the scan completed with errors and no normal DIM13 Device response was observed, the detailed WHO1023 protocol remains poorly understood.

The only strong conclusion is that WHO1023 is used by MyHOME Suite as the Access Control diagnostic domain.

WHO1013 — Device Diagnostic

Public OpenWebNet documentation identifies WHO1013 as:

Device diagnostic

This project has not yet performed a systematic investigation of WHO1013.

It should therefore remain separate from the functional Diagnostic WHO domains until its role is better understood.

It may provide Device-level diagnostics that are independent of a specific functional system, but this remains unverified in the current captures.

Relationship with Normal WHO Values

Diagnostic WHO values should not be assumed to follow a universal:

Diagnostic WHO = Normal WHO + 1000

pattern.

Some mappings appear to follow that rule:

WHO4  → WHO1004
WHO18 → WHO1018

but WHO1001 demonstrates that the relationship is more complex.

MyHOME Suite's Automation diagnostic domain includes Devices associated with multiple normal functional WHO families, including lighting and automation functions.

Therefore:

A Diagnostic WHO appears to represent a broader diagnostic/configuration domain rather than a one-to-one wrapper around a normal runtime WHO.

Diagnostic Domain versus Functional WHO

A useful distinction is:

Concept Purpose
Normal WHO Runtime functional communication
Diagnostic WHO Discovery, identification, configuration, diagnostics, and programming

For example:

Runtime:
WHO1 → Lighting
WHO2 → Automation

Diagnostic:
WHO1001 → shared Automation configuration domain

This explains why multiple normal WHO families can be managed through one Diagnostic WHO.

Relationship with Addressing Topology

The strongest current architectural model is that a Diagnostic WHO selects not only a functional family but also a compatible configuration/addressing topology.

Conceptually:

Diagnostic WHO
      │
      ├── discovery rules
      ├── address representation
      ├── Device interview
      └── configuration model

For example:

Diagnostic WHO Likely topology
WHO1001 Automation A/PL
WHO1004 Thermoregulation
WHO1018 Energy Management
WHO1023 Access Control

The discovery algorithm can therefore be shared while the WHERE semantics remain domain-specific.

Relationship with EN_SYSTEM

The MHCatalogue database contains system definitions such as:

  • Automation;
  • Temperature Control;
  • Energy Management;
  • Access Control.

However, no direct database field has yet been found that maps these systems explicitly to:

1001
1004
1018
1023

The mapping may instead be hard-coded in MyHOME Suite or derived indirectly.

Shared Discovery Behavior

Across the currently observed Diagnostic WHO domains, the strongest shared behavior is hardware-ID discovery.

Typical sequence:

WHAT12
   │
   ▼
Reset discovery state
   │
   ▼
DIM13 request
   │
   ▼
Device hardware IDs

Observed request forms include:

*#1001*0*13##
*#1004*0*13##
*#1018*0*13##
*#1023*0*13##

This supports a common Diagnostic WHO framework with domain-specific addressing and Device semantics layered on top.

Current Architectural Model

The present working model is:

Normal functional protocols
   │
   ├── WHO1
   ├── WHO2
   ├── WHO4
   ├── WHO18
   └── ...
          │
          ▼
Diagnostic/configuration domains
   │
   ├── WHO1001
   │     └── Automation-related topology
   │
   ├── WHO1004
   │     └── Temperature Control topology
   │
   ├── WHO1018
   │     └── Energy Management topology
   │
   └── WHO1023
         └── Access Control topology

This model is strongly supported by MyHOME Suite behavior, but the exact boundaries of each domain remain partly under investigation.

See Also

Clone this wiki locally