How to manage device descriptors in HA profile?

XBee & XBee Gateway XBee - Zigbee
, , , ,
1

I have a setup which is working with ZigBee Home Automation profile. From one side I have device which is acting as a gateway and management panel. From another side - XBee S2C SMT module which is configured according to ZigBee HA requirements, and which I need to use as a thermostat. I can successfully join module to the network. But than coordinator sends simple descriptor request and module automatically replies with next packet:

[14:55:11.957803]	Simple Descriptor Response	61-88-95-60-17-00-00-D4-A4-08-02-00-00-D4-A4-1E-54-28-0D-00-00-00-3B-11-91-40-00-A2-13-00-00-4B-96-10-27-DB-B1-D1-D9-CF-3B-50-A7-DE-FB-31-4F-90-88-50-46-87-6D-00-77-52-A5-2C-FF-FF
Frame Information: (60 bytes)
	Packet Number: 769
	Protocol: ZigBee
	Timestamp: 14:55:11.957803
	Time Delta: 0.032152
	Channel: 25
	Length: 60
	Link Quality: 1 dBm
	Source: USB8621
	Layer: ZDP
	Status: Decrypted
MAC Header: (9 bytes)
	Frame Control: 0x8861
		···· ···· ···· ·001 = Frame Type: [0x1] Data
		···· ···· ···· 0··· = Security Enabled: [0x0] No
		···· ···· ···0 ···· = Frame Pending: [0x0] No
		···· ···· ··1· ···· = Acknowledgement Request: [0x1] Yes
		···· ···· ·1·· ···· = Intra-PAN: [0x1] Yes
		···· ··00 0··· ···· = Reserved: 0x0
		···· 10·· ···· ···· = Destination Addr Mode: [0x2] 16-bit Short Address
		··00 ···· ···· ···· = Reserved: 0x0
		10·· ···· ···· ···· = Source Addr Mode: [0x2] 16-bit Short Address
	Sequence Number: 149
	Destination PAN ID: 0x1760
	Destination Address: 0x0000
	Source Address: 0xA4D4
MAC Payload: (49 bytes)
	NWK Header: 0x541EA4D400000208
		Frame Control: 0x0208
			···· ···· ···· ··00 = Frame Type: [0x0] Data
			···· ···· ··00 10·· = Protocol Version: 0x2
			···· ···· 00·· ···· = Route Discovery: [0x0] Suppressed
			···· ···0 ···· ···· = Multicast Flag: [0x0] Unicast or Broadcast
			···· ··1· ···· ···· = Security Enabled: [0x1] Yes
			···· ·0·· ···· ···· = Source Route Included: [0x0] No
			···· 0··· ···· ···· = Destination IEEE Address Included: [0x0] No
			···0 ···· ···· ···· = Source IEEE Address Included: [0x0] No
			··0· ···· ···· ···· = Device Initiator: [0x0] No
			00·· ···· ···· ···· = Reserved: 0x0
		Destination Address: 0x0000
		Source Address: 0xA4D4
		Radius: 0x1E
		Sequence Number: 84
	NWK Aux Header: (14 bytes)
		Network Security Control: 0x28
			···· ·000 = Network Security Level: [0x0] None
			···0 1··· = Key NWK ID: [0x1] Network Key
			··1· ···· = Extended Nonce: [0x1] Yes
			00·· ···· = Reserved: 0x0
		NWK Frame Counter: 13
		Source Address: 00:13:A2:00:40:91:11:3B
		NWK Key Sequence Number: 0
	NWK Payload: (23 bytes)
		APS Header: 0x8F00000080040040
			Frame Control: 0x40
				···· ··00 = Frame Type: [0x0] Data
				···· 00·· = Delivery Mode: [0x0] Normal Unicast Delivery
				···0 ···· = Acknowledgement Format: 0x0
					Format: [0x0] Data Frame
				··0· ···· = Security Enabled: [0x0] No
				·1·· ···· = Acknowledgement Request: [0x1] Yes
				0··· ···· = Extended Header Present: [0x0] No
			Destination Endpoint: 0x00
			Cluster ID: [0x8004] Simple Descriptor Response
			Profile ID: [0x0000] ZigBee Device Profile
			Source Endpoint: 0x00
			APS Counter: 143
		APS Payload: (15 bytes)
			ZDP Transaction Sequence Number: 12
			Simple Descriptor Response: (14 bytes)
				Status: [0x00] Success
				NWK Address of Interest: 0xA4D4
				Simple Descriptor Length: 10
				Simple Descriptor: (10 bytes)
					Endpoint: 0xEE
					Application Profile ID: [0x0105] ZigBee Building Automation
					Application Device ID: [0x0001] Generic: Level Control Switch
					Application Device Version: 1
					Reserved: 0x0
					Application Input Clusters Count: 1
					Application Input Clusters List: 0x0000
						Cluster 0: [0x0000] General: Basic
					Application Output Clusters Count: 0
	NWK MIC: 0x33298457
MAC Footer: 0xFFFF
	Frame Check Sequence: 0xFFFF

Why it replies with Application Profile ID: Application Profile ID: [0x0105] ZigBee Building Automation and Application Device ID: [0x0001] Generic: Level Control Switch? How can I configure required device descriptions? If I need to send this frames via UART, then how to disable automatic resonse?

2

Try using API mode with ZDO pass thru enabled.

1 Like
3

It is already as requested (AP = 0x01, AO = 0x0B). I have no problem with receiving and sending packets. But it seems that XBee FW already contains APL layer implemented, because it replies to simple descriptor request from coordinator with simple descriptor response automatically. But I need to know how to configure descriptor in FW, or, otherwise, to block it from replying automatically for the purpose to manage with host MCU.

4

I am not sure you can configure or modify that part of it. But they should be able to pull for active end points which I believe will be sent out the UART thus allowing for your processor to respond along with the radios active end points.

5

I think it will not work this way. Because Active Endpoints Response and Simple Descriptor Response have ZDP Transaction Sequence Number which should match with number in request. System doesn’t expect 2 responses with the same number from one device.
Is this a limitation of particular model/FW of XBee module? I don’t see much info regarding ZigBee HA with XBee S2C at the forum and Internet.

6

Are you sure we are talking about the same thing? The ZDO request I am referring to is the Query Active End points which is something that a processor should receive and respond to.

7

Yes, I am talking about Active Endpoints Request which is used as example in section Sending ZigBee Device Objects (ZDO) commands with the API of ZigBee RF Modules user guide.

8

Can you reproduce the issue using two XBee S2C modules running firmware version 4059? If so, can you provide me with the API frames you are using?

What is the full part number of the module as well? it should be something like XB24-Z7CIT

9

I am not sure that you understood me well. What exactly should I reproduce? In case of 2 XBee I am in control what and where I want to send. Active Endpoints Request is not sent automatically. And when I send Active Endpoints Request from ZC to ZED like:

[19:02:13.879142] Active Endpoints Request 61-88-00-59-A8-32-46-00-00-48-02-32-46-00-00-1E-44-28-24-C0-2F-00-38-11-91-40-00-A2-13-00-00-45-72-10-CB-9E-ED-13-85-BE-4C-89-8B-A2-14-67-FF-FF
Frame Information: (48 bytes)
Packet Number: 167
Protocol: ZigBee
Timestamp: 19:02:13.879142
Time Delta: 8.587592
Channel: 25
Length: 48
Link Quality: -8 dBm
Source: USB8621
Layer: ZDP
Status: Decrypted
MAC Header: (9 bytes)
Frame Control: 0x8861
···· ···· ···· ·001 = Frame Type: [0x1] Data
···· ···· ···· 0··· = Security Enabled: [0x0] No
···· ···· ···0 ···· = Frame Pending: [0x0] No
···· ···· ··1· ···· = Acknowledgement Request: [0x1] Yes
···· ···· ·1·· ···· = Intra-PAN: [0x1] Yes
···· ··00 0··· ···· = Reserved: 0x0
···· 10·· ···· ···· = Destination Addr Mode: [0x2] 16-bit Short Address
··00 ···· ···· ···· = Reserved: 0x0
10·· ···· ···· ···· = Source Addr Mode: [0x2] 16-bit Short Address
Sequence Number: 0
Destination PAN ID: 0xA859
Destination Address: 0x4632
Source Address: 0x0000
MAC Payload: (37 bytes)
NWK Header: 0x441E000046320248
Frame Control: 0x0248
···· ···· ···· ··00 = Frame Type: [0x0] Data
···· ···· ··00 10·· = Protocol Version: 0x2
···· ···· 01·· ···· = Route Discovery: [0x1] Enabled
···· ···0 ···· ···· = Multicast Flag: [0x0] Unicast or Broadcast
···· ··1· ···· ···· = Security Enabled: [0x1] Yes
···· ·0·· ···· ···· = Source Route Included: [0x0] No
···· 0··· ···· ···· = Destination IEEE Address Included: [0x0] No
···0 ···· ···· ···· = Source IEEE Address Included: [0x0] No
··0· ···· ···· ···· = Device Initiator: [0x0] No
00·· ···· ···· ···· = Reserved: 0x0
Destination Address: 0x4632
Source Address: 0x0000
Radius: 0x1E
Sequence Number: 68
NWK Aux Header: (14 bytes)
Network Security Control: 0x28
···· ·000 = Network Security Level: [0x0] None
···0 1··· = Key NWK ID: [0x1] Network Key
··1· ···· = Extended Nonce: [0x1] Yes
00·· ···· = Reserved: 0x0
NWK Frame Counter: 3129380
Source Address: 00:13:A2:00:40:91:11:38
NWK Key Sequence Number: 0
NWK Payload: (11 bytes)
APS Header: 0x2900000000050040
Frame Control: 0x40
···· ··00 = Frame Type: [0x0] Data
···· 00·· = Delivery Mode: [0x0] Normal Unicast Delivery
···0 ···· = Acknowledgement Format: 0x0
Format: [0x0] Data Frame
··0· ···· = Security Enabled: [0x0] No
·1·· ···· = Acknowledgement Request: [0x1] Yes
0··· ···· = Extended Header Present: [0x0] No
Destination Endpoint: 0x00
Cluster ID: [0x0005] Active Endpoints Request
Profile ID: [0x0000] ZigBee Device Profile
Source Endpoint: 0x00
APS Counter: 41
APS Payload: 0x463201
ZDP Transaction Sequence Number: 1
Active Endpoints Request: 0x4632
NWK Address of Interest: 0x4632
NWK MIC: 0x7678B2D8
MAC Footer: 0xFFFF
Frame Check Sequence: 0xFFFF

I receive automatic Active Endpoints Response from ZED like:

[19:02:13.931326] Active Endpoints Response 61-88-B5-59-A8-00-00-32-46-48-02-00-00-32-46-1E-EF-28-1B-00-00-00-3B-11-91-40-00-A2-13-00-00-EF-1E-19-6B-3B-D1-28-3A-14-64-32-0A-DC-07-BB-41-7D-94-FF-FF
Frame Information: (51 bytes)
Packet Number: 173
Protocol: ZigBee
Timestamp: 19:02:13.931326
Time Delta: 0.038840
Channel: 25
Length: 51
Link Quality: 1 dBm
Source: USB8621
Layer: ZDP
Status: Decrypted
MAC Header: (9 bytes)
Frame Control: 0x8861
···· ···· ···· ·001 = Frame Type: [0x1] Data
···· ···· ···· 0··· = Security Enabled: [0x0] No
···· ···· ···0 ···· = Frame Pending: [0x0] No
···· ···· ··1· ···· = Acknowledgement Request: [0x1] Yes
···· ···· ·1·· ···· = Intra-PAN: [0x1] Yes
···· ··00 0··· ···· = Reserved: 0x0
···· 10·· ···· ···· = Destination Addr Mode: [0x2] 16-bit Short Address
··00 ···· ···· ···· = Reserved: 0x0
10·· ···· ···· ···· = Source Addr Mode: [0x2] 16-bit Short Address
Sequence Number: 181
Destination PAN ID: 0xA859
Destination Address: 0x0000
Source Address: 0x4632
MAC Payload: (40 bytes)
NWK Header: 0xEF1E463200000248
Frame Control: 0x0248
···· ···· ···· ··00 = Frame Type: [0x0] Data
···· ···· ··00 10·· = Protocol Version: 0x2
···· ···· 01·· ···· = Route Discovery: [0x1] Enabled
···· ···0 ···· ···· = Multicast Flag: [0x0] Unicast or Broadcast
···· ··1· ···· ···· = Security Enabled: [0x1] Yes
···· ·0·· ···· ···· = Source Route Included: [0x0] No
···· 0··· ···· ···· = Destination IEEE Address Included: [0x0] No
···0 ···· ···· ···· = Source IEEE Address Included: [0x0] No
··0· ···· ···· ···· = Device Initiator: [0x0] No
00·· ···· ···· ···· = Reserved: 0x0
Destination Address: 0x0000
Source Address: 0x4632
Radius: 0x1E
Sequence Number: 239
NWK Aux Header: (14 bytes)
Network Security Control: 0x28
···· ·000 = Network Security Level: [0x0] None
···0 1··· = Key NWK ID: [0x1] Network Key
··1· ···· = Extended Nonce: [0x1] Yes
00·· ···· = Reserved: 0x0
NWK Frame Counter: 27
Source Address: 00:13:A2:00:40:91:11:3B
NWK Key Sequence Number: 0
NWK Payload: (14 bytes)
APS Header: 0xD400000080050040
Frame Control: 0x40
···· ··00 = Frame Type: [0x0] Data
···· 00·· = Delivery Mode: [0x0] Normal Unicast Delivery
···0 ···· = Acknowledgement Format: 0x0
Format: [0x0] Data Frame
··0· ···· = Security Enabled: [0x0] No
·1·· ···· = Acknowledgement Request: [0x1] Yes
0··· ···· = Extended Header Present: [0x0] No
Destination Endpoint: 0x00
Cluster ID: [0x8005] Active Endpoints Response
Profile ID: [0x0000] ZigBee Device Profile
Source Endpoint: 0x00
APS Counter: 212
APS Payload: 0xEE0146320001
ZDP Transaction Sequence Number: 1
Active Endpoints Response: 0xEE01463200
Status: [0x00] Success
NWK Address of Interest: 0x4632
Active Endpoints Count: 1
Active Endpoints List: 0xEE
Endpoint 0: 0xEE
NWK MIC: 0x41302097
MAC Footer: 0xFFFF
Frame Check Sequence: 0xFFFF

No data at UART interface. As I understand Active Endpoints Request is sent to 0x00 by default. I don’t know if it is determined by ZigBee standard or I can modify it. Of course, in case of 2 XBee devices I can send Active Endpoints Request to 0xE8 (where UART is), but I am not in control of 3rd party device. I cannot force it pull data from different desired endpoint.

In original network with 3rd party coordinator configured with HA profile the sequence of pairing is following (for simplicity will use ZED for XBee module and ZC for 3rd party coordinator):

  1. ZED sends Beacon Request
  2. ZC replies with Beacon
  3. ZED sends Association Request
  4. ZC replies with Association Response
  5. ZC sends Transport Key
  6. ZED sends Device Announce
  7. ZC sends Active Endpoints Request
  8. ZED replies Active Endpoints Response
  9. ZC sends Node Descriptor Request
  10. ZED replies with Node Descriptor Response
  11. ZC sends Simple Descriptor Request
  12. ZED replies with Node Descriptor Response (with Profile ID 0x0105 and Device ID 0x001)

In this case all communication is done without involving host MCU for ZED.

FW: 0x4059
Part Number: XB24CZ7PIS-004-revC

10

What I was saying is that if you send the same active end point request from another XBee module to the same end point, what happens? Do you see the same response? If so, then you need to notify Digi Technical Support.

11

As you can see from my reply above, it sends the same response. By the way, if I’ve tried to send Active Endpoints Request to the destination endpoints 0x00 and 0xE8. Only in second case I see this request frame at UART interface of ZED. AO is set to 7 in both cases. Does it mean that passthru mode doesn’t work?

12

I can’t answer that. You need to take this discussion up with Digi technical Support instead of the member helping member support forum.

13

I can :). I found that frames are not passed through in case of setting AO to 7 (Same as 3, plus supported ZDO request passthru). And this option is not documented. However, it is available in XCTU 6.2.0. With AO = 3 (Same as 1, plus unsupported ZDO request passthru) incoming frames are passed to the UART. For the reference AO = 1 means Received RF data formatted as Explicit Rx-Indicator.