Nokia F-Bus Protocol: Do You Wish To Control Appliances From Your Mobile?
Nokia F-Bus Protocol: Do You Wish To Control Appliances From Your Mobile?
A Introduction to Nokia F-Bus The F-Bus Protocol Sending an SMS message Receiving an SMS message Deleting an SMS message The F-Bus Demo Board F-Bus Libraries for Codevision AVR (The Firmware) The SMS telemetry Programmable logic Controller (PLC) The SMS Car tracking System Very useful F-Bus Links
The very popular Nokia 3310/3315 has the F/M Bus connection under the battery holder. This is a bit of a pain to get to and requires a special cable to make the connection. The left picture above shows the 4 gold pads used for the F and M Bus. The right picture shows the F-Bus cable connected to my Nokia 3310.
Nokia download cables are available from most mobile phone shops and some electronics stores. I brought my cable from Dick Smith electronics in Australia. The cost of the Nokia 3310 download cable is around $30AUD and is an excellent investment to get the most out of your phone. You can use PC software like Logomanager and Oxygen Phone Manager (See links below) to upload ringtones, graphics, phone numbers etc. No more paying for those cool ringtones, just download them off the internet or record your own! I have even designed a ringtone doorbell, just what every house needs! The cable contains electronics to level convert 3V signals to RS232 type signals. There are also M and F bus switching in most cables.Some pages have schematics for making your own cable, however I think it's easier to buy one, as the phone connectors are very hard to come by.
Added 29-Dec-2003 - For all you microcontroller DIYer's out there, connect the DTR pin to a +3 to 12 Volt supply and RTS to a -3 to -12Volt supply. The easy way to achieve this is by using a Max232 or similar transceiver for the RS232 TX and RX pins and then connecting the DTR pin on the serial cable to the V+ pin on the Max232. Do the same for the RTS, however connect it to the V- pin on the Max232. The V+ and V- pins are derived from internal charge pumps that double the input voltage. ie. for a 5V Max232, the V+ will +10V and the V- will be -10V. I hope this clears up this issue for most people! The next step is to synchronize the UART in the phone with your PC or microcontroller. This is done by sending a string of 0x55 or 'U' 128 times. Simple! The bus is now ready to be used for sending frames. The Nokia protocol has a series of commands that allow the user to make calls, send and get SMS messages and lots more. If you have not already go to The Linux Gnokii Project and download the source code. This group has excellent documentation on the commands used with different Nokia phones. This is great work guys! Please do not email me for the Nokia Commands - If you want them download the Linux Gnokii Project Source Sample frame sent to my Nokia 3310 (showed as a Hex dump)
Byte: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 Data: 1E 00 0C D1 00 07 00 01 00 03 00 01 60 00 72 D5
This sample frame is used to get the hardware and software version from a Nokia phone. It is a good starting point to test if our implementation of the protocol is working. Byte 0: All frames sent by cable will start with the character 0x1E first. This is the FBus Frame ID. Cable is 0x1E and InfraRed is 0x1C. Byte 1: This is the destination address. When sending data, it's the phone's device ID byte. In our case it's always 00 for the phone. Byte 2: This is the source address. When sending data, it's the PC's device ID byte. In our case it's always 0x0C (Terminal). Byte 3: This is the message type or 'command'. 0xD1 is Get HW & SW version. Byte 4 & 5: Byte 4 & 5 is the message length. In our case it is 7 bytes long. Byte 4 is the MSB and byte 5 is the LSB. Thanks to Ron Reiter for comfirming this! Byte 6: The data segment starts here and goes for 7 bytes in our case. As The Nokia is a 16 bit phone and therefore requires an even number of bytes. As ours is odd the last byte will be a padding byte and the message will end at location 13. The last byte in the data segment (Byte 12 above) is the sequence number. The last 3 bits of this byte increments from 0 to 7 for each frame. This part needs to be sent back to the phone in the acknowledge frame. The other bits I am unsure about what they mean! Bytes 14 & 15: The second to last byte is always the odd checksum byte and the last byte is the even checksum byte. The checksum is calculated by XORing all the odd bytes and placing the result in the odd Checksum location and then XORing the even bytes and then placing the result in the even byte.
Well that is our first frame for our Nokia Phone. If the phone received it is show reply with the following data
1E 0C 00 7F 00 02 D1 00 CF 71 1E 0C 00 D2 00 26 01 00 00 03 56 20 30 34 2E 34 35 0A 32 31 2D 30 36 2D 30 31 0A 4E 48 4D 2D 35 0A 28 63 29 20 4E 4D 50 2E 00 01 41 3F A4
The first line is an Acknowledge command frame. Notice how the destination and source addresses are now swapped. This is because the Nokia phone is now talking. This message is two bytes long with the two bytes representing the message type received (0xD1) and the sequence number (0x00). The last two bytes are the checksum and should be checked to make sure the data is correct. The 3310 will be waiting for an acknowledge frame after these two frames were sent. If the acknowledge frame is not sent the 3310 will retry sending the data. The 3310 will only send the data 3 times and then gives up. The second frame from our Nokia 3310 is the data we requested. The message type is 0xD2. This is 'receive Get HW&SW version'. This 38-byte (0x26) message should show 0x0003 "V " "firmware\n" "firmware date\n" "model\n" "(c)NMP." The last byte in the data is the sequence number. As with standard F-bus frames, the last two bytes in the frame are checksum bytes. The received data without f-bus frame
01 00 00 03 56 20 30 34 2E 34 35 0A 32 31 2D 30 36 2D 30 31 0A 4E 48 4D 2D 35 0A 28 63 29 20 4E 4D 50 2E 00 01 41 M 0003 V 5 \n ( c 0 ) 4 . 4 5 \n 2 N M P . 1 / 0 6 / Sequence no. 0 1 \n N H
All that is required now is to send a acknowledge frame back to the phone to say 'I got it!'
1E 00 0C 7F 00 02 D2 01 C0 7C
0x7F is the acknowledge frame's command. We are only required to send a two-byte message so length is set to 0x02. The message contains the acknowledged message type (0xD2) and the sequence no. (0x01). The sequence number is made from the last 3 bits of the sequence number in the previous frame. The checksum needs to be calculated and sent.Well that's easy now! We will look at sending SMS messages next, (part two) and look at the AVR hardware for the project in part three, coming soon!!
How to send a SMS message with FBus? Now that we know how to send frames on the bus, we should look at
sending an SMS message. It is not a hard process, once you can pack the message into 7-bit characters!
When dealing with binary, it makes life easier to write everything backwards. The first byte in the string is on the right. The least significant bit is then displayed on the left with the most significant bit on the left. Shown below is the same string of 'hello' just displayed backwards. Then it's just a matter to dividing the binary values into bytes starting with the first character in the string. (Start from right and go to left.) The first decoded byte is simply the first 7 bits of the first character with the first bit of the second character added to the end as shown below. The next decoded byte in then the remaining 6 bits from the second character with two bits of the third byte added to the end. This process just keeps going until all characters are decoded. The last decoded byte is the remaining bits from the last character with the most significant bits packed with zeros.
6F 6C 6C 65 68 1101111 1101100 1101100 1100101 1101000 (The ASCII characters shown in binary) 110 11111101 10011011 00110010 11101000 (The above binary just split into 8 bit segments) 06 FD 9B 32 E8 (The 8 bit segments decoded into hex)
The message hello is therefore E8 32 9B FD 06 when packed .When playing with sending SMS messages a lot of decoding is required. Therefore I wrote a few small programs to automatically pack and unpack the data for me. The first program allows me to input the string to be packed in the top memo box and when the button 'Pack' is pressed the top string is packed ready to go!The full program with source for downloading SMSPacker.zip This program below, will both unpack and then pack the message. It was used to read the packed messages from my serial protocol analyzer. It also tests my subroutines in C for both pack and unpack. Already for my AT90S8535 microcontroller! Swen-Peter Ekkebus has an excellent page - The on-line PDU converter
XXXX XXX1 = SMS Submit - The short message is transmitted from the Mobile Station (MS) to the Service Centre (SC). XXXX XXX0 = SMS Deliver - The short message is transmitted from the SC to the MS.
(Refer to GSM 03.40 - 9.2.3 Definition of the TPDU parameters) In our case it is 0x15 = 0001 0101 in binary. The message is SMS Submit, Reject Duplicates, and Validity Indicator present. Byte 25: Message Reference if SMS Deliver & Validity Indicator used (Not used in this case). Refer GSM 03.40 - 9.2.3.6 TP-Message-Reference (TP-MR) Byte 26: Protocol ID. Refer to GSM 3.40 - 9.2.3.9 TP-Protocol-Identifier (TP-PID) Byte 27: Data Coding Scheme. Refer to GSM 03.38 & GSM 3.40 - 9.2.3.10 TP-DataCoding-Scheme (TP-DCS) Byte 28: Message Size is 0x33 in hex or 51 bytes long in decimal. This is the size of the unpacked message. Refer to GSM 03.40 - 9.2.3.16 TP-User-Data-Length (TP-UDL) Destination's Phone Number (12 Bytes) Byte 29: Destination's number length. Is this correct?. Byte 30: Number type e.g. 0x81-unknown 0x91-international 0xa1-national Byte 31 to 40: (Octet format) Destination's Phone Number Validity Period (VP) Byte 41: Validity-Period Code. Time period during which the originator considers the short message to be valid. Byte 42 to 47: Service Centre Time Stamp ?? For SMS-Deliver The SMS Message (SMS-SUBMIT) Byte 48 to 92: This is the SMS message packed into 7 bit characters. SMS Point-toPoint Character Packing Byte 93: Always 0x00 The F-Bus usual ending Byte 94: Packet Sequence Number Byte 95: Padding Byte - String is old and requires to be even! Byte 96 & 97: Odd & even checksum bytes. If the phone receives a valid frame it should reply with something like this below, to say it got the message. Reply frame sent from my Nokia 3310 (showed as a Hex dump)
Byte: 00 01 02 03 04 05 06 07 08 09 Data: 1E 0C 00 7F 00 02 02 03 1C 72
This is just like the above Acknowledge command frame. The destination and source addresses are swapped, as this is a frame from the phone to the PC. This message is two bytes long with the first byte representing the message type received (0x02) and the next byte, the sequence number (0x03). The last two bytes are the checksum and should be checked to make sure the data is correct. After a short time the phone will reply with a 'Message sent' frame shown below.
Byte: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 Data: 1E 0C 00 02 00 09 01 08 00 02 64 12 00 01 44 00 3F 1E
Byte 03: Message Type = 0x02 - SMS Handing Byte 04 & 05: Message Length = 0x0009 - 9 Bytes long
Byte 09: 0x02 = Message Sent Byte 10 to 14: Unsure of what this is? The PC must then acknowledge the frame. No explanation required here!
Byte: 00 01 02 03 04 05 06 07 08 09 Data: 1E 00 0C 7F 00 02 02 04 10 79
Now we know how to pack and unpack the message lets look at the full frame.
Number 37 38 39 60 61 62 70 40 32 97 E7 F3
Byte: 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97
Data: 4D 07 D1 D1 F2 77 FD 8C 06 19 5B C2 FA DC 05 1A BE DF EC 50 08 01 45 00 4A 5C
Byte 03: Message Type = 0x02 - SMS Handing Byte 04 & 05: Message Length = 0x0059 - 89 Bytes long Byte 09: 0x10 = SMS Message received Byte 10: 0x02 = Memory Type = SIM Byte 11: 0x10 = Location where SMS message stored - required to delete SMS message (TPDU) Transfer Protocol Data Unit Byte 24: 0x38 Byte 25: 0x04 Byte 26: Protocol ID Byte 27: Data Coding Scheme Byte 28: Message Length. 0x33 = 51 Bytes long! The PC must then acknowledge this frame like normal
Byte: 00 01 02 03 04 05 06 07 08 09 Data: 1E 00 0C 7F 00 02 02 05 10 78
Well that's the received message above, the only last thing that can be done, is to delete the message from the phone. The phone can only hold so many messages so this should be required, or the memory with fill up.
Byte 03: Message Type = 0x14 - SMS Functions Byte 04 & 05: Message Length = 0x0008 - 08 Bytes long Byte 6 to 8: Start of the SMS Frame Header. 0x00, 0x01, 0x00 Byte 9: 0x0A Delete SMS Message Byte 10: 0x02 = Memory Type = SIM - Make sure message is store in this type (0x03 = phone) Byte 11: 0x02 = Location where SMS message stored. This location can be found in the 'receive SMS frame' (Byte 11) Byte 12: 0x01 Byte 13: Packet Sequence Number Byte 14 & 15: Odd & even checksum bytes.
The two jumpers near the F-Bus connection sets the levels for RTS and DTR. The 6 Pin header on the AVR570 is the In-Circuit Programming (ISP) port with the 10 Pin IDC used for JTAG programming and debugging. The board was designed with holethrough components as I am trying to get rid of my old stock! 24/05/2003 Well I have been able to receive and display hardware and software information from my Nokia Phone (see below). This is the first step to getting the frame send and receive routines working with the frame acknowledge. I have been able to send a SMS from my Mega128 using a fixed frame of data stored in flash. The next step is to build the frame on the fly, so any text can be sent. I am currently writing a Command Interpreter so simple commands can be sent over the serial interface to setup the processor and send messages etc. A dump from the terminal
Welcome to Wayne's Nokia 3310 F-Bus Command Manager Version 1.0 S->GetHWSW Sending Frame: 1E 00 0C D1 00 07 00 01 00 03 00 01 60 00 72 D5 Received: 1E 0C 00 7F 00 02 D1 00 CF 71 Received: 1E 0C 00 D2 00 26 01 00 00 03 56 20 30 34 2E 34 35 0A 32 31 2D 30 36 2D 30 31 0A 4E 48 4D 2D 35 0A 28 63 29 20 4E 4D 50 2E 00 01 43 3F A6 Sending Ack: 1E 00 0C 7F 00 02 D2 03 C0 7E Hardware & Software Versions Firware: V 04.45 21-06-01 Model: NHM-5 OK->
02/06/2003 We this is it! I can now receive SMS messages and turn I/O pins on and off remotely. Below is a screen dump from the RS232 port used for debuging my project.
Welcome to Wayne's Nokia 3310 SMS Manager MK1 Sending Frame: 1E 00 0C D1 00 07 00 01 00 03 00 01 60 00 72 D5 Received: 1E 0C 00 7F 00 02 D1 00 CF 71 Received: 1E 0C 00 D2 00 26 01 00 00 03 56 20 30 34 2E 34 35 0A 32 31 2D 30 36 2D 30 31 0A 4E 48 4D 2D 35 0A 28 63 29 20 4E 4D 50 2E 00 01 45 3F A0 Sending Ack: 1E 00 0C 7F 00 02 D2 05 C0 78 Hardware & Software Versions Firware: V 04.45 21-06-01 Model: NHM-5 Sending Frame: 1E 00 0C 02 00 08 00 01 00 33 64 01 01 42 77 7B Received: 1E 0C 00 7F 00 02 02 82 1C F3 Received: 1E 0C 00 02 00 2A 01 08 00 34 01 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 91 16 14 91 09 10 F0 00 00 00 00 53 4D 53 43 31 30 00 01 46 5D 02 Sending Ack: 1E 00 0C 7F 00 02 02 06 10 7B SMS Centre Details SMS Number : +61411990010 SMS Name : SMSC10 Received: 1E 0C 00 02 00 33 01 08 00 10 02 18 00 07 91 16 14 91 09 10 F0 00 10 1F C8 04 00 00 07 0B 91 16 04 73 95 72 F9 30 60 10 22 30 60 10 22 45 83 6B CC 32 39 06 7A BB 01 01 47 00 0D 0A Sending Ack: 1E 00 0C 7F 00 02 02 07 10 7A Receiving incoming SMS message! SMS Centre Number : +61411990010 Senders Phone Number : +61403XXXXXX Message Size = 7 Message = Led1 on We have a Match LED ON Received: 1E 0C 00 0A 00 15 01 08 00 71 01 00 01 0B 01 02 C3 F2 22 75 05 F5 20 00 00 01 40 00 9A 10 Sending Ack: 1E 00 0C 7F 00 02 0A 00 18 7D Received: 1E 0C 00 02 00 33 01 08 00 10 02 19 00 07 91 16 14 91 09 10 F0 00 10 1F 48 04 00 00 08 0B 91 16 04 73 95 72 F9 30 60 10 22 30 60 10 22 55 81 6B CC 32 39 06 7A 9B CD 01 41 00 4A 3B
Sending Ack: 1E 00 0C 7F 00 02 02 01 10 7C Receiving incoming SMS message! SMS Centre Number : +61411990010 Senders Phone Number : +61403XXXXXX Message Size = 8 Message = Led1 off We have a Match LED OFF Received: 1E 0C 00 0A 00 15 01 08 00 71 01 00 01 0B 01 02 C3 F2 22 75 05 F5 20 00 00 01 42 00 98 10 Sending Ack: 1E 00 0C 7F 00 02 0A 02 18 7F
An optional 2x 40-character LCD panel can be added to give instant status of the unit. The unit runs from a 12 volt supply and is portable so it can be used in moving equipment like portable generators and farm equipment. The systems can work in many ways, however you will need you own mobile phone plus a spare one to connect to the Nokia PLC board. If you need to turn on a Pump connected to Relay 2 you just setup the message string for relay2 to pump using the terminal port on the Nokia PLC. All settings are stored in the Mega128s internal EEPROM so none are lossed during a period of power loss. Once this is done, just type pump on into you phone and send a SMS to the phone connected to the system. The relay should then turn on. To turn it off, just use your phone to SMS Pump off to the Nokia PLC. If enabled the Nokia PLC will send a reply back to you phone, to say the command was successful. As anyone who has sent a message on new years eve will know, there can be big delays or even message loss when the network is overworked. If one of the Opto-isolated inputs become active the Mega128 will send a programmed SMS message to the phone whos number is programmed into the Nokia PLC. This message can be anything like over temperature alarm etc. For the more advanced projects the temperature reading could be sent.
Schematics
Coming soon:-)
Links
The Linux Gnokii Project - A linux based programme to send SMS from a linux box. An Excellent source of information on the F-Bus protocols - A must for
developing systems for F-Bus. Have a look at the doc/protocol/nk6110.txt file for commands - Get the standards for GSM Digital cellular telecommunications system GSM 03.38 - Alphabets and language-specific information (Information on packing 7 bit characters in SMS messages) GSM 03.40 - Technical realization of the Short Message Service (SMS) Pointto-Point (PP) Advanced Wireless Planet - Useful links and resources Nokia 61xx SMS send/receive functions by Justin Karneges - A special thanks to Andrew Dunn for showing me this one! Swen-Peter Ekkebus has an excellent page - The on-line PDU converter LogoManager - A programme to send SMS, edit ringtones, graphics etc (For Microsoft Windows) Oxygen Phone Manager - A programme to send SMS, edit ringtones, graphics etc (For Microsoft Windows) Sysinternals Download the free PortMon. This is a powerful port monitor written by Mark Russinovich that greatly helps in debugging serial and parallel port activity. Sysinternals have some very powerful utilities for debugging just about anything PC related. A must bookmark site! Sales of Nokia Data Cables in AustraliaHardware
Solutions
For all you people who can't be bothered to make your own, here's some you can buy now! The Spider SMS By Halytech Pty. Ltd, an Australia Company. Digital and Analog Inputs, Inbuilt Web server, Relay Outputs! Why not download a datasheet today!
AutoBleep SMS controllers Anino SMS New: 21th June 2004 Mel Bacuen has made an inexpensive way of controlling remote devices through the use of an ordinary cellular phone. He is based in the Phillipines & the price is $US 70.00.
My favorite idea - A SMS based weather station. Just SMS it a blank message and it replies with current temperature, humidity, wind speed, direction and atmospheric pressure. Just think of the message costs!! A SMS based programmable logic controller (PLC). Gives you the freedom of turning pumps and mains equipment on and off by SMS. Every house and workplace needs one!! Air-cond on, Air-cond off. Add SMS to your alarm system - Reports sectors and type of alarm when tripped. A SMS based car GPS tracking system. Just SMS your car with the string "Tracking on" and it starts SMSing you the position of your car every minute etc. The ideal car alarm system. It can even SMS you when the alarm goes off.