Issue Reporting Tamper Detection via ActiveHardwareFaults (0x0005) – General Diagnostics Cluster (0x0033)

[rahul@123]

Hi Nordic Team,

I am using NCS v3.0.0 and working on a Matter-based application.

I have enabled the ActiveHardwareFaults attribute (0x0005) in the General Diagnostics cluster (0x0033) using ZAP GUI, and now I am implementing tamper detection functionality (enum value 10: TamperDetected).

• I have written custom logic to detect tamper events and update the ActiveHardwareFaults attribute accordingly.

• However, on the chip-tool side, the attribute still shows 0 entries — it does not reflect the tamper fault value.

1. My code logic for how I’m updating the ActiveHardwareFaults attribute.

// Work handler function: runs in thread context
static void tamper_work_handler(struct k_work *work)
{
    GeneralFaults<kMaxHardwareFaults> hwFaultsPrevious;
    GeneralFaults<kMaxHardwareFaults> hwFaultsCurrent;
    using app::Clusters::GeneralDiagnostics::HardwareFaultEnum;

    ReturnOnFailure(hwFaultsCurrent.add(to_underlying(HardwareFaultEnum::kTamperDetected)));
    ReturnOnFailure(hwFaultsPrevious.add(to_underlying(HardwareFaultEnum::kTamperDetected)));
    LOG_ERR("Before OnHardwareFaultsDetect");
    app::Clusters::GeneralDiagnosticsServer::Instance().OnHardwareFaultsDetect(hwFaultsPrevious, hwFaultsCurrent);
    LOG_ERR("After OnHardwareFaultsDetect");
}

// GPIO button interrupt callback
static void button_pressed(const struct device *dev, struct gpio_callback *cb, uint32_t pins)
{
    gpio_pin_toggle_dt(&led);

    tamperDetected = !tamperDetected;

    LOG_INF("TamperDetected set to: %s", tamperDetected ? "true" : "false");

    k_work_submit(&tamper_work); // Defer heavy processing
}

2.A screenshot of chip-tool output showing no tamper entry.

[1745906495.161] [26069:26186] [EM] >>> [E:30943r S:33378 M:217564310] (S) Msg RX from 1:0000000000002231 [DD9E] to 000000000001B669 --- Type 0001:05 (IM:ReportData) (B:70)
[1745906495.161] [26069:26186] [EM] Handling via exchange: 30943r, Delegate: 0x6013e6a79348
[1745906495.161] [26069:26186] [DMG] ReportDataMessage =
[1745906495.161] [26069:26186] [DMG] {
[1745906495.161] [26069:26186] [DMG] 	SubscriptionId = 0xb5a61ce8,
[1745906495.161] [26069:26186] [DMG] 	AttributeReportIBs =
[1745906495.161] [26069:26186] [DMG] 	[
[1745906495.161] [26069:26186] [DMG] 		AttributeReportIB =
[1745906495.161] [26069:26186] [DMG] 		{
[1745906495.161] [26069:26186] [DMG] 			AttributeDataIB =
[1745906495.161] [26069:26186] [DMG] 			{
[1745906495.161] [26069:26186] [DMG] 				DataVersion = 0x25eb9646,
[1745906495.161] [26069:26186] [DMG] 				AttributePathIB =
[1745906495.161] [26069:26186] [DMG] 				{
[1745906495.161] [26069:26186] [DMG] 					Endpoint = 0x0,
[1745906495.161] [26069:26186] [DMG] 					Cluster = 0x33,
[1745906495.161] [26069:26186] [DMG] 					Attribute = 0x0000_0005,
[1745906495.161] [26069:26186] [DMG] 				}
[1745906495.161] [26069:26186] [DMG] 					
[1745906495.161] [26069:26186] [DMG] 				Data = [
[1745906495.161] [26069:26186] [DMG] 						
[1745906495.161] [26069:26186] [DMG] 				],
[1745906495.161] [26069:26186] [DMG] 			},
[1745906495.161] [26069:26186] [DMG] 			
[1745906495.161] [26069:26186] [DMG] 		},
[1745906495.161] [26069:26186] [DMG] 		
[1745906495.161] [26069:26186] [DMG] 	],
[1745906495.161] [26069:26186] [DMG] 	
[1745906495.161] [26069:26186] [DMG] 	InteractionModelRevision = 12
[1745906495.161] [26069:26186] [DMG] }
[1745906495.161] [26069:26186] [TOO] Endpoint: 0 Cluster: 0x0000_0033 Attribute 0x0000_0005 DataVersion: 636196422
[1745906495.161] [26069:26186] [TOO]   ActiveHardwareFaults: 0 entries

Could you please guide me on how to correctly update and report the ActiveHardwareFaults attribute so that the chip-tool reflects the tamper fault?

Thanks & Regards,
Rahul Chauhan

[Maria Gilje]

Hi Rahul,

Marte was very busy today, so I volunteered to take over.

Forgive me if my code understanding is wrong, but as I see it the tamperDetected variable will only be true when the button is continously pressed. Do you still see that chip-tool does not print any entries for the ActiveHardwareFaults entries when holding the button down while reading the attribute value? Or alternatively if you replace the toggle with a counter and modify the code to accommodate this change.

Best regards,

Maria

[rahul@123]

Hi Maria Gilje 

The button_pressed function is only used to test the tamper detection feature. Upon every button press event (no need press and hold), I am triggering hwFaultsCurrent attribute for kTamperDetected. I am not clearing it from anywhere. So theoretically chip-tool should have entry for with the tamper fault.

Is my understanding and code to test this are correct?

BR,

Rahul

[Marte Myrvold]

Hi Rahul,

It seems like your code triggers the HardwareFaultChange event instead of updating the ActiveHardwareFaults attribute. A solutions is to read or subscribe to the event instead. You can do so with the following commands:

./chip-tool generaldiagnostics read-event hardware-fault-change destination-id endpoint-id

./chip-tool generaldiagnostics subscribe-event hardware-fault-change min-interval max-interval destination-id endpoint-id

Here, you can see the output when the chip-tool is subscribed to the event and receives a report when tamper_work_handler() is called on the device:

[1746450384.039] [7523:7525] [EM] >>> [E:51032r S:48502 M:35076606] (S) Msg RX from 1:0000000000000001 [514B] to 000000000001B669 --- Type 0001:05 (IM:ReportData) (B:86)
[1746450384.039] [7523:7525] [EM] Handling via exchange: 51032r, Delegate: 0x5ad2e4b22908
[1746450384.039] [7523:7525] [TOO] Endpoint: 0 Cluster: 0x0000_0033 Event 0x0000_0000
[1746450384.039] [7523:7525] [TOO]   Event number: 3
[1746450384.039] [7523:7525] [TOO]   Priority: Critical
[1746450384.039] [7523:7525] [TOO]   Timestamp: 87825
[1746450384.039] [7523:7525] [TOO]   HardwareFaultChange: {
[1746450384.039] [7523:7525] [TOO]     Current: 1 entries
[1746450384.039] [7523:7525] [TOO]       [1]: 10
[1746450384.039] [7523:7525] [TOO]     Previous: 1 entries
[1746450384.039] [7523:7525] [TOO]       [1]: 10
[1746450384.039] [7523:7525] [TOO]    }

Best regards,
Marte

[rahul@123]

Hi Marte,

Really appreciate your help!

The chip-tool event command works fine — I receive the HardwareFaultChange event properly when tamper_work_handler() is triggered.

But when I subscribe to the ActiveHardwareFaults attribute (0x0005), it still shows 0 entries. I was expecting the tamper (enum 10) to appear there.

Am I missing something in how to update this attribute?

Best regards,
Rahul Chauhan

[Marte Myrvold]

Hi Rahul,

From the code, I see that OnHardwareFaultsDetect() calls on MatterReportingAttributeChangeCallback() to inform that an attribute has been updated and to trigger reporting. Still, I do not find any place where the attribute is updated, as OnHardwareFaultsDetect() only records the event.

I will have to do some more digging and discuss this internally. I will get back to you by the end of the week.

Best regards,
Marte

[Marte Myrvold]

Hi,

I have not figured this out yet, but I have forwarded it internally to the developers, and I am waiting for a response. I will get back to you when I hear from them.

Best regards,
Marte

[rahul@123]

Hi Marte,

I hope you're doing well.

Just wanted to follow up and see if there’s any update regarding the attribute update in OnHardwareFaultsDetect(). I’m happy to wait if it’s still being checked internally.

Thanks again for your support!

Best regards,
Rahul Chauhan