Vario Bus

Siedle Vario-Bus

The Siedle Vario-Bus is proprietary and undocumented. Needs independent security research. (Note to the manufacturer, "security by obscurity" never works. Please document the Siedle Vario-Bus.)

According to http://www.siedle.de/xs_db/DOKUMENT_DB/www/Produktinformationen/DCIP_650_DE_237157.pdf, the information on the Vario-Bus is transmitted via the RS485 protocol.

Connections

Connector	Usage
cv, bv	10–15 V AC or 10–30 V DC
Da, Db	Vario-Bus. "Da" is the positive RS485 signal line, terminal "Db" is the negative signal line

Source: http://www.siedle.de/xs_db/DOKUMENT_DB/www/Produktinformationen/PRI_602-01_USB_200035245-02_PI--.pdf and https://www.mikrocontroller.net/topic/428823

Protocol

Source: https://www.mikrocontroller.net/topic/428823. Grateful acknowledgment is made to Jan S.

Basics

The Siedle Vario Bus is an RS485 interface. Terminal "Da" is the positive signal line, terminal "Db" is the negative signal line. The input controller probably contains a bias network, an external bias network against 5V also works. Transmission is carried out with 9600 bit/s, 1 start bit, 1 stop bit, no parity and 1 stop bit. LSB first.

All packets are introduced with STX 0x02 and are terminated with ETX 0x03. If the values 0x03 or 0x10 are present in the user data, these values are prefixed DLE 0x10. The only exception is ACK 0c06 from COM 611, which is sent in response to the beep command.

Address broadcasts, startup messages from COM 611

STX; Source address; 0x02; Source address; 0x00; Checksum; ETX
STX; 0x21;0x2D; 0x01; Checksum; ETX (at address 01)
STX; 0x22;0x2D; 0x02; Checksum; ETX (for address 02)

Is an ACK expected?

Commands from COM 611

Startup messages, address broadcasts

Are not answered by the EC 602-03 by all appearances.

3x sent: STX; source address; 0x02; source address; 0x00; checksum; ETX
3x sent: STX; 0x20 + source address; 0x2D; source address; checksum; ETX

Byte	Function/ Input
Byte 0	STX
Byte 1	Destination address?
Byte 2	0x15 - Code/Function, 0x16 - Addressed ringing
Byte 3	Source address of COM 611
Byte 4 - 7	Entered code in high and low nibble, unused places are set to "F"h
Byte 8	Always 0x00?
Byte 9	Checksum 2 complement of the 8bit sum
Byte 10	ETX

Examples:

Input 12345678 + "F" key
0x02 0xFF 0x15 0x01 0x01 0x12 0x34 0x56 0x56 0x78 0x00 0xD7 0x03
Input 12345678 + "bell" button
0x02 0xFF 0x16 0x01 0x01 0x12 0x34 0x56 0x78 0x00 0xD6 0x031

Door opener function

Byte	Door opener function
Byte 0	STX
Byte 1	Destination address?
Byte 2	0x17
Byte 3	Source address of COM 611
Byte 4	0x01 for key on COM 611, 0x02 for input contact on COM 611
Byte 5	Checksum 2 complement of the 8bit sum
Byte 6	ETX

Examples:

Door release button on COM 611
0x02 0xFF 0x17 0x01 0x01 0x01 0xE8 0x03
Input contact at COM 611
0x02 0xFF 0x17 0x01 0x02 0xE7 0x03

If no beep command is sent to COM 611 for all of the above functions, it signals with three short beeps.

Commands for COM 611

Beep command

Transmitted by EC 602-03 after 20-25ms, COM 11 confirmed with 0x06 (ACK). If it is not transmitted, the COM 611 signals after a timeout with three short beeps.

Byte	Meaning
Byte 0	STX
Byte 1	Destination address
Byte 2	Function code
Byte 3	Possibly transmitter address
Byte 4	?
Byte 5	?
Byte 6	Duration of the beep, possibly in 10ms steps, Siedle value is 0x1E, 0x00 produces a continuous tone
Byte 6	Checksum 2 complement of the 8bit sum
Byte 7	ETX

Example:

TX: 0x02 0x01 0x13 0x40 0x01 0x00 0x1E 0x8D 0x03
Siedle Default at Addr 01

RX: 0x06
Confirmation of COM 611