I have managed to get signals from the system - both commands and responses. There is still an issue I have to sort out with picking up the initial traffic when the MAX is first turned on, (which is of course the most interesting part).
The two Smart motors, when stationary, both return 0. Using 0x24 as the command byte drives the motor forward; 0x34 drives it back. Using the Remote Controller, there seems to be another command in there to change the speed. So when I start the first motor in the forward direction, then the second in the same direction, the command sequence is:
FF 0 0 FE FE C0 - 8
FF 0 0 FE FE C1 - 0
FF 0 0 FE FE C2 - ~~
FF 45 20 FE FE 93 - ~~
FF 24 0 FE FE 40 - 8
FF 24 0 FE FE 41 - 0
FF 24 0 FE FE 42 - ~~
FF 24 0 FE FE 43 - ~~
FF 24 0 FE FE 40 - c
FF 24 45 FE FE D1 - 0
FF 24 24 FE FE A2 - ~~
FF 24 24 FE FE A3 - ~~
FF 24 24 FE FE A0 - 14
FF 24 24 FE FE A1 - 0
FF 24 24 FE FE A2 - ~~
FF 24 24 FE FE A3 - ~~
FF 24 24 FE FE A0 - 1a
where the first 6 bytes are the command, and the final value is the response. (the ~~ indicates there is no response). I'm presuming the response is something to do with the speed, as it increases after the "45" command. The command to go to full speed is 0x4A.
Starting just the second motor in reverse gives:
FF 0 0 FE FE C2 - ~~
FF 20 45 FE FE 93 - ~~
FF 0 34 FE FE 50 - 27
FF 0 34 FE FE 51 - 1e
FF 0 34 FE FE 52 - ~~
FF 0 34 FE FE 53 - ~~
FF 0 34 FE FE 50 - 27
FF 20 34 FE FE 71 - 18
FF 0 34 FE FE 52 - ~~
FF 0 34 FE FE 53 - ~~
FF 0 34 FE FE 50 - 27
FF 0 34 FE FE 51 - 11
I still need to work on my sniffer program so I can get at the start-up codes, but at least I'm getting sensible results. I also need to sort out what the responses mean.
What is your interest in the MAX?