Blum ServoDrive Wireless Protocol Deciphered

one of my latest projects is to integrate the kitchen cabinets into a smart home system. The end idea is to automatically close all cabinets when I turn off the light as I usually tend to leave the cabinets open whilst repeatedly taking things out. Another idea might be to automatically open all cabinets on button press to empty the dishwasher.

I will not make the addresses and channels public as this is taking a lot of efforts and time from my side. If you are interested in the already identified addresses and channels, please donate a coffee of at least 15 EUR and send me a mail at "blum at bluhm-de dot com". I will send you the full information.

In addition I am working on a virtual switch/cabinet sketch for Ardunio that you can buy from me for 25 EUR. Follow the above process. This sketch includes a working set of all below functions as sender and receiver/master and slave.

Inside the buttons are nrf24L01+ transceivers.

They are working on at least three different frequencies:

1. Button communication
2. Programming
3. Syncing

Communication

Switch

The switch sends the following 9 byte sequence to the cupboard receiver address 01:

ba MM NN ff 01 20 XX YY dd

MM NN is the switch's ID.
XX YY is a sequence number which changes for every submission. It does not seem to be validated.

Programming

Switch

  1. Press the "Switch" button on the cupboard receiver for a few seconds. This triggers the reception mode on the configuration channel.
  2. Hold the switch for a few seconds. This sends the following 9 byte sequence 
    ba MM NN ff 01 01 00 YY dd
    MM NN is the button's ID.
    YY is a sequence number which changes for every submission.
  3. The cupboard receiver sends the following sequence as Ack Payload.
    ba MM NN 01 01 81 00 YY dd
    MM NN is the cupboard receiver's ID.
    YY is a sequence number which changes for every submission.
  4. The cupboard receiver stores the switch's ID to identify a valid switch on future transmissions.
  5. The receiver's ID is reversed and stored in the switch to be used as transmission address 01
    (i.e. ddNNMMba01)

Sync

Collision

Other functions

Sync button (single press) - [to be tested]

Pressing the sync button one time lights up the green LED on each synced partner. The message

BA MM NN 00 01 27 00 YY DD BA UU VV 01

is sent to the sync address of the stored partner(s).

MM NN is the sender's ID.
UU VV is the partner's ID.
YY is a sequence number which changes for every submission.

Wireless Reset Button - [to be tested]

Pressing the reset button resets al stored wireless information. It also removes the sync programming on the synced drives. The message

BA MM NN 00 01 42 00 YY DD BA UU VV 01

is sent to the sync address of the stored partner(s).

MM NN is the sender's ID.
UU VV is the partner's ID.
YY is a sequence number which changes for every submission.

 

[verify if colission and button programming is also cleared]