X10 RF Security Extended Address
From mochad
X10 RF Addendum
This document shows USB data packets captured from CM15A and CM19A transceivers for various X10 RF security devices. The X10 Wireless RF protocol is well documented in [1]. [1] describes the protocol as seen over-the-air while this document describes the same data received from CM15A/CM19A transceivers.
DS10A and MS10A security sensors and the KR10A remote control send 41 bit streams vs. 32 bit streams for other RF security devices. The extra 9 bits are additional security address bits. This information is based on observation of DS10A, MS10A, and KR10A devices and does not come from any official X10 source. [1] says the 9 bits have a fixed value but observations of newer devices show the 9 bits change whenever a new security address is generated. The additional address bits means more devices can be used without the chance of duplicate addresses.
Contents[hide] |
MS10A PIR motion sensor
Sample data from an MS10A captured from a CM15A. Note the CM19A produces the same data except it does not send the first byte 0x5D. The CM19A does not have a power line interface (PL) so it does not need to identify whether the packet came from the PL or RF interface. The CM15A sends the extra byte since it has both PL and RF interfaces.
5D 29 C6 C9 0C F3 1B 00
5D = received from RF interface (not seen from CM19A) 29 = RF security
The previous two bytes are generated by the controller. The following bytes are the over-the-air transmission. See [1] for details on decoding these bytes but be sure to note the order of the bits is reversed.
C6 = security address 1 C9 = XOR with previous byte must be 0x0F 0C = function/key F3 = XOR with previous byte must be 0xFF 1B = security address 2 00 = parity bit for previous byte.
The parity bit is specified by the mask 0x80. The remaining 7 bits are always zero.
If the total number of ones in security address 2 is even the last byte is 0x00. If the total number of ones in security address 2 is odd the last byte is 0x80.
In this example, 0x1B = 00011011 which has four ones so the last byte is 0x00.
The mochad CM15A/CM19A driver/gateway decodes the packet like this.
12/18 17:26:15 Rx RFSEC Addr: C6:1B:00 Func: Motion_alert_MS10A
DS10A Window/Door Sensor
Sample data from a DS10A captured from a CM15A.
5D 29 EF E0 81 7E 43 80
5D = received from RF interface (not seen from CM19A) 29 = RF security
The previous two bytes are generated by the controller. The following bytes are the over-the-air transmission. [1] does not mention this device but the packet is similar to the MS10A.
EF = security address 1 E0 = XOR with previous byte must be 0x0F 81 = function/key 73 = XOR with previous byte must be 0xFF 43 = security address 2 80 = parity bit for previous byte.
The mochad CM15A/CM19A driver/gateway decodes the packet like this.
12/18 17:40:02 Rx RFSEC Addr: EF:43:80 Func: Contact_normal_min_low_DS10A
Function/Key Values
Other function/key values and their meanings are shown below. min/max refer to the position of the slide switch inside the DS10A cover. low means low battery. The MS10A does not have a low battery indicator or a min/max switch.
| Function/Key | Description |
|---|---|
| 0x0C | Motion_alert_MS10A |
| 0x8C | Motion_normal_MS10A |
| 0x04 | Contact_alert_min_DS10A |
| 0x84 | Contact_normal_min_DS10A |
| 0x00 | Contact_alert_max_DS10A |
| 0x80 | Contact_normal_max_DS10A |
| 0x01 | Contact_alert_min_low_DS10A |
| 0x81 | Contact_normal_min_low_DS10A |
| 0x05 | Contact_alert_max_low_DS10A |
| 0x85 | Contact_normal_max_low_DS10A |
| 0x06 | Arm_KR10A |
| 0x86 | Disarm_KR10A |
| 0x46 | Lights_On_KR10A |
| 0xC6 | Lights_Off_KR10A |
| 0x26 | Panic_KR10A |
References
[1] "Data format for X-10 wireless units" by Edward Cheung, Ph.D. and Paul Gumerman.