• State Resolved
  • Locked Locked
  • Replies 28 replies
  • Answers 2 answers
  • Subscribers 56 subscribers
  • Views 1335 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC2531EMK: Danfoss Thermostat joining but received strange messages

Luca Vetri
Intellectual 560 points

Part Number: CC2531EMK

Hi,

I managed to connect my danfoss thermostat to my CC2531EMK ( I follow this blog's post: Sun May Sky: Use ZTool + Z-Stack 3.0 ZNP to set up a basic Zigbee 3.0 network)

I sniffed the serial port, which is connected to my dongle, and put my thermostat in pairing mode; I received these strange, to me at least, frame from it. (at the end I manage to get the device announce ind frame)

When I move the knob of my thermostat I don't receive any INCOMING MSG regarding changes of the temperature, which is pretty strange

FW: Zstack 3.0.X

Thermostat: Danfoss 014G2461

I looked at the ZSTACK Monitor and Test API but doesn't seem to exist any Cmd0 = 0xCC and can't really seem to grasp the concept behind these frame.

Unfortunately I can't setup any sniffer.

  • 0
    TI__Guru**** 223987 points

    I took the liberty of interpreting the packets for you.  Keep in mind that the packet format is SOF byte (0xFE), length of data byte, two command bytes, data bytes, and FCS byte.

    FE 01 65 36 00 52 (ZDO_MGMT_PERMIT_JOIN_REQ SRSP)
    FE 03 45 B6 00 00 00 F0 (ZDO_MGMT_PERMIT_JOIN_RSP)
    FE 0C 45 CA 3E CB 41 56 39 FE FF CC CC CC 00 00 95 (5 times) (ZDO_TC_DEV_IND)
    FE 0D 45 C1 3E CB 3E CB 41 56 39 FE FF CC CC CC 80 EA (ZDO_END_DEVICE_ANNCE_IND)

    Regards,
    Ryan

  • 0
    Guru 735705 points

    If you mean to get LocalTemperature attribute report, I suppose you have to send binding request to danfoss thermostat first.

  • 0 in reply to Ryan Brown1
    Intellectual 560 points

    Thank you so much Ryan!

    I was tired and I guess didn't see it haha.

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Yeah, I would like to get an AF_INCOMING_MSG everytime I move the knob.

    Do I have to bind the thermostat even to send an AF_DATA_REQUEST to change an attribute?

  • 0 in reply to Luca Vetri
    Guru 735705 points

    I am not sure which or what cluster/attribute would be changed when you move the knob on danfoss thermostat. But, you definitely need to do binding to danfoss thermostat. Binding is the process to tell danfoss thermostat where to report its attribute.

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Ok, 

    So I've run a ZDO_BIND_REQ 

    <TX>09:48:35.23 COM4 ZDO_BIND_REQ (0x2521)
    DstAddr: 0x0000
    SrcAddress: 0xCCCCCCFFFE395641
    SrcEndpoint: 0x01
    ClusterID: 0x0201
    BindAddrMode: 0x0F (BROADCAST) (0xF)
    BindAddr: ........ (0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
    BindEndpoint: 0x01

    And as result I get this:

    <RX>09:48:35.23 COM4 ZDO_BIND_REQ_SRSP (0x6521)
    Status: afStatus_SUCCESS (0x0)

<RX>09:48:35.23 COM4 ZDO_BIND_RSP (0x45A1)
    SrcAddr: 0x0000
    Status: ZDP_NOT_SUPPORTED (0x84)

    Looking at ZCL the cluster ID of the thermostat is 0x201, end point should be 0x1 for both.

    Is there any way to get informations regarding the thermostat ( cluster supported, end points etc. etc.)?

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    I've also run a AF_DATA_REQUEST

    <TX>01:21:32.68 COM4 AF_DATA_REQUEST (0x2401)
    DstAddr: 0x3448
    DestEndpoint: 0x00
    SrcEndpoint: 0x00
    ClusterID: 0x0201
    TransID: 0x1E
    Options: 0x00
    Radius: 0x1E
    Len: 0x05
    Data: ..... (0x10, 0x03, 0x00, 0x12, 0x00) ZCL PACKET 00 = READ COMMAND and 
                                               0x0012 is the attribute id

<RX>01:21:32.68 COM4 AF_DATA_REQUEST_SRSP (0x6401)
    Status: afStatus_SUCCESS (0x0)

*** WARNING ***
    Unsupported or unformatted message received.  Raw data: 
    03 45 81 48 34 84   <----- CMD=0x4581 is ZDO_IEEE_ADDR_RSP so i'm confused

    How do I get the endpoints of a device? also all endpoint implement all zigbee clusters?

    Do I need to register some end points or BDB manages everything?

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Nevermind: I've registered the endpoint with AF_REGISTER and now everything works.

    But when I move the knob I don't receive any INCOMING_MSG (the attribute is in 0x201 and the attribute it changes is inside that CLUSTER)

  • 0 in reply to Luca Vetri
    Guru 735705 points

    Try to refer to https://sunmaysky.blogspot.com/2016/08/how-to-handle-end-node-announcement.html?m=1 but you need to do activate endpoint request and simple descriptor request using ZTool/MT commands.

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    I didn't understand, could you please explain? 

    After an end device joins the network, what do i have to do? (MT Commands)

  • 0 in reply to Luca Vetri
    Guru 735705 points

    Use short address in device announcement to send endpoint request.

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    I've registered an endpoint using AF_REGISTER. ( no AF_INCOMING_MSG when moving knob )

    Could you please explain what do you mean by "send endpoint request"?

  • 0 in reply to Luca Vetri
    Guru 735705 points
    Luca Vetri said:
    How do I get the endpoints of a device? also all endpoint implement all zigbee clusters?

    Don’t you ask how to do this? I just answered your question.

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Last question before marking this thread as resolved:

    Once an end device joins the network, If I understood correctly:

    1) AF_REGISTER you register an endpoint in the coordinator with the cluster you need ( in this case 0x0201) what does ClusterIn and ClusterOut mean?

    2) You get the active end point in the end device

    3) You send all the necessary data

    But still when I move the knob I don't get any AF_INCOMING_MSG from the thermostat

    Please correct me If I missed a step after end device joining

  • 0 in reply to Luca Vetri
    Guru 735705 points

    You should use AF_REGISTER to register endpoint Before you start network. For receiving attribute report from thermostat, you should do binding but I don’t see you do binding in your steps.

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    You right.

    So (updated) steps:

    • AF_FEGISTER ( end point = 0x01, app profID = 0x104, AppDeviceId = 0x0 ( Cannot find a device id for the coordinator), AppDevVer = 0x00, Cluster 1 = 1 -> 0x0201, ClusterOut = 1--> 0x201)
    • BDB_START_COMMISSIONING with "NETWORK FORMATION" 
    • BDB_START_COMMISSIONING with "NETWORK STEERING" to let my thermostat join. ( If already part of the network does it have to join again or I don't need the network steering?
    • ZDO_BIND_REQ ( DstAddr = 0x3448 (Short address of thermostat) , SrcAddress = 64bit address of thermostat, SrcEndPoint = 0x01, ClusterId = 0x201, BindAddrMode = 0x03, BindAddr = 64bit of coordinator dongle, BindEndpoint = 0x01 ( the one registered with af_register))

    Stil no attribute report after moving the knob

    In case of any error please let me know

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Running SIMPLE_DESC on the thermostat gives me this result:

    <TX>03:48:29.15 COM4 ZDO_SIMPLE_DESC_REQ (0x2504)
    DstAddr: 0x3448
    NWKAddrOfInterest: 0x3448
    Endpoint: 0x01

<RX>03:48:29.16 COM4 ZDO_SIMPLE_DESC_REQ_SRSP (0x6504)
    Status: afStatus_SUCCESS (0x0)

<RX>03:48:31.33 COM4 ZDO_SIMPLE_DESC_RSP (0x4584)
    SrcAddr: 0x3448
    Status: ZDP_SUCCESS (0x0)
    NwkAddr: 0x3448
    Len: 0x1C
    Endpoint: 0x01
    ProfileID: 0x0104
    DeviceID: 0x0301
    DeviceVersion: 1 (0x1)
    NumInClusters: 0x08
    InClusterList: 0x0000, 0x0001, 0x0003, 0x000A, 0x0020, 0x0201, 0x0204, 0x0B05
    NumOutClusters: 0x02
    OutClusterList: 0x0000, 0x0019

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Also tried the blogpost with no results.

  • +1 in reply to Luca Vetri
    TI__Guru**** 223987 points

    I'm not certain that binding is required depending on the Thermostat attribute.  Is there an attribute being reported or a command (such as COMMAND_THERMOSTAT_SETPOINT_RAISE_OR_LOWER) being sent out?  Do we know which specific attribute is being sought after, and would it be more simple to read/write that value?  There is very little known about this Danfoss Thermostat without a sniffer log.

    Regards,
    Ryan

  • 0 in reply to Luca Vetri
    Guru 735705 points

    I think you need to check user manual to know what attributes would change when you move the knob on danfoss thermostat and you should check if the attribute is reportable in ZCL spec to know if it will send report.

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Thanks to Yikai And Ryan.

    When moving the knob the attribute OCCUPIED_HEATING_SETPOINT is being changed, I tested reading the value via AF_DATA_REQUEST and it was a success.

    Let's say a customer moves the knob, the final app is supposed to update the value. I can accomplish this via pooling or other ways but I've seen that via ZigBee2MQTT when I move the knob I get an AF_INCOMING_MSG ( check below )

        fe 
	20 
	44 81 
	00 
	00 
	01 02 
	2b 2d 
	01 
	01 
	00 
	a5 
	00 
	8e 54 13 00 
	00 
	0c 
	08 51 0a 12 00 29 dc 05 30 00 30 00 2b 2d 1d 
	2a

  • +1 in reply to Luca Vetri
    Guru 735705 points

    According to ZCL specification, OCCUPIED_HEATING_SETPOINT  is not a reportable attribute. I am not sure how Zigbee2MQTT make it reportable (or maybe danfoss make it as reportable attribute). If you try to do binding to cluster ID 0x0201 on endpoint 1 to danfoss thermostat, can you see it report OCCUPIED_HEATING_SETPOINT when you move the knob?

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Registered the endpoint to my coordinator as follows.

    <TX>12:21:06.26 COM4 AF_REGISTER (0x2400)
    EndPoint: 0x01
    AppProfID: 0x0104
    AppDeviceId: 0x0000
    AppDevVer: 0x00
    LatencyReq: NO_LATENCY_REQS (0x0)
    AppNumInClusters: 0x01
    AppInClusterList: 0x0201
    AppNumOutClusters: 0x01
    AppOutClusterList: 0x0201

<RX>12:21:06.26 COM4 AF_REGISTER_SRSP (0x6400)
    Status: afStatus_SUCCESS (0x0)

    Run the binding

    <TX>12:23:06.67 COM4 ZDO_BIND_REQ (0x2521)
    DstAddr: 0x3448   <--- NWK address of the danfoss thermostat
    SrcAddress: 0xCCCCCCFFFE395641 <--- ieee address of the danfoss thermostat.
    SrcEndpoint: 0x01
    ClusterID: 0x0201
    BindAddrMode: 0x03 (ADDRESS_64_BIT) (0x3)
    BindAddr: ..K..... (0x00, 0x12, 0x4B, 0x00, 0x1C, 0xD4, 0xAA, 0x81)
    BindEndpoint: 0x01

<RX>12:23:06.67 COM4 ZDO_BIND_REQ_SRSP (0x6521)
    Status: afStatus_SUCCESS (0x0)

    But I get no results when moving the knob

  • 0 in reply to Luca Vetri
    Guru 735705 points

    The ieee address of the danfoss thermostat looks weird to me. Are you sure it's correct? The afStatus_SUCCESS in ZDO_BIND_REQ_SRSP means Ztool/ZNP receives your binding request. If binding is successful, you should see ZDO_BIND_RSP with ZDP_SUCCESS, which you can refer to my example in sunmaysky.blogspot.com/.../how-to-do-device-binding-from-ti-ztool.html

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    That is the correct IEEE address. It looked weird to me at first too.

    I receive a ZDO_BIND_RSP with status: ZDP_SUCCESS.

    So I guess binding went right.

    Still no INCOMING_MSG from the danfoss thermostat once moved the knob.

  • 0 in reply to Luca Vetri
    Guru 735705 points

    If you are sure binding is successful, I think you need contact manufacturer for help

  • 0 in reply to YiKai Chen
    Intellectual 560 points

    Maybe using AF_DATA_REQUEST and inside the data run the Comman Reporting Command could be a good way of doing this?

    Thanks to both Ryan and Yikai for the help and for being patient.

    I will contact the manufacturer. ( Any future update in this thread is maybe needed? )

  • 0 in reply to Luca Vetri
    Guru 735705 points

    Report command is usually sent from device.