Device 07: CS92 DHW Sensor

RF check

The button LED is normally off. A short/single press on the button will enter an RF check (0016) mode:

17:45:12.336 047 RQ --- 07:045960 01:145038 --:------ 0016 002 0000
17:45:12.348 058 RP --- 01:145038 07:045960 --:------ 0016 002 0038

17:45:17.338 048 RQ --- 07:045960 01:145038 --:------ 0016 002 0000
17:45:17.351 052 RP --- 01:145038 07:045960 --:------ 0016 002 002C

The green LED will be hard on, and the red LED will display a repeating sequence of five quick red flashes, then a pause (starting with a pause). The CS92 will send a packet every five seconds (apparently, every second cycle). In this mode, a short/single press will stop the RF check mode.

RF bind

A five-second press on the button will enter an RF bind mode (1FC9) where the green LED is on, and the red LED is constantly flashing. In this mode, a short/single will start the bind sequence (NB: the payloads have been edited for readability):

18:01:41.920 053  I --- 07:045960 --:------ 07:045960 1FC9 012 00-1260-1CB388 00-1FC9-1CB388
18:01:41.936 064  W --- 01:145038 07:045960 --:------ 1FC9 006 00-10A0-06368E
18:01:41.958 053  I --- 07:045960 01:145038 --:------ 1FC9 006 00-1260-1CB388

18:01:42.780 063  I --- 01:145038 --:------ 01:145038 0005 004 000D0100
18:01:44.465 052 RQ --- 07:045960 01:145038 --:------ 10A0 006 0013740003E4
18:01:44.482 054 RP --- 01:145038 07:045960 --:------ 10A0 006 0013880003E8

old stuff...

First, the CS92A is bound as a sensor (the controller is listening):

16:32:10.928 055  I --- 07:045960 --:------ 07:045960 1FC9 012 00-1260-1CB388 00-1FC9-1CB388
16:32:10.942 045  W --- 01:145038 07:045960 --:------ 1FC9 006 00-10A0-06368E
16:32:10.967 054  I --- 07:045960 01:145038 --:------ 1FC9 006 00-1260-1CB388

For the 1FC9 (bind) payloads, each entry is <zone_idx> <pkt_code> <device_id>:

• the CS92A is offering 1260 (DHW temperature) and 1FC9
• then 10A0 (DHW parameters)
• then 1260 (DHW temperature)

Then:

16:32:12.128 045  I --- 01:145038 --:------ 01:145038 0005 004 000D0100

Finally, an actuator to the same zone (the BDR91A is in listen mode, the controller sends the first signal):

16:33:26.749 051  I --- 01:145038 --:------ 01:145038 1FC9 018 FA-0008-06368E FC-3B00-06368E FA-1FC9-06368E
16:33:28.010 052  W --- 13:106039 01:145038 --:------ 1FC9 006 00-3EF0-359E37
16:33:28.025 049  I --- 01:145038 13:106039 --:------ 1FC9 006 00-FFFF-06368E

For the 1FC9 (bind) payloads:

• the controller is offering 0008, 3B00 (for FC, not for a zone) and 1FC9
• the actuator binding is for 3EF0
• the purpose of the 3rd packet is unclear