USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE PTM 215B Bluetooth® Pushbutton Transmitter Module 07.06.2019 Observe precautions! Electrostatic sensitive devices! Patent protected: WO98/36395, DE 100 25 561, DE 101 50 128, WO 2004/051591, DE 103 01 678 A1, DE 10309334, WO 04/109236, WO 05/096482, WO 02/095707, US 6,747,573, US 7,019,241 © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE REVISION HISTORY The following major modifications and improvements have been made to this document: Version 1.0 1.1 1.2 Author MKA MKA MKA Reviewer MK MKA MKA Date 14.10.2016 15.12.2016 25.01.2017 1.3 1.4 1.5 1.6 MKA MKA MK MK MKA MKA MKA MKA 17.03.2017 30.03.2017 17.07.2017 11.10.2017 1.7 1.8 MKA MKA MKA MKA 21.12.2017 22.06.2018 1.9 MKA MKA 07.06.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE TABLE OF CONTENT 1. 2. 3. 4. 5. 6. General description ........................................................................................ 6 Basic functionality ......................................................................................... 6 Technical data............................................................................................... 7 Physical dimensions ..................................................
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 7. 6.2.2 IDLE state .............................................................................................. 31 6.2.3 READY 1 state......................................................................................... 31 6.2.4 READY 2 state ......................................................................................... 32 6.2.5 ACTIVE state ...................................................................................
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 11. A. B. C. Product history............................................................................................ 70 Parsing PTM 215B radio telegrams ................................................................. 71 Data telegram example ................................................................................ 71 A.1.1 BLE frame structure ............................................................................. 71 A.1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 1. General description Basic functionality PTM 215B enables the realization of energy harvesting wireless switches for lighting, building or industrial automation control systems using Bluetooth® low energy technology. PTM 215B is mechanically compatible with the established PTM 210 form factor enabling quick integration into a wide range of designs.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Technical data Antenna Integrated PCB antenna Max. transmit power measured Communication Range (guidance only) 0.4dBm / 1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 2. Functional information Device Overview The pushbutton transmitter module PTM 215B from EnOcean enables the implementation of wireless remote controls without batteries. It transmits Bluetooth Low Energy (BLE) data telegrams where the required energy is provided by a built-in electro-dynamic energy generator. The outer appearance of PTM 215B is shown on the picture below.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Block Diagram Button Contacts Data Processor RF Transmitter Ant NFC Pushed /Released Push / Release Detection Antenna DC Power Energy Bow N Power Converter S Figure 3 – Functional block diagram of PTM 215B Energy Bow / Power Generator Converts the motion of the energy bow into electrical energy Power Converter Converts the energy of the power generator into a stable DC supply voltage for the device electronics Processor Determines the
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE User Interface PTM 215B devices provide four button contacts. They are grouped into two channels (Channel A and Channel B) each containing two button contacts (State O and State I). The state of all four button contacts (pressed or not pressed) is transmitted together with a unique device identification (48 Bit device ID) whenever the energy bow is pushed or released.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 3. Telegram transmission Radio channel parameters PTM 215B transmits Bluetooth Low Energy (BLE) advertising telegrams within the 2.4 GHz radio frequency band (2402MHz … 2480MHz). By default, PTM 215B will use the three BLE advertising channels (BLE Channel 37, 38 and 39) defined for transmission. The transmission of a radio telegram on these three advertising channels is called an Advertising Event.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Default radio transmission sequence PTM 215B transmits telegrams in its standard configuration by using so-called Advertising Events. An advertising event is defined as the transmission of the same radio telegram on all selected radio channels (by default this would be on BLE Channel 37, 38 and 39) one after another with minimum delay in between.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 3.3.1 Supported radio transmission sequences PTM 215B supports the following user-defined sequences: ◼ Three channel sequence This sequence is similar to the default Advertising Event with the difference that the user can select the radio channels to be used. The three channel sequence is described in chapter 3.3.2 below.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 3.3.3 Two channel radio transmission sequence The two channel radio transmission sequence removes transmission on the third radio channel (selected by TX_CHANNEL3) and instead repeats the transmission once more (four times in total). The PTM 215B telegram will in this mode be transmitted on the radio channel selected by TX_CHANNEL1 first, immediately followed by a transmission on the radio channel selected by TX_CHANNEL2.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4. Telegram format PTM 215B transmits Bluetooth Low Energy (BLE) radio telegrams in the 2.4 GHz band. For detailed information about the Bluetooth Low Energy standard, please refer to the applicable specifications. Figure 9 below summarizes the BLE frame structure. Figure 9 – BLE frame structure The content of these fields is described in more detail below. Preamble The BLE Preamble is 1 byte long and identifies the start of the BLE frame.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Source address The 6 byte BLE Source Address (MAC address) uniquely identifies each PTM 215B product.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4.4.2 Resolvable private address mode For some applications it is desirable to obfuscate the origins of PTM 215B data telegrams in order to prevent tracking of its radio transmissions. This can be achieved by using resolvable private addresses (RPA) as defined in the Bluetooth Core Specification.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Whenever the receiver receives a data telegram with a resolvable private address (identified by the most significant bits of the address field being set to 0b10), it will itself generate a 24 bit hash from the 24 bit prand sequentially using each IRK known to it (i.e. the IRK of each device that has been learned into it). If an IRK matches (i.e.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Telegram payload PTM 215B can transmit two types of telegrams: ◼ Data telegrams The payload of data telegrams contains the switch status together with optional data (if applicable), the current sequence counter value and the resulting authentication signature ◼ Commissioning telegrams The payload of commissioning telegrams contains the private security key as well as the current value of the sequence counter and the device address The pay
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE ◼ Security Signature (4 byte) The Security Signature is used to authenticate PTM 215B radio telegrams as described in chapter 4.6.3 Figure 14 below illustrates the data telegram payload. Figure 14 – Data telegram payload structure 4.6.2 Switch status encoding The Switch Status field within the data telegram payload identifies the PTM 215B action (button push or release).
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4.6.3 Commissioning telegram payload The payload of commissioning telegrams is 30 bytes long and consists of the following fields: ◼ Length (1 byte) The Length field specifies the combined length of the following fields. For PTM 215B commissioning telegrams, this field is set to 0x1D to indicate 29 byte of manufacturer-specific data. Note: In product versions prior to DC-06 this field was incorrectly set to 0x1E.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE PTM 215B data telegram authentication PTM 215B implements telegram authentication for transmitted data telegrams to ensure that only telegrams from transmitters using a previously exchanged security key will be accepted by the receiver. Authentication relies on a 32 bit telegram signature which is calculated as shown in Figure 17 below and exchanged as part of the radio telegram.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 4.7.1 Authentication implementation PTM 215B implements data telegram authentication based on AES128 in CCM (Counter with CBC-MAC) mode as described in IETF RFC3610. At the time of writing, the RFC3610 standard could be found here: https://www.ietf.org/rfc/rfc3610.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 5. Commissioning Commissioning is the process by which PTM 215B is learned into a receiver (actuator, controller, gateway, etc.). The following two tasks are required in this process: ◼ Device identification The receiver needs to know how to uniquely identify this specific PTM 215B device. This is achieved by using a unique 48 Bit ID (Source Address) for each PTM 215B device as described in chapter 4.4.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE NFC-based commissioning All required PTM 215B parameters can be read via a suitable NFC reader and writer supporting the ISO/IEC 14443 Part 2 and 3 standards. The actual NFC implementation in PTM 215B uses a Mifare Ultralight tag. Commissioning via NFC should follow these steps: 1. Unlock PTM 215B using the default NFC PIN code 0x0000E215 2.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Camera-based commissioning Each PTM 215B module contains an optically readable Commissioning Code implemented either as Data Matrix Code or as QR Code depending on the device revision. This Commissioning Code on the device label can be scanned by a suitable commissioning tool (e.g. smartphone or PC with DMC / QR code reader) to read the static source address and the security key of the device.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE To enter commissioning mode, start by selecting one button contact of PTM 215B. Any button of PTM 215B (A0, A1, B0, B1) can be used. This button is referred to as Button_X in Figure 20 above. Next, execute the following long-short-long sequence: 1. Press and hold the selected button together with the energy bar for more than 7 seconds before releasing it 2.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Factory Reset PTM 215B can be reset to its default settings by means of a factory reset. This ensures that PTM 215B can be reset to a known configuration in case the PIN for the NFC access has been lost or NFC access is not possible for other reasons In order to execute such factory reset, the rocker(s) and the switch housing have to be removed from the PTM 215B module.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6. NFC interface PTM 215B implements NFC Forum Type 2 Tag functionality as specified in the ISO/IEC 14443 Part 2 and 3 standards using an NXP NT3H2111 Mifare Ultralight tag. This NFC functionality can be used to access (read and write) the PTM 215B configuration memory and thereby configure the device as described in the following chapters. Chapter 6.1 below gives an introduction to the NFC functionality and options to use the NFC interface.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE NFC communication distance is for security reasons set to require direct contact between reader and switches based on PTM 215B. NFC interface functions For a detailed description about the NFC functionality, please refer to the ISO/IEC 14443 standard.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Figure 22 – NFC interface state machine 6.2.2 IDLE state IDLE is the waiting state after a Power-On Reset (POR), i.e. after the NFC tag has been introduced into the magnetic field of the NFC reader. The NFC tag exits the IDLE state towards the READY 1 state when either a REQA or a WUPA command is received from the NFC reader.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE READY 1 is the first UID resolving state where the NFC tag resolves the first 3 bytes of the 7 byte UID using the ANTICOLLISION or SELECT commands for cascade level 1. READY 1 state is exited after the SELECT command from cascade level 1 with the matching complete first part of the UID has been executed. The NFC tag then proceeds into READY 2 state where the second part of the UID is resolved. 6.2.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.2.6 Read command The READ command requires a start page address, and returns the 16 bytes of four NFC tag pages (where each page is 4 byte in size). For example, if the specified address is 03h then pages 03h, 04h, 05h, 06h are returned. Special conditions apply if the READ command address is near the end of the accessible memory area. Figure 23 below shows the read command sequence. Figure 23 – NFC read command sequence 6.2.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.2.8 Password authentication (PWD_AUTH) command The protected memory area can be accessed only after successful password verification via the PWD_AUTH command. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. Figure 25 below shows the password authentication sequence.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Using TWN4 as USB NFC reader Elatec RFID Systems provides a PC software called “Director” as part of their software support package. At the time of writing, this was available from this address: https://www.elatec-rfid.com/en/download-center/contact-form-twn4-devpack-sdk/ Figure 26 below shows the user interface of this software.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.3.1 Useful commands The following commands are especially useful: ◼ SearchTag(maximum ID bytes) Used to search for a connected tag and identify type and ID of such tag. This should always be used as first operation ahead of any read / write / authenticate actions.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Configuration memory organization The PTM 215B configuration memory is divided into the following areas: ◼ Public data ◼ Protected data In addition to that, PTM 215B maintains a private configuration memory region used to store default parameters and confidential information which is not accessible to the user. Figure 29 below shows the configuration memory structure used by PTM 215B.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Memory Address Map The NFC-accessible configuration memory is organized in memory pages where each memory page is 4 byte wide. An NFC access reads 16 bytes (4 pages) or writes 4 bytes (one page). The addresses map of the configuration memory is shown in Table 2 below. The byte order is little endian, i.e. byte 0 will be read first and byte 3 last.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Public data Public data can be read by any NFC-capable device supporting the ISO/IEC 14443 Part 2 and 3 standards. No specific security measures are used to restrict read access to this data. The following items are located in the public data area: ◼ PTM 215B Product Name This is always “PTM 215B” ◼ PTM 215B Product ID This is an 8 byte field which is by default set to 0x0000000000000000.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Protected Data The following items are located in the protected data area: ◼ Source Address Write register This 4 byte register is used to update the lower 4 byte of the Static Source Address, see chapter 6.7.4 ◼ Product ID Write register This 8 byte register is used to update the Product ID, see chapter 6.7.7 ◼ Manufacturer ID Write register This 4 byte register is used to update the Manufacturer ID, see chapter 6.7.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.1 PIN Code Protected data access is only possible after unlocking the configuration memory with the correct 32 bit PIN code. By default, the protected area is locked and the default pin code for unlocking access is 0x0000E215. The default pin code shall be changed to a user-defined value as part of the installation process.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.4 Source Address Write register The Source Address Write register is 4 byte wide and can be used to modify the lower 32 bit of the PTM 215B Static Source Address. The upper 16 bit of the PTM 215B Static Source Address are always fixed to 0xE215 to identify the device type. In order to do change the lower 32 bit of the Static Source Address, follow these steps: 1. Write new source address into the Source Address Write register 2.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.6 Private Security Key mode PTM 215B provides a private security key mode for applications requiring high security. In this mode, it is possible to write a security key which subsequently is inaccessible via NFC and will not show up in commissioning telegram. In both cases, the security key will be set to all zeros. The written security key thereby is completely inaccessible externally.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE of the Product ID Write register to the Product ID register and any non-zero value of the Manufacturer ID Write Register to the Manufacturer ID register. After that, PTM 215B will clear the UPDATE MAN ID flag to 0b0. 6.7.8 Optional Data register The Optional Data register can be used to specify up to 4 byte of custom data that will be transmitted as part of each data telegram.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.9 Variant register The Variant register is 1 byte wide and allows selection of the custom radio transmission modes as described in chapter 3.3. Additionally, it allows reducing the transmission interval from 20 ms to 10 ms and to increase the bit rate from 1 Mbit to 2 Mbit. The structure of the Custom Variant register is shown Figure 31 below.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.9.2 Interval selection Starting with version DC-06 it is possible to reduce the transmission interval from the default setting of 20 ms to 10 ms by setting bit 3 of the Variant register. Setting Result 0b0 20 ms Interval (Default configuration) 0b1 10 ms Interval Table 4 – Interval settings 6.7.9.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.10 Radio channel selection registers If the TRANSMISSION MODE field of the Variant register is set to a value other than 0x00 then the radio channels for transmission are selected using the registers TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3 as described in chapter 3.3. The TX_CHANNEL1, TX_CHANNEL2 and TX_CHANNEL3 registers are 1 byte wide and use the encoding shown in Table 6 below.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 6.7.11 Customer Data PTM 215B allocates 64 pages (256 byte) for customer data that can be read and written via the NFC interface in protected mode. The main intention is to enable storing OEM-specific information such as product type, revision, date code or similar. There is however no restriction (other than the maximum size of 256 byte) on the type of content that can be stored in this memory region.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Private Data The private data area stores the following items: ◼ Security Key ◼ Default settings The content of the private data area is not externally accessible. 6.8.1 Security Key The Security Key field contains the 128 bit private key used for authenticating PTM 215B telegrams and for resolving private source addresses. This register is programmed with a random value during manufacturing.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 7. Device integration PTM 215B is designed for integration into button or rocker based switches. It implements the established PTM 2xx mechanical form factor and can therefore be used with a wide variety of existing designs. Mechanical Interface Characteristics Energy bow travel / operating force 1.8 mm / typ. 9 N At room temperature Only one of the two energy bows may be actuated at the same time! Restoring force at energy bow typ. 0.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 1) these catwalks are not needed when using one single rocker only 2) dimensions of rocker part Figure 33 – PTM 215B, top view (note cut A, B and C marking) © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Figure 34 – PTM 215B, cut A 2) dimensions of rocker part Figure 35 – PTM 215B, cut B and C © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Hatched areas: support planes Figure 36 – PTM 215B rear view © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 2) dimensions of rocker part Figure 37 – PTM 215B, side view If the rocker is not mounted on the rotation axis of PTM 215B several tolerances have to be considered! The measure from support plane to top of the energy bow is 7.70 mm +/- 0.3 mm! The movement of the energy bow must not be limited by mounted rockers! Catwalks of the switch rocker must not exert continuous forces on the button contacts! © 2019 EnOcean | www.enocean.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE It is required to use non-conductive material (no metal or plastic with metal or graphite elements) for the rockers, the frame and the base plate to ensure best transmission range. PTM 215B is powered by the electromagnetic generator ECO 200. For proper function magnets or ferromagnetic materials are not permitted within a keep-out zone of 60mm around the center of PTM 215B. © 2019 EnOcean | www.enocean.com F-710-017, V1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Product label Customer products integrating PTM 215B modules should include a QR code on their product label for the purpose of commissioning as described in chapter 5.2. This QR code can then be scanned by commissioning tools to automatically extract the required product parameters. The format of the QR code has to be according to the ANSI/MH10.8.2-2013 industry standard using the syntax described in chapter 8.2.1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 8. PTM 215B device label Each PTM 215B module contains a device label. Note that the finished switches (EWSSB, EWSDB, ESRPB and EDRPB) use a different product label as described in their user manuals and the information given in the subsequent chapters applies only to the PTM 215B module itself.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE The device label additionally contains two DMC codes: ◼ The smaller DLC on the left side (Manufacturer DMC) is used for manufacturing only and not relevant for customers ◼ The larger DMC code on the right side (Commissioning DMC) specifies Source Address and Security Key and can be used for commissioning the switch into a network. The structure of the Commissioning DMC is described in the next chapter. 8.1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE PTM 215B device label for products starting with version DC-06 PTM 215B products starting with version DC–06 (PTM 215B produced after May 2018) use a new label as shown in Figure 41 below. Figure 41 – PTM 215B device label (for versions starting with DC-06) This label adds the required ARIB (Japan) certification logo and ID (206-000585) and merges the two DMC used previously into one QR code. Other fields remain unchanged.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 9. Application information Transmission range The main factors that influence the system transmission range are: - Type and location of the antennas of receiver and transmitter - Type of terrain and degree of obstruction of the link path - Sources of interference affecting the receiver - “Dead spots” caused by signal reflections from nearby conductive objects.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Receiver configuration PTM 215B communicates user actions (rocker push / release) using a sequence of advertising telegrams as described in chapter 0.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10. Regulatory information PTM 215B has been certified according to FCC (US), ISED (CA) and RED (EU) regulations. Changes or modifications not expressly approved by EnOcean could void the user's authority to operate the equipment. RED for European Market The Radio Equipment Directive (2014/53/EU, typically referred to as RED) replaces R&TTE directive as regulatory framework for radio products in the European Union.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE FCC (United States) Certificate © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10.2.1 FCC (United States) Regulatory Statement This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE IC (Industry Canada) Certificate © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 10.3.1 IC (Industry Canada) Regulatory Statement This device complies with Industry Canada licence-exempt RSS standard(s). Operation is subject to the following two conditions: (1) this device may not cause interference, and (2) this device must accept any interference, including interference that may cause undesired operation of the device.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE ACMA (Australia) Declaration of Conformity © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE ARIB (Japan) Construction Type Conformity Certifaction © 2019 EnOcean | www.enocean.com F-710-017, V1.0 PTM 215B User Manual | v1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE 11. Product history Table 9 below lists the product history of PTM 215B.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE A. Parsing PTM 215B radio telegrams This appendix is intended as an example of how start to parse received PTM 215B radio telegrams. Please refer to chapter 4 first for a description of the BLE frame structure Data telegram example We consider the following raw data telegram data captured from an EnOcean PTM 215B device: D6 BE 89 8E 42 13 9F 1B 00 00 15 E2 0C FF DA 03 69 01 00 00 10 8A D6 C1 7E 16 EE 23 A.1.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE Commissioning telegram example We consider the following raw commissioning telegram data captured from an EnOcean PTM 215B device: D6 BE 89 8E 42 24 9F 1B 00 00 15 E2 1E FF DA 03 71 01 00 00 AB 4B 9A 91 85 2B 70 B8 A6 52 A0 5E 92 BB 12 A0 9F 1B 00 00 15 E2 9E 6D 7C A.2.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE B. Address resolution for resolvable private addresses (RPA) PTM 215B provides the option to obfuscate its identity by means of using resolvable private addresses (RPA) as described in chapter 4.4.2. The following chapters describe how to resolve such addresses. B.1.1 RPA resolution flow The execution flow for resolving private addresses (RPA) is shown in Figure 42 below. 0000000...
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE B.1.2 Address resolution example We consider a PTM 215B device with the following IRK (options for determining the IRK / security key of a PTM 215B are described in chapter C.1.3.): BE759A027A4870FD242794F4C45220FB We further consider a telegram having the following resolvable private address: 493970E51944 We will now test if this resolvable private address was generated using the IRK above.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C. Authentication of PTM 215B data telegrams PTM 215B provides the option to authenticate its data telegrams as described in chapter 4.6.3. The authentication mechanism used by PTM 215B is standardized as RFC3610. The full RFC3610 specification could be found here at the time of writing and should be used as primary source of information: https://www.ietf.org/rfc/rfc3610.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.2 Variable input parameters The RFC3610 implementation in PTM 215B requires four variable input parameters: ◼ Source address The 6 byte source address used to identify the sender of an authenticated message. The source address is required in little endian (least significant byte first) format.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.3 Obtaining the security key All required parameters except the security key can be directly extracted from the received message that shall be authenticated. The security key –the common secret shared between sender and receiver – has to be obtained via specific mechanisms.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.3.2 Obtaining the security key via the product DMC code Each PTM 215B module contains a DMC code on its product label which identifies source address and security key of the module, see chapter 5.2. The DMC code of the device used for this tutorial encoded in the DMC code format up to revision DB-05 is shown in Figure 43 below. Figure 43 – Example DMC code (used up to DB-05) This DMC code can be read using a suitable DMC code reader (e.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.3.3 Obtaining the security key via a commissioning telegram PTM 215B modules can send dedicated commissioning telegrams that identify their security key. Transmission of such commissioning telegrams can be triggered by means of a specific button sequence as described in chapter 5.3.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.1.5 Constant internal parameters The RFC3610 implementation in PTM 215B derives two internal parameters – M’ and L’ – based on the input data and uses them to construct A0_Flag and B_0_Flag which – together with the iteration counter i – are required for subsequent processing. The value of these internal parameters - listed in Table 12 below - is the same for all PTM 215B telegrams.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.2 Algorithm execution sequence The algorithm uses the variable internal parameters A_0, B_0, B_1 together with the private key to generate the authentication vector T_0 using three AES-128 and two XOR operations. The algorithm execution sequence is shown in Figure 45 below. The first four bytes of T_0 are then used to authenticate PTM 215B telegrams. Figure 45 – Authentication algorithm sequence © 2019 EnOcean | www.enocean.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3 Examples The following four chapters give step by step examples based on one actual device and 0 / 1 / 2 or 4 byte of optional data. C.3.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE The execution sequence would then be as follows: X_1 = AES128(B0, Key) X_1 = AES128(49B819000015E25D0400000000000000, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_1 = 41ef09792ae152ae52c671435c1f247d X_1A = XOR(X_1, B_1) X_1A = XOR(41ef09792ae152ae52c671435c1f247d, 00090CFFDA035D040000110000000000) X_1A = 41e60586f0e20faa52c660435c1f247d X_2 = AES128(X1A, Key) X_2 = AES128(41e60586f0e20faa52c660435c1f247d, 3DDA31AD44767AE3CE56DCE2B3CE2ABB) X_2 = 8d89e
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3.2 Data telegram with 1 byte optional data For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 0D FF DA 03 62 04 00 00 10 12 B9 FE AC C1 The last four bytes of this payload (B9 FE AC C1) are the sender-provided signature which has to be authenticated.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3.3 Data telegram with 2 byte optional data For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 0E FF DA 03 63 04 00 00 11 12 34 52 E0 51 16 The last four bytes of this payload (52 E0 51 16) are the sender-provided signature which has to be authenticated.
USER MANUAL PTM 215B – BLUETOOTH® PUSHBUTTON TRANSMITTER MODULE C.3.4 Data telegram with 4 byte optional data For this example, we consider the following telegram payload received from a PTM 215B with the source address E215000019B8 and security key 3DDA31AD44767AE3CE56DCE2B3CE2ABB: 10 FF DA 03 6A 04 00 00 10 12 34 56 78 2C 9E 10 95 The last four bytes of this payload (2C 9E 10 95) are the sender-provided signature which has to be authenticated.
