icasa ICZB-KPD6F FoH Switch

ebaauw commented 3 years ago

Device

Product name: ICZB-KPD6F
Manufacturer: n/a (ZGP)
Model identifier: n/a (ZGP)
Device type : Battery powered ZGP switch with four buttons

Screenshots

n/a (ZGP)

Support by Hue bridge

To pair the switch with the (gen-2) Hue bridge, you need to hold the button corresponding to the Zigbee channel for 10 seconds. Then, you need to press BL+UR. The Hue bridge creates the following resource:

{
  "state": {
    "buttonevent": 21,
    "lastupdated": "2021-01-28T17:33:53"
  },
  "swupdate": {
    "state": "notupdatable",
    "lastinstall": null
  },
  "config": {
    "on": true
  },
  "name": "Friends of Hue Switch 1",
  "type": "ZGPSwitch",
  "modelid": "FOHSWITCH",
  "manufacturername": "PhilipsFoH",
  "productname": "Friends of Hue Switch",
  "diversityid": "ded6468f-6b26-4a75-9582-f2b52d36a5a3",
  "uniqueid": "00:00:00:00:01:71:b2:e6-f2",
  "capabilities": {
    "certified": true,
    "primary": true,
    "inputs": [
      {
        "repeatintervals": [],
        "events": [
          {
            "buttonevent": 16,
            "eventtype": "initial_press"
          },
          {
            "buttonevent": 20,
            "eventtype": "short_release"
          }
        ]
      },
      {
        "repeatintervals": [],
        "events": [
          {
            "buttonevent": 17,
            "eventtype": "initial_press"
          },
          {
            "buttonevent": 21,
            "eventtype": "short_release"
          }
        ]
      },
      {
        "repeatintervals": [],
        "events": [
          {
            "buttonevent": 19,
            "eventtype": "initial_press"
          },
          {
            "buttonevent": 23,
            "eventtype": "short_release"
          }
        ]
      },
      {
        "repeatintervals": [],
        "events": [
          {
            "buttonevent": 18,
            "eventtype": "initial_press"
          },
          {
            "buttonevent": 22,
            "eventtype": "short_release"
          }
        ]
      }
    ]
  }
}

It generates the following button events:

Button(s)	Press	Release
UL	16	20
BL	17	21
BR	18	22
UR	19	23
BL+BR	98	99
UL+UR	100	101
BL+UR	104	104

deCONZ

Trying to pair the switch with deCONZ, on a test network with no other routers than the Coordinator. The REST API is willing to create a resource:

{
  "config": {
    "on": true
  },
  "ep": 242,
  "etag": "8e4586e6af491df7ea0ce1335564bd4a",
  "lastseen": "2021-01-28T16:57Z",
  "manufacturername": "PhilipsFoH",
  "modelid": "FOHSWITCH",
  "name": "Hue Tap 14",
  "state": {
    "buttonevent": 7002,
    "lastupdated": "2021-01-28T16:57:10.982"
  },
  "type": "ZGPSwitch",
  "uniqueid": "00:00:00:00:01:71:b2:e6-f2"
}

But otherwise the switch is dead. I'm not sure where the 7002 comes from; I've sometimes seen it followed by a 7003.

Sniffing

The sniffer confirms that the switch isn't sending anything, after the Commissioning message. I think it wants a reply by the coordinator before activating itself. The Commissioning message:

ZigBee Encapsulation Protocol, Channel: 15, Length: 61
IEEE 802.15.4 Data, Dst: Broadcast
    Frame Control Field: 0x0801, Frame Type: Data, Destination Addressing Mode: Short/16-bit, Frame Version: IEEE Std 802.15.4-2003, Source Addressing Mode: None
    Sequence Number: 14
    Destination PAN: 0xffff
    Destination: 0xffff
    TI CC24xx-format metadata: FCS OK
ZGP stub NWK header Data, GPD Src ID: 0x0171b2e6
    Frame Control Field: 0x0c, Frame Type: Data Data
    Src ID: Unknown (0x0171b2e6)
    Command Frame: Commissioning
        ZGPD Command ID: Commissioning (0xe0)
        ZGPD Device ID: Generic: GP On/Off Switch (0x02)
        Options Field: 0xc5, MAC Sequence number capability, Application information present, Fixed Location, Extended Option Field
            .... ...1 = MAC Sequence number capability: True
            .... ..0. = RxOnCapability: False
            .... .1.. = Application information present: True
            ...0 .... = PANId request: False
            ..0. .... = GP Security Key Request: False
            .1.. .... = Fixed Location: True
            1... .... = Extended Option Field: True
        Extended Options Field: 0xf2, Key Type: Individual, out of the box GPD key, GPD Key Present, GPD Key Encryption, GPD Outgoing present
            .... ..10 = Security Level Capabilities: 0x2
            ...1 00.. = Key Type: Individual, out of the box GPD key (0x4)
            ..1. .... = GPD Key Present: True
            .1.. .... = GPD Key Encryption: True
            1... .... = GPD Outgoing present: True
        Security Key: b6d23bdf149db138f00370a2052fa444
        GPD Key MIC: 0x5df08a69
        GPD Outgoing Counter: 0x0000030e
        Application information Field: 0x04, GP commands list present
            .... ...0 = Manufacturer ID present: False
            .... ..0. = Manufacturer Model ID present: False
            .... .1.. = GP commands list present: True
            .... 0... = Cluster reports present: False
        Number of GPD commands: 17
        GPD CommandID list
            ZGPD Command ID: Scene 0 (0x10)
            ZGPD Command ID: Scene 1 (0x11)
            ZGPD Command ID: Scene 2 (0x12)
            ZGPD Command ID: Scene 3 (0x13)
            ZGPD Command ID: Scene 4 (0x14)
            ZGPD Command ID: Scene 5 (0x15)
            ZGPD Command ID: Scene 6 (0x16)
            ZGPD Command ID: Scene 7 (0x17)
            ZGPD Command ID: Toggle (0x22)
            ZGPD Command ID: Press 1 of 1 (0x60)
            ZGPD Command ID: Press 1 of 2 (0x62)
            ZGPD Command ID: Release 1 of 2 (0x63)
            ZGPD Command ID: Press 2 of 2 (0x64)
            ZGPD Command ID: Release 2 of 2 (0x65)
            ZGPD Command ID: Short press 1 of 1 (0x66)
            ZGPD Command ID: Short press 1 of 2 (0x67)
            ZGPD Command ID: Short press 2 of 2 (0x68)

ebaauw commented 3 years ago

When pairing with the Hue bridge:

Switch broadcasts a ZGP Commissioning;
ZGP Proxy broadcasts a ZCL GP Commissioning Notification, relaying the payload of the ZGP Commissioning;
ZGP Proxy broadcasts a Device Announcement for the switch;
Hue bridge broadcast a ZCL GP Pairing;
(On pressing BL+UR) Switch broadcasts ZGP Short press 2 of 2;
ZGP Proxy broadcasts ZCL GP Notification.

The GP Pairing:

ZigBee Encapsulation Protocol, Channel: 20, Length: 78
IEEE 802.15.4 Data, Dst: Broadcast, Src: 0x0002
    Frame Control Field: 0x8841, Frame Type: Data, PAN ID Compression, Destination Addressing Mode: Short/16-bit, Frame Version: IEEE Std 802.15.4-2003, Source Addressing Mode: Short/16-bit
    Sequence Number: 189
    Destination PAN: 0x193d
    Destination: 0xffff
    Source: 0x0002
    [Extended Source: PhilipsL_01:04:34:2c:ff (00:17:88:01:04:34:2c:ff)]
    [Origin: 9713]
    TI CC24xx-format metadata: FCS OK
ZigBee Network Layer Data, Dst: Broadcast, Src: 0x0001
    Frame Control Field: 0x0208, Frame Type: Data, Discover Route: Suppress, Security Data
    Destination: 0xfffd
    Source: 0x0001
    Radius: 29
    Sequence Number: 75
    [Extended Source: PhilipsL_01:05:0a:55:da (00:17:88:01:05:0a:55:da)]
    [Origin: 9711]
    ZigBee Security Header
ZigBee Application Support Layer Data, Dst Endpt: 242, Src Endpt: 242
    Frame Control Field: Data (0x08)
        .... ..00 = Frame Type: Data (0x0)
        .... 10.. = Delivery Mode: Broadcast (0x2)
        ..0. .... = Security: False
        .0.. .... = Acknowledgement Request: False
        0... .... = Extended Header: False
    Destination Endpoint: 242
    Cluster: Green Power (0x0021)
    Profile: Green Power (0xa1e0)
    Source Endpoint: 242
    Counter: 206
ZigBee Cluster Library Frame
    Frame Control Field: Cluster-specific (0x19)
        .... ..01 = Frame Type: Cluster-specific (0x1)
        .... .0.. = Manufacturer Specific: False
        .... 1... = Direction: Server to Client
        ...1 .... = Disable Default Response: True
    Sequence Number: 68
    Command: GP Pairing (0x01)
    Options: 0x00e5c8, ApplicationID: 0b000 4b SrcID; no Endpoint, Add Sink, Communication mode: Groupcast to pre-commissioned GroupID, GPD Fixed, MAC Seq number cap, SecurityLevel: 4B frame counter and 4B MIC only, SecurityKeyType: (individua
        .... .... .... .... .... .000 = ApplicationID: 0b000 4b SrcID; no Endpoint (0x0)
        .... .... .... .... .... 1... = Add Sink: True
        .... .... .... .... ...0 .... = Remove GPD: False
        .... .... .... .... .10. .... = Communication mode: Groupcast to pre-commissioned GroupID (0x2)
        .... .... .... .... 1... .... = GPD Fixed: True
        .... .... .... ...1 .... .... = MAC Seq number cap: True
        .... .... .... .10. .... .... = SecurityLevel: 4B frame counter and 4B MIC only (0x2)
        .... .... ..10 0... .... .... = SecurityKeyType: (individual) out-of-the-box GPD key (0x4)
        .... .... .1.. .... .... .... = Frame Counter present: True
        .... .... 1... .... .... .... = Key present: True
        .... ...0 .... .... .... .... = Assigned Alias present: False
        .... ..0. .... .... .... .... = Forwarding Radius present: False
    SrcID: 0x0171b2e6
    Sink GroupID: 0x77a0
    DeviceID: Generic: GP On/Off Switch (0x02)
    Frame counter: 798
    GPD key: f79f168ddb186b3517bf36adfbf8264c

The ZGP Short press 2 of 2:

ZigBee Encapsulation Protocol, Channel: 20, Length: 24
IEEE 802.15.4 Data, Dst: Broadcast
    Frame Control Field: 0x0801, Frame Type: Data, Destination Addressing Mode: Short/16-bit, Frame Version: IEEE Std 802.15.4-2003, Source Addressing Mode: None
    Sequence Number: 31
    Destination PAN: 0xffff
    Destination: 0xffff
    TI CC24xx-format metadata: FCS OK
ZGP stub NWK header Data, GPD Src ID: 0x0171b2e6
    Frame Control Field: 0x8c, Frame Type: Data, NWK Frame Extension Data
    Extended NWK Frame Control Field: 0x30, Application ID: Unknown, Security Level: Full frame counter and full MIC only, Security Key, Direction: From ZGPD
    Src ID: Unknown (0x0171b2e6)
    Security Frame Counter: 799
    Command Frame: Short press 2 of 2
        ZGPD Command ID: Short press 2 of 2 (0x68)
    Security MIC: 0x139574aa

The GP Notification:

ZigBee Encapsulation Protocol, Channel: 20, Length: 61
IEEE 802.15.4 Data, Dst: Broadcast, Src: 0x0001
    Frame Control Field: 0x8841, Frame Type: Data, PAN ID Compression, Destination Addressing Mode: Short/16-bit, Frame Version: IEEE Std 802.15.4-2003, Source Addressing Mode: Short/16-bit
    Sequence Number: 46
    Destination PAN: 0x193d
    Destination: 0xffff
    Source: 0x0001
    [Extended Source: PhilipsL_01:05:0a:55:da (00:17:88:01:05:0a:55:da)]
    [Origin: 9711]
    TI CC24xx-format metadata: FCS OK
ZigBee Network Layer Data, Dst: Broadcast, Src: 0xb2e6
    Frame Control Field: 0x0208, Frame Type: Data, Discover Route: Suppress, Security Data
    Destination: 0xfffd
    Source: 0xb2e6
    Radius: 30
    Sequence Number: 22
    ZigBee Security Header
ZigBee Application Support Layer Data, Group: 0x77a0, Src Endpt: 242
    Frame Control Field: Data (0x0c)
        .... ..00 = Frame Type: Data (0x0)
        .... 11.. = Delivery Mode: Group (0x3)
        ..0. .... = Security: False
        .0.. .... = Acknowledgement Request: False
        0... .... = Extended Header: False
    Group: 0x77a0
    Cluster: Green Power (0x0021)
    Profile: Green Power (0xa1e0)
    Source Endpoint: 242
    Counter: 208
ZigBee Cluster Library Frame
    Frame Control Field: Cluster-specific (0x11)
        .... ..01 = Frame Type: Cluster-specific (0x1)
        .... .0.. = Manufacturer Specific: False
        .... 0... = Direction: Client to Server
        ...1 .... = Disable Default Response: True
    Sequence Number: 0
    Command: GP Notification (0x00)
    Options: 0x14a0, ApplicationID: 0b000 4b SrcID; no Endpoint, Also Commissioned Group, SecurityLevel: 4B frame counter and 4B MIC only, SecurityKeyType: (individual) out-of-the-box GPD key, gpTxQueueFull
        .... .... .... .000 = ApplicationID: 0b000 4b SrcID; no Endpoint (0x0)
        .... .... .... 0... = Also Unicast: False
        .... .... ...0 .... = Also Derived Group: False
        .... .... ..1. .... = Also Commissioned Group: True
        .... .... 10.. .... = SecurityLevel: 4B frame counter and 4B MIC only (0x2)
        .... .100 .... .... = SecurityKeyType: (individual) out-of-the-box GPD key (0x4)
        .... 0... .... .... = RxAfterTx: False
        ...1 .... .... .... = gpTxQueueFull: True
        ..0. .... .... .... = Bidirectional Capability: False
        .0.. .... .... .... = Proxy info present: False
    SrcID: 0x0171b2e6
    Frame counter: 799
    ZGPD CommandID: Short press 2 of 2 (0x68)
    Payload size: 255

ebaauw commented 3 years ago

OK, I'm officially going crazy. Repaired the switch to deCONZ, and now it works. It seems quite critical to hit BL+UR immediately after holding the button corresponding to the Zigbee channel for 10 seconds. Apparently, this is what activates the switch.

I didn't delete the resource on the RaspBee II network; I now have two deCONZ test instances (on the same channel) issuing button events from a single action.

After deleting the resource, the RaspBee II network no longer issues button events, but the ZGP Proxy (that apparently decided to adopt the switch) still relays the messages.

ebaauw commented 3 years ago

For completeness: the REST API plugin translates the ZGP commands to regular buttonevent values, another incompatibility with the Hue API. Also note that the button number do not follow the ZGP scheme to number the buttons counter-clockwise.

Button(s)	Press/Release	Press/Hold/Release
UL	1000/1002	1000/1001/1003
BL	2000/2002	2000/2001/2003
BR	4000/4002	4000/4001/4003
UR	3000/3002	3000/3001/3003
BL+BR	6000/6002	6000/6001/6003
UL+UR	5000/5002	5000/5001/5003
BL+UR	7000/7000	7000/-/7000

dresden-elektronik / deconz-rest-plugin