Z-Wave Secure Inclusion

As I said, I can’t really comment without seeing the logs - sorry - but really this doesn’t provide a lot to go on.

Please also provide the version - just so we are sure about what this is to avoid confusion.

230 │ Active │ 80 │ │ ZWave Binding

Hi Chris, all,

After reading numberous of treads around OpenHAB secure inclusion, trying several z-wave snapshot versions, I don’t know how to continu, therefore asking for help in this post:

My configuration :running openHAB 2.3 on a synology DS918+, Aeotec zwave.stick and a bunch of z-wave sensors and switches. All working fine, except my Aeon Garage door controller ZW062, the secure inclusion does not work in my case. I know there is a lot of treads on this topic, All tips & sugguestion did not work for me. I got the following log when including the ZW062.

This is the log from Karaf:

16:54:11.739 [INFO ] [smarthome.event.BindingEvent ] - org.openhab.binding.zwave.event.BindingEvent@2d83151a
16:54:14.958 [INFO ] [ommandclass.ZWaveSecurityCommandClass] - NODE 35: setupNetworkKey useSchemeZero=false
16:54:15.040 [INFO ] [ig.discovery.internal.PersistentInbox] - Added new thing ‘zwave:device:e97d8083:node35’ to inbox.
16:54:15.041 [INFO ] [smarthome.event.InboxAddedEvent ] - Discovery Result with UID ‘zwave:device:e97d8083:node35’ has been added.
16:54:15.043 [INFO ] [smarthome.event.BindingEvent ] - org.openhab.binding.zwave.event.BindingEvent@29bc9472
16:54:20.087 [INFO ] [ommandclass.ZWaveSecurityCommandClass] - NODE 35: setupNetworkKey useSchemeZero=true
16:54:20.089 [INFO ] [ommandclass.ZWaveSecurityCommandClass] - NODE 35: Using Scheme0 Network Key for Key Exchange since we are in inclusion mode.
16:54:20.219 [INFO ] [ecurityCommandClassWithInitialization] - NODE 35: Setting Network Key to real key after SECURITY_NETWORK_KEY_SET
16:54:20.221 [INFO ] [ommandclass.ZWaveSecurityCommandClass] - NODE 35: setupNetworkKey useSchemeZero=false
16:54:20.292 [ERROR] [ocol.security.ZWaveSecureNonceTracker] - NODE 35: SECURITY_ERROR Device message contained nonce that is unknown to us, id=83.
16:54:20.359 [WARN ] [ommandclass.ZWaveSecurityCommandClass] - NODE 35: payloadQueue was empty, returning!
16:54:31.023 [ERROR] [ecurityCommandClassWithInitialization] - NODE 35: SECURITY_INCLUSION_FAILED Failed at step SECURITY_NETWORK_KEY_SET: 10000ms passed since last request was sent, secure inclusion failed.
16:54:40.891 [INFO ] [commandclass.ZWaveVersionCommandClass] - NODE 35: Command Class LOCK has version 0!
16:54:41.168 [INFO ] [ol.commandclass.ZWavePlusCommandClass] - NODE 35: unknown ZWavePlus device type: 7680

any ideas, suggestions ?

Additional Info:

This is the zwave binding I am using
230 │ Active │ 80 │ │ ZWave Binding

This binding is not one that will work securely, and the log you have posted is from a binding that doesn’t support security.

Please read the first few messages in the following thread -:

You need to use the binding that is included in the link on the first post of that thread.

Hi Chris,

Thanks a lot, that did the trick !
Inclusion of the Aeon Garage door controller ZW062 worked as a charm on the first attempt.
I had to delete all devices, and configure them again. some did not behave as they did before.
So wenn will binding officially available ?


Hi Chris,
Since I use the new Binding, my Garage Door is working but now I have problems to get the Philio PST02A to work. Temp and Humidity work, but i do not receive updates for the Motion and Door contact. I saw serverall other people reporting the same issue. Is this related to the new binding ?


I don’t know what the problem is that you have, so it’s very hard to say. There shouldn’t be any change to the definitions of the devices between binding since they use exactly the same database.

Can you elaborate how you got to use security attribute? I’m having same issue, never succeeding to get it secured. I have exclude/include the smart lock numerous times

Which version of the binding are you using? Unless you’re using the following version, it won’t work -:

I’m using the proper version, or so I think.
147 | Active | 80 | | org.openhab.binding.zwave

Yes - I think this is ok.

Maybe you can elaborate on what you are doing - this is what we have in the docs -:

Secure inclusion must be started from the binding directly (ie with the controller plugged in to the USB and Online). This is because once the device is included into the network, a key exchange takes place between the binding and the device. This key exchange must take place within a very short time of the inclusion, and if it doesn’t succeed, the device must be excluded and included again. Secure inclusion will generate a lot of activity on the network, so you should avoid other activities at the same time, and the device being included should be close to the controller to reduce any retries that could cause the security handshake to fail.

So Finally got it to work (only took a whole day :slight_smile: ).
Had a lot of help from the kind people in the forum and from deep investigation in multiple forum threads.

What I can gather so far:

  1. Must have the secure binding version
  2. Need OpenHab 2.3 (though i’ve seen people getting it to work on 2.2)
  3. Not every time that you’d do exclude/include it’d work - need to try more than once.
  4. What nailed it for me is changing the network key. I’ve seen this happened to other people as well.

Thanks everybody for all the help. Really Really great forum!


Hi Elad,

I’m glad you were able to get this working for you. I believe I’m at step 4 right now, how did you generate your new key?



Not working at all. I have read almost every post but still doesn’t work. I added the device like mentioned. I can see the device but for some reason it is not included secure. When I try to operate it from openhab this is what I see in the logfiles but nothing happens to the lock

2018-08-08 15:19:21.184 [WARN ] [ng.zwave.internal.protocol.ZWaveNode] - NODE 4: CommandClass DOOR_LOCK is not marked as secure but should be, forcing secure

Yes I have installed the latest binding.

During startup of openhab

2018-08-08 15:35:58.189 [ERROR] [curityCommandClassWithInitialization] - NODE 5: SECURITY_ERROR Invalid state! Secure inclusion has not completed and we are not in inclusion mode. Aborting

Included now but when I want to switch the lock from openhab this is the error:

2018-08-08 16:30:40.096 [ERROR] [nal.common.AbstractInvocationHandler] - An error occurred while calling method ‘ThingHandler.handleCommand()’ on ‘org.openhab.binding.zwave.handler.ZWaveThingHandler@1fe0e21’: null

java.lang.NullPointerException: null

** at org.openhab.binding.zwave.internal.converter.ZWaveDoorLockConverter.receiveCommand(ZWaveDoorLockConverter.java:102) [15:org.openhab.binding.zwave:]**

** at org.openhab.binding.zwave.handler.ZWaveThingHandler.handleCommand(ZWaveThingHandler.java:878) [15:org.openhab.binding.zwave:]**

** at sun.reflect.GeneratedMethodAccessor59.invoke(Unknown Source) ~[?:?]**

** at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]**

** at java.lang.reflect.Method.invoke(Method.java:498) ~[?:?]**

** at org.eclipse.smarthome.core.internal.common.AbstractInvocationHandler.invokeDirect(AbstractInvocationHandler.java:153) [96:org.eclipse.smarthome.core:]**

** at org.eclipse.smarthome.core.internal.common.InvocationHandlerSync.invoke(InvocationHandlerSync.java:59) [96:org.eclipse.smarthome.core:]**

** at com.sun.proxy.$Proxy117.handleCommand(Unknown Source) [15:org.openhab.binding.zwave:]**

** at org.eclipse.smarthome.core.thing.internal.profiles.ProfileCallbackImpl.handleCommand(ProfileCallbackImpl.java:75) [103:org.eclipse.smarthome.core.thing:]**

** at org.eclipse.smarthome.core.thing.internal.profiles.SystemDefaultProfile.onCommandFromItem(SystemDefaultProfile.java:49) [103:org.eclipse.smarthome.core.thing:]**

** at sun.reflect.GeneratedMethodAccessor58.invoke(Unknown Source) ~[?:?]**

** at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]**

** at java.lang.reflect.Method.invoke(Method.java:498) ~[?:?]**

** at org.eclipse.smarthome.core.internal.common.AbstractInvocationHandler.invokeDirect(AbstractInvocationHandler.java:153) [96:org.eclipse.smarthome.core:]**

** at org.eclipse.smarthome.core.internal.common.Invocation.call(Invocation.java:53) [96:org.eclipse.smarthome.core:]**

** at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:?]**

** at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:?]**

** at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:?]**

** at java.lang.Thread.run(Thread.java:748) [?:?]**

I’ve got a Schlage lock that I’m trying to include. I’m using v2.3 on ubuntu with an AEON z stick. I’ve uninstalled the default zwave binding and placed 2.4 in the addons folder. I’ve read in several places that it is necessary to initiate inclusion from the “binding itself”. I’m sad to report I can’t figure out where that is in either the paper UI or Habmin. There is a “exclude devices” in the paper UI in the zwave controller thing editor, but that is the closest I’ve come.

Also, can someone answer if it is necessary to use the snapshot binding or if the stable release binding will work. The documentation seems to suggest stable release includes security features.


Read the second post in this thread. You start inclusion just like adding Things with any other binding. Big blue button in PaperUI or magnifying glass with plus sign in Habmin.

Thanks. That worked, or at least got into inclusion mode.