RCS TZ20 & TZ43

RCS TZB43 The TZB20 & TZB43 are prototype RCS thermostats. It looks like RCS never released them as products to the general public. These thermostats can be found cheaply on EBay for a relatively low price. With no documentation they're not really friendly to use but a little investigation and it appears that the engineers did a really good job of reuse. As closely as I can tell they use a similar protocol to the TR-16. This is my starting point.

RCS has a very good reputation for the products they make. So while I won't be able to get any support from RCS I expect that these will work for my rather odd needs (and a bit of hacker curiosity).

RCS TZB20 I found these on EBay when I was looking for Z-Wave thermostats. RCS also sells a TZ43, which is a Z-Wave model of the RCS thermostat. The TZB models may share the same hardware but the protocol is different (ZigBee != Z-Wave). The TZB20 is a RCS ZigBee prototype thermostat based on the RCS TR-16 thermostat and the Digi XBee wireless modules. Now understand that my home is electric base board heating and can't directly use standard 24v thermostats. Through the use of a contactor (24v controlled/220v) I can control the heaters.

So far I've found that the thermostat has an MSP430 processor (excellent low powered 16bit TI processor), an XBee Series 2 transceiver (XB24-Z7WIT-004) running the ZigBee stack (not the 802.15.4 stack or the ZNet 2.5 stack) and has the standard 24v interfaces to the HVAC. I'm trying to work out how to communicate with it. And for experimentation I intend to use a few LEDS and a 24Vac power supply (and maybe a fan). I have a Sparkfun XBee Explorer USB and when I get the rest of my TZB20s I'll steal an Xbee from it to see if I can figure how to communicate with these devices (done!). I must say I was confused by some of the terminology (coordinator, end-point, router, etc.). I found Robert Faludi's "Building Wireless Sensor Networks" and found it helped to clear that up as it covers these very chips.

Documents

TR16 Installation manual - TR16 is similar to the TZB20
TR16 programming manual - TR16 is similar to the TZB20

Links

Book: "Building Wireless Sensor Networks" - By Robert Faludi, Publisher: O'Reilly Media. Description: Create distributed sensor systems and intelligent interactive devices using the ZigBee wireless networking protocol and Series 2 XBee radios. By the time you're halfway through this fast-paced, hands-on guide, you'll have built a series of useful projects, including a complete ZigBee wireless network that delivers remotely sensed data. This resource and reference-packed book is ideal for inventors, hackers, crafters, students, hobbyists, and scientists.
My opinion of this book is that it's a good book to have if you're a hobbyist and working with the XBee radios.
Robert Faludi's ZigBee page.
RCS Serial Thermostats
TZB43 thermostat and xbee series 2 communication
Packet-check - TCL code to decode raw hex
Java Xbee API
Need Help with Series 2 Xbee API
Example of Xbee API Frames
Xbee FAQ
common-xbee-mistakes

Other

On board, front:

TZB20

FCC ID:OUR-XBEE2
IC4214AXBEE2
XBEE Series 2

On board, back:

TS-3
(C)2007 Digi Int'l 
PN:30009582-02 REV A

On sticker, back:

R201WW7215215
0013A200
12345678
XB24-Z7WIT-004-revD1 (WIT = Whip Antenna, CIT = Chip Antenna)
2008-12-09-13

Note that if you type in atdh (high) you should get back 0013A200. And if you type in atdl (low) 12345678 (0013A20012345678). This is the 64 bit serial number of the board.

TZB43

ZigBee Info
Network: N/A Not Installed
MAC: 0013A200403ABB28
extPAN=Id: 0000000000000000
FW: 2341 HW: 1341
Chan: 00 RSSI: 0
Pan-Id: FFFF

New XBee boards

FCC ID:OUR-XBEE2
IC4214AXBEE2
XBEE Series 2

STM-5 or TS-3
30009582-03 Rev A or 30009582-02 Rev A

R201WW072215215
XB24-Z7CIT-004-revF (and revG)
031510-23:51

The 'XB24' is Xbee 2.4Ghz, normal power. 'XBP24' would be the PRO/higher power. 'Z7' means newer ZigBee 2007 stack, so look for the 'XB24-ZB' in XCTU pull-down. 'CIT' means it's a chip antenna.

[john@eccles ~]$ packet-check -api2
API Packet analyzer version 1.2 for XBees (802.15.4, DigiMesh, ZNet, ZB)
Escape characters enabled (AP=2)
Note: if it prompts for more bytes and you're done, hit return
Enter packet: 7E 00 1E 90 00 7D 33 A2 00 40 48 95 A3 23 3E 01 41 3D 30 30 20 4F 3D 31 20 5A 3D 31 20 54 3D 37 36 0D CA

Original packet: 7E 00 1E 90 00 7D 33 A2 00 40 48 95 A3 23 3E 01 41 3D 30 30 20 4F 3D 31 20 5A 3D 31 20 54 3D 37 36 0D CA

Unescaped packet: 7E 00 1E 90 00 13 A2 00 40 48 95 A3 23 3E 01 41 3D 30 30 20 4F 3D 31 20 5A 3D 31 20 54 3D 37 36 0D CA
7E // Correct packet header byte
00 1E // payload length (decimal 30)
90 // Packet type: ZigBee receive packet
   // Valid for DigiMesh, Znet2.5, ZigBee
00 13 A2 00 40 48 95 A3 // 64-bit source address
23 3E // 16-bit source address
01 // Rx options: ack
   // TX data (18 bytes) [1]
41 // transmitted data 'A'
3D // transmitted data '='
30 // transmitted data '0'
30 // transmitted data '0'
20 // transmitted data ' '
4F // transmitted data 'O'
3D // transmitted data '='
31 // transmitted data '1'
20 // transmitted data ' '
5A // transmitted data 'Z'
3D // transmitted data '='
31 // transmitted data '1'
20 // transmitted data ' '
54 // transmitted data 'T'
3D // transmitted data '='
37 // transmitted data '7'
36 // transmitted data '6'
0D // transmitted data CR
CA // checksum - correct

Notes:
[1] Max 100 bytes on 802.15.4, or 72 on DigiMesh or ZNet2.5
[john@eccles ~]$



A=00 O=1 Z=1 T=76 <CR>


 A typical TZB message sequence looks as follows:


   From Host System address 00 : A=1 O=00 R=1 <CR> (originator O=00
      is optional, A=1 R=1 <CR> is also valid) Which means message is
      being sent to device addressed 1, from Host address 00,
      requesting R1 status.  The response to the above message from a
      network HVAC device with address = 1 would be:

       A=00 O=1 Z=1 T=76 SP=78 M=H FM=0<CR>


   Which means Reply to Host address 00, message originated from System address 1, Zone 1, Temp=76,
      Setpoint=78, Mode = Heat, Manual Fan = Off. For single zone devices


Example:

    Sent to Therm:   A=1 O=00 R=1 <CR>
    Recv from Therm: A=00 O=1 Z=1 T=76 SP=78 M=H FM=0<CR>


 Setup 

 Okay the first thing I did was to make sure that my, PC connected,
    USB/XBee was running the coordinator software (I used the XCTU
    software to upgrade my USB/XBee). I have 2 XBees setup for
    this. One is an AT coordinator (you communicate using AT
    commands).  The other is an API coordinator. At the moment I'm
    just using the AT coordinator.  The TZB43 & TZB20s are setup as
    Router/End Devices and I haven't touched their XBee firmware
    yet.

 The next thing I did was to connect to the USB/XBee with a
    terminal emulator (9600, 8, n, & 1). I did this because the
    XCTU software wouldn't permit me to cut and paste commands into
    the terminal window (very useful when you're experimenting). I
    next: 

+++OK
atid ffff
OK
atwr
OK


 I typed in the white characters in my terminal emulator and the
    red characters are the response back from the USB/XBee. When you
    enter the '+++' do not hit enter and don't type anything for at
    least 2 seconds. Once you get the 'OK'
    you're ready to enter the appropriate AT commands. The session
    will timeout after 10 seconds and then the XBee falls back into
    transparent mode (anything you type is broadcast out to the
    network). The command 'atid ffff' set the PAN ID to FFFF (0000
    0000 0000 FFFF). You can
    set it to anything you want but FFFF worked for me. Next I
    configured the TZB43.

TZB43 Setup

 I found this on the SmartHome site. It's related to the EcoView
    system. It may not apply to the TZB43 but it does have a few
    things that are worth knowing (such as how to get into install
    mode).


   Once the thermostat has been installed, there will be four buttons across the bottom and
         up/down arrows next to screen.

  
      Press the Menu button to access the menu (this is the
          1^st button on the left).
      Hold the middle two buttons while on the first menu to access the installer menu.
      Scroll to System Settings using up/down arrows to the right of screen.
      Press Select.
      Arrow down to Mechanical Settings.
      Press Select.
      Enter package unit specifics here (number of stages, unit type, etc.) Refer to
          Appendix A - Thermostat Settings
      Press Done twice to get back to the main menu.
      Arrow down to Zigbee Install.
      Press Select.
      A prompt will be displayed asking to Add the thermostat to the network. Press
          the up arrow to accept only if the prompt displayed does not ask to Remove the
          thermostat from the network.
      Press Exit and Done to return to main menu
      Arrow down to Zigbee Network Info.
      Press Select.
      Ensure the Network says OPEN and the status says INSTALLED.
      Press Done to return to main screen.
  

   Thermostat Activation.

  
      Remove thermostat from back plate and wait 10 seconds.
      Reinstall thermostat to back plate. This will activate thermostat.
      NOTE: If this is not completed the thermostats may not communicate properly.
  


 Once the TZB43 was 'OPENED' and 'INSTALLED'. I began typing
    commands on the USB/XBee and started getting responses back
    (yeah!). 

TZB16 Setup

 This comes from the RCS TR16  Manual, hopefully it will be similar
    to the TZB16.

 Enter the setup mode by the following procedure:


   First press and hold the Mode button
   Simultaneously press the Fan button.
   The display will change to show "SU".
   Release all buttons.
   The display will change to show the setup menu, starting with
       "Ad" (address - this is the RCS address, not the XBee address)
   Select what setup function you want to change or view by
       pressing the Mode button to cycle through the menu
       options:

  
    "Ad" Serial Network address
    "FC" Fahrenheit or Celsius mode
    "C1" Calibrate Internal Sensor (or Remote Sensor address 1 if attached)
     and if additional external sensors are attached they will appear also:

        "C2" (if Remote Sensor address 2 attached)
  



 What I saw in the terminal emulator

A=00 O=1 Z=1 T=78 (automatically, maybe every 60 seconds this occurs)

A=1 O=00 R=1
A=00 O=1 Z=1 T=78 SPH=62 SPC=82 M=H FM=0


A=1 O=00 R=2 (Type 2 Query)
A=00 O=1 H1A=0 H2A=0 H3A=0 C1A=0 C2A=0 FA=0 SCP=00

A=1 O=00 R=6 (Type 6 Query)
Rx: A=00 O=1 TZB43=V02.00.20/TZB43=V-2.00.20


 I typed in (okay, I edited the commands in an editor and pasted
    in) the strings in white. The cyan text is just comments and the
    red text is what is being sent from the thermostat. The white is
    what I typed in.

XBee 1mW Chip Antenna (XB24-ACI-001) - 802.15.4 OEM RF modules (S1 ?)
XBee ZB ZigBee (XB24-Z7CIT-004) - ZigBee (S2B?)

RCS chips   - 2241 XB24-B (AT  Router/End Device Sensor Adapter)
RCS chips   - 2341 XB24-B (API Router/End Device Sensor Adapter, Hmmm>/i>)
EBay chips  - 2270 XB24-B (AT  Router/End Device Digital IO Adapter)
Mark 0 Chip - 2064 XB24-B (AT  Coordinator, AT Command Mode (AP=0), were EBay chips)
Mark 1 Chip - 2164 XB24-B (API Coordinator, API Mode (AP=1,2), were EBay chips)

Thermostat
TZB43 - 0013A200 403ABB28
        XB24-Z7WIT-003 revA
Coordinator
USB   - 0013A200 4064EFF3

ATDL 403ABB28
OK
ATID FFFF
OK


 Then use the Setup instructions above to install the ZigBee network on the TZB43

Rx: A=00 O=1 Z=1 T=78 (automatically, about every 60 seconds this occurs)

Tx: A=1 O=00 R=1 (Type 1 Query - Note: Don't send the <CR>)
Rx: A=00 O=1 Z=1 T=78 SPH=62 SPC=82 M=H FM=0


Tx: A=1 O=00 R=2 (Type 2 Query)
Rx: A=00 O=1 H1A=0 H2A=0 H3A=0 C1A=0 C2A=0 FA=0 SCP=00

  - HEATING STAGE 1 Status. Format: H1A=x, where x = 0 for Off or 1 for On
  - HEATING STAGE 2 Status. Format: H2A=x, where x = 0 for Off or 1 for On.
  - COOLING STAGE 1 Status. Format: C1A=x, where x = 0 for Off or 1 for On.
  - For Ver 2.9 (2 stage systems only)
    COOLING STAGE 2 Status. Format: C2A=x, where x = 0 for Off or 1 for On.
  - FAN Relay Status. Format: FA =x, where x = 0 for Off or 1 for On.
  - SCP/MRT Status. Format: SCP =x, where x=0 for Off or 1 for On. Status
    is on whenever the Short Cycle Protection (SCP) Delay on Compressor Call
    is active or Minimum Run Time (MRT) delay off is active. (Ver 2.9)

Tx: A=1 O=00 R=6 (Type 6 Query)
Rx: A=00 O=1 TZB43=V02.00.20/TZB43=V-2.00.20


 Okay, now we have it working! 

** XBee-ZB Firmware Versions **

 XBee version numbers will have 4 significant digits. A version
     number is reported by issuing an ATVR command.  The response
     returns 3 or 4 numbers. All numbers are hexadecimal and can have
     a range from 0-0xF.  A version is reported as "ABCD". Digits ABC
     are the main release number and D is the revision number from the
     main release. "B" is a variant designator. The following variants
     exist in ZB firmware: 


   "0" - Coordinator, AT Command Mode (AP=0) 
   "1" - Coordinator, API Mode (AP=1,2) 
   "2" - Router AT Command Mode (AP=0) 
   "3" - Router API Mode (AP=1,2) 
   "8" - End Device, AT Command Mode (AP=0)
   "9" - End Device, API Mode (AP=1,2)


 Digi has developed an assortment of sensor adapter products that
    use the ZB firmware.  (See www.digi.com for details.)  Adapter
    firmware versions include the following variants: 


   "4" - Router/End Device Sensor Adapter
   "5" - End Device Power Harvester Adapter
   "6" - Router/End Device Analog IO Adapter
   "7" - Router/End Device Digital IO Adapter


 All releases will have an even number for C. All internal
    development will have an odd number for C. Field D is always
    present, even when D is 0.



 Notes


   The RCS TZB20 appears to be similar to the TR16
   The RCS TZB43 appears to be similar to the TR40
   Instead of RS485 (used in the TR16 & TR40) the XBees are used.
   XBees can be purchased with or without ZigBee (Series 1 without?
       Series 2 with? - XB24-B, series 2)
   ZigBee networks always have a single coordinator device (I now have an API & ATI Coordinator setup).
   ZigBee networks also have, at least, either one router or
       end-device
   Routers are always on device and are plugged into a constant
       power source (such as a power outlet).
   End-devices can save power by going into non-responsive sleep
       mode.
   Routers can also contain end-device (minus the sleep mode).
   ZigBee uses source-routing 
   To configure the XBees you'll need X-CTU
       
   There is the AT mode (like the Hayes AT command set) and the API
       mode (which one for the TZB? Probably AT)
   ZNet2.5? ZigBee? Probably ZigBee (ATVR -> 2241 response)