Kwikset 916 w/Aeotec Z-Stick v5 on a Pi3+, problem with secure inclusion

  • Platform information:
    • Hardware: CPUArchitecture/RAM/storage Pi3b+ Rev 1.3
    • OS: what OS is used and which version Raspbian GNU/Linux 10 (buster)
    • Java Runtime Environment: which java platform is used and what version
    • openHAB version: Openhab 2.5.7-1
  • Issue of the topic: I do not understand how to securely include my 916. I have installed the Z-Wave Binding 2.5.7. I am new to Openhab and Linux. I searched for inclusion instructions, which was to take the Z-Stick to the lock and press the button on the Z-Stick and them immediately press the “A” on the lock to start the inclusion process.

I thought this was successful, but the Item that was found was Node 2. Upon further research, I learned that Secure Inclusion is accomplished via Software. So, I did a factory reset both the Z-Stick and the 916, and uninstalled the Z Wave Binding and rebooted.

I went to PaperUI Configuration Add-Ons > Bindings and I installed binding-zwave - 2.5.7. I rebooted, and then went to the Inbox and select the “+”, I then chose the Z-Wave Binding and pressed the “A” on the 916.

Z-Wave Node 2, an Unknown Device is all that appears. I click the check mark, the dialog box states " You are about to add a new thing Z-Wave Node 002 (zwave:device:33c19c6e:node2) from the inbox". I do not proceed, because my expectation is that it should have been identified as a 916.

I did validate that Configuration > Things has a single entry, Z-Wave Serial Controller zwave.serial_zstick:33c19c6e, which shows it is online. So it appears the Z-Stick is working.

Back to the binding, I can not find the 916 listed under Supported Things, but I see other locks like the 914 listed. I have seen several post about adding the 916, but I have no idea what my next step should be. Can anyone point me in the right direction?


Even if the device is not currently n the community maintained database it should appear as a node being an Unknown Device if it is fully discovered. openHAB makes an xml file for the node in the zwave folder of userdata containing the information for your device.

The database is currently in transition to a new server home so I am not cure if any changes may be delayed.

Thanks @Bruce_Osborne.

I tried some additional trouble shooting. I found some characters in the security key for the controller. I was unable to change the security key or delete it, so I removed the node, then excluded the controller. I then I reinstalled the controller. I was surprised that this time a Kwikset 914 thing was in the Inbox.

I’m not sure if the issue has been resolved, I still need to test, but I’ve never made it this far, so I’m optimistic. If the issue is resolved, I’ll leave an update here. Thanks again.

1 Like

Okay, so I’m still having issues with Secure Inclusion. The real problem is I don’t know exactly how to start the Secure Inclusion process. I tried several different variations, but in general:

  1. Removed the lock from the controller, I believe this was in the locks properties.
  2. Deleted the lock from Things.
  3. Performed a factory reset on the lock.
  4. I went to the Z-Stick Configuration and selected Exclude Devices, then the check mark and pressed the “A” on the lock.
  5. I then deleted the Z-Stick from Things.
  6. I shutdown the Pi.
  7. I remove and factory reset the Z-Stick.
  8. I reinsert the Z-Stick and power up the Pi.
  9. I did not think about removing the binding, but I may try that tomorrow.
  10. I went to Things, clicked the “+” and selected the only binding I have installed, the Z-Wave Binding.
  11. I tried several different combinations at this point, pressing “A” on the lock before clicking the right arrow, pressing the right arrow then pressing the “A”, pressing the right arrow and the “A” at the same time.
  12. The lock is almost immediately identified as a Kwikset. The process clocks for a couple of minutes, but before this is completed, I get a message in the inbox.
  13. After the clocking has finished, I go to the inbox and add the Thing.
  14. I go to the Things tab and select properties and I see that the secure inclusion is still set to false.

As a side note, I am using ETH0 with a static IP for Node Red. I don’t have WiFi enabled, so the closest I can get to the lock is 5 feet away. I think this is close enough since I get the Kwikset info on the node.

Is there a place that shows the exact process of inclusion for locks?

I could be wrong, but I don’t believe that the aeotec gen 5 stick supports secure inclusion. Only the aeotec devices currently listed as “S2” have that capability and the gen 5 stick is not one of those.

That may or may not be correct. S2 devices are required to be backward compatible with S0 security. Currently OH only supports S0 security but S2 devices work with that level.

1 Like

This is incorrect.

Security is not handled by the controller - it’s handled by the binding. The binding only supports S0 at this point - S2 will always fall back to S0, so all devices are supported.

The binding docs provide information on inclusion. Every device is however different so you need to look at the device manual.

The important thing with secure inclusion is timing - everything from the initial inclusion of the device into the network, and the key exchange (aka the secure inclusion) must happen within approx 15 seconds. If it doesn’t work, you MUST reset the device and start again.


I have found the issue and have been able to securely include the lock. The process was interesting. I removed / uninstalled everything Z-Wave. I did a factory reset on both the Z-Stick and the 916.

From 30 feet away, the Z-Stick is recognized and the controller is added. The Node was recognized as a 914, but secure inclusion was false.

I obtained a 25’ cat5, and preformed the same steps listed above, with the same results. I was able to get within 2’, performed the same steps and failed again.

I obtained a 50’ cat5, and performed the same steps listed above with the Z-Stick in physical contact with the 916. Success! Now I have secure inclusion.

I would have never guessed that I needed to be so close to the device for secure inclusion. I noticed that from 30’ away that I was able to get the Node for 914 installed. I thought that since the Z-Stick was talking to the 916, I would have been able to complete the secure inclusion. This was not the case.

I would like to thank everyone who helped.