all | frequencies |
|
exhibits | applications |
---|---|---|---|---|
manual |
app s | submitted / available | |||||||
---|---|---|---|---|---|---|---|---|
1 2 |
|
User Manual | Users Manual | 2.05 MiB | ||||
1 2 | Test Report | |||||||
1 2 | Cover Letter(s) | |||||||
1 2 |
|
External Photos | External Photos | 1.54 MiB | ||||
1 2 |
|
Internal Photos | Internal Photos | 1011.41 KiB | ||||
1 2 | Test Report | |||||||
1 2 | Test Setup Photos | |||||||
1 2 | Cover Letter(s) | |||||||
1 2 | Cover Letter(s) | |||||||
1 2 | ID Label/Location Info | |||||||
1 2 | Operational Description | |||||||
1 2 | External Photos |
1 2 | User Manual | Users Manual | 2.05 MiB |
USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE PTM 215B Bluetooth Pushbutton Transmitter Module 07.06.2019 Observe precautions! Electrostatic sensitive devices!
Patent protected:
WO98/36395, DE 100 25 561, DE 101 50 128, WO 2004/051591, DE 103 01 678 A1, DE 10309334, WO 04/109236, WO 05/096482, WO 02/095707, US 6,747,573, US 7,019,241 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 1/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE REVISION HISTORY The following major modifications and improvements have been made to this document:
Version Author Reviewer Date 1.0 1.1 1.2 MK MKA MKA MKA MKA MKA 14.10.2016 15.12.2016 25.01.2017 1.3 1.4 1.5 1.6 1.7 1.8 MKA MKA MK MK MKA MKA MKA MKA MKA MKA MKA MKA 17.03.2017 30.03.2017 17.07.2017 11.10.2017 21.12.2017 22.06.2018 1.9 MKA MKA 07.06.2019 Major Changes First release for DA-3 status Update for DB-4 status Added NFC reader information Added instructions for validating the au-
thentication signature Added note on receiver configuration Added telegram parsing examples R&TTE -> RED, max. transmit power Added note regarding magnets or ferro-
magnetic materials near PTM 215B Added Australia certification Added Japan certification and changes introduced in version DC-06 Added DD-07 feature set Added RPA Example Published by EnOcean GmbH, Kolpingring 18a, 82041 Oberhaching, Germany www.enocean.com, info@enocean.com, phone +49 (89) 6734 6890 EnOcean GmbH, All Rights Reserved The Bluetooth word mark and logos are registered trademarks owned by the Bluetooth SIG, Inc. and any use of such marks by EnOcean GmbH is under license. Other trademarks and trade names are those of their respective owners. Important!
This information describes the type of component and shall not be considered as assured characteristics. No responsibility is assumed for possible omissions or inaccuracies. Circuitry and specifications are subject to change without notice. For the latest product specifica-
tions, refer to the EnOcean website: http://www.enocean.com. As far as patents or other rights of third parties are concerned, liability is only assumed for modules, not for the described applications, processes and circuits. EnOcean does not assume responsibility for use of modules described and limits its liability to the replacement of modules determined to be defective due to workmanship. Devices or systems containing RF components must meet the essential requirements of the local legal authorities. The modules must not be used in any relation with equipment that supports, directly or indirectly, human health or life or with applications that can result in danger for people, animals or real value. Components of the modules are considered and should be disposed of as hazardous waste. Local government regulations are to be observed. Packing: Please use the recycling opera-
tors known to you. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 2/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE TABLE OF CONTENT 1. General description ........................................................................................ 6 Basic functionality ......................................................................................... 6 Technical data ............................................................................................... 7 Physical dimensions ....................................................................................... 7 Environmental conditions ............................................................................... 7 Packaging information .................................................................................... 7 Ordering information...................................................................................... 7 Functional information ................................................................................... 8 Device Overview ........................................................................................... 8 Basic Functionality ......................................................................................... 8 Block Diagram .............................................................................................. 9 User Interface ............................................................................................. 10 Telegram transmission ................................................................................. 11 Radio channel parameters ............................................................................ 11 Default radio transmission sequence .............................................................. 12 User-defined radio transmission sequences ..................................................... 12 3.3.1 Supported radio transmission sequences .................................................... 13 3.3.2 Three channel radio transmission sequence ................................................ 13 3.3.3 Two channel radio transmission sequence ................................................... 14 3.3.4 Single channel radio transmission sequence ................................................ 14 Telegram format ......................................................................................... 15 Preamble .................................................................................................... 15 Access Address ........................................................................................... 15 Header ....................................................................................................... 15 Source address ........................................................................................... 16 4.4.1 Static source address mode ...................................................................... 16 4.4.2 Resolvable private address mode............................................................... 17 Check Sum ................................................................................................. 18 Telegram payload ........................................................................................ 19 4.6.1 Data telegram payload ............................................................................. 19 4.6.2 Switch status encoding ............................................................................. 20 4.6.3 Commissioning telegram payload .............................................................. 21 PTM 215B data telegram authentication ......................................................... 22 4.7.1 Authentication implementation .................................................................. 23 Commissioning ............................................................................................ 24 NFC-based commissioning ............................................................................ 25 Camera-based commissioning ....................................................................... 26 Radio-based commissioning .......................................................................... 26 5.3.1 Commissioning mode entry ....................................................................... 26 5.3.2 Commissioning telegram transmission........................................................ 27 5.3.3 Exit from commissioning mode .................................................................. 27 5.3.4 Disable commissioning mode .................................................................... 27 Factory Reset .............................................................................................. 28 NFC interface .............................................................................................. 29 Using the NFC interface ................................................................................ 29 NFC interface functions ................................................................................ 30 6.2.1 NFC interface state machine ..................................................................... 30 2. 3. 4. 5. 6. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 3/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.2.2 IDLE state .............................................................................................. 31 6.2.3 READY 1 state ......................................................................................... 31 6.2.4 READY 2 state ......................................................................................... 32 6.2.5 ACTIVE state .......................................................................................... 32 6.2.6 Read command ....................................................................................... 33 6.2.7 Write command ....................................................................................... 33 6.2.8 Password authentication (PWD_AUTH) command......................................... 34 Using TWN4 as USB NFC reader .................................................................... 35 6.3.1 Useful commands .................................................................................... 36 6.3.2 Translation into binary data ...................................................................... 36 Configuration memory organization ............................................................... 37 Memory Address Map ................................................................................... 38 Public data ................................................................................................. 39 Protected Data ............................................................................................ 40 6.7.1 PIN Code ................................................................................................ 41 6.7.2 Configuration of product parameters .......................................................... 41 6.7.3 Configuration register .............................................................................. 41 6.7.4 Source Address Write register ................................................................... 42 6.7.5 Security Key Write register ....................................................................... 42 6.7.6 Private Security Key mode ........................................................................ 43 6.7.7 Product ID and Manufacturer ID Write register ............................................ 43 6.7.8 Optional Data register .............................................................................. 44 6.7.9 Variant register ....................................................................................... 45 6.7.10 Radio channel selection registers ............................................................... 47 6.7.11 Customer Data ........................................................................................ 48 Private Data................................................................................................ 49 6.8.1 Security Key ........................................................................................... 49 6.8.2 Default Settings ...................................................................................... 49 Device integration ....................................................................................... 50 Mechanical Interface Characteristics .............................................................. 50 Mechanical Interface Drawings ...................................................................... 50 Product label ............................................................................................... 56 7.3.1 Example for a product QR code ................................................................. 56 PTM 215B device label ................................................................................. 57 PTM 215B device label for products up to version DB-05 .................................. 57 8.1.1 Commissioning DMC structure ................................................................... 58 PTM 215B device label for products starting with version DC-06 ........................ 59 8.2.1 QR Code format ...................................................................................... 59 Application information ................................................................................ 60 Transmission range ..................................................................................... 60 Receiver configuration.................................................................................. 61 Regulatory information ................................................................................. 62 RED for European Market ........................................................................ 62 FCC (United States) Certificate ................................................................. 63 10.2.1 FCC (United States) Regulatory Statement ................................................. 64 IC (Industry Canada) Certificate ............................................................... 65 10.3.1 IC (Industry Canada) Regulatory Statement ............................................... 66 ACMA (Australia) Declaration of Conformity ............................................... 67 ARIB (Japan) Construction Type Conformity Certifaction .............................. 69 7. 8. 9. 10. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 4/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE C. B. 11. A. A.1.1 A.1.2 A.2.1 A.2.2 Product history ............................................................................................ 70 Parsing PTM 215B radio telegrams ................................................................. 71 Data telegram example ................................................................................ 71 BLE frame structure ............................................................................. 71 EnOcean data telegram payload structure ............................................... 71 Commissioning telegram example ................................................................. 72 BLE frame structure ............................................................................. 72 EnOcean commissioning telegram payload structure ................................ 72 Address resolution for resolvable private addresses (RPA) ................................ 73 B.1.1 RPA resolution flow .................................................................................. 73 B.1.2 Address resolution example ...................................................................... 74 Authentication of PTM 215B data telegrams .................................................... 75 C.1 Algorithm input parameters ...................................................................... 75 C.1.1 Constant input parameters ....................................................................... 75 C.1.2 Variable input parameters ........................................................................ 76 C.1.3 Obtaining the security key ........................................................................ 77 C.1.3.1 Obtaining the security key via NFC interface ................................................... 77 C.1.3.2 Obtaining the security key via the product DMC code ....................................... 78 C.1.3.3 Obtaining the security key via a commissioning telegram ................................. 79 C.1.4 Internal parameters ................................................................................. 79 C.1.5 Constant internal parameters .................................................................... 80 C.1.6 Variable internal parameters ..................................................................... 80 Algorithm execution sequence ................................................................... 81 C.2 C.3 Examples ............................................................................................... 82 C.3.1 Data telegram without optional data .......................................................... 82 C.3.2 Data telegram with 1 byte optional data ..................................................... 84 C.3.3 Data telegram with 2 byte optional data ..................................................... 85 C.3.4 Data telegram with 4 byte optional data ..................................................... 86 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 5/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 1. General description Basic functionality PTM 215B enables the realization of energy harvesting wireless switches for lighting, build-
ing or industrial automation control systems using Bluetooth low energy technology. PTM 215B is mechanically compatible with the established PTM 210 form factor enabling quick integration into a wide range of designs. Key applications are wall-mounted or porta-
ble switches either with up to two rockers or up to four push buttons. PTM 215B pushbutton transmitters are self-powered (no batteries) and fully maintenance-
free. They can therefore be used in all environments including locations that are difficult to reach or within hermetically sealed housings. The required energy is generated by an elec-
tro-dynamic energy transducer actuated by an energy bow located on the left and right of the module. This energy bow which can be pushed from outside the module by an appro-
priate pushbutton or switch rocker. When the energy bow is pushed down or released, electrical energy is created and a radio telegram according to the Bluetooth low energy standard is transmitted. This radio tele-
gram transmits the status of all four contact nipples at the moment when the energy bow was pushed down or released. PTM 215B radio telegrams are protected with AES-128 security based on a device-unique private key. Figure 1 PTM 215B Product Outline PTM 215B is available in the following variants:
PTM 215B Stand-alone module without additional components EWSSB / EWSDB PTM 215B integrated into European-style single / double rocker wall switch housing ESRPB / EDRPB PTM 215B integrated into US-style single or double rocker pad housing The term PTM 215B as used in this document applies to all product variants unless other-
wise mentioned. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 6/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Technical data Antenna Max. transmit power measured Integrated PCB antenna 0.4dBm / 1.1mW Communication Range (guidance only) 75 m ideal line of sight / 10 m indoor environment Communication Standard Radio Frequency (min / max) Radio Channels (default) Advertising Events per press or release
(min / max) Data Rate and Modulation (default) Configuration Interface Device Identification Security Power Supply Button Inputs Physical dimensions Module Dimensions Module Weight Environmental conditions Operating Temperature Storage Temperature Humidity Packaging information Packaging Unit Packaging Method Ordering information Bluetooth Low Energy (BLE) 2402 MHz / 2480 MHz CH 37 / 38 / 39 (2402 MHz / 2426 MHz / 2480 MHz) 2 / 3 1 Mbit/s GFSK NFC Forum Type 2 Tag (ISO/IEC 14443 Part 2 and 3) Unique 48 Bit Device ID (factory programmed) AES128 (CBC Mode) with Sequence Code Integrated Kinetic Energy Harvester Up to four buttons or two rockers 40.0 x 40.0 x 11.2 mm 20 g +/- 1g
-25C ... 65C
-25C ... 65C 0% to 95% r.h. (non-condensing) Tray / Box (10 units per tray, 10 trays per box) 100 units Type Ordering Code Frequency PTM 215B S3221-A215 2.4 GHz (Bluetooth Low Energy) 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 7/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 2. Functional information Device Overview
(1) Energy bow on both device sides The pushbutton transmitter module PTM 215B from EnOcean enables the implementation of wireless remote controls without batteries. It transmits Bluetooth Low Energy (BLE) data telegrams where the required energy is provided by a built-in electro-dynamic energy gen-
erator. The outer appearance of PTM 215B is shown on the picture below. Figure 2 Electro-dynamic powered pushbutton transmitter module PTM 215B Snap-in and rotation axis for pushbuttons or switch rocker
(2) Button contacts for switch rocker identification Basic Functionality PTM 215B devices contain an electro-dynamic energy converter which is actuated by an energy bow (1). This bow is pushed by an appropriate push button, switch rocker or a simi-
lar construction mounted onto the device. An internal spring will release the energy bow as soon as it is not pushed down anymore. When the energy bow is pushed down, electrical energy is created and a BLE radio tele-
gram is transmitted which identifies the action (pressed or not pressed) and the status of the four button contacts (2). Releasing the energy bow similarly generates energy which is used to transmit a different radio telegram. It is therefore possible to distinguish between radio telegrams sent when the energy bar was pushed and radio telegrams sent when the energy bar was released. By identifying these different telegrams types and measuring the time between pushing and releasing of the energy bar, it is possible to distinguish between Long and Short button contact presses. This enables simple implementation of applications such as dim-
ming control or blinds control including slat action. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 8/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Block Diagram Button Contacts Data Data Processor Processor NFC Pushed / Released Push / Release Detection DC Power DC Power RF Transmitter Ant Antenna Energy Energy Bow Bow N N N S S S Power Power Converter Converter Figure 3 Functional block diagram of PTM 215B Energy Bow / Power Generator Converts the motion of the energy bow into electrical energy Power Converter Converts the energy of the power generator into a stable DC supply voltage for the device electronics Processor Determines the status of the button contacts and the energy bow, encodes this status into a data word, generates the proper radio telegram structure and sends it to the radio transmitter RF transmitter Transmits the data in the form of a series of short 2.4 GHz Bluetooth Low Energy radio telegrams using the integrated antenna NFC interface Allows reading and writing certain product parameters using an NFC compliant reader /
writer supporting NFC Forum Type 2 tags (as specified by ISO/IEC 14443 Part 2 and 3). 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 9/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE User Interface PTM 215B devices provide four button contacts. They are grouped into two channels
(Channel A and Channel B) each containing two button contacts (State O and State I). The state of all four button contacts (pressed or not pressed) is transmitted together with a unique device identification (48 Bit device ID) whenever the energy bow is pushed or re-
leased. Figure 4 below shows the arrangement of the four button contacts and their designation:
Figure 4 Button contact designation 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 10/86 OIBACHANNELSTATEOIBACHANNELSTATE USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 3. Telegram transmission Radio channel parameters PTM 215B transmits Bluetooth Low Energy (BLE) advertising telegrams within the 2.4 GHz radio frequency band (2402MHz 2480MHz). By default, PTM 215B will use the three BLE advertising channels (BLE Channel 37, 38 and 39) defined for transmission. The transmission of a radio telegram on these three advertis-
ing channels is called an Advertising Event. Use of different radio channels within the frequency band from 2402 MHz to 2480 MHz is possible, see chapter 6.7.10. The initialization value for data whitening is set as follows:
For BLE channels is set according to specification (value = radio channel) For the custom radio channels the initialization value is equal to the offset from 2400 MHz (e.g. value = 3 for 2403 MHz) Table 1 below summarizes radio channels supported by PTM 215B. Radio Channel Frequency BLE Radio Channels Channel Type 37 0 1 10 38 11 12 36 39 40 41 77 78 2402 MHz 2404 MHz 2406 MHz 2424 MHz 2426 MHz 2428 MHz 2430 MHz 2478 MHz 2480 MHz BLE Advertising Channel BLE Data Channel BLE Data Channel BLE Data Channel BLE Advertising Channel BLE Data Channel BLE Data Channel BLE Data Channel BLE Advertising Channel Custom Radio Channels 2403 MHz 2405 MHz 2477 MHz 2479 MHz Custom Radio Channel Custom Radio Channel Custom Radio Channel Custom Radio Channel Table 1 PTM 215B supported radio channels 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 11/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Default radio transmission sequence PTM 215B transmits telegrams in its standard configuration by using so-called Advertising Events. An advertising event is defined as the transmission of the same radio telegram on all se-
lected radio channels (by default this would be on BLE Channel 37, 38 and 39) one after another with minimum delay in between. For reliability reasons, PTM 215B will send several (minimum two, maximum three) adver-
tising events for each button input. The resulting transmission sequence is shown in Figure 5 below. The default interval between the advertising events is 20 ms. Starting with product version DC-06 it is possible to reduce this interval to 10 ms via the NFC configuration interface. See chapter 6.7.9 for details. Figure 5 Default radio transmission sequence User-defined radio transmission sequences In certain situations it might be desirable to transmit radio telegrams on channels other than the three advertising channels. PTM 215B therefore allows to select the radio channels to be used for the transmission of data telegrams and commissioning telegrams. The following transmission modes are sup-
ported:
Both commissioning telegrams and data telegrams are transmitted on the advertis-
ing channels as three advertising events. This is the default configuration and de-
scribed in chapter 3.2 above. Commissioning telegrams are transmitted on the advertising channels as three ad-
vertising events while data telegrams are transmitted in a user-defined sequence as described below. Both commissioning and data telegrams are transmitted in a user-defined sequence as described below. The selection of the transmission mode is done using the VARIANT register of the NFC con-
figuration interface as described in chapter 6.7.9. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 12/86 CH 37CH 38CH 39INTERVAL(20ms or 10ms)INTERVAL(20ms or 10ms)CH 37CH 38CH 39CH 37CH 38CH 39 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 3.3.1 Supported radio transmission sequences PTM 215B supports the following user-defined sequences:
Three channel sequence This sequence is similar to the default Advertising Event with the difference that the user can select the radio channels to be used. The three channel sequence is de-
scribed in chapter 3.3.2 below. Two channel sequence In this sequence the radio telegram is transmitted using four transmissions on two radio channels. It is described in chapter 3.3.3 below. One channel sequence In this sequence the radio telegram is transmitted using six transmissions on one radio channel. It is described in chapter 3.3.4 below. The selection of user-defined radio transmission sequences is made via the VARIANT register of the NFC configuration interface, please see chapter 6.7.9. 3.3.2 Three channel radio transmission sequence The three channel radio transmission sequence is similar to the default transmission se-
quence. The difference is that the radio channels (BLE Channel 37, 38 and 39 in the default transmission sequence) can be selected using the registers TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3. The PTM 215B telegram will in this mode be transmitted on the radio channel selected by TX_CHANNEL1 first, immediately followed by a transmission on the radio channel selected by TX_CHANNEL2 and a transmission on the radio channel selected by TX_CHANNEL3. This transmission sequence will be sent three times in total as shown in Figure 6 below. The default interval between the advertising events is 20 ms. Starting with product version DC-06 it is possible to reduce this interval to 10 ms via the NFC configuration interface. See chapter 6.7.9 for details. Figure 6 Three channel radio transmission sequence The format of TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3 is described in chapter 6.7.10. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 13/86 TX_CHANNEL1TX_CHANNEL2TX_CHANNEL3TX_CHANNEL1TX_CHANNEL2TX_CHANNEL3TX_CHANNEL1TX_CHANNEL2TX_CHANNEL3INTERVAL(20ms or 10ms)INTERVAL(20ms or 10ms) USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 3.3.3 Two channel radio transmission sequence The two channel radio transmission sequence removes transmission on the third radio channel (selected by TX_CHANNEL3) and instead repeats the transmission once more (four times in total). The PTM 215B telegram will in this mode be transmitted on the radio channel selected by TX_CHANNEL1 first, immediately followed by a transmission on the radio channel selected by TX_CHANNEL2. This transmission sequence will be sent four times in total as shown in Figure 7 below. The default interval between the advertising events is 20 ms. Starting with product version DC-06 it is possible to reduce this interval to 10 ms via the NFC configuration interface. See chapter 6.7.9 for details. Figure 7 Two channel radio transmission sequence The format of TX_CHANNEL1 and TX_CHANNEL2 is described in chapter 6.7.10. 3.3.4 Single channel radio transmission sequence The single channel radio transmission sequence removes transmission on the second and third radio channel (selected by TX_CHANNEL2 and TX_CHANNEL3 respectively), i.e. all trans-
missions will be on the radio channel selected by TX_CHANNEL1. The PTM 215B telegram will be sent six times on this radio channel as shown in Figure 8 below. The default interval between the advertising events is 20 ms. Starting with product version DC-06 it is possible to reduce this interval to 10 ms via the NFC configuration interface. See chapter 6.7.9 for details. Figure 8 Single channel radio transmission sequence The format of TX_CHANNEL1 is described in chapter 6.7.10. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 14/86 TX_CHANNEL1TX_CHANNEL2TX_CHANNEL1TX_CHANNEL2INTERVAL(20ms or 10ms)TX_CHANNEL1TX_CHANNEL2INTERVAL(20ms or 10ms)TX_CHANNEL1TX_CHANNEL2INTERVAL(20ms or 10ms)TX_CHANNEL1TX_CHANNEL1INTERVAL(20ms or 10ms)TX_CHANNEL1INTERVAL(20ms or 10ms)TX_CHANNEL1INTERVAL(20ms or 10ms)TX_CHANNEL1INTERVAL(20ms or 10ms)TX_CHANNEL1INTERVAL(20ms or 10ms) USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 4. Telegram format PTM 215B transmits Bluetooth Low Energy (BLE) radio telegrams in the 2.4 GHz band. For detailed information about the Bluetooth Low Energy standard, please refer to the applica-
ble specifications. Figure 9 below summarizes the BLE frame structure. Figure 9 BLE frame structure The content of these fields is described in more detail below. Preamble The BLE Preamble is 1 byte long and identifies the start of the BLE frame. The value of the BLE Preamble is always set to 0xAA. Access Address The 4 byte BLE Access Address identifies the radio telegram type. For advertising frames, the value of the Access Address is always set to 0x8E89BED6. Header The BLE Header identifies certain radio telegram parameters. Figure 10 below shows the structure of the BLE header. Figure 10 BLE header structure 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 15/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Source address The 6 byte BLE Source Address (MAC address) uniquely identifies each PTM 215B product. PTM 215B supports two source address modes:
Static Source Address mode (default) In this mode, the source address is constant (but its lower 32 bit can be configured via NFC interface) Resolvable Private Address mode (NFC configurable option) In this mode, the source address changes for each transmission By default PTM 215B uses Static Source Address mode. Private Resolvable Address mode can be selected by setting the Private Source Address flag in the Configuration register
(see chapter 6.7.3) to 0b1. These two address modes are described in the following chapters. 4.4.1 Static source address mode By default, PTM 215B uses static source addresses meaning that the source address is con-
stant during normal operation. The static source address can be read and configured (writ-
ten) via NFC as described in chapter 6. The structure of PTM 215B static addresses is as follows:
The upper 2 bytes of the source address are used to identify the device type and set to 0xE215 for all PTM 215B devices (to designate EnOcean PTM 215 device type). These two bytes cannot be changed. The lower 4 bytes are uniquely assigned to each device. They can be changed using the NFC configuration interface as described in chapter 0 Figure 11 below illustrates the static address structure used by PTM 215B. Figure 11 BLE static source address structure 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 16/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 4.4.2 Resolvable private address mode For some applications it is desirable to obfuscate the origins of PTM 215B data telegrams in order to prevent tracking of its radio transmissions. This can be achieved by using resolva-
ble private addresses (RPA) as defined in the Bluetooth Core Specification. PTM 215B can be configured to use resolvable private addresses by setting the RPA ADDRESS MODE flag within the Configuration register (described in chapter 6.7.3) to 0b1. When using resolvable private addresses, the address used by PTM 215B is modified (rotat-
ed) according to a defined scheme which on one hand precludes determining the device identity by unauthorized receivers while allowing authorized receivers (sharing a specific security key with PTM 215B) to do so. The shared security key which has to be known by both PTM 215B and the authorized receiver is called the Identity Resolution Key (IRK). PTM 215B uses its device-unique ran-
dom key as identity resolution key. This key can be modified if needed via the NFC configu-
ration interface as described in chapter 6.7.5. For each data telegram transmitted by PTM 215B (i.e. for every button push or release), a new resolvable private address is generated. The 48 bit address field of such resolvable private address is split into two sub-fields:
prand This field contains a random number which always starts (two most significant bits) with 0b10. The prand value is changed for each telegram that is transmitted. Individual advertising events used to transmit one telegram (as described in chapter 3) use the same prand value. hash This field contains a verification value (hash) generated from prand using the IRK The structure of a resolvable private address is shown in Figure 12 below. Figure 12 BLE resolvable private address structure The prand value is encrypted using the IRK. The lowest 24 bit of the result (encrypted val-
ue) are then used as hash. The concatenation of 24 bit prand and 24 bit hash will be trans-
mitted as 48 bit private resolvable source address. The receiver maintains a list of IRK for all transmitters that have been commissioned to work with it. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 17/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Whenever the receiver receives a data telegram with a resolvable private address (identi-
fied by the most significant bits of the address field being set to 0b10), it will itself generate a 24 bit hash from the 24 bit prand sequentially using each IRK known to it (i.e. the IRK of each device that has been learned into it). If an IRK matches (i.e. when prand is encoded with the IRK then the result matches hash), then the receiver has established the IRK used by the transmitter and thereby the identity of the transmitter. So conceptually the IRK takes the role of the device address of the transmitter while prand and hash provide a mechanism for the receiver to select the correct IRK among the set of IRK known to it. This mechanism is illustrated in Figure 13 below. Figure 13 Resolving private addresses Refer to Appendix B for an example of resolving a resolvable private address. Note that commissioning telegrams (as described in chapter 5.3.2) always use static source addresses (as described in chapter 4.4.1) since they establish the device identity and con-
tain the IRK in the payload. Check Sum The 3 byte BLE Check Sum is used to verify data integrity of received BLE radio telegrams. It is calculated as CRC (cyclic redundancy check) of the BLE Header, Source Address and Payload fields. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 18/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Telegram payload PTM 215B can transmit two types of telegrams:
Data telegrams The payload of data telegrams contains the switch status together with optional data
(if applicable), the current sequence counter value and the resulting authentication signature Commissioning telegrams The payload of commissioning telegrams contains the private security key as well as the current value of the sequence counter and the device address The payload structure of both telegram types is described in the following chapters. 4.6.1 Data telegram payload The payload of data telegrams is 13 17 bytes long (depending on the size of the Optional Data field) and consists of the following fields:
Length (1 byte) The Length field specifies the combined length of the following fields. The content of the field depends on the size of the Optional Data field (which can be 0 / 1 / 2 or 4 byte). The resulting Length setting would be 12 / 13 / 14 or 16 byte (0x0C / 0x0D /
0x0E / 0x10) respectively Type (1 byte) The Type field identifies the data type used for this telegram. For PTM 215B data telegrams, this field is always set to 0xFF to designate manufacturer-specific data field Manufacturer ID (2 byte) The Manufacturer ID field is used to identify the manufacturer of BLE devices based on assigned numbers. EnOcean has been assigned 0x03DA as manufacturer ID code. The Manufacturer ID can be changed via the NFC configuration interface as de-
scribed in chapter 6.7.7. Sequence Counter (4 byte) The Sequence Counter is a continuously incrementing counter used for security processing. It is initialized to 0 at the time of production and incremented for each telegram (data telegram or commissioning telegram) sent. Switch Status (1 byte) The Switch Status field reports the button action. The encoding of this field is de-
scribed in chapter 4.6.2. Optional Data (0 / 1 / 2 or 4 byte) PTM 215B provides the option to transmit additional user-defined data within each data telegram as described in chapter 6.7.8. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 19/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Security Signature (4 byte) The Security Signature is used to authenticate PTM 215B radio telegrams as de-
scribed in chapter 4.6.3 Figure 14 below illustrates the data telegram payload. Figure 14 Data telegram payload structure 4.6.2 Switch status encoding The Switch Status field within the data telegram payload identifies the PTM 215B action
(button push or release). PTM 215B uses the following sequence to identify and transmit button contact status:
1. Determine direction of the energy bar movement (Push Action or Release Action) 2. Read input status of all button contacts 3. Calculate data payload 4. Calculate security signature In PTM 215B, the type of action (Press Action or Release Action) is indicated by Bit 0 (Ener-
gy Bar). If a button contact has been actuated during Press Action or Release Action then this is indicated by the according status bit set to 1. Note that all contacts that were pressed during Press Action will be released during Release Action. The case of continuing to hold one (or several) button contacts during Release Ac-
tion is mechanically not possible. The switch status encoding used by PTM 215B is shown Figure 15 in below. Figure 15 - PTM 215B button action encoding 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 20/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 4.6.3 Commissioning telegram payload The payload of commissioning telegrams is 30 bytes long and consists of the following fields:
Length (1 byte) The Length field specifies the combined length of the following fields. For PTM 215B commissioning telegrams, this field is set to 0x1D to indicate 29 byte of manufactur-
er-specific data. Note: In product versions prior to DC-06 this field was incorrectly set to 0x1E. Type (1 byte) The Type field identifies the data type used for this telegram. This field is set to 0xFF to indicate a Manufacturer-specific Data field Manufacturer ID (2 byte) The Manufacturer ID field is used to identify the manufacturer of BLE devices based on assigned numbers. By default, this field is set to 0x03DA (EnOcean GmbH). This field can be changed via the NFC configuration interface as described in chapter 6.7.7. Sequence Counter (4 byte) The Sequence Counter is a continuously incrementing counter used for security pro-
cessing. It is initialized to 0 at the time of production and incremented for each tele-
gram (data telegram or commissioning telegram) sent. Security Key (16 byte) Each PTM 215B device contains its own 16 byte device-unique random security key which is generated and programmed during manufacturing. It is transmitted during commissioning to enable the receiver to authenticate PTM 215B data telegrams and used as IRK for the case of resolvable private address mode Static Source Address (6 byte) The Static Source Address is used to uniquely identify each BLE device. It is trans-
mitted as part of the BLE frame as described in chapter 4.4.1. Some devices (most notable all iOS-based products) however do not expose this address to their applications. This makes it impossible to use such applications to commission PTM 215B. The Static Source Address is therefore again transmitted as part of the payload. Figure 16 below illustrates the commissioning telegram payload. Figure 16 Commissioning telegram payload structure 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 21/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE PTM 215B data telegram authentication PTM 215B implements telegram authentication for transmitted data telegrams to ensure that only telegrams from transmitters using a previously exchanged security key will be accepted by the receiver. Authentication relies on a 32 bit telegram signature which is cal-
culated as shown in Figure 17 below and exchanged as part of the radio telegram. Figure 17 Telegram authentication flow Sequence counter, source address and the remaining telegram data together form the in-
put data for the signature algorithm. This algorithm uses AES128 encryption based on the device-unique random security key to generate a 32 bit signature which will be transmitted as part of the radio telegram. The signature is therefore dependent both on the current value of the sequence counter, the device source address and the telegram payload. Changing any of these three parame-
ters will therefore result in a different signature. The receiver performs the same signature calculation based on sequence counter, source address and the remaining telegram data of the received telegram using the security key it received from PTM 215B during commissioning. The receiver then compares the signature reported as part of the telegram with the signa-
ture it has calculated. If these two signatures match then the following statements are true:
Transmitter (PTM 215B) and receiver use the same security key The message content (address, sequence counter, data) has not been modified At this point, the receiver has validated that the message originates from a trusted trans-
mitter (as identified by its security key) and that its content is valid. In order to avoid message replay (capture and retransmission of a valid message), it is required that the receiver tracks the value of the sequence counter used by PTM 215B and only accepts messages with higher sequence counter values (i.e. not accepts equal or lower sequence counter values for subsequent telegrams). 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 22/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 4.7.1 Authentication implementation PTM 215B implements data telegram authentication based on AES128 in CCM (Counter with CBC-MAC) mode as described in IETF RFC3610. At the time of writing, the RFC3610 stand-
ard could be found here: https://www.ietf.org/rfc/rfc3610.txt The 13 Byte CCM Nonce (number used once unique) initialization value is constructed as concatenation of 6 byte Source Address, 4 byte Sequence Counter and 3 bytes of value 0x00 (for padding). Note that both Source Address and Sequence Counter use little endian format (least signifi-
cant byte first). Figure 18 below shows the structure of the AES128 Nonce. Figure 18 AES128 Nonce structure The AES128 Nonce and the 128 bit device-unique security key are then used to calculate a 32 bit signature of the authenticated telegram payload shown in Figure 19 below. Figure 19 Authenticated payload The calculated 32 bit signature is then appended to the data telegram payload as shown in Figure 14 in chapter 4.6. In addition to the RFC3610 standard itself, please consult also Appendix C for a step by step description of the authentication process. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 23/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 5. Commissioning Commissioning is the process by which PTM 215B is learned into a receiver (actuator, con-
troller, gateway, etc.). The following two tasks are required in this process:
Device identification The receiver needs to know how to uniquely identify this specific PTM 215B device. This is achieved by using a unique 48 Bit ID (Source Address) for each PTM 215B device as described in chapter 4.4. In addition, up to 4 byte of Optional Data can be configured as described in chapter 6.7.8 Security parameter exchange The receiver needs to be able to authenticate radio telegrams from PTM 215B in or-
der to ensure that they originate from this specific device and have not been modi-
fied as described in chapter 4.6.3. This is achieved by exchanging a 128 Bit random security key used by PTM 215B to authenticate its radio telegrams. PTM 215B provides the following options for these tasks:
NFC-based commissioning The PTM 215B parameters are read by a suitable commissioning tool (e.g. NFC smartphone with suitable software) which is already part of the network into which PTM 215B will be commissioned. The commissioning tool then communicates these parameters to the intended receiver of PTM 215B radio telegrams. NFC-based com-
missioning is described in chapter 6 Camera-based commissioning Each PTM 215B module contains an optically readable Data Matrix Code (DMC) which identifies its ID and its security key. This DMC can be read by a by a suitable commissioning tool (e.g. smartphone) which is already part of the network into which PTM 215B will be commissioned. The commissioning tool then communicates these parameters to the intended receiver of PTM 215B radio telegrams. The DMC structure is described in chapter 8.1.1 Radio-based commissioning PTM 215B can communicate its parameters via special radio telegrams (commission-
ing telegrams) to the intended receiver. To do so, PTM 215B can be temporarily placed into radio-based commissioning mode as described in chapter 5.3 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 24/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE NFC-based commissioning All required PTM 215B parameters can be read via a suitable NFC reader and writer sup-
porting the ISO/IEC 14443 Part 2 and 3 standards. The actual NFC implementation in PTM 215B uses a Mifare Ultralight tag. Commissioning via NFC should follow these steps:
1. Unlock PTM 215B using the default NFC PIN code 0x0000E215 2. Read the PTM 215B Source Address, Security Key and Sequence Counter and con-
figure the receiver accordingly 3. Important: The pre-programmed random security key used by PTM 215B can be obtained both from the product DMC code as described in chapter 5.2, from received commissioning telegrams as described in chapter 5.3 and via the NFC interface. For security-critical applications where unauthorized users could have physical ac-
cess to the switch it is therefore strongly recommended to change the security key to a new security key as part of the NFC-based commissioning process. To do so, follow the procedure outlined in chapter 6.7.5. For additional security, NFC read-out of the new security key can be disabled by set-
ting the PRIVATE SECURITY KEY flag in the Configuration register before setting the new security key. This ensures that even persons knowing the correct PIN code to configure this spe-
cific switch cannot read out the programmed new security key. Please verify that you have properly documented the new security key as there is no possibility to re-
trieve this after it has been written. 4. Important: It is strongly recommended to disable radio-based commissioning after programming a new security key. This ensures that the new security key cannot be read out by triggering a commissioning telegram as described in chapter 5.3. To disable radio-based commissioning, set the DISABLE LRN TELEGRAM flag in the Con-
figuration register to 0b1, see chapter 6.7.3. 5. Important: You should always change the NFC PIN code from its default setting to a new NFC PIN code and lock the NFC configuration interface. This step is mandato-
ry to avoid access to the PTM 215B configuration using the default PIN code. Should you lose the new NFC PIN code then PTM 215B can be reset to factory mode
(with the default NFC PIN code) by means of a factory reset as described in chapter 5.4. For security reasons, this factory reset will always reset the security key to its pre-programmed value. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 25/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Camera-based commissioning Each PTM 215B module contains an optically readable Commissioning Code implemented either as Data Matrix Code or as QR Code depending on the device revision. This Commissioning Code on the device label can be scanned by a suitable commissioning tool (e.g. smartphone or PC with DMC / QR code reader) to read the static source address and the security key of the device. The commissioning tool can the use this information to configure the intended receiver of PTM 215B radio telegrams. See chapter 8 for details of the commissioning code structure. Radio-based commissioning For cases where both NFC and camera-based commissioning are not feasible it is possible to set PTM 215B into a specific mode where it transmits commissioning telegrams. This functionality can be disabled via the NFC configuration interface by setting the DISABLE LRN TELEGRAM flag in the Configuration register to 0b1 (see chapter 6.7.3). Starting from product version DC-06, this functionality can also be disabled by means of a specific button press (long press of A0 + A1 + B1), see chapter 5.3.4. 5.3.1 Commissioning mode entry Commissioning mode is entered using a special button contact sequence. This is illustrated in Figure 20 below. Figure 20 Button sequence to enter radio-based commissioning mode 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 26/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE To enter commissioning mode, start by selecting one button contact of PTM 215B. Any but-
ton of PTM 215B (A0, A1, B0, B1) can be used. This button is referred to as Button_X in Figure 20 above. Next, execute the following long-short-long sequence:
1. Press and hold the selected button together with the energy bar for more than 7 seconds before releasing it 2. Press the selected button together with the energy bar quickly (hold for less than 2 seconds) 3. Press and hold the selected button together with the energy bar again for more than 7 seconds before releasing it Upon detection of this sequence, PTM 215B will enter commissioning mode if the DISABLE LRN TELEGRAM flag in the Configuration register of the NFC interface is not set (0b0, default state). If the DISABLE LRN TELEGRAM flag in the Configuration register of the NFC interface is set
(0b1, configured via NFC interface) then PTM 215B will not enter commissioning mode and transmit normal data telegrams according to the button status. 5.3.2 Commissioning telegram transmission PTM 215B will transmit a commissioning telegram (on the radio channels selected as de-
scribed in chapter 3.1) upon entering commissioning mode. The structure of the commis-
sioning telegram is described in chapter 4.6.3. PTM 215B will continue to transmit commissioning telegrams whenever the button used for entry into commissioning mode (Button_X) is pressed or released again. 5.3.3 Exit from commissioning mode Pressing any key except the button used for entry into commissioning mode (Button_X) will cause PTM 215B to stop transmitting commissioning telegrams and return to normal data telegram transmission. 5.3.4 Disable commissioning mode Starting with product version DC-06 it will be possible to disable commissioning mode in addition to using the NFC interface also by means of a specific button input. To do so, press buttons A0, A1 and B1 together with the energy bar and hold them for at least 10 seconds before releasing them. Commissioning mode can be re-enabled by means of a factory reset as described below. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 27/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Factory Reset PTM 215B can be reset to its default settings by means of a factory reset. This ensures that PTM 215B can be reset to a known configuration in case the PIN for the NFC access has been lost or NFC access is not possible for other reasons In order to execute such factory reset, the rocker(s) and the switch housing have to be removed from the PTM 215B module. Then, all four button contacts (A0, A1, B0 and B1) have to be pressed at the same time while the energy bow is pressed down. The energy bow must then be held at the down position for at least 10 seconds before be-
ing released. The button contacts A0, A1, B0 and B1 can be released at any time after pressing the energy bow down, i.e. it is no requirement to hold them as well for at least 10 seconds. Upon detecting this input, PTM 215B will restore the default settings of the following items:
Static Source Address Security Key and Security Key Write register Both registers will be restored to the value of the factory-programmed security key Manufacturer ID The manufacturer ID will be reset to 0x03DA (EnOcean GmbH) NFC PIN Code The NFC PIN Code will be reset to 0x0000E215 After such factory reset, Source Address and Security Key will again match the content of the DMC code on the unit label as described in chapter 8. In addition, PTM 215B will reset the following registers:
Configuration register (to 0x00) Variant Register (to 0x00) 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 28/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6. NFC interface PTM 215B implements NFC Forum Type 2 Tag functionality as specified in the ISO/IEC 14443 Part 2 and 3 standards using an NXP NT3H2111 Mifare Ultralight tag. This NFC functionality can be used to access (read and write) the PTM 215B configuration memory and thereby configure the device as described in the following chapters. Chapter 6.1 below gives an introduction to the NFC functionality and options to use the NFC interface. For in-depth support for integrating the NXP NT3H2111 NFC functionality into PC or smartphone SW please contact NXP technical support. Using the NFC interface Using the NFC interface requires the following:
NFC reader (either PC USB accessory or suitable smartphone / tablet) NFC SW with read, write, PIN lock, PIN unlock and PIN change functionality EnOcean recommends TWN4 (order code T4BT-FB2BEL2-SIMPL) from Elatec RFID Systems
(https://www.elatec-rfid.com/en/) as USB NFC reader. This reader is shown in Figure 21 below. Figure 21 Elatec TWN4 MultiTech Desktop NFC Reader TWN4 can be configured as CDC / Virtual COM port and can then be accessed like any serial interface. It provides all necessary commands for the NFC interface, specifically to:
Read data from configuration memory and write data to configuration memory Authenticate the user (to allow read / write of protected memory) via 32 bit PIN NFC functionality is also available in certain Android smartphones and tablets. NXP provides a SW framework that can be used with Android devices and can advise regarding suitable tablets and smartphones. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 29/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE NFC communication distance is for security reasons set to require direct contact between reader and switches based on PTM 215B. NFC interface functions For a detailed description about the NFC functionality, please refer to the ISO/IEC 14443 standard. For specific implementation aspects related to the NXP implementation in NT3H2111, please refer to the NXP documentation which at the time of writing was available under this link:
http://cache.nxp.com/documents/data_sheet/NT3H2111_2211.pdf The following chapters summarize the different functions for reference purposes. 6.2.1 NFC interface state machine Figure 22 below shows the overall state machine of the NFC interface. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 30/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Figure 22 NFC interface state machine 6.2.2 IDLE state IDLE is the waiting state after a Power-On Reset (POR), i.e. after the NFC tag has been introduced into the magnetic field of the NFC reader. The NFC tag exits the IDLE state towards the READY 1 state when either a REQA or a WUPA command is received from the NFC reader. REQA and WUPA commands are transmitted by the NFC reader to determine whether any cards are present within its working range. Any other data received by the NFC tag while in IDLE state is discarded and the NFC tag will remain in IDLE state. 6.2.3 READY 1 state 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 31/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE READY 1 is the first UID resolving state where the NFC tag resolves the first 3 bytes of the 7 byte UID using the ANTICOLLISION or SELECT commands for cascade level 1. READY 1 state is exited after the SELECT command from cascade level 1 with the matching complete first part of the UID has been executed. The NFC tag then proceeds into READY 2 state where the second part of the UID is resolved. 6.2.4 READY 2 state READY 2 is the second UID resolving state where the NFC tag resolves the remaining 4 bytes of the 7 byte UID using the ANTICOLLISION or SELECT commands for cascade level 2. READY 2 state is exited after the SELECT command from cascade level 2 with the matching complete part of the UID has been executed. The NFC tag then proceeds into ACTIVE state where the application-related commands can be executed. 6.2.5 ACTIVE state ACTIVE state enables read and write accesses to unprotected memory. If access to protected memory is required then the tag can transition from the ACTIVE state to AUTHENTICATED state by executing the PWD_AUTH command in conjunction with the correct 32 bit password. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 32/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.2.6 Read command The READ command requires a start page address, and returns the 16 bytes of four NFC tag pages (where each page is 4 byte in size). For example, if the specified address is 03h then pages 03h, 04h, 05h, 06h are returned. Spe-
cial conditions apply if the READ command address is near the end of the accessible memory area. Figure 23 below shows the read command sequence. Figure 23 NFC read command sequence 6.2.7 Write command The WRITE command requires a start page address and returns writes 4 bytes of data into that page. Figure 24 below shows the read command sequence. Figure 24 NFC write command sequence 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 33/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.2.8 Password authentication (PWD_AUTH) command The protected memory area can be accessed only after successful password verification via the PWD_AUTH command. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. Figure 25 below shows the password authentication sequence. Figure 25 Password authentication sequence After successful authentication, the password can be changed by writing the new password to memory page 0xE5. Note that a read access to page 0xE5 always return 0x00000000, i.e. it is not possible to read out the current PIN code. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 34/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Using TWN4 as USB NFC reader Elatec RFID Systems provides a PC software called Director as part of their software sup-
port package. At the time of writing, this was available from this address:
https://www.elatec-rfid.com/en/download-center/contact-form-twn4-devpack-sdk/
Figure 26 below shows the user interface of this software. Figure 26 User interface of TWN4 Director By using this software, it is easily possible to generate the required serial commands that have to be sent via CDC / Virtual COM port to TWN4 and understand the structure of the response that will be received back. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 35/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.3.1 Useful commands The following commands are especially useful:
SearchTag(maximum ID bytes) Used to search for a connected tag and identify type and ID of such tag. This should always be used as first operation ahead of any read / write / authenticate actions. Example: SearchTag(32) NTAG_PwdAuth(32 bit password as hex bytes, 16 bit password_ack as hex bytes) Used to authenticate access to the protected memory area Example: NTAG_PwdAuth(0x00 0x00 0xE2 0x15, 0x00 0x00) NTAG_Read(page) Used to read one page of data Example: NTAG_Read(0x04) NTAG_Write(page, data) Used to write one page of data Example: NTAG_Write(0x40, 0x12 0x34 0x56 0x78) NTAG_Write(0xE5, PIN Code) Used to set a new pin code by writing to page 0xE5 Example: NTAG_Write(0xE5, 0x12 0x34 0x56 0x78) 6.3.2 Translation into binary data In order to use these commands within a user application, they have to be translated into raw data. This can be done by enabling the Show Raw Data feature in the command log of the Director software as shown in Figure 27 below. Figure 27 Enabling raw data display This raw data can then be transmitted to TWN4 via a virtual COM port. TWN4 will respond to the request with the corresponding response as shown in Figure 28 below. Figure 28 Binary data exchange 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 36/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Configuration memory organization The PTM 215B configuration memory is divided into the following areas:
Public data Protected data In addition to that, PTM 215B maintains a private configuration memory region used to store default parameters and confidential information which is not accessible to the user. Figure 29 below shows the configuration memory structure used by PTM 215B. Figure 29 Configuration memory structure 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 37/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Memory Address Map The NFC-accessible configuration memory is organized in memory pages where each memory page is 4 byte wide. An NFC access reads 16 bytes (4 pages) or writes 4 bytes
(one page). The addresses map of the configuration memory is shown in Table 2 below. The byte order is little endian, i.e. byte 0 will be read first and byte 3 last. Area NFC Page Byte Offset Byte 0 (LSB) Public Memory Area Byte 1 Byte 2 Byte 3 (MSB) Public Public Public Public Public Public Public Public Public Public Public Public Public 0 (0x00) 3 (0x03) 4 (0x04) 5 (0x05) 6 (0x06) 7 (0x07) 8 (0x08) 9 (0x09) 10 (0x0A) 11 (0x0B) 12 (0x0C) 13 (0x0D) 0 12 16 20 24 28 32 36 40 44 48 52 Reserved Product Name
"PTM 215B"
Product ID NFC Revision Manufacturer ID Reserved Hardware Revision Software Revision Static Source Address Sequence Counter Protected Memory Area Variant Reserved Opt Data 1 Opt Data 2 Opt Data 3 Product ID Write Source ID Write Manufacturer ID Write Reserved TX_CHANNEL1 TX_CHANNEL2 TX_CHANNEL3 Reserved Opt Data 0 Configuration Protected 14 (0x0E) Protected 15 (0x0F) Protected 16 (0x10) Protected 17 (0x11) Protected 18 (0x12) Protected 19 (0x13) Protected 20 (0x14) Protected Protected 23 (0x17) Protected 24 (0x18) Protected 25 (0x19) Protected Protected 31 (0x1F) Protected 32 (0x20) Protected Protected 95 (0x5F) Protected 96 (0x60) Protected Protected 225 (0x10) Protected 229 (0xE5) Table 2 Configuration memory address map 56 60 64 68 72 76 80 92 96 100 124 128 380 384 900 916 Security Key Write Reserved Customer NFC Data Reserved PIN Code (Write Only) 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 38/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Public data Public data can be read by any NFC-capable device supporting the ISO/IEC 14443 Part 2 and 3 standards. No specific security measures are used to restrict read access to this data. The following items are located in the public data area:
PTM 215B Product Name This is always PTM 215B PTM 215B Product ID This is an 8 byte field which is by default set to 0x0000000000000000. Product ID and Manufacturer ID can be configured by the customer as required to identify his PTM 215B based product, see chapter 6.7.7 PTM 215B Manufacturer ID This is an 2 byte field used to identify the manufacturer of a BLE product, see chap-
ter 4.6. This field is by default set to 0x03DA (EnOcean GmbH). Product ID and Manufacturer ID can be configured by the customer as required to identify his PTM 215B based product, see chapter 6.7.7 PTM 215B Static Source Address This is a 4 byte field containing the four least significant bytes (the two most signifi-
cant bytes are always 0xE215) of the static source address used by PTM 215B, see chapter 4.4.1. Each PTM 215B is pre-programmed with an individual static source address. The Static Source Address can be configured by the customer as required to identify his PTM 215B based product, see chapter 6.7.4 Hardware Revision, Software Revision and NFC Revision These fields identify the device revision Telegram sequence counter This is a 4 byte field which is initialized to zero during manufacturing and incre-
mented for each transmitted telegram. Receivers shall never accept telegrams con-
taining sequence counter values equal or less than previously received values to avoid replay attacks. Changing the Static Source Address, Manufacturer ID and Product ID fields is only possible via protected data access as described below to prevent unauthorized modification. For security reasons, the telegram sequence counter cannot be written or reset by any mechanism. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 39/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Protected Data The following items are located in the protected data area:
Source Address Write register This 4 byte register is used to update the lower 4 byte of the Static Source Address, see chapter 6.7.4 Product ID Write register This 8 byte register is used to update the Product ID, see chapter 6.7.7 Manufacturer ID Write register This 4 byte register is used to update the Manufacturer ID, see chapter 6.7.7 Security Key Write register This 16 byte register is used to update the security key used by PTM 215B, see chapter 6.7.5 Optional Data register This 4 byte register contains optional data that can be transmitted as part of all data telegrams, see chapter 4.6. Optional Data 0 is sent first, Optional Data 3 last. Configuration register This 1 byte register is used to configure the functional behavior of PTM 215B, see chapter 6.7.3 Variant register This 1 byte register is used to configure the transmission behavior of PTM 215B, see chapter 6.7.9 Custom Radio Channel registers (TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3) These 1 byte registers are used to configure the radio channels in custom transmis-
sion mode of PTM 215B, see chapter 6.7.10 Custom NFC Data PTM 215B reserves 64 byte for customer-specific NFC data, see chapter 6.7.11 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 40/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.7.1 PIN Code Protected data access is only possible after unlocking the configuration memory with the correct 32 bit PIN code. By default, the protected area is locked and the default pin code for unlocking access is 0x0000E215. The default pin code shall be changed to a user-defined value as part of the installation process. This can be done by unlocking the NFC interface with the old PIN code and then writing the new PIN code to page 0xE5 as described in chapter 6.3.1. 6.7.2 Configuration of product parameters PTM 215B allows no direct modification of the following parameters:
Static Source Address Product ID Manufacturer ID Security Key In order to modify these parameters, the user has to write the new value into specific reg-
isters (Source Address Write, Product ID Write, Manufacturer ID Write and Security Key Write) in the protected data area and set the according Update flag in the Configuration register. After that, the user has to push and release the energy bar of the PTM 215B module. 6.7.3 Configuration register The Configuration register is 1 byte wide and contains configuration flags. Figure 30 below shows the structure of the Configuration register. Figure 30 Configuration register structure The Configuration register is used to select the length of optional data, to disable the transmission of commissioning telegrams, to select resolvable private address mode, to disable NFC read-out of the security key and to indicate an update of the security key, the manufacturer ID or the source ID. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 41/86 Bit 1Bit 0CONFIGURATIONBit 3Bit 4Bit 2Bit 6Bit 7Bit 5OPTIONAL DATA SIZEDISABLE LRN TELEGRAMRPA ADDRESS MODEPRIVATESECURITY KEYUPDATE SECURITY KEYUPDATEMAN IDUPDATESOURCE ID USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.7.4 Source Address Write register The Source Address Write register is 4 byte wide and can be used to modify the lower 32 bit of the PTM 215B Static Source Address. The upper 16 bit of the PTM 215B Static Source Address are always fixed to 0xE215 to identify the device type. In order to do change the lower 32 bit of the Static Source Address, follow these steps:
1. Write new source address into the Source Address Write register 2. Set the UPDATE SOURCE ID flag in the Configuration register to 0b1 3. Actuate (press and release) the energy bar of PTM 215B PTM 215B will determine that it should modify the Static Source Address based on the set-
ting of the Update Source ID flag and copy the value of the Source Address Write register to the lower 32 bit of the Source Address register. After successful execution, PTM 215B will clear the UPDATE SOURCE ID flag to 0b0. 6.7.5 Security Key Write register The Security Key Write register is 16 byte wide and contains the device-unique random security key. The factory programmed key can be replaced with a user defined key by fol-
lowing these steps:
1. Write new security key into the Security Key Write register Note that for security reasons, setting the Security Key to the following values is not possible:
0x00000000000000000000000000000000 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF If the Security Key Write register is set to one of these values then no update of the Security Key will occur. 2. Set the UPDATE SECURITY KEY flag in the Configuration register to 0b1 3. If the key should be write-only (not readable after the key update) then set the Pri-
vate Security Key flag in the Configuration register to 0b1 4. Actuate (press and release) the energy bar of PTM 215B PTM 215B will determine that it should modify the security key based on the setting of the Update Security Key flag and copy the value of the Security Key Write register to the Se-
curity Key register in private memory. After successful execution, PTM 215B will clear the UPDATE SECURITY KEY flag to 0b0. The protected memory is designed to support 1000 modi-
fications of the security key. Note that it is not possible to read the current security key via NFC if the Security Key Write register has been accidentally overwritten or cleared via NFC write. In this case it is necessary to write a new security key (as described above) or to reset the device to its de-
fault security key by means of a factory reset. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 42/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.7.6 Private Security Key mode PTM 215B provides a private security key mode for applications requiring high security. In this mode, it is possible to write a security key which subsequently is inaccessible via NFC and will not show up in commissioning telegram. In both cases, the security key will be set to all zeros. The written security key thereby is completely inaccessible externally. To use private security key mode, set the PRIVATE SECURITY KEY flag in the Configuration register is to 0b1, the Security Key Write register to the desired security key and the UP-
DATE SECURITY KEY flag in the Configuration register is to 0b1 and pushing the energy bar. The Security Key Write register will be cleared to 0x00000000000000000000000000000000 after successful execution and the written security key will not be NFC readable (even for users having the correct PIN code). If commissioning telegrams are enabled then the secu-
rity key will be set to 0x00000000000000000000000000000000 there as well. It is possible to return to Public (NFC-accessible) key mode by clearing the PRIVATE SECURI-
TY KEY flag in the Configuration register, setting the Security Key Write register to the desired security key and the UPDATE SECURITY KEY flag in the Configuration register is to 0b1 and pushing the energy bar. The protected memory is designed to support 1000 modifications of the security key. 6.7.7 Product ID and Manufacturer ID Write register The Product ID register is 8 byte wide and can be used to specify a publicly-accessible pa-
rameter (e.g. a user-specific ID or name) that can be read by an NFC commissioning tool in order to determine the specific product type. The Manufacturer ID is 2 byte wide and specifies the manufacturer of a BLE product and is transmitted as part of each BLE telegram. By default, the manufacturer ID is set to 0x03DA
(EnOcean GmbH) but it can be changed to a different OEM identifier. Product ID and Manufacturer ID can be changed by following these steps:
1. Write the desired Product ID (8 byte using HEX or ASCII encoding according to user choice) into the Product ID Write register. Setting the Product ID register to 0x0000000000000000 will cause PTM 215B not to update the Product ID. 2. Write the desired Manufacturer ID (2 byte) into the Manufacturer ID Write register. Setting the Manufacturer ID Write register to 0x0000 will cause PTM 215B not to update the Manufacturer ID. 3. Set the UPDATE MAN ID flag in the Configuration register to 0b1 4. Actuate (press and release) the energy bar of PTM 215B PTM 215B will determine that it should update the Product ID and Manufacturer ID based on the setting of the Update Product and Manufacturer ID flag and copy any non-zero value 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 43/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE of the Product ID Write register to the Product ID register and any non-zero value of the Manufacturer ID Write Register to the Manufacturer ID register. After that, PTM 215B will clear the UPDATE MAN ID flag to 0b0. 6.7.8 Optional Data register The Optional Data register can be used to specify up to 4 byte of custom data that will be transmitted as part of each data telegram. This optional data can store user-specific or ap-
plication-specific information. The size of the Optional Data field is specified by the OPTIONAL DATA SIZE field in the Con-
figuration register. The following settings of OPTIONAL DATA SIZE are supported:
0b00: 0 byte (No optional data, default) 0b01: 1 byte 0b10: 2 byte 0b11: 4 byte If the size of the OPTIONAL DATA SIZE field is set to a non-zero value in the Configuration register then PTM 215B will read the corresponding amount of data from the Optional Data register beginning with the least significant byte (Byte 0 Optional Data 0). Note that using the optional data feature requires additional energy for the radio telegram transmission and might therefore reduce the total number of redundant telegrams which are transmitted. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 44/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.7.9 Variant register The Variant register is 1 byte wide and allows selection of the custom radio transmission modes as described in chapter 3.3. Additionally, it allows reducing the transmission interval from 20 ms to 10 ms and to increase the bit rate from 1 Mbit to 2 Mbit. The structure of the Custom Variant register is shown Figure 31 below. Figure 31 Variant register structure 6.7.9.1 Transmission Mode selection Table 3 below shows the supported custom radio transmission modes that can be selected using Bit [2:0] of the Custom Variant register. Setting Meaning 0b000 Commissioning and data telegrams in standard Advertising Mode
(Default configuration) 0b001 Commissioning telegrams in standard Advertising Mode Data telegrams on 3 user-defined radio channels 0b010 Commissioning telegrams in standard Advertising Mode Data telegrams on 2 user-defined radio channels 0b011 Commissioning telegrams in standard Advertising Mode Data telegrams on 1 user-defined radio channel 0b100 0b101 0b110 0b111 Commissioning and Data telegrams on 3 user-defined radio channels Commissioning and Data telegrams on 2 user-defined radio channels Commissioning and Data telegrams on 1 user-defined radio channel RFU , will be treated as 0x00 Table 3 Transmission Mode settings 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 45/86 TRANSMISSION_MODERFUINTERVALDATA_RATEBit 1Bit 0VARIANTBit 3Bit 4Bit 2Bit 6Bit 7Bit 5 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.7.9.2 Interval selection Starting with version DC-06 it is possible to reduce the transmission interval from the de-
fault setting of 20 ms to 10 ms by setting bit 3 of the Variant register. Setting Result 0b0 0b1 20 ms Interval (Default configuration) 10 ms Interval Table 4 Interval settings 6.7.9.3 Data rate selection Starting with version DD-07 it is possible to increase the data rate from the default setting of 1 Mbit to 2 Mbit by setting bit 4 of the Variant register. Setting Result 0b0 0b1 1 Mbit Data Rate (Default configuration) 2 Mbit Data Rate Table 5 Data Rate settings 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 46/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.7.10 Radio channel selection registers If the TRANSMISSION MODE field of the Variant register is set to a value other than 0x00 then the radio channels for transmission are selected using the registers TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3 as described in chapter 3.3. The TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3 registers are 1 byte wide and use the en-
coding shown in Table 6 below. Note that two radio channel types are supported by PTM 215B:
Standard BLE radio channels BLE Channel 0 BLE Channel 39 use the even frequencies from 2402 MHz to 2480 Custom radio channels in between the standard BLE channels Custom Channel 40 78 use the odd frequencies from 2403 MHz to 2479 MHz TX_CHANNELn Frequency BLE Radio Channels Channel Type 37 0 1 10 38 11 12 36 39 40 41 77 78 2402 MHz 2404 MHz 2406 MHz 2424 MHz 2426 MHz 2428 MHz 2430 MHz 2478 MHz 2480 MHz BLE Advertising Channel BLE Data Channel BLE Data Channel BLE Data Channel BLE Advertising Channel BLE Data Channel BLE Data Channel BLE Data Channel BLE Advertising Channel Custom Radio Channels 2403 MHz 2405 MHz 2477 MHz 2479 MHz Custom Radio Channel Custom Radio Channel Custom Radio Channel Custom Radio Channel Table 6 Radio Channel Selection register settings 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 47/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 6.7.11 Customer Data PTM 215B allocates 64 pages (256 byte) for customer data that can be read and written via the NFC interface in protected mode. The main intention is to enable storing OEM-specific information such as product type, revi-
sion, date code or similar. There is however no restriction (other than the maximum size of 256 byte) on the type of content that can be stored in this memory region. PTM 215B will not access or modify this memory region. Users should keep in mind that the content of this memory region will not be affected by a factory reset. This means that after a factory reset, the content of this memory region can be read using the default PIN code. This region should therefore not be used to store sensi-
tive data. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 48/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Private Data The private data area stores the following items:
Security Key Default settings The content of the private data area is not externally accessible. 6.8.1 Security Key The Security Key field contains the 128 bit private key used for authenticating PTM 215B telegrams and for resolving private source addresses. This register is programmed with a random value during manufacturing. It can be changed using the Security Key Write feature described in chapter 6.7.5. 6.8.2 Default Settings The Default Settings field contains a backup of the following PTM 215B factory settings:
Static Source Address Security Key Manufacturer ID NFC PIN Code These default settings can be restored by means of a factory reset as described in chapter 5.4. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 49/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 7. Device integration PTM 215B is designed for integration into button or rocker based switches. It implements the established PTM 2xx mechanical form factor and can therefore be used with a wide va-
riety of existing designs. Mechanical Interface Characteristics Energy bow travel / operating force 1.8 mm / typ. 9 N At room temperature Only one of the two energy bows may be actuated at the same time!
Restoring force at energy bow typ. 0.7 N Minimum restoring force of 0.5 N is required for correct operation Number of operations at 25C typ. 100.000 actuations tested according to VDE 0632 / EN 60669 Cover material Energy bow material Mechanical Interface Drawings Hostaform (POM) PBT (50% GV) Figure 32 PTM 215B, tilted view (including rocker catwalks) 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 50/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 1) these catwalks are not needed when using one single rocker only 2) dimensions of rocker part Figure 33 PTM 215B, top view (note cut A, B and C marking) 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 51/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Figure 34 PTM 215B, cut A 2) dimensions of rocker part Figure 35 PTM 215B, cut B and C 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 52/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Hatched areas: support planes Figure 36 PTM 215B rear view 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 53/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 2) dimensions of rocker part Figure 37 PTM 215B, side view If the rocker is not mounted on the rotation axis of PTM 215B several tolerances have to be considered! The measure from support plane to top of the energy bow is 7.70 mm +/- 0.3 mm!
The movement of the energy bow must not be limited by mounted rockers!
Catwalks of the switch rocker must not exert continuous forces on the button con-
tacts!
2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 54/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE It is required to use non-conductive material (no metal or plastic with metal or graphite elements) for the rockers, the frame and the base plate to ensure best transmission range. PTM 215B is powered by the electromagnetic generator ECO 200. For proper func-
tion magnets or ferromagnetic materials are not permitted within a keep-out zone of 60mm around the center of PTM 215B. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 55/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Product label Customer products integrating PTM 215B modules should include a QR code on their prod-
uct label for the purpose of commissioning as described in chapter 5.2. This QR code can then be scanned by commissioning tools to automatically extract the required product pa-
rameters. The format of the QR code has to be according to the ANSI/MH10.8.2-2013 industry stand-
ard using the syntax described in chapter 8.2.1. The QR code should at a minimum contain the two fields listed in Table 7 below. Identifier Length of data (excluding identifier) Value 30S Z 12 characters 32 characters Static Source Address (hex) Security Key (hex) Table 7 Required fields for the product QR code 7.3.1 Example for a product QR code For this example we consider a product using the following parameters:
Static Source Address:
E21501500100 Security Key:
0123456789ABCDEF0123456789ABCDEF The resulting ANSI/MH10.8.2-2013 string would be:
30SE21501500100+Z0123456789ABCDEF0123456789ABCDEF Figure 38 below shows the QR code corresponding to this example. This QR code should be part of the customer product label with a size and resolution that enables easy scanning using a mobile phone or tablet. Figure 38 Example for a product QR code 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 56/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 8. PTM 215B device label Each PTM 215B module contains a device label. Note that the finished switches (EWSSB, EWSDB, ESRPB and EDRPB) use a different product label as described in their user manuals and the information given in the subsequent chapters applies only to the PTM 215B module itself. The format of the PTM 215B device label depends on the revision of the device:
Revisions up to DB-05 (produced before July 2018) use a device label with two DMC codes Revisions starting with DC-06 (produced after July 2018) use a new label with only one QR code Both versions are described in the following chapters. PTM 215B device label for products up to version DB-05 PTM 215B products up to version DB05 (PTM 215B produced before July 2018) contain the label shown in Figure 39 below. Figure 39 PTM 215B device label (for versions up to DB-05) The device label identifies the following parameters relevant for customer use:
Order number (S3221-A215) and revision (DA-2) Manufacturing date (week 20, 2017) Static Source Address (0xE2:15:01:50:01:00) 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 57/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE The device label additionally contains two DMC codes:
The smaller DLC on the left side (Manufacturer DMC) is used for manufacturing only and not relevant for customers The larger DMC code on the right side (Commissioning DMC) specifies Source Ad-
dress and Security Key and can be used for commissioning the switch into a net-
work. The structure of the Commissioning DMC is described in the next chapter. 8.1.1 Commissioning DMC structure The commissioning DMC uses the ECC200 standard to encode the following data string:
<PRODUCT_NAME>ID<SOURCE_ID>OOB<DEVICE_KEY>
This data string identifies the following product parameters:
Product name (always PTM215B) 48 bit Static Source Address (unique for each device, starts with E215 Prefix) 128 bit device-unique random security key (different for each device) Figure 40 below shows the Commissioning DMC from the label in Figure 39. Figure 40 Commissioning DMC (for PTM 215B versions up to DB-05) The Commissioning DMC shown above encodes the following string:
PTM215BIDE21501500100OOB0123456789ABCDEF0123456789ABCDEF For better readability, the same reading is shown below coloured red, green and orange to identify the different parts:
PTM215BIDE21501500100OOB0123456789ABCDEF0123456789ABCDEF This particular DMC reading would identify the following parameters:
Product name = PTM215B Static Source Address = E21501500100 Device-unique random security key = 0123456789ABCDEF0123456789ABCDEF 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 58/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE PTM 215B device label for products starting with version DC-06 PTM 215B products starting with version DC06 (PTM 215B produced after May 2018) use a new label as shown in Figure 41 below. Figure 41 PTM 215B device label (for versions starting with DC-06) This label adds the required ARIB (Japan) certification logo and ID (206-000585) and merges the two DMC used previously into one QR code. Other fields remain unchanged. Starting with version DD-07, the Dolphin logo is replaced by EnOcean. 8.2.1 QR Code format The QR code used in the new product label encodes the product parameter according to the ANSI/MH10.8.2-2013 industry standard. The QR code shown in Figure 41 above encodes the following string:
30SE21501500100+Z0123456789ABCDEF0123456789ABCDEF+30PS3221-A215+2PDC06+S01234567890123 Table 8 below describes the ANSI/MH10.8.2 data identifiers used by the PTM 215B device label and shows the interpretation of the data therein. Identifier Length of data (excluding identifier) Value 30S Z 30P 2P S 12 characters 32 characters 10 characters 4 characters 14 characters Static Source Address (hex) Security Key (hex) Ordering Code (S3221-A215) Step Code - Revision (DC-06) Serial Number Table 8 QR code format (for PTM 215B versions starting with DC-06) 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 59/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 9. Application information Transmission range The main factors that influence the system transmission range are:
- Type and location of the antennas of receiver and transmitter
- Type of terrain and degree of obstruction of the link path
- Sources of interference affecting the receiver
-
Dead spots caused by signal reflections from nearby conductive objects. Since the expected transmission range strongly depends on this system conditions, range tests should always be performed to determine the reliably achievable range under the giv-
en conditions. The following figures should be treated as a rough guide only:
- Line-of-sight connections Typically 10 m range in corridors, up to 30 m in halls
- Plasterboard walls / dry wood Typically 10 m range, through max. 2 walls
- Ferro concrete walls / ceilings Typically 5 m range, through max. 1 ceiling (depending on thickness)
- Fire-safety walls, elevator shafts, staircases and similar areas should be considered as shielded The angle at which the transmitted signal hits the wall is very important. The effective wall thickness and with it the signal attenuation varies according to this angle. Signals should be transmitted as directly as possible through the wall. Wall niches should be avoid-
ed. Other factors restricting transmission range include:
- Switch mounting on metal surfaces (up to 30% loss of transmission range)
- Hollow lightweight walls filled with insulating wool on metal foil
- False ceilings with panels of metal or carbon fibre
- Lead glass or glass with metal coating, steel furniture The distance between the receiver and other transmitting devices such as computers, audio and video equipment that also emit high-frequency signals should be at least 0.5 m. Note that interference from other radio equipment operating in the 2.4 GHz band (WiFi routers, smartphones, wireless audio and video systems, etc.) can have major impact on radio performance. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 60/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Receiver configuration PTM 215B communicates user actions (rocker push / release) using a sequence of advertis-
ing telegrams as described in chapter 0. In order to maximize the likelihood of reception of these telegrams, it is necessary that the receiver is either permanently in receive mode on the selected radio channels or if this is not possible is in receive mode periodically on one of the chosen radio channels for a cer-
tain minimum period of time. The two key timing parameters for the periodical reception case are the scan interval (time between the start of two consecutive scanning cycles) and the scan duration (for how long will the receiver scan within each scanning cycle). PTM 215B transmits the advertising events with a pause interval of 20 ms between two transmissions. The transmission of the advertising event itself requires approximately 1 ms per radio channel (meaning approximately 3 ms in total when using 3 radio channels) which means that the total time between the start of two advertising events is approxi-
mately 23 ms. Considering that the receiver might start scanning directly after the start of one transmis-
sion, we can therefore determine that it should remain active (scan duration) for at least 23 ms to check for the start of the next transmission. Likewise, we need to ensure that the receiver will become active (scan period) no later than right before the beginning of the third advertising event. So the longest period for which the receiver can be inactive is given by the time from the beginning of the first advertising events until the beginning of the third advertising event, meaning approximately 46 ms in total. The likelihood of correct reception obviously increases if more than one of the redundant advertising events is received. It should also be considered that the receiver is typically scanning on different radio channels. Therefore the theoretical maximum of 46 ms should be significantly reduced to increase the likelihood of correct reception. It is therefore recommended to use a setting of 30 ms scan period and 23 ms scan interval for cases where continuous reception is not possible. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 61/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 10. Regulatory information PTM 215B has been certified according to FCC (US), ISED (CA) and RED (EU) regulations. Changes or modifications not expressly approved by EnOcean could void the user's authori-
ty to operate the equipment. RED for European Market The Radio Equipment Directive (2014/53/EU, typically referred to as RED) replaces R&TTE directive as regulatory framework for radio products in the European Union. All products sold final customers within the European Union have to be compliant to RED. At the time of writing, the text of the RED legislation was available from this link: http://eur-
lex.europa.eu/eli/dir/2014/53/oj Dolphin radio modules are components which are delivered to OEM manufacturers for their use/integration in final or combined products. It is the responsibility of the OEM manufac-
turer to demonstrate compliance to all applicable EU directives and standards. The EnOcean attestation of conformity can be used as input to the declaration of conformity for the full product. At the time of writing, guidance on the implementation of EU product rules the so called Blue Guide was available from this link:
http://ec.europa.eu/DocsRoom/documents/18027/
Specifically within the new RED framework, all OEM manufacturers have for instance to fulfill the following additional requirements:
Provide product branding (on the product) clearly identifying company name or brand and product name as well as type, charge or serial number for market surveil-
lance Include (with the product) documentation containing full postal address of the man-
ufacturer as well as radio frequency band and max. transmitting power Include (with the product) user manual, safety information and a declaration of con-
formity for the final product in local language Provide product development and test documentation upon request Please contact an accredited test house for detailed guidance. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 62/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE FCC (United States) Certificate 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 63/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 10.2.1 FCC (United States) Regulatory Statement This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions:
(1) this device may not cause harmful interference, and
(2) this device must accept any interference received, including interference that may cause undesired operation. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 64/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE IC (Industry Canada) Certificate 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 65/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 10.3.1 IC (Industry Canada) Regulatory Statement This device complies with Industry Canada licence-exempt RSS standard(s). Operation is subject to the following two conditions:
(1) this device may not cause interference, and
(2) this device must accept any interference, including interference that may cause unde-
sired operation of the device. Le prsent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils radio exempts de licence. L'exploitation est autorise aux deux conditions suivantes :
(1) l'appareil ne doit pas produire de brouillage, et
(2) l'utilisateur de l'appareil doit accepter tout brouillage radiolectrique subi, mme si le brouillage est susceptible d'en compromettre le fonctionnement. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 66/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE ACMA (Australia) Declaration of Conformity 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 67/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 68/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE ARIB (Japan) Construction Type Conformity Certifaction 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 69/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE 11. Product history Table 9 below lists the product history of PTM 215B. Revision Release date Key changes versus previous revision DA-03 DB-04 First release for lead customers October 2016 February 2017 Broad market release incorporating lead customer feedback Added option to change Manufacturer ID Added option to use custom radio channels Changed NFC memory organization to include additional configuration registers Changed format of commissioning telegram:
o Addition of Static Source Address o Removal of Product Name (PTM215B') DB-05 DC-06 March 2018 July 2018 Internal version (component update), no customer change Corrected length field in commissioning telegram (now correctly set to 0x1D) Addition of option to reduce interval between advertising events from 20 ms to 10 ms Addition of option to disable transmission of commission-
ing telegrams via long press A0+A1+B1 Modification of product label o Addition of ARIB approval sign o Merge of the two DMC into one QR code with parameter encoding according to ANSI/MH10.8.2 standard Added option for 2 Mbit bit rate Dolphin logo replaced with EnOcean on the device label DD-07 July 2019 Table 9 Product History 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 70/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE A. Parsing PTM 215B radio telegrams This appendix is intended as an example of how start to parse received PTM 215B radio telegrams. Please refer to chapter 4 first for a description of the BLE frame structure Data telegram example We consider the following raw data telegram data captured from an EnOcean PTM 215B device:
D6 BE 89 8E 42 13 9F 1B 00 00 15 E2 0C FF DA 03 69 01 00 00 10 8A D6 C1 7E 16 EE 23 BLE frame structure A.1.1 The message shown above can be parsed into the following components (keep in mind the little endian byte order):
BLE Access Address (4 byte):
BLE Frame Control (2 byte):
0x8E89BED6 0x1342 Size of source address + payload: 0x13 (19 byte) Telegram type: Non-connectable Advertising BLE Source Address (6 byte):
Length of payload (1 byte):
Type of payload (1 byte):
Manufacturer ID (2 byte):
EnOcean Payload (9 byte):
CRC (3 byte):
0xE21500001B9F 0x0C (12 byte) 0xFF (manufacturer-specific data) 0x03DA (EnOcean GmbH) 69 01 00 00 10 8A D6 C1 7E 16 EE 23 EnOcean data telegram payload structure A.1.2 The EnOcean data telegram payload can now be parsed as follows:
Sequence Counter (4 byte):
Switch Status:
Telegram Signature:
10 (Release of button B1) C7 24 EA F0 0x00000169 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 71/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Commissioning telegram example We consider the following raw commissioning telegram data captured from an EnOcean PTM 215B device:
D6 BE 89 8E 42 24 9F 1B 00 00 15 E2 1E FF DA 03 71 01 00 00 AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12 A0 9F 1B 00 00 15 E2 9E 6D 7C BLE frame structure A.2.1 The message shown above can be parsed into the following components (keep in mind the little endian byte order):
BLE Access Address (4 byte):
BLE Frame Control (2 byte):
0x8E89BED6 0x2442 Size of source address + payload: 0x24 (36 byte) Telegram type: Non-connectable Advertising BLE Source Address (6 byte):
Length of payload (1 byte):
Type of payload (1 byte):
Manufacturer ID (2 byte):
EnOcean Payload (27 byte):
CRC (3 byte):
0xE21500001B9F 0x1E (30 byte) Note that this field should correctly be set to 0x1D This issue has been corrected in product version DC-06 0xFF (manufacturer-specific data) 0x03DA (EnOcean GmbH) 71 01 00 00 AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12 A0 9F 1B 00 00 15 E2 0x7C6D9E EnOcean commissioning telegram payload structure A.2.2 The EnOcean commissioning telegram payload can now be parsed as follows:
Sequence Counter (4 byte):
Security Key:
Static Source Address:
0xE21500001B9F 0x00000171 AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12 A0 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 72/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE B. Address resolution for resolvable private addresses (RPA) PTM 215B provides the option to obfuscate its identity by means of using resolvable private addresses (RPA) as described in chapter 4.4.2. The following chapters describe how to re-
solve such addresses. RPA resolution flow B.1.1 The execution flow for resolving private addresses (RPA) is shown in Figure 42 below. Figure 42 Execution flow for resolving private addresses (RPA resolution) The input to the RPA resolution flow are the prand part of the resolvable private address field of the received telegram together with one (or several) locally stored IRK. The receiver will then try for each locally stored IRK if the hash generated using the execu-
tion flow above matches the hash part of the resolvable private address field of the received telegram. If it does then the IRK identifies the device from which this telegram originated. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 73/86 0000000...0000000prand104 Bit Padding (all zero)24 Bit prandIdentity Resolution Key (IRK)128 Bit Identity Resolution Key (IRK)AES128Don t Carehash104 Bit Don t Care 24 Bit hash USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Address resolution example B.1.2 We consider a PTM 215B device with the following IRK (options for determining the IRK /
security key of a PTM 215B are described in chapter C.1.3.):
BE759A027A4870FD242794F4C45220FB We further consider a telegram having the following resolvable private address:
493970E51944 We will now test if this resolvable private address was generated using the IRK above. Referring to the resolvable private address structure shown in Figure 12, we split the re-
solvable private address into prand and hash as follows:
prand = (RPA && 0xFFFFFF000000) >> 24 prand = 0x493970 hash = RPA && 0x000000FFFFFF hash = 0xE51944 Next, we verify the address mode by looking at the two most significant bit of prand:
mode = (prand && 0xC00000) >> 22 mode = 0b01 Referring to chapter 4.4.2, the setting of 0b01 indicates resolvable private address mode. To generate the hash, we add 104 bit of padding (all zeros) to prand:
0x00000000000000000000000000493970 We can now generate the hash as AES128 operation between the IRK and the thus padded prand:
hash = AES128(IRK; Padded prand) hash = AES128(0xBE759A027A4870FD242794F4C45220FB;
0x00000000000000000000000000493970) At the time of writing, a suitable online AES calculator could be found here:
http://testprotect.com/appendix/AEScalc With this, we can calculate the result as:
hash = 0x286ACB1F9C8A80EE21B3F02225E51944 With that, we can verify that the lowest 24 bit of the calculated hash (0xE51944) match the hash that was received as part of the resolvable private address. Therefore the transmitter of this telegram used this specific IRK to generate this resolvable private address. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 74/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE C. Authentication of PTM 215B data telegrams PTM 215B provides the option to authenticate its data telegrams as described in chapter 4.6.3. The authentication mechanism used by PTM 215B is standardized as RFC3610. The full RFC3610 specification could be found here at the time of writing and should be used as primary source of information: https://www.ietf.org/rfc/rfc3610.txt The following description aims to summarize the security processing steps for users not deeply familiar with cryptography in general or RFC3610 in particular. Algorithm input parameters C.1 The purpose of the security processing in PTM 215B is to calculate a unique signature that can be used to verify authenticity (telegram has not been modified) and originality (tele-
gram comes from the assumed sender) of a telegram. To do so, two types of algorithm parameters are required:
Constant algorithm input parameters These parameters identify high level algorithm and telegram properties and are the same for any PTM 215B telegram Variable algorithm input parameters These parameters identify telegram-specific parameters and therefore depend on the specifics of the transmitted telegram Constant input parameters C.1.1 The RFC3610 implementation in PTM 215B requires two constant input parameters:
Length field size This is the size (in byte) of the field used to encode the length of the input data
(which is the payload to be authenticated). The maximum size of PTM 215B payload to be authenticated is 13 byte; therefore one byte would be easily sufficient to encode the payload size. The minimum value permitted by the standard is however 2 bytes which is therefore chosen. Signature size This is the desired size of the generated signature which is 4 byte for PTM 215B Table 10 below summarizes these constant algorithm parameters. Parameter Length Field Size Signature Size Comment / Description Size (in bytes) of the field used to encode the input length Desired size (in byte) of the signa-
ture generated by the algorithm Example 2 (always, minimum permissible size) 4 (always) Table 10 Constant algorithm input parameters 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 75/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Variable input parameters C.1.2 The RFC3610 implementation in PTM 215B requires four variable input parameters:
Source address The 6 byte source address used to identify the sender of an authenticated message. The source address is required in little endian (least significant byte first) format. Input data (Payload to be authenticated) The authenticated payload contains source address, sequence counter, switch status and optional data (if present). See chapter 4.6.3 for a description of the authenti-
cated payload. Input length (Size of the payload to be authenticated) The length of the payload to be authenticated depends on the amount of optional data used in the telegram. This is configured via the Configuration register, see chapter 6.7.3. By default, no optional data is present and the length of the authenticated payload is 9 byte. Sequence counter Each PTM 215B contains a sequence counter which is initialized to zero during pro-
duction and increased for each telegram that is sent. The sequence counter is transmitted as part of the input data. The receiver of PTM 215B telegrams keeps track of this counter and will accept only telegrams with counter values higher than the highest previously used value. This eliminates the possibility of reusing previously transmitted telegrams. Note that the individual (identical) advertising telegrams used to encode the same data telegram use the same sequence counter value. Security key Each PTM 215B is programmed with a random 16 byte security key during manufac-
turing. This key can be modified using the NFC interface, see chapter 6.7.5. Table 11 below summarizes these parameters. Comment / Description Parameter Source Address Input Data Telegram data to be authenticated Unique source address of the PTM 215B module (little endian) Input Length Length of input data (in bytes, en-
coded using 2 bytes) Sequence Counter Security Key Incrementing counter to avoid replay Part of the input data (byte 4 7) 128 bit random key that is known both to sender and receiver Table 11 Variable input parameters Example B819000015E2 (little endian represen-
tation of E215000019B8) 0CFFDA035D04000011 0x0009 (if optional data size = 0, default) 0x000A (if optional data size = 1) 0x000B (if optional data size = 2) 0x000D (if optional data size = 4) 5D040000 (little endian representa-
tion of the counter value 0000045D) 3DDA31AD44767AE3CE56DCE2B3CE2ABB 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 76/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Obtaining the security key C.1.3 All required parameters except the security key can be directly extracted from the received message that shall be authenticated. The security key the common secret shared between sender and receiver has to be ob-
tained via specific mechanisms. As described in chapter 5, there are three different ways to obtain the security key of a given PTM 215B module:
Obtaining the key via the NFC configuration interface Obtaining the key via the product DMC code Obtaining the key via a dedicated commissioning telegram Each option is described now in detail. C.1.3.1 Obtaining the security key via NFC interface Using the Elatec TWN4 reader (as described in chapter 6.3), the security key can be read using the following command sequence:
SearchTag(32) NTAG_PwdAuth(0x00 0x00 0xE2 0x15,0x00 0x00) NTAG_Read(0x14) This is equivalent to the following binary command sequence:
050020 Request:
Response: 0001803807048831A2014F8020060000E2150000 Request:
Response: 0001 Request:
Response: 00013DDA31AD44767AE3CE56DCE2B3CE2ABB 20060000E2150000 200014 The tag response to the last command - NTAG_Read(0x14) - contains the password:
NTAG_Read(0x14) Result: true Page: 3DDA31AD44767AE3CE56DCE2B3CE2ABB The password of this device is therefore: 3DDA31AD44767AE3CE56DCE2B3CE2ABB 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 77/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE C.1.3.2 Obtaining the security key via the product DMC code Each PTM 215B module contains a DMC code on its product label which identifies source address and security key of the module, see chapter 5.2. The DMC code of the device used for this tutorial encoded in the DMC code format up to revision DB-05 is shown in Figure 43 below. Figure 43 Example DMC code (used up to DB-05) This DMC code can be read using a suitable DMC code reader (e.g. QRbot smartphones). The content of this example DMC code is:
PTM215BIDE215000019B8OOB3DDA31AD44767AE3CE56DCE2B3CE2ABB The structure of the DMC code is described in chapter 8.1.1. The location of the security key in above DMC string is marked red for reference. This means that the security key of this device is:
3DDA31AD44767AE3CE56DCE2B3CE2ABB Note that the device label has been updated starting with product version DC-06 as de-
scribed in chapter 8.2. Figure 44 below shows the same information encoded according to that. Figure 44 Example QR code (used starting with DC-06) The QR code shown above encodes the following text:
30SE215000019B8+Z3DDA31AD44767AE3CE56DCE2B3CE2ABB+30PS3221-A215+2PDC06+
S01234567890123 The security key can then be obtained from the Z field as highlighted in red above. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 78/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE C.1.3.3 Obtaining the security key via a commissioning telegram PTM 215B modules can send dedicated commissioning telegrams that identify their security key. Transmission of such commissioning telegrams can be triggered by means of a specific button sequence as described in chapter 5.3. Note that this feature can be disabled via the NFC commissioning interface by setting the DISABLE LRN TELEGRAM flag in the Configuration register to 0b1 (see chapter 6.7.3). The resulting commissioning telegram has the following payload:
1D FF DA 03 56 04 00 00 3D DA 31 AD 44 76 7A E3 CE 56 DC E2 B3 CE 2A BB B8 19 00 00 15 E2 Please see Figure 16 in chapter 5.3.2 for a description of the commission telegram struc-
ture. The location of the security key is for reference highlighted red above. This means that the security key of this device is:
3DDA31AD44767AE3CE56DCE2B3CE2ABB Internal parameters C.1.4 The RFC3610 implementation in PTM 215B derives a set of internal parameters for further processing from the provided input parameters. Again, there are two types of internal parameters:
Constant internal parameters These parameters are based on the high level algorithm and telegram properties and are the same for any PTM 215B telegram Variable input parameters These parameters are based on the telegram-specific parameters and therefore de-
pend on the specifics of the transmitted telegram 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 79/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Constant internal parameters C.1.5 The RFC3610 implementation in PTM 215B derives two internal parameters M and L based on the input data and uses them to construct A0_Flag and B_0_Flag which togeth-
er with the iteration counter i are required for subsequent processing. The value of these internal parameters - listed in Table 12 below - is the same for all PTM 215B telegrams. Parameter Comment / Description Example M L A0_Flag B0_Flag i Binary encoded output length M = (Output length / 2) - 1 Binary encoded length field size L = length field size - 1 L
(0b01<<6) + (M<<3) + L Iteration counter Table 12 Constant internal parameters 0b001 (always) 0b001 (always) 0x01 (always) 0x49 (always) 0x0000 (always) Variable internal parameters C.1.6 The RFC3610 implementation in PTM 215B derives four internal parameters Nonce, A0, B0 and B1 based on the telegram specific input data and the constant internal parame-
ters. These variable internal parameters - listed in Table 13 below - are then used together with the security key to calculate the actual signature. Parameter Comment / Description Example Nonce A0 B0 B1 13 byte initialization vector based on concatenation of source address, sequence counter and padding, see 4.7.1 A0_Flag followed by Nonce followed by 2 byte 0x00 B0_Flag followed by Nonce followed by 2 byte 0x00 (no message to encode) Input Length followed by Input Data fol-
lowed by 5 / 4 / 3 / 1 byte of 0x00 padding
(for optional data size = 0 / 1 / 2 / 4 byte) Table 13 Variable internal parameters FE19000015E2D00A0000000000 01FE19000015E2D00A00000000000000 49FE19000015E2D00A00000000000000 00090CFFDA03D00A0000030000000000 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 80/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Algorithm execution sequence C.2 The algorithm uses the variable internal parameters A_0, B_0, B_1 together with the private key to generate the authentication vector T_0 using three AES-128 and two XOR opera-
tions. The algorithm execution sequence is shown in Figure 45 below. The first four bytes of T_0 are then used to authenticate PTM 215B telegrams. Figure 45 Authentication algorithm sequence 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 81/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Examples C.3 The following four chapters give step by step examples based on one actual device and 0 /
1 / 2 or 4 byte of optional data. Data telegram without optional data C.3.1 For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB:
The last four bytes of this payload (B2 FA 88 FF) are the sender-provided signature which has to be authenticated (compared against the signature the receiver calculates based on its own security key). The variable input parameters are therefore the following:
0C FF DA 03 5D 04 00 00 11 B2 FA 88 FF Parameter Source Address Input Data Input Length Sequence Counter Security Key In this example B819000015E2 (little endian representation of E215000019B8) 0CFFDA035D04000011 0x0009 5D040000 3DDA31AD44767AE3CE56DCE2B3CE2ABB The constant internal parameters are always the same:
Parameter A0_Flag B0_Flag i In this example 0x01 (always) 0x49 (always) 0x0000 (always) Based on variable input data and constant internal algorithm parameters, we can now de-
rive the following variable internal parameters:
Parameter Nonce A0 B0 B1 In this example B819000015E25D040000000000 01B819000015E25D0400000000000000 49B819000015E25D0400000000000000 00090CFFDA035D040000110000000000 We can now calculate the signature using AES128 and XOR operations. At the time of writing, a suitable online AES calculator could be found here:
http://testprotect.com/appendix/AEScalc Likewise, a suitable XOR calculator could be found here:
http://xor.pw/?
2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 82/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE The execution sequence would then be as follows:
X_1 = AES128(B0, Key) X_1 = AES128(49B819000015E25D0400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_1 = 41ef09792ae152ae52c671435c1f247d X_1A = XOR(X_1, B_1) X_1A = XOR(41ef09792ae152ae52c671435c1f247d, 00090CFFDA035D040000110000000000) X_1A = 41e60586f0e20faa52c660435c1f247d X_2 = AES128(X1A, Key) X_2 = AES128(41e60586f0e20faa52c660435c1f247d, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_2 = 8d89e733da516ae3e08f9e30184909fc S_0 = AES128(A0, Key) S_0 = AES128(01B819000015E25D0400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) S_0 = 3f736fcc8bcaf2d4aabca0260fab7976 T_0 = XOR(X_2, S_0) T_0 = XOR(8d89e733da516ae3e08f9e30184909fc, 3f736fcc8bcaf2d4aabca0260fab7976) T_0 = b2fa88ff519b98374a333e1617e2708a The calculated signature is formed by the first four bytes of T_0, i.e. it is B2 FA 88 FF. The calculated signature matches the signature that was transmitted as part of the pay-
load. This proves that the telegram originates from a sender that possesses the same secu-
rity key and the telegram content has not been modified. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 83/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Data telegram with 1 byte optional data C.3.2 For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB:
The last four bytes of this payload (B9 FE AC C1) are the sender-provided signature which has to be authenticated. The variable input parameters are therefore the following:
0D FF DA 03 62 04 00 00 10 12 B9 FE AC C1 Parameter Source Address Input Data Input Length Sequence Counter Security Key In this example B819000015E2 (little endian representation of E215000019B8) 0DFFDA03620400001012 0x000A 62040000 3DDA31AD44767AE3CE56DCE2B3CE2ABB Based on variable input data and constant internal algorithm parameters, we can now de-
rive the following variable internal parameters:
Parameter Nonce A0 B0 B1 In this example B819000015E262040000000000 01B819000015E2620400000000000000 49B819000015E2620400000000000000 000A0DFFDA0362040000101200000000 The execution sequence would then be as follows:
X_1 = AES128(B0, Key) X_1 = AES128(49B819000015E2620400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_1 = dc8d685f968e795b23f4370b3091f33f X_1A = XOR(X_1, B_1) X_1A = XOR(dc8d685f968e795b23f4370b3091f33f, 000A0DFFDA0362040000101200000000) X_1A = dc8765a04c8d1b5f23f427193091f33f X_2 = AES128(X1A, Key) X_2 = AES128(dc8765a04c8d1b5f23f427193091f33f, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_2 = 231be2ff54ca62fb38d32eaaaf1b447d S_0 = AES128(A0, Key) S_0 = AES128(01B819000015E2620400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) S_0 = 9ae54e3e95de9f91a0c279537bc25b00 T_0 = XOR(X_2, S_0) T_0 = XOR(231be2ff54ca62fb38d32eaaaf1b447d, 9ae54e3e95de9f91a0c279537bc25b00) T_0 = b9feacc1c114fd6a981157f9d4d91f7d The calculated signature is formed by the first four bytes of T_0, i.e. it is B9 FE AC C1. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 84/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Data telegram with 2 byte optional data C.3.3 For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB:
The last four bytes of this payload (52 E0 51 16) are the sender-provided signature which has to be authenticated. The variable input parameters are therefore the following:
0E FF DA 03 63 04 00 00 11 12 34 52 E0 51 16 Parameter Source Address Input Data Input Length Sequence Counter Security Key In this example B819000015E2 (little endian representation of E215000019B8) 0EFFDA0363040000111234 0x000B 62040000 3DDA31AD44767AE3CE56DCE2B3CE2ABB Based on variable input data and constant internal algorithm parameters, we can now de-
rive the following variable internal parameters:
Parameter Nonce A0 B0 B1 In this example B819000015E263040000000000 01B819000015E2630400000000000000 49B819000015E2630400000000000000 000B0EFFDA0363040000111234000000 The execution sequence would then be as follows:
X_1 = AES128(B0, Key) X_1 = AES128(49B819000015E2630400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_1 = ab5ec24beabc9ddeeb73751c7734cc64 X_1A = XOR(X_1, B_1) X_1A = XOR(ab5ec24beabc9ddeeb73751c7734cc64, 000B0EFFDA0363040000111234000000) X_1A = ab55ccb430bffedaeb73640e4334cc64 X_2 = AES128(X1A, Key) X_2 = AES128(ab55ccb430bffedaeb73640e4334cc64, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_2 = d33e96d7a105c4e8543207f9e75e6cfe S_0 = AES128(A0, Key) S_0 = AES128(01B819000015E2630400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) S_0 = 81dec7c16915c6647d92b0668f65e9c9 T_0 = XOR(X_2, S_0) T_0 = XOR(d33e96d7a105c4e8543207f9e75e6cfe, 81dec7c16915c6647d92b0668f65e9c9) T_0 = 52e05116c810028c29a0b79f683b8537 The calculated signature is formed by the first four bytes of T_0, i.e. it is 52 E5 11 16. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 85/86 USER MANUAL PTM 215B BLUETOOTH PUSHBUTTON TRANSMITTER MODULE Data telegram with 4 byte optional data C.3.4 For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB:
The last four bytes of this payload (2C 9E 10 95) are the sender-provided signature which has to be authenticated. The variable input parameters are therefore the following:
10 FF DA 03 6A 04 00 00 10 12 34 56 78 2C 9E 10 95 Parameter Source Address Input Data Input Length Sequence Counter Security Key In this example B819000015E2 (little endian representation of E215000019B8) 10FFDA036A0400001012345678 0x000D 6A040000 3DDA31AD44767AE3CE56DCE2B3CE2ABB Based on variable input data and constant internal algorithm parameters, we can now de-
rive the following variable internal parameters:
Parameter Nonce A0 B0 B1 In this example B819000015E26A040000000000 01B819000015E26A0400000000000000 49B819000015E26A0400000000000000 000D10FFDA036A040000101234567800 The execution sequence would then be as follows:
X_1 = AES128(B0, Key) X_1 = AES128(49B819000015E26A0400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_1 = 434fa5855b8a8a8ae99bf1cb114a51b7 X_1A = XOR(X_1, B_1) X_1A = XOR(434fa5855b8a8a8ae99bf1cb114a51b7, 000D10FFDA036A040000101234567800) X_1A = 4342b57a8189e08ee99be1d9251c29b7 X_2 = AES128(X1A, Key) X_2 = AES128(4344b57a8189e08ee99be1d9251c29b7, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_2 = 12c78b85a4ecb6f34daff7651db8e386 S_0 = AES128(A0, Key) S_0 = AES128(01B819000015E2630400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) S_0 = 3e599b103f33447e6b46eec4a042d0bc T_0 = XOR(X_2, S_0) T_0 = XOR(12c78b85a4ecb6f34daff7651db8e386, 3e599b103f33447e6b46eec4a042d0bc) T_0 = 2c9e10959bdff28d26e919a1bdfa333a The calculated signature is formed by the first four bytes of T_0, i.e. it is 2C 9E 10 95. 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.9 | June 2019 | Page 86/86
frequency | equipment class | purpose | ||
---|---|---|---|---|
1 | 2019-12-17 | 2402 ~ 2480 | DXX - Part 15 Low Power Communication Device Transmitter | Class II Permissive Change |
2 | 2016-09-26 | 2402 ~ 2480 | DXX - Part 15 Low Power Communication Device Transmitter | Original Equipment |
app s | Applicant Information | |||||
---|---|---|---|---|---|---|
1 2 | Effective |
2019-12-17
|
||||
1 2 |
2016-09-26
|
|||||
1 2 | Applicant's complete, legal business name |
EnOcean GmbH
|
||||
1 2 | FCC Registration Number (FRN) |
0011813441
|
||||
1 2 |
0012797742
|
|||||
1 2 | Physical Address |
Kolpingring 18a
|
||||
1 2 |
Oberhaching, N/A
|
|||||
1 2 |
Oberhaching, N/A 82041
|
|||||
1 2 |
Germany
|
|||||
app s | TCB Information | |||||
1 2 | TCB Application Email Address |
g******@emcc.de
|
||||
1 2 |
c******@emcc.de
|
|||||
1 2 | TCB Scope |
A2: Low Power Transmitters (except Spread Spectrum) and radar detectors operating above 1 GHz
|
||||
app s | FCC ID | |||||
1 2 | Grantee Code |
SZV
|
||||
1 2 | Equipment Product Code |
PTM215B
|
||||
app s | Person at the applicant's address to receive grant or for contact | |||||
1 2 | Name |
A**** A********
|
||||
1 2 | Title |
Director Product Marketing
|
||||
1 2 | Telephone Number |
+49 8********
|
||||
1 2 | Fax Number |
+49 8********
|
||||
1 2 |
a******@enocean.com
|
|||||
app s | Technical Contact | |||||
n/a | ||||||
app s | Non Technical Contact | |||||
n/a | ||||||
app s | Confidentiality (long or short term) | |||||
1 2 | Does this application include a request for confidentiality for any portion(s) of the data contained in this application pursuant to 47 CFR § 0.459 of the Commission Rules?: | Yes | ||||
1 2 | Long-Term Confidentiality Does this application include a request for confidentiality for any portion(s) of the data contained in this application pursuant to 47 CFR § 0.459 of the Commission Rules?: | No | ||||
1 2 | Yes | |||||
1 2 | If so, specify the short-term confidentiality release date (MM/DD/YYYY format) | 03/25/2017 | ||||
if no date is supplied, the release date will be set to 45 calendar days past the date of grant. | ||||||
app s | Cognitive Radio & Software Defined Radio, Class, etc | |||||
1 2 | Is this application for software defined/cognitive radio authorization? | No | ||||
1 2 | Equipment Class | DXX - Part 15 Low Power Communication Device Transmitter | ||||
1 2 | Description of product as it is marketed: (NOTE: This text will appear below the equipment class on the grant) | 2402 MHz - 2480 MHz transmitter | ||||
1 2 | Related OET KnowledgeDataBase Inquiry: Is there a KDB inquiry associated with this application? | No | ||||
1 2 | Modular Equipment Type | Does not apply | ||||
1 2 | Purpose / Application is for | Class II Permissive Change | ||||
1 2 | Original Equipment | |||||
1 2 | Composite Equipment: Is the equipment in this application a composite device subject to an additional equipment authorization? | No | ||||
1 2 | Related Equipment: Is the equipment in this application part of a system that operates with, or is marketed with, another device that requires an equipment authorization? | No | ||||
1 2 | Is there an equipment authorization waiver associated with this application? | No | ||||
1 2 | If there is an equipment authorization waiver associated with this application, has the associated waiver been approved and all information uploaded? | No | ||||
app s | Test Firm Name and Contact Information | |||||
1 2 | Firm Name |
EMCCons Dr. Rasek GmbH & Co.KG
|
||||
1 2 |
EMCCons DR. RASEK GmbH & Co. KG
|
|||||
1 2 | Name |
R******** S********
|
||||
1 2 |
R****** S********
|
|||||
1 2 | Telephone Number |
49-91********
|
||||
1 2 |
49-91********
|
|||||
1 2 | Fax Number |
49-91********
|
||||
1 2 |
49-91********
|
|||||
1 2 |
e******@emcc.de
|
|||||
1 2 |
e******@emcc.de.
|
|||||
Equipment Specifications | |||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Line | Rule Parts | Grant Notes | Lower Frequency | Upper Frequency | Power Output | Tolerance | Emission Designator | Microprocessor Number | |||||||||||||||||||||||||||||||||
1 | 1 | 15C | 2402.00000000 | 2480.00000000 | |||||||||||||||||||||||||||||||||||||
Line | Rule Parts | Grant Notes | Lower Frequency | Upper Frequency | Power Output | Tolerance | Emission Designator | Microprocessor Number | |||||||||||||||||||||||||||||||||
2 | 1 | 15C | 2402.00000000 | 2480.00000000 |
some individual PII (Personally Identifiable Information) available on the public forms may be redacted, original source may include additional details
This product uses the FCC Data API but is not endorsed or certified by the FCC