M-Net interface IC is Mitsumi MM1167, like MM1034

[ChrisTank]

Has anyone the datasheet for MM1167?

[LenShustek]

Sorry, I don't. I wish I did!

[ChrisTank]

Could M-NET be based on the Japan Home Bus System?

Just found this today from Fujitsu MB86046B Home Bus Protocol controller.
It documents exact timings, and the bytes in the packets.

Priority Code
Source Address
Destination Address
Control Code (you labeled flags)
Message Length Code
Data
Check Code
Dummy Byte
ACK/NAK

[LenShustek]

Good find! The Home Bus System (HBS) protocol implemented by that chip seems very similar to M-Net. The biggest difference is that the source and destination addresses are switched.
I found the datasheet for that chip at http://www.datasheet-pdf.com/PDF/MB86046B-Datasheet-Fujitsu-512918, but I can't find the specification that it refers to: "Home Bus System Standard Specifications (ET-2101) (EIAJ/REEA) established in September, 1988." Do you know where we can get that?

[ChrisTank]

SRC and DST address reversed, I'm not sure.
Your PDF shows DST then SRC, but the traces you provided show SRC first, FB being the Cool Master.

 BD FB 01 3F 02 2D 01 D8 06             CM->01 get status
 BE 01 FB 3F 05 2D 81 00 00 00 54 06      ->CM  stopped
 BD FB 02 3F 02 2D 01 D7 06             CM->02 get status
 BE 02 FB 3F 05 2D 81 00 00 00 53 06      ->CM  stopped

[LenShustek]

You are right! My document is wrong, but my Sniffer code and the examples are correct. The source address comes first.
I still haven't found the HBS ET-2101 spec online, but I did find https://echonet.jp/wp/wp-content/uploads/pdf/General/Standard/Echonet/Version_2_11_en/spec_v211e_3.pdf,
which starting on page 4-7 describes the packet formats for an extension of HBS. I think it might be helpful. On page 4-13 it describes the 4th ("control code") byte, but if I'm reading it right M-Net seems to be using the "not used" protocol identifier 1111, which is mysterious.

[rubeycubey]

Is this datasheet of any use?
http://www.datasheet.hk/view_download.php?id=1475353&file=0238%5Cmb86046b_4989759.pdf

[LenShustek]

Yes, thanks! Assuming it's the same protocol, it shows that the mysterious first byte, which I had called "type", is actually "priority". The fourth byte, which I called "flags", is a "control code", but unfortunately there is no detail about it. I don't think it's the same as the "Control code register" on page 11.