Ok meme,
The data is not APT frames since the modules are using AT firmware (also know as transparent mode). The relevant document is # 90000866_C, ZNet 2.5 OEM modules.
The doc (like the ZB doc) shows most commands in the API frames but has very little on just AT data. But, the AT data is just the ‘data payload’ of an API transfer. So read the API frame examples but ignore the APT frame values (delimiter, frame type, cksum, etc).
First, Could you resend one of the screen shots but expand the Hex display to show the full 16 bytes of data across the row (the ASCII part can be cut of as it has no value). You only show 13 1/2 bytes of 16.
I first looked at the Hex data for a repeating pattern (can be seen in the ASCII dump also). Your bi2.jpg at address 0000500 has:
0500 10 00 B5 00 25 00 3E 00 42 00 46 00 01 0? ?? ??
0510 65 00 AA 00 10 00 B5 00 25 00 3E 00 42 0? ?? ??
0520 01 00 40 00 65 00 AA 00 10 00 B5 00 25 0? ?? ??
0530 42 00 46 00 01 00 40 00 65 00 AA 00 10 0? ?? ??
0540 85 00 3C 00 42 00 46 00 01 00 40 00 F1 0? ?? ??
0550 10 00 B5 00 25 00 3E 00 42 00 46 00 01 0? ?? ??
0560 65 00 AA 00 10 00 CB 00 85 00 3C 00 42 0? ?? ??
I see B5 and AA repeated so there is a repeating pattern of 20 bytes. So first guess is that the data payload is 20 bytes long. Now the hard part, which byte is the beginning of the data?
So lets go the the document.
Starting on page 70 is a table of the AT commands. Most likely the data is a response of AT command ‘IS’ (page 74). But what is the data structure of the data? Well its an IO Data Sample and is shown in an API frame on page 65.
Since your module has AT firmware ignore the API frame parts and only look at the ‘cmdData’ starting at ‘Num Samples (byte 16)’. Its structure is:
1 byte- # of sample sets, this is always 1
2 bytes- digital channel mask
1 byte- analog channel mask
2 bytes- digital data
2 bytes per enabled analog
So assuming that the data is 20 bytes, there would be 7 analog channels enabled. Now the first byte is always a 0x01 and I only see one byte set to 0x01 in 20 bytes so it is fairly safe to assume this is the beginning of the data set. line 0520 starts with 01 so the that data set is:
01
00 40
00
65 00
AA 00
10 00
B5 00
25 0?
?
?
Now the problem is that this does not make sense to me. The doc (page 67) indicates that there can only be 5 (including supply voltage) analog inputs. Also the ADC is only 10 bit so a value of 0x6500 is too big (0x0065 is ok) but maybe its byte reversed (little vs big endian).
I haven’t yet found any errors in the other Digi docs but they never were clear until I figured out how the units worked. Then the doc made sense.
When you collect the data again is there a way you could add something to the data stream so its easy to find the beginning of the data set. I’m guessing that there could be another group of values other than the IO data coming through. How about a little more information on how the two modules are setup. This can be figured out and MAYBE someone from Digi will actually gives us the information you need.
I’d also do what Admin suggests and go through the code for the EmbeddedKitService and try to understand how it gets and parses the data.