SIEMENS BSB/LPB protocol

[ameliaamelia]

Is there anyone who want to exchange their knowledge about the protocol BSB / LPB Siemens ?

Currently I am able to read the parameters of the HVAC-controller, but I'm not able to change the values.
I am willing to make available all that I have achieved.

amelia

[ameliaamelia]

Step1   THE SIGNAL

CABLE
two wires:
   1- signal at 12+ volt;
   2- signal GND.

FORMAT
like the UART-TTL but with higher level of voltage;
   12 volt = 1
   0 volt  = 0
        4800 BAUDS [1 Start bit - 8 data bits - 1 ODD parity bit - 1 stop bit] (see HvacWriteMsgSignal.png).

VOLTAGE
In Rx it is necessary to step down the voltage at the level of micro used 5.0 or 3.3 volt.
In TX a step up.

INTERFACE
The same cable is used by various devices, at my home they are 4, so the need to control the collisions.
The schema is derived from the original done by <Daniel Heule>; I added same components to meet the following
needs (see HvacInterfaceSCH.png):
    1 LPB_LINE   direct RX TTL level, used by the CMSA/CA collision detection function
   2 TX_CTRL   disable the output connection;
   3 RX CTRL   disable the input connection, so the micro UART-INTERRUPT is not fired;
   4 GND
   5 VCC
   6 TX      direct software formatted OUT signal, not sent through the UART-TX;
   7 RX      IN signal to UART-RX;

amelia

[pablo2048]

I hope that this link https://groups.google.com/forum/#!topic/openhab/xN71wLdzWX4 and this http://blog.dest-unreach.be/2012/12/14/reverse-engineering-the-elco-heating-protocol/comment-page-1 is not against forum rules and maybe help a lot...

[ameliaamelia]

to pablo2048

I already googled for the subject and I also got your links.
No one has complete information like message format, contents and so on.
Today I solved my "write" problem and and will continue to publishing all my steps.
Anyway, thank you.

amelia

[Some Anon Guy]

have you thought about using a level shifter like this one
https://www.sparkfun.com/products/12009

And a logic analyzer like this
http://www.ebay.com/itm/Compatible-with-Saleae-USB-Logic-24MHz-8Ch-Logic-Analyzer-Supports-1-1-15-USA-/261496674835?pt=LH_DefaultDomain_0&hash=item3ce26a9a13

Then you can "sniff" the logic of the signal and reverse engineer it...

[ameliaamelia]

to Some Anom Guy

I am using a Poscope logic analyzer as you con see at the image HvacWriteMsgSignal.png.
The voltages involved are +12.0 to 5.0 or 3.3 (depending on microprocessor used).
As stated before, now I am able to read-from and to set-to (change) the Siemens controller.
As soon as possible I will continue to publish my work.
Bye.

amelia

[ameliaamelia]

Step2   THE MESSAGE

STRUCTURE
      byte
   1      SYNC always 0xdc
        2      DEVICE from with bit 7 (0x80) ON
   3      DEVICE to
   4   length of all the message from SYNC to last CRC
   5   TYPE of message
   6   COMMAND 1
   7                  2
   8                     3
   9                     4
   10    DATA of variable length VL
   ..
   10+VL   byte 1 of 16 bit CRC-CCITT (XModem)
   10+VL+1          2   

DEVICE
   0   RV61.843/160 - Siemens Controller (installed at my home) (1)
   4   USER1 - My Application 1
   5   USER2 - My Application 2
   6   QAA75.611 - Room Control (1)
   10   AVS37.294 - HVAC Front panel (1)
   127   Broadcast (1)

      (1) predefined
      
TYPE
   1   ?
   2   Info
   3   Set
   4   ACK to Set
        5       ?
   6   Request
   7   Reply to Request

COMMAND
It is a 4 byte sequence; I coded it as it appears on the TYPE 4-ACK and 7-Reply.
The messages TYPE 3-Set and 6-Request have the COMMAND-1 and COMMAND-2 inverted;
the sequence is (in hex):

TX ...3d0507b0...     RX ...053d07b0...

DATA
The first byte has the value of 0x00 or 0x01; not sure, but I think that 0x00 = ENABLE and 0x01=DISABLE,
it needs further investigation.
The second byte and the following are the value.
Every command has it FORMAT. I decoded all the command available on my QAA75-611,
but I am still verifying the correctness. I found these:

FORMAT
   10   C°         bytes   2..3 / 64
   11   C° ambient         1..2 (!) / 64 sent by QAA75-611
   20   Seconds         2
   30   Minutes         2..3
   31   Minutes short      2
   40   Hours            2..5 / 3600
   41   Hours short         2         
   50   Days            2
   80   Number         2..5
   81   Number short      2..3
   100   YY MM DD hh mm ss   2..9
   101   hh:mm         2..3 (2)
   102   DD:MM         2..3 (2)
   103   YYYY            2..3 (2)
   120   Options table      2 it is a single byte with various meanings, like a menu option

      (2) to be verified

The code number of the FORMAT was assigned by me.

Attached is a part of my db, regarding the DHW section.

amelia

[ameliaamelia]

Step2a  THE MESSAGE UPDATE a

...

DATA
The first byte:
   normally it has the value of 0x00;
   few commands can be set DISABLED or SET, the value in RX is 0x00 = SET and 0x01 = DISABLED
   or in TX 0x06 = SET and 0x05 = DISABLED.

...



amelia

[ameliaamelia]

Step3   DIRECT WRITE TO HVAC

SUMMARY
a - The communication BSB/LPB uses only one wire plus ground.
b - Many users can read and write simultaneously.
c - To avoid collision, the CMSA/CA protocol must be used.
d - The bits must be inverted.

MICRO APPLICATION
Language:   C
Micro:      Microchip PIC32 32MX360F512L
Frequency:  80 MHz

The TX uses the attached direct write to HVAC.
The RX uses the standard USART port.

Actually I can read and write from/to the HVAC.


amelia

Attachment: the direct write function.